July 2020 - Linux-stable-mirror

[PATCH 1/1] usb: cdns3: gadget: own the lock wrongly at the suspend routine

by Peter Chen

When it is device mode with cable connected to host, the call stack is: cdns3_suspend->cdns3_gadget_suspend->cdns3_disconnect_gadget, the cdns3_disconnect_gadget owns lock wrongly at this situation, it causes the system being deadlock after resume due to at cdns3_device_thread_irq_handler, it tries to get the lock, but will never get it. To fix it, we delete the lock operations, and add them at the caller when necessary. Cc: stable <stable(a)vger.kernel.org> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Signed-off-by: Peter Chen <peter.chen(a)nxp.com> --- drivers/usb/cdns3/gadget.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c index 13027ce6bed8..f6c51cc924a8 100644 --- a/drivers/usb/cdns3/gadget.c +++ b/drivers/usb/cdns3/gadget.c @@ -1674,11 +1674,8 @@ static int cdns3_check_ep_interrupt_proceed(struct cdns3_endpoint *priv_ep) static void cdns3_disconnect_gadget(struct cdns3_device *priv_dev) { - if (priv_dev->gadget_driver && priv_dev->gadget_driver->disconnect) { - spin_unlock(&priv_dev->lock); + if (priv_dev->gadget_driver && priv_dev->gadget_driver->disconnect) priv_dev->gadget_driver->disconnect(&priv_dev->gadget); - spin_lock(&priv_dev->lock); - } } /** @@ -1713,8 +1710,10 @@ static void cdns3_check_usb_interrupt_proceed(struct cdns3_device *priv_dev, /* Disconnection detected */ if (usb_ists & (USB_ISTS_DIS2I | USB_ISTS_DISI)) { + spin_unlock(&priv_dev->lock); cdns3_disconnect_gadget(priv_dev); priv_dev->gadget.speed = USB_SPEED_UNKNOWN; + spin_lock(&priv_dev->lock); usb_gadget_set_state(&priv_dev->gadget, USB_STATE_NOTATTACHED); cdns3_hw_reset_eps_config(priv_dev); } -- 2.17.1

4 years, 7 months

2
2
0 0

[PATCH v2 1/2 net] bitfield.h: don't compile-time validate _val in FIELD_FIT

by Nick Desaulniers

From: Jakub Kicinski <kuba(a)kernel.org> When ur_load_imm_any() is inlined into jeq_imm(), it's possible for the compiler to deduce a case where _val can only have the value of -1 at compile time. Specifically, /* struct bpf_insn: _s32 imm */ u64 imm = insn->imm; /* sign extend */ if (imm >> 32) { /* non-zero only if insn->imm is negative */ /* inlined from ur_load_imm_any */ u32 __imm = imm >> 32; /* therefore, always 0xffffffff */ if (__builtin_constant_p(__imm) && __imm > 255) compiletime_assert_XXX() This can result in tripping a BUILD_BUG_ON() in __BF_FIELD_CHECK() that checks that a given value is representable in one byte (interpreted as unsigned). FIELD_FIT() should return true or false at runtime for whether a value can fit for not. Don't break the build over a value that's too large for the mask. We'd prefer to keep the inlining and compiler optimizations though we know this case will always return false. Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/kernel-hardening/CAK7LNASvb0UDJ0U5wkYYRzTAdnEs64HjX… Reported-by: Masahiro Yamada <masahiroy(a)kernel.org> Debugged-by: Sami Tolvanen <samitolvanen(a)google.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com> --- Changes V1->V2: * None include/linux/bitfield.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h index 48ea093ff04c..4e035aca6f7e 100644 --- a/include/linux/bitfield.h +++ b/include/linux/bitfield.h @@ -77,7 +77,7 @@ */ #define FIELD_FIT(_mask, _val) \ ({ \ - __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_FIT: "); \ + __BF_FIELD_CHECK(_mask, 0ULL, 0ULL, "FIELD_FIT: "); \ !((((typeof(_mask))_val) << __bf_shf(_mask)) & ~(_mask)); \ }) -- 2.27.0.383.g050319c2ae-goog

