The patch titled
Subject: kfence: fix is_kfence_address() for addresses below KFENCE_POOL_SIZE
has been added to the -mm tree. Its filename is
kfence-fix-is_kfence_address-for-addresses-below-kfence_pool_size.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/kfence-fix-is_kfence_address-for-…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/kfence-fix-is_kfence_address-for-…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Marco Elver <elver(a)google.com>
Subject: kfence: fix is_kfence_address() for addresses below KFENCE_POOL_SIZE
Originally the addr != NULL check was meant to take care of the case where
__kfence_pool == NULL (KFENCE is disabled). However, this does not work
for addresses where addr > 0 && addr < KFENCE_POOL_SIZE.
This can be the case on NULL-deref where addr > 0 && addr < PAGE_SIZE or
any other faulting access with addr < KFENCE_POOL_SIZE. While the kernel
would likely crash, the stack traces and report might be confusing due to
double faults upon KFENCE's attempt to unprotect such an address.
Fix it by just checking that __kfence_pool != NULL instead.
Link: https://lkml.kernel.org/r/20210818130300.2482437-1-elver@google.com
Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")
Signed-off-by: Marco Elver <elver(a)google.com>
Reported-by: Kuan-Ying Lee <Kuan-Ying.Lee(a)mediatek.com>
Acked-by: Alexander Potapenko <glider(a)google.com>
Cc: Dmitry Vyukov <dvyukov(a)google.com>
Cc: <stable(a)vger.kernel.org> [5.12+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/kfence.h | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/include/linux/kfence.h~kfence-fix-is_kfence_address-for-addresses-below-kfence_pool_size
+++ a/include/linux/kfence.h
@@ -51,10 +51,11 @@ extern atomic_t kfence_allocation_gate;
static __always_inline bool is_kfence_address(const void *addr)
{
/*
- * The non-NULL check is required in case the __kfence_pool pointer was
- * never initialized; keep it in the slow-path after the range-check.
+ * The __kfence_pool != NULL check is required to deal with the case
+ * where __kfence_pool == NULL && addr < KFENCE_POOL_SIZE. Keep it in
+ * the slow-path after the range-check!
*/
- return unlikely((unsigned long)((char *)addr - __kfence_pool) < KFENCE_POOL_SIZE && addr);
+ return unlikely((unsigned long)((char *)addr - __kfence_pool) < KFENCE_POOL_SIZE && __kfence_pool);
}
/**
_
Patches currently in -mm which might be from elver(a)google.com are
kfence-fix-is_kfence_address-for-addresses-below-kfence_pool_size.patch
kfence-show-cpu-and-timestamp-in-alloc-free-info.patch
The patch titled
Subject: mm/filemap.c: remove bogus VM_BUG_ON
has been added to the -mm tree. Its filename is
mm-remove-bogus-vm_bug_on.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-remove-bogus-vm_bug_on.patch
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-remove-bogus-vm_bug_on.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org>
Subject: mm/filemap.c: remove bogus VM_BUG_ON
It is not safe to check page->index without holding the page lock. It can
be changed if the page is moved between the swap cache and the page cache
for a shmem file, for example. There is a VM_BUG_ON below which checks
page->index is correct after taking the page lock.
Link: https://lkml.kernel.org/r/20210818144932.940640-1-willy@infradead.org
Fixes: 5c211ba29deb ("mm: add and use find_lock_entries")
Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Reported-by: <syzbot+c87be4f669d920c76330(a)syzkaller.appspotmail.com>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/filemap.c | 1 -
1 file changed, 1 deletion(-)
--- a/mm/filemap.c~mm-remove-bogus-vm_bug_on
+++ a/mm/filemap.c
@@ -2038,7 +2038,6 @@ unsigned find_lock_entries(struct addres
if (!xa_is_value(page)) {
if (page->index < start)
goto put;
- VM_BUG_ON_PAGE(page->index != xas.xa_index, page);
if (page->index + thp_nr_pages(page) - 1 > end)
goto put;
if (!trylock_page(page))
_
Patches currently in -mm which might be from willy(a)infradead.org are
mm-remove-bogus-vm_bug_on.patch
mm-report-a-more-useful-address-for-reclaim-acquisition.patch
mm-mark-idle-page-tracking-as-broken.patch
avoid-a-warning-in-sparse-memory-support.patch
mm-move-kvmalloc-related-functions-to-slabh.patch
This is the start of the stable review cycle for the 5.4.142 release.
