Commit 6f93e834fa7c5faa0372e46828b4b2a966ac61d7 upstream.
The mount option max_inline ranges from 0 to the sectorsize (which is
now equal to page size). But we parse the mount options too early and
before the actual sectorsize is read from the superblock. So the upper
limit of max_inline is unaware of the actual sectorsize and is limited
by the temporary sectorsize 4096, even on a system where the default
sectorsize is 64K.
Fix this by reading the superblock sectorsize before the mount option
parse.
Reported-by: Alexander Tsvetkov <alexander.tsvetkov(a)oracle.com>
CC: stable(a)vger.kernel.org # 5.4+
Signed-off-by: Anand Jain <anand.jain(a)oracle.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: Anand Jain <anand.jain(a)oracle.com>
---
fs/btrfs/disk-io.c | 45 +++++++++++++++++++++++----------------------
1 file changed, 23 insertions(+), 22 deletions(-)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index dacd67dca43f..946ae198b344 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2894,6 +2894,29 @@ int open_ctree(struct super_block *sb,
*/
fs_info->compress_type = BTRFS_COMPRESS_ZLIB;
+ /*
+ * Flag our filesystem as having big metadata blocks if they are bigger
+ * than the page size
+ */
+ if (btrfs_super_nodesize(disk_super) > PAGE_SIZE) {
+ if (!(features & BTRFS_FEATURE_INCOMPAT_BIG_METADATA))
+ btrfs_info(fs_info,
+ "flagging fs with big metadata feature");
+ features |= BTRFS_FEATURE_INCOMPAT_BIG_METADATA;
+ }
+
+ /* Set up fs_info before parsing mount options */
+ nodesize = btrfs_super_nodesize(disk_super);
+ sectorsize = btrfs_super_sectorsize(disk_super);
+ stripesize = sectorsize;
+ fs_info->dirty_metadata_batch = nodesize * (1 + ilog2(nr_cpu_ids));
+ fs_info->delalloc_batch = sectorsize * 512 * (1 + ilog2(nr_cpu_ids));
+
+ /* Cache block sizes */
+ fs_info->nodesize = nodesize;
+ fs_info->sectorsize = sectorsize;
+ fs_info->stripesize = stripesize;
+
ret = btrfs_parse_options(fs_info, options, sb->s_flags);
if (ret) {
err = ret;
@@ -2920,28 +2943,6 @@ int open_ctree(struct super_block *sb,
if (features & BTRFS_FEATURE_INCOMPAT_SKINNY_METADATA)
btrfs_info(fs_info, "has skinny extents");
- /*
- * flag our filesystem as having big metadata blocks if
- * they are bigger than the page size
- */
- if (btrfs_super_nodesize(disk_super) > PAGE_SIZE) {
- if (!(features & BTRFS_FEATURE_INCOMPAT_BIG_METADATA))
- btrfs_info(fs_info,
- "flagging fs with big metadata feature");
- features |= BTRFS_FEATURE_INCOMPAT_BIG_METADATA;
- }
-
- nodesize = btrfs_super_nodesize(disk_super);
- sectorsize = btrfs_super_sectorsize(disk_super);
- stripesize = sectorsize;
- fs_info->dirty_metadata_batch = nodesize * (1 + ilog2(nr_cpu_ids));
- fs_info->delalloc_batch = sectorsize * 512 * (1 + ilog2(nr_cpu_ids));
-
- /* Cache block sizes */
- fs_info->nodesize = nodesize;
- fs_info->sectorsize = sectorsize;
- fs_info->stripesize = stripesize;
-
/*
* mixed block groups end up with duplicate but slightly offset
* extent buffers for the same range. It leads to corruptions
--
2.31.1
On Thu, Dec 17, 2020 at 6:09 AM Robert Foss <robert.foss(a)linaro.org> wrote:
>
> 4k requires two dsi pipes, so don't report MODE_OK when only a
> single pipe is configured. But rather report MODE_PANEL to
> signal that requirements of the panel are not being met.
>
> Reported-by: Peter Collingbourne <pcc(a)google.com>
> Suggested-by: Peter Collingbourne <pcc(a)google.com>
> Signed-off-by: Robert Foss <robert.foss(a)linaro.org>
> Tested-by: John Stultz <john.stultz(a)linaro.org>
> Tested-by: Anibal Limon <anibal.limon(a)linaro.org>
> Acked-By: Vinod Koul <vkoul(a)kernel.org>
> Tested-by: Peter Collingbourne <pcc(a)google.com>
> Reviewed-by: Bjorn Andersson <bjorn.andersson(a)linaro.org>
This landed in commit d1a97648ae028a44536927c87837c45ada7141c9. Since
this is a bug fix I'd like to request it to be applied to the 5.10
stable kernel.
Peter
On 16.09.21 14:56, gregkh(a)linuxfoundation.org wrote:
>
> The patch below does not apply to the 4.14-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable(a)vger.kernel.org>.