4 years, 7 months

2
1
0 0

[PATCH] KVM: arm64: Fix definition of PAGE_HYP_DEVICE

by Will Deacon

PAGE_HYP_DEVICE is intended to encode attribute bits for an EL2 stage-1 pte mapping a device. Unfortunately, it includes PROT_DEVICE_nGnRE which encodes attributes for EL1 stage-1 mappings such as UXN and nG, which are RES0 for EL2, and DBM which is meaningless as TCR_EL2.HD is not set. Fix the definition of PAGE_HYP_DEVICE so that it doesn't set RES0 bits at EL2. Cc: Marc Zyngier <maz(a)kernel.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: James Morse <james.morse(a)arm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Will Deacon <will(a)kernel.org> --- Marc -- I'm happy to take this as a fix via arm64 with your Ack. Please just let me know. arch/arm64/include/asm/pgtable-prot.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h index 2e7e0f452301..4d867c6446c4 100644 --- a/arch/arm64/include/asm/pgtable-prot.h +++ b/arch/arm64/include/asm/pgtable-prot.h @@ -67,7 +67,7 @@ extern bool arm64_use_ng_mappings; #define PAGE_HYP __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_HYP_XN) #define PAGE_HYP_EXEC __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_RDONLY) #define PAGE_HYP_RO __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_RDONLY | PTE_HYP_XN) -#define PAGE_HYP_DEVICE __pgprot(PROT_DEVICE_nGnRE | PTE_HYP) +#define PAGE_HYP_DEVICE __pgprot(_PROT_DEFAULT | PTE_ATTRINDX(MT_DEVICE_nGnRE) | PTE_HYP | PTE_HYP_XN) #define PAGE_S2_MEMATTR(attr) \ ({ \ -- 2.27.0.383.g050319c2ae-goog

4 years, 7 months

2
2
0 0

[PATCH] bitfield.h: don't compile-time validate _val in FIELD_FIT

by Nick Desaulniers

From: Jakub Kicinski <kuba(a)kernel.org> When ur_load_imm_any() is inlined into jeq_imm(), it's possible for the compiler to deduce a case where _val can only have the value of -1 at compile time. Specifically, /* struct bpf_insn: _s32 imm */ u64 imm = insn->imm; /* sign extend */ if (imm >> 32) { /* non-zero only if insn->imm is negative */ /* inlined from ur_load_imm_any */ u32 __imm = imm >> 32; /* therefore, always 0xffffffff */ if (__builtin_constant_p(__imm) && __imm > 255) compiletime_assert_XXX() This can result in tripping a BUILD_BUG_ON() in __BF_FIELD_CHECK() that checks that a given value is representable in one byte (interpreted as unsigned). FIELD_FIT() should return true or false at runtime for whether a value can fit for not. Don't break the build over a value that's too large for the mask. We'd prefer to keep the inlining and compiler optimizations though we know this case will always return false. Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/kernel-hardening/CAK7LNASvb0UDJ0U5wkYYRzTAdnEs64HjX… Reported-by: Masahiro Yamada <masahiroy(a)kernel.org> Debugged-by: Sami Tolvanen <samitolvanen(a)google.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com> --- include/linux/bitfield.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h index 48ea093ff04c..4e035aca6f7e 100644 --- a/include/linux/bitfield.h +++ b/include/linux/bitfield.h @@ -77,7 +77,7 @@ */ #define FIELD_FIT(_mask, _val) \ ({ \ - __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_FIT: "); \ + __BF_FIELD_CHECK(_mask, 0ULL, 0ULL, "FIELD_FIT: "); \ !((((typeof(_mask))_val) << __bf_shf(_mask)) & ~(_mask)); \ }) -- 2.27.0.383.g050319c2ae-goog