There are 62 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 18 Aug 2021 12:54:12 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.142-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.142-rc1
Saeed Mirzamohammadi <saeed.mirzamohammadi(a)oracle.com>
iommu/vt-d: Fix agaw for a supported 48 bit guest address width
Nathan Chancellor <nathan(a)kernel.org>
vmlinux.lds.h: Handle clang's module.{c,d}tor sections
Jeff Layton <jlayton(a)kernel.org>
ceph: take snap_empty_lock atomically with snaprealm refcount change
Jeff Layton <jlayton(a)kernel.org>
ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm
Jeff Layton <jlayton(a)kernel.org>
ceph: add some lockdep assertions around snaprealm handling
Sean Christopherson <seanjc(a)google.com>
KVM: VMX: Use current VMCS to query WAITPKG support for MSR emulation
Thomas Gleixner <tglx(a)linutronix.de>
PCI/MSI: Protect msi_desc::masked for multi-MSI
Thomas Gleixner <tglx(a)linutronix.de>
PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
Thomas Gleixner <tglx(a)linutronix.de>
PCI/MSI: Correct misleading comments
Thomas Gleixner <tglx(a)linutronix.de>
PCI/MSI: Do not set invalid bits in MSI mask
Thomas Gleixner <tglx(a)linutronix.de>
PCI/MSI: Enforce MSI[X] entry updates to be visible
Thomas Gleixner <tglx(a)linutronix.de>
PCI/MSI: Enforce that MSI-X table entry is masked for update
Thomas Gleixner <tglx(a)linutronix.de>
PCI/MSI: Mask all unused MSI-X entries
Thomas Gleixner <tglx(a)linutronix.de>
PCI/MSI: Enable and mask MSI-X early
Ben Dai <ben.dai(a)unisoc.com>
genirq/timings: Prevent potential array overflow in __irq_timings_store()
Bixuan Cui <cuibixuan(a)huawei.com>
genirq/msi: Ensure deactivation on teardown
Babu Moger <Babu.Moger(a)amd.com>
x86/resctrl: Fix default monitoring groups reporting
Thomas Gleixner <tglx(a)linutronix.de>
x86/ioapic: Force affinity setup before startup
Thomas Gleixner <tglx(a)linutronix.de>
x86/msi: Force affinity setup before startup
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
Randy Dunlap <rdunlap(a)infradead.org>
x86/tools: Fix objdump version check again
Pu Lehui <pulehui(a)huawei.com>
powerpc/kprobes: Fix kprobe Oops happens in booke
Xie Yongji <xieyongji(a)bytedance.com>
nbd: Aovid double completion of a request
Longpeng(Mike) <longpeng2(a)huawei.com>
vsock/virtio: avoid potential deadlock when vsock device remove
Maximilian Heyne <mheyne(a)amazon.de>
xen/events: Fix race in set_evtchn_to_irq
Eric Dumazet <edumazet(a)google.com>
net: igmp: increase size of mr_ifc_count
Neal Cardwell <ncardwell(a)google.com>
tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets
Willy Tarreau <w(a)1wt.eu>
net: linkwatch: fix failure to restore device state across suspend/resume
Yang Yingliang <yangyingliang(a)huawei.com>
net: bridge: fix memleak in br_add_if()
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: sja1105: fix broken backpressure in .port_fdb_dump
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: lantiq: fix broken backpressure in .port_fdb_dump
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: lan9303: fix broken backpressure in .port_fdb_dump
Eric Dumazet <edumazet(a)google.com>
net: igmp: fix data-race in igmp_ifc_timer_expire()
Takeshi Misawa <jeliantsurux(a)gmail.com>
net: Fix memory leak in ieee802154_raw_deliver
Ben Hutchings <ben.hutchings(a)mind.be>
net: dsa: microchip: Fix ksz_read64()
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix colour distortion from HDR set during vendor u-boot
Aya Levin <ayal(a)nvidia.com>
net/mlx5: Fix return value from tracer initialization
Roi Dayan <roid(a)nvidia.com>
psample: Add a fwd declaration for skbuff
Md Fahad Iqbal Polash <md.fahad.iqbal.polash(a)intel.com>
iavf: Set RSS LUT and key in reset handle path
Hangbin Liu <liuhangbin(a)gmail.com>
net: sched: act_mirred: Reset ct info when mirror/redirect skb
Pali Rohár <pali(a)kernel.org>
ppp: Fix generating ifname when empty IFLA_IFNAME is specified