4 years, 7 months

4
6
0 0

[PATCH] arm64: dts: qcom: sc7180: Drop the unused non-MSA SID

by Sibi Sankar

Having a non-MSA (Modem Self-Authentication) SID bypassed breaks modem sandboxing i.e if a transaction were to originate from it, the hardware memory protections units (XPUs) would fail to flag them (any transaction originating from modem are historically termed as an MSA transaction). Drop the unused non-MSA modem SID on SC7180 SoCs and cheza so that SMMU continues to block them. Fixes: bec71ba243e95 ("arm64: dts: qcom: sc7180: Update Q6V5 MSS node") Fixes: 68aee4af5f620 ("arm64: dts: qcom: sdm845-cheza: Add iommus property") Cc: stable(a)vger.kernel.org Reported-by: Sai Prakash Ranjan <saiprakash.ranjan(a)codeaurora.org> Signed-off-by: Sibi Sankar <sibis(a)codeaurora.org> --- arch/arm64/boot/dts/qcom/sc7180-idp.dts | 2 +- arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sc7180-idp.dts b/arch/arm64/boot/dts/qcom/sc7180-idp.dts index 39dbfc89689e8..141de49a1b7d6 100644 --- a/arch/arm64/boot/dts/qcom/sc7180-idp.dts +++ b/arch/arm64/boot/dts/qcom/sc7180-idp.dts @@ -312,7 +312,7 @@ &qupv3_id_1 { &remoteproc_mpss { status = "okay"; compatible = "qcom,sc7180-mss-pil"; - iommus = <&apps_smmu 0x460 0x1>, <&apps_smmu 0x444 0x3>; + iommus = <&apps_smmu 0x461 0x0>, <&apps_smmu 0x444 0x3>; memory-region = <&mba_mem &mpss_mem>; }; diff --git a/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi b/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi index 70466cc4b4055..64fc1bfd66fad 100644 --- a/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi +++ b/arch/arm64/boot/dts/qcom/sdm845-cheza.dtsi @@ -634,7 +634,7 @@ &mdss_mdp { }; &mss_pil { - iommus = <&apps_smmu 0x780 0x1>, + iommus = <&apps_smmu 0x781 0x0>, <&apps_smmu 0x724 0x3>; }; -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project

4 years, 7 months

3
2
0 0

[PATCH 4.19 00/36] 4.19.132-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.132 release. There are 36 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 09 Jul 2020 14:57:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.132-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.132-rc1 Peter Jones <pjones(a)redhat.com> efi: Make it possible to disable efivar_ssdt entirely Hou Tao <houtao1(a)huawei.com> dm zoned: assign max_io_len correctly Marc Zyngier <maz(a)kernel.org> irqchip/gic: Atomically update affinity Hauke Mehrtens <hauke(a)hauke-m.de> MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> cifs: Fix the target file was deleted when rename failed. Paul Aurich <paul(a)darkrain42.org> SMB3: Honor lease disabling for multiuser mounts Paul Aurich <paul(a)darkrain42.org> SMB3: Honor persistent/resilient handle flags for multiuser mounts Paul Aurich <paul(a)darkrain42.org> SMB3: Honor 'seal' flag for multiuser mounts Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "ALSA: usb-audio: Improve frames size computation" J. Bruce Fields <bfields(a)redhat.com> nfsd: apply umask on fs without ACL support Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: mlxcpld: check correct size of maximum RECV_LEN packet Chris Packham <chris.packham(a)alliedtelesis.co.nz> i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 Christoph Hellwig <hch(a)lst.de> nvme: fix a crash in nvme_mpath_add_disk Paul Aurich <paul(a)darkrain42.org> SMB3: Honor 'posix' flag for multiuser mounts Hou Tao <houtao1(a)huawei.com> virtio-blk: free vblk-vqs in error path of virtblk_probe() Chen-Yu Tsai <wens(a)csie.org> drm: sun4i: hdmi: Remove extra HPD polling Misono Tomohiro <misono.tomohiro(a)jp.fujitsu.com> hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() Chu Lin <linchuyuan(a)google.com> hwmon: (max6697) Make sure the OVERT mask is set correctly Rahul Lakkireddy <rahul.lakkireddy(a)chelsio.com> cxgb4: fix SGE queue dump destination buffer context Rahul Lakkireddy <rahul.lakkireddy(a)chelsio.com> cxgb4: use correct type for all-mask IP address comparison Rahul Lakkireddy <rahul.lakkireddy(a)chelsio.com> cxgb4: parse TC-U32 key values and masks natively Rahul Lakkireddy <rahul.lakkireddy(a)chelsio.com> cxgb4: use unaligned conversion for fetching timestamp Chen Tao <chentao107(a)huawei.com> drm/msm/dpu: fix error return code in dpu_encoder_init Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() Douglas Anderson <dianders(a)chromium.org> kgdb: Avoid suspicious RCU usage warning Anton Eidelman <anton(a)lightbitslabs.com> nvme-multipath: fix deadlock between ana_work and scan_work Sagi Grimberg <sagi(a)grimberg.me> nvme: fix possible deadlock when I/O is blocked Keith Busch <kbusch(a)kernel.org> nvme-multipath: set bdi capabilities once Christian Borntraeger <borntraeger(a)de.ibm.com> s390/debug: avoid kernel warning on too large number of pages Zqiang <qiang.zhang(a)windriver.com> usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect Qian Cai <cai(a)lca.pw> mm/slub: fix stack overruns with SLUB_STATS Dongli Zhang <dongli.zhang(a)oracle.com> mm/slub.c: fix corrupted freechain in deactivate_slab() Tuomas Tynkkynen <tuomas.tynkkynen(a)iki.fi> usbnet: smsc95xx: Fix use-after-free after removal Borislav Petkov <bp(a)suse.de> EDAC/amd64: Read back the scrub rate PCI register on F15h Hugh Dickins <hughd(a)google.com> mm: fix swap cache node allocation mask Filipe Manana <fdmanana(a)suse.com> btrfs: fix a block group ref counter leak after failure to remove block group ------------- Diffstat: Makefile | 4 +- arch/mips/kernel/traps.c | 1 + arch/s390/kernel/debug.c | 3 +- crypto/af_alg.c | 26 ++--- crypto/algif_aead.c | 9 +- crypto/algif_hash.c | 9 +- crypto/algif_skcipher.c | 9 +- drivers/block/virtio_blk.c | 1 + drivers/edac/amd64_edac.c | 2 + drivers/firmware/efi/Kconfig | 11 ++ drivers/firmware/efi/efi.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 5 +- drivers/hwmon/acpi_power_meter.c | 4 +- drivers/hwmon/max6697.c | 7 +- drivers/i2c/algos/i2c-algo-pca.c | 3 +- drivers/i2c/busses/i2c-mlxcpld.c | 4 +- drivers/irqchip/irq-gic.c | 14 +-- drivers/md/dm-zoned-target.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c | 6 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 10 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c | 18 +-- .../ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h | 122 ++++++++++++++------- drivers/net/ethernet/chelsio/cxgb4/sge.c | 2 +- drivers/net/usb/smsc95xx.c | 2 +- drivers/nvme/host/core.c | 1 - drivers/nvme/host/multipath.c | 33 ++++-- drivers/usb/misc/usbtest.c | 1 + fs/btrfs/extent-tree.c | 19 ++-- fs/cifs/connect.c | 9 +- fs/cifs/inode.c | 10 +- fs/nfsd/vfs.c | 6 + include/crypto/if_alg.h | 4 +- kernel/debug/debug_core.c | 4 + mm/slub.c | 30 ++++- mm/swap_state.c | 3 +- sound/usb/card.h | 4 - sound/usb/endpoint.c | 43 +------- sound/usb/endpoint.h | 1 - sound/usb/pcm.c | 2 - 40 files changed, 256 insertions(+), 192 deletions(-)