Ben Hutchings <ben.hutchings(a)mind.be>
net: phy: micrel: Fix link detection on ksz87xx switch"
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables
Florian Eckert <fe(a)dev.tdt.de>
platform/x86: pcengines-apuv2: revert wiring up simswitch GPIO as LED
DENG Qingfang <dqfext(a)gmail.com>
net: dsa: mt7530: add the missing RxUnicast MIB counter
Richard Fitzgerald <rf(a)opensource.cirrus.com>
ASoC: cs42l42: Fix LRCLK frame start edge
Yajun Deng <yajun.deng(a)linux.dev>
netfilter: nf_conntrack_bridge: Fix memory leak when error
Richard Fitzgerald <rf(a)opensource.cirrus.com>
ASoC: cs42l42: Remove duplicate control for WNF filter frequency
Richard Fitzgerald <rf(a)opensource.cirrus.com>
ASoC: cs42l42: Fix inversion of ADC Notch Switch control
Richard Fitzgerald <rf(a)opensource.cirrus.com>
ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J
Richard Fitzgerald <rf(a)opensource.cirrus.com>
ASoC: cs42l42: Correct definition of ADC Volume control
Dongliang Mu <mudongliangabcd(a)gmail.com>
ieee802154: hwsim: fix GPF in hwsim_new_edge_nl
Dongliang Mu <mudongliangabcd(a)gmail.com>
ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi
Dan Williams <dan.j.williams(a)intel.com>
libnvdimm/region: Fix label activation vs errors
Dan Williams <dan.j.williams(a)intel.com>
ACPI: NFIT: Fix support for virtual SPA ranges
Luis Henriques <lhenriques(a)suse.de>
ceph: reduce contention in ceph_check_delayed_caps()
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
i2c: dev: zero out array used for i2c reads from userspace
Takashi Iwai <tiwai(a)suse.de>
ASoC: intel: atom: Fix reference to PCM buffer address
Takashi Iwai <tiwai(a)suse.de>
ASoC: xilinx: Fix reference to PCM buffer address
Colin Ian King <colin.king(a)canonical.com>
iio: adc: Fix incorrect exit of for-loop
Chris Lesiak <chris.lesiak(a)licor.com>
iio: humidity: hdc100x: Add margin to the conversion time
Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/kernel/kprobes.c | 3 +-
arch/x86/kernel/apic/io_apic.c | 6 +-
arch/x86/kernel/apic/msi.c | 13 ++-
arch/x86/kernel/cpu/resctrl/monitor.c | 27 +++--
arch/x86/kvm/vmx/vmx.h | 2 +-
arch/x86/tools/chkobjdump.awk | 1 +
drivers/acpi/nfit/core.c | 3 +
drivers/base/core.c | 1 +
drivers/block/nbd.c | 14 ++-
drivers/gpu/drm/meson/meson_registers.h | 5 +
drivers/gpu/drm/meson/meson_viu.c | 7 +-
drivers/i2c/i2c-dev.c | 5 +-
drivers/iio/adc/palmas_gpadc.c | 4 +-
drivers/iio/adc/ti-ads7950.c | 1 -
drivers/iio/humidity/hdc100x.c | 6 +-
drivers/iommu/intel-iommu.c | 7 +-
drivers/net/dsa/lan9303-core.c | 34 +++---
drivers/net/dsa/lantiq_gswip.c | 14 ++-
drivers/net/dsa/microchip/ksz_common.h | 8 +-
drivers/net/dsa/mt7530.c | 1 +
drivers/net/dsa/sja1105/sja1105_main.c | 4 +-
drivers/net/ethernet/intel/iavf/iavf_main.c | 13 ++-
.../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 11 +-
drivers/net/ieee802154/mac802154_hwsim.c | 6 +-
drivers/net/phy/micrel.c | 2 -
drivers/net/ppp/ppp_generic.c | 2 +-
drivers/nvdimm/namespace_devs.c | 17 ++-
drivers/pci/msi.c | 125 +++++++++++++--------
drivers/platform/x86/pcengines-apuv2.c | 5 +-
drivers/xen/events/events_base.c | 20 +++-
fs/ceph/caps.c | 17 ++-
fs/ceph/mds_client.c | 25 +++--
fs/ceph/snap.c | 54 +++++----
fs/ceph/super.h | 2 +-
include/asm-generic/vmlinux.lds.h | 1 +
include/linux/device.h | 1 +
include/linux/inetdevice.h | 2 +-
include/linux/irq.h | 2 +
include/linux/msi.h | 2 +-
include/net/psample.h | 2 +
kernel/irq/chip.c | 5 +-
kernel/irq/msi.c | 13 ++-
kernel/irq/timings.c | 5 +
net/bridge/br_if.c | 2 +
net/bridge/netfilter/nf_conntrack_bridge.c | 6 +
net/core/link_watch.c | 5 +-
net/ieee802154/socket.c | 7 +-
net/ipv4/igmp.c | 21 ++--
net/ipv4/tcp_bbr.c | 2 +-
net/sched/act_mirred.c | 3 +
net/vmw_vsock/virtio_transport.c | 7 +-
sound/soc/codecs/cs42l42.c | 39 +++----
sound/soc/intel/atom/sst-mfld-platform-pcm.c | 3 +-
sound/soc/xilinx/xlnx_formatter_pcm.c | 4 +-
55 files changed, 382 insertions(+), 219 deletions(-)