4 years, 7 months

10
48
0 0

[PATCH 4.14 00/27] 4.14.188-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.188 release. There are 27 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 09 Jul 2020 14:57:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.188-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.188-rc1 Peter Jones <pjones(a)redhat.com> efi: Make it possible to disable efivar_ssdt entirely Hou Tao <houtao1(a)huawei.com> dm zoned: assign max_io_len correctly Marc Zyngier <maz(a)kernel.org> irqchip/gic: Atomically update affinity Hauke Mehrtens <hauke(a)hauke-m.de> MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> cifs: Fix the target file was deleted when rename failed. Paul Aurich <paul(a)darkrain42.org> SMB3: Honor persistent/resilient handle flags for multiuser mounts Paul Aurich <paul(a)darkrain42.org> SMB3: Honor 'seal' flag for multiuser mounts Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "ALSA: usb-audio: Improve frames size computation" J. Bruce Fields <bfields(a)redhat.com> nfsd: apply umask on fs without ACL support Chris Packham <chris.packham(a)alliedtelesis.co.nz> i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 Hou Tao <houtao1(a)huawei.com> virtio-blk: free vblk-vqs in error path of virtblk_probe() Chen-Yu Tsai <wens(a)csie.org> drm: sun4i: hdmi: Remove extra HPD polling Misono Tomohiro <misono.tomohiro(a)jp.fujitsu.com> hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() Chu Lin <linchuyuan(a)google.com> hwmon: (max6697) Make sure the OVERT mask is set correctly Rahul Lakkireddy <rahul.lakkireddy(a)chelsio.com> cxgb4: parse TC-U32 key values and masks natively Rahul Lakkireddy <rahul.lakkireddy(a)chelsio.com> cxgb4: use unaligned conversion for fetching timestamp Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() Douglas Anderson <dianders(a)chromium.org> kgdb: Avoid suspicious RCU usage warning Zqiang <qiang.zhang(a)windriver.com> usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect Qian Cai <cai(a)lca.pw> mm/slub: fix stack overruns with SLUB_STATS Dongli Zhang <dongli.zhang(a)oracle.com> mm/slub.c: fix corrupted freechain in deactivate_slab() Tuomas Tynkkynen <tuomas.tynkkynen(a)iki.fi> usbnet: smsc95xx: Fix use-after-free after removal Borislav Petkov <bp(a)suse.de> EDAC/amd64: Read back the scrub rate PCI register on F15h Hugh Dickins <hughd(a)google.com> mm: fix swap cache node allocation mask Filipe Manana <fdmanana(a)suse.com> btrfs: fix data block group relocation failure due to concurrent scrub Anand Jain <Anand.Jain(a)oracle.com> btrfs: cow_file_range() num_bytes and disk_num_bytes are same Filipe Manana <fdmanana(a)suse.com> btrfs: fix a block group ref counter leak after failure to remove block group ------------- Diffstat: Makefile | 4 +- arch/mips/kernel/traps.c | 1 + crypto/af_alg.c | 26 ++--- crypto/algif_aead.c | 9 +- crypto/algif_hash.c | 9 +- crypto/algif_skcipher.c | 9 +- drivers/block/virtio_blk.c | 1 + drivers/edac/amd64_edac.c | 2 + drivers/firmware/efi/Kconfig | 11 ++ drivers/firmware/efi/efi.c | 2 +- drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 5 +- drivers/hwmon/acpi_power_meter.c | 4 +- drivers/hwmon/max6697.c | 7 +- drivers/i2c/algos/i2c-algo-pca.c | 3 +- drivers/irqchip/irq-gic.c | 14 +-- drivers/md/dm-zoned-target.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c | 18 +-- .../ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h | 122 ++++++++++++++------- drivers/net/ethernet/chelsio/cxgb4/sge.c | 2 +- drivers/net/usb/smsc95xx.c | 2 +- drivers/usb/misc/usbtest.c | 1 + fs/btrfs/extent-tree.c | 19 ++-- fs/btrfs/inode.c | 35 ++++-- fs/cifs/connect.c | 3 + fs/cifs/inode.c | 10 +- fs/nfsd/vfs.c | 6 + include/crypto/if_alg.h | 4 +- kernel/debug/debug_core.c | 4 + mm/slub.c | 30 ++++- mm/swap_state.c | 3 +- sound/usb/card.h | 4 - sound/usb/endpoint.c | 43 +------- sound/usb/endpoint.h | 1 - sound/usb/pcm.c | 2 - 34 files changed, 239 insertions(+), 179 deletions(-)

4 years, 7 months

5
31
0 0

[PATCH 4.9 00/24] 4.9.230-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.230 release. There are 24 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 09 Jul 2020 14:57:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.230-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.230-rc1 Peter Jones <pjones(a)redhat.com> efi: Make it possible to disable efivar_ssdt entirely Vasily Averin <vvs(a)virtuozzo.com> netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6 Hauke Mehrtens <hauke(a)hauke-m.de> MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> cifs: Fix the target file was deleted when rename failed. Paul Aurich <paul(a)darkrain42.org> SMB3: Honor persistent/resilient handle flags for multiuser mounts Paul Aurich <paul(a)darkrain42.org> SMB3: Honor 'seal' flag for multiuser mounts Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "ALSA: usb-audio: Improve frames size computation" Chris Packham <chris.packham(a)alliedtelesis.co.nz> i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 Hou Tao <houtao1(a)huawei.com> virtio-blk: free vblk-vqs in error path of virtblk_probe() Misono Tomohiro <misono.tomohiro(a)jp.fujitsu.com> hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() Chu Lin <linchuyuan(a)google.com> hwmon: (max6697) Make sure the OVERT mask is set correctly Rahul Lakkireddy <rahul.lakkireddy(a)chelsio.com> cxgb4: parse TC-U32 key values and masks natively Shile Zhang <shile.zhang(a)nokia.com> sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() Douglas Anderson <dianders(a)chromium.org> kgdb: Avoid suspicious RCU usage warning Zqiang <qiang.zhang(a)windriver.com> usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect Qian Cai <cai(a)lca.pw> mm/slub: fix stack overruns with SLUB_STATS Dongli Zhang <dongli.zhang(a)oracle.com> mm/slub.c: fix corrupted freechain in deactivate_slab() Tuomas Tynkkynen <tuomas.tynkkynen(a)iki.fi> usbnet: smsc95xx: Fix use-after-free after removal Borislav Petkov <bp(a)suse.de> EDAC/amd64: Read back the scrub rate PCI register on F15h Hugh Dickins <hughd(a)google.com> mm: fix swap cache node allocation mask Filipe Manana <fdmanana(a)suse.com> btrfs: fix data block group relocation failure due to concurrent scrub Anand Jain <Anand.Jain(a)oracle.com> btrfs: cow_file_range() num_bytes and disk_num_bytes are same Filipe Manana <fdmanana(a)suse.com> btrfs: fix a block group ref counter leak after failure to remove block group ------------- Diffstat: Makefile | 4 +- arch/mips/kernel/traps.c | 1 + crypto/af_alg.c | 26 ++--- crypto/algif_aead.c | 9 +- crypto/algif_hash.c | 9 +- crypto/algif_skcipher.c | 9 +- drivers/block/virtio_blk.c | 1 + drivers/edac/amd64_edac.c | 2 + drivers/firmware/efi/Kconfig | 11 ++ drivers/firmware/efi/efi.c | 2 +- drivers/hwmon/acpi_power_meter.c | 4 +- drivers/hwmon/max6697.c | 7 +- drivers/i2c/algos/i2c-algo-pca.c | 3 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c | 18 +-- .../ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h | 122 ++++++++++++++------- drivers/net/usb/smsc95xx.c | 2 +- drivers/usb/misc/usbtest.c | 1 + fs/btrfs/extent-tree.c | 19 ++-- fs/btrfs/inode.c | 36 ++++-- fs/cifs/connect.c | 3 + fs/cifs/inode.c | 10 +- include/crypto/if_alg.h | 4 +- include/linux/sched/sysctl.h | 1 + kernel/debug/debug_core.c | 4 + kernel/sched/core.c | 5 +- kernel/sched/rt.c | 1 + kernel/sysctl.c | 2 +- mm/slub.c | 30 ++++- mm/swap_state.c | 3 +- net/netfilter/nf_conntrack_h323_main.c | 1 + sound/usb/card.h | 4 - sound/usb/endpoint.c | 43 +------- sound/usb/endpoint.h | 1 - sound/usb/pcm.c | 2 - 34 files changed, 235 insertions(+), 165 deletions(-)

4 years, 7 months

5
28
0 0

[PATCH 4.4 00/19] 4.4.230-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.4.230 release. There are 19 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 09 Jul 2020 14:57:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.230-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.4.230-rc1 Vasily Averin <vvs(a)virtuozzo.com> netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6 Hauke Mehrtens <hauke(a)hauke-m.de> MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> cifs: Fix the target file was deleted when rename failed. Paul Aurich <paul(a)darkrain42.org> SMB3: Honor persistent/resilient handle flags for multiuser mounts Paul Aurich <paul(a)darkrain42.org> SMB3: Honor 'seal' flag for multiuser mounts Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "ALSA: usb-audio: Improve frames size computation" Chris Packham <chris.packham(a)alliedtelesis.co.nz> i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 Hou Tao <houtao1(a)huawei.com> virtio-blk: free vblk-vqs in error path of virtblk_probe() Misono Tomohiro <misono.tomohiro(a)jp.fujitsu.com> hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() Chu Lin <linchuyuan(a)google.com> hwmon: (max6697) Make sure the OVERT mask is set correctly Shile Zhang <shile.zhang(a)nokia.com> sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() Douglas Anderson <dianders(a)chromium.org> kgdb: Avoid suspicious RCU usage warning Zqiang <qiang.zhang(a)windriver.com> usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect Qian Cai <cai(a)lca.pw> mm/slub: fix stack overruns with SLUB_STATS Borislav Petkov <bp(a)suse.de> EDAC/amd64: Read back the scrub rate PCI register on F15h Hugh Dickins <hughd(a)google.com> mm: fix swap cache node allocation mask Filipe Manana <fdmanana(a)suse.com> btrfs: fix data block group relocation failure due to concurrent scrub Anand Jain <Anand.Jain(a)oracle.com> btrfs: cow_file_range() num_bytes and disk_num_bytes are same ------------- Diffstat: Makefile | 4 ++-- arch/mips/kernel/traps.c | 1 + crypto/af_alg.c | 26 +++++++++----------- crypto/algif_aead.c | 9 +++---- crypto/algif_hash.c | 9 +++---- crypto/algif_skcipher.c | 9 +++---- drivers/block/virtio_blk.c | 1 + drivers/edac/amd64_edac.c | 2 ++ drivers/hwmon/acpi_power_meter.c | 4 +++- drivers/hwmon/max6697.c | 7 +++--- drivers/i2c/algos/i2c-algo-pca.c | 3 ++- drivers/usb/misc/usbtest.c | 1 + fs/btrfs/inode.c | 36 ++++++++++++++++++++-------- fs/cifs/connect.c | 3 +++ fs/cifs/inode.c | 10 ++++++-- include/crypto/if_alg.h | 4 ++-- include/linux/sched/sysctl.h | 1 + kernel/debug/debug_core.c | 4 ++++ kernel/sched/core.c | 5 ++-- kernel/sched/rt.c | 1 + kernel/sysctl.c | 2 +- mm/slub.c | 3 ++- mm/swap_state.c | 3 ++- net/netfilter/nf_conntrack_h323_main.c | 1 + sound/usb/card.h | 4 ---- sound/usb/endpoint.c | 43 ++++------------------------------ sound/usb/endpoint.h | 1 - sound/usb/pcm.c | 2 -- 28 files changed, 95 insertions(+), 104 deletions(-)

4 years, 7 months

7
26
0 0

[PATCH 3/5] module: Do not expose section addresses to non-CAP_SYSLOG

by Kees Cook

The printing of section addresses in /sys/module/*/sections/* was not using the correct credentials to evaluate visibility. Before: # cat /sys/module/*/sections/.*text 0xffffffffc0458000 ... # capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text" 0xffffffffc0458000 ... After: # cat /sys/module/*/sections/*.text 0xffffffffc0458000 ... # capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text" 0x0000000000000000 ... Additionally replaces the existing (safe) /proc/modules check with file->f_cred for consistency. Cc: stable(a)vger.kernel.org Reported-by: Dominik Czarnota <dominik.czarnota(a)trailofbits.com> Fixes: be71eda5383f ("module: Fix display of wrong module .text address") Signed-off-by: Kees Cook <keescook(a)chromium.org> --- kernel/module.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/module.c b/kernel/module.c index 9e2954519259..e6c7571092cb 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -1530,8 +1530,8 @@ static ssize_t module_sect_read(struct file *file, struct kobject *kobj, if (pos != 0) return -EINVAL; - return sprintf(buf, "0x%px\n", kptr_restrict < 2 ? - (void *)sattr->address : NULL); + return sprintf(buf, "0x%px\n", + kallsyms_show_value(file->f_cred) ? (void *)sattr->address : NULL); } static void free_sect_attrs(struct module_sect_attrs *sect_attrs) @@ -4380,7 +4380,7 @@ static int modules_open(struct inode *inode, struct file *file) if (!err) { struct seq_file *m = file->private_data; - m->private = kallsyms_show_value(current_cred()) ? NULL : (void *)8ul; + m->private = kallsyms_show_value(file->f_cred) ? NULL : (void *)8ul; } return err; -- 2.25.1

4 years, 7 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror July 2020