>
> thanks,
>
> greg k-h
>
> ------------------ original commit in Linus's tree ------------------
>
> From 7cf209ba8a86410939a24cb1aeb279479a7e0ca6 Mon Sep 17 00:00:00 2001
> From: David Hildenbrand <david(a)redhat.com>
> Date: Tue, 7 Sep 2021 19:54:59 -0700
> Subject: [PATCH] mm/memory_hotplug: use "unsigned long" for PFN in
> zone_for_pfn_range()
>
> Patch series "mm/memory_hotplug: preparatory patches for new online policy and memory"
>
> These are all cleanups and one fix previously sent as part of [1]:
> [PATCH v1 00/12] mm/memory_hotplug: "auto-movable" online policy and memory
> groups.
>
> These patches make sense even without the other series, therefore I pulled
> them out to make the other series easier to digest.
>
> [1] https://lkml.kernel.org/r/20210607195430.48228-1-david@redhat.com
>
> This patch (of 4):
>
> Checkpatch complained on a follow-up patch that we are using "unsigned"
> here, which defaults to "unsigned int" and checkpatch is correct.
>
> As we will search for a fitting zone using the wrong pfn, we might end
> up onlining memory to one of the special kernel zones, such as ZONE_DMA,
> which can end badly as the onlined memory does not satisfy properties of
> these zones.
>
> Use "unsigned long" instead, just as we do in other places when handling
> PFNs. This can bite us once we have physical addresses in the range of
> multiple TB.
>
> Link: https://lkml.kernel.org/r/20210712124052.26491-2-david@redhat.com
> Fixes: e5e689302633 ("mm, memory_hotplug: display allowed zones in the preferred ordering")
> Signed-off-by: David Hildenbrand <david(a)redhat.com>
> Reviewed-by: Pankaj Gupta <pankaj.gupta(a)ionos.com>
> Reviewed-by: Muchun Song <songmuchun(a)bytedance.com>
> Reviewed-by: Oscar Salvador <osalvador(a)suse.de>
> Cc: David Hildenbrand <david(a)redhat.com>
> Cc: Vitaly Kuznetsov <vkuznets(a)redhat.com>
> Cc: "Michael S. Tsirkin" <mst(a)redhat.com>
> Cc: Jason Wang <jasowang(a)redhat.com>
> Cc: Pankaj Gupta <pankaj.gupta.linux(a)gmail.com>
> Cc: Wei Yang <richard.weiyang(a)linux.alibaba.com>
> Cc: Michal Hocko <mhocko(a)kernel.org>
> Cc: Dan Williams <dan.j.williams(a)intel.com>
> Cc: Anshuman Khandual <anshuman.khandual(a)arm.com>
> Cc: Dave Hansen <dave.hansen(a)linux.intel.com>
> Cc: Vlastimil Babka <vbabka(a)suse.cz>
> Cc: Mike Rapoport <rppt(a)kernel.org>
> Cc: "Rafael J. Wysocki" <rjw(a)rjwysocki.net>
> Cc: Len Brown <lenb(a)kernel.org>
> Cc: Pavel Tatashin <pasha.tatashin(a)soleen.com>
> Cc: Heiko Carstens <hca(a)linux.ibm.com>
> Cc: Michael Ellerman <mpe(a)ellerman.id.au>
> Cc: Catalin Marinas <catalin.marinas(a)arm.com>
> Cc: virtualization(a)lists.linux-foundation.org
> Cc: Andy Lutomirski <luto(a)kernel.org>
> Cc: "Aneesh Kumar K.V" <aneesh.kumar(a)linux.ibm.com>
> Cc: Anton Blanchard <anton(a)ozlabs.org>
> Cc: Ard Biesheuvel <ardb(a)kernel.org>
> Cc: Baoquan He <bhe(a)redhat.com>
> Cc: Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
> Cc: Borislav Petkov <bp(a)alien8.de>
> Cc: Christian Borntraeger <borntraeger(a)de.ibm.com>
> Cc: Christophe Leroy <christophe.leroy(a)c-s.fr>
> Cc: Dave Jiang <dave.jiang(a)intel.com>
> Cc: "H. Peter Anvin" <hpa(a)zytor.com>
> Cc: Ingo Molnar <mingo(a)redhat.com>
> Cc: Jia He <justin.he(a)arm.com>
> Cc: Joe Perches <joe(a)perches.com>
> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com>
> Cc: Laurent Dufour <ldufour(a)linux.ibm.com>
> Cc: Michel Lespinasse <michel(a)lespinasse.org>
> Cc: Nathan Lynch <nathanl(a)linux.ibm.com>
> Cc: Nicholas Piggin <npiggin(a)gmail.com>
> Cc: Paul Mackerras <paulus(a)samba.org>
> Cc: Peter Zijlstra <peterz(a)infradead.org>
> Cc: Pierre Morel <pmorel(a)linux.ibm.com>
> Cc: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com>
> Cc: Rich Felker <dalias(a)libc.org>
> Cc: Scott Cheloha <cheloha(a)linux.ibm.com>
> Cc: Sergei Trofimovich <slyfox(a)gentoo.org>
> Cc: Thiago Jung Bauermann <bauerman(a)linux.ibm.com>
> Cc: Thomas Gleixner <tglx(a)linutronix.de>
> Cc: Vasily Gorbik <gor(a)linux.ibm.com>
> Cc: Vishal Verma <vishal.l.verma(a)intel.com>
> Cc: Will Deacon <will(a)kernel.org>
> Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
> Cc: <stable(a)vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
>
> diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
> index a7fd2c3ccb77..d01b504ce06f 100644
> --- a/include/linux/memory_hotplug.h
> +++ b/include/linux/memory_hotplug.h
> @@ -339,8 +339,8 @@ extern void sparse_remove_section(struct mem_section *ms,
> unsigned long map_offset, struct vmem_altmap *altmap);
> extern struct page *sparse_decode_mem_map(unsigned long coded_mem_map,
> unsigned long pnum);
> -extern struct zone *zone_for_pfn_range(int online_type, int nid, unsigned start_pfn,
> - unsigned long nr_pages);
> +extern struct zone *zone_for_pfn_range(int online_type, int nid,
> + unsigned long start_pfn, unsigned long nr_pages);
> extern int arch_create_linear_mapping(int nid, u64 start, u64 size,
> struct mhp_params *params);
> void arch_remove_linear_mapping(u64 start, u64 size);
> diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
> index f829805fe1ca..fa349acb8810 100644
> --- a/mm/memory_hotplug.c
> +++ b/mm/memory_hotplug.c
> @@ -708,8 +708,8 @@ static inline struct zone *default_zone_for_pfn(int nid, unsigned long start_pfn
> return movable_node_enabled ? movable_zone : kernel_zone;
> }
>
> -struct zone *zone_for_pfn_range(int online_type, int nid, unsigned start_pfn,
> - unsigned long nr_pages)
> +struct zone *zone_for_pfn_range(int online_type, int nid,
> + unsigned long start_pfn, unsigned long nr_pages)
> {
> if (online_type == MMOP_ONLINE_KERNEL)
> return default_kernel_zone_for_pfn(nid, start_pfn, nr_pages);
>
AFAIKS, there are only contextual differences and they are pretty easy
to sort out. @Greg, I can send a backport if it helps.
--
Thanks,
David / dhildenb
The tty driver name is used also after registering the driver and must
specifically not be allocated on the stack to avoid leaking information
to user space (or triggering an oops).
Drivers should not try to encode topology information in the tty device
name but this one snuck in through staging without anyone noticing and
another driver has since copied this malpractice.
Fixing the ABI is a separate issue, but this at least plugs the security
hole.
Fixes: ba4dc61fe8c5 ("Staging: ipack: add support for IP-OCTAL mezzanine board")
Cc: stable(a)vger.kernel.org # 3.5
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
drivers/ipack/devices/ipoctal.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
index c14e65a5d38f..c62fec75987c 100644
--- a/drivers/ipack/devices/ipoctal.c
+++ b/drivers/ipack/devices/ipoctal.c
@@ -264,7 +264,6 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
int res;
int i;
struct tty_driver *tty;
- char name[20];
struct ipoctal_channel *channel;
struct ipack_region *region;
void __iomem *addr;
@@ -355,8 +354,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
/* Fill struct tty_driver with ipoctal data */
tty->owner = THIS_MODULE;
tty->driver_name = KBUILD_MODNAME;
- sprintf(name, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
- tty->name = name;
+ tty->name = kasprintf(GFP_KERNEL, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
+ if (!tty->name) {
+ res = -ENOMEM;
+ goto err_put_driver;
+ }
tty->major = 0;
tty->minor_start = 0;
@@ -371,8 +373,7 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
res = tty_register_driver(tty);
if (res) {
dev_err(&ipoctal->dev->dev, "Can't register tty driver.\n");
- tty_driver_kref_put(tty);
- return res;
+ goto err_free_name;
}
/* Save struct tty_driver for use it when uninstalling the device */
@@ -409,6 +410,13 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
ipoctal_irq_handler, ipoctal);
return 0;
+
+err_free_name:
+ kfree(tty->name);
+err_put_driver:
+ tty_driver_kref_put(tty);
+
+ return res;
}
static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel,
@@ -696,6 +704,7 @@ static void __ipoctal_remove(struct ipoctal *ipoctal)
}
tty_unregister_driver(ipoctal->tty_drv);
+ kfree(ipoctal->tty_drv->name);
tty_driver_kref_put(ipoctal->tty_drv);
kfree(ipoctal);
}
--
2.32.0
From: Li Jinlin <lijinlin3(a)huawei.com>
[ Upstream commit 884f0e84f1e3195b801319c8ec3d5774e9bf2710 ]
The pending timer has been set up in blk_throtl_init(). However, the
timer is not deleted in blk_throtl_exit(). This means that the timer
handler may still be running after freeing the timer, which would
result in a use-after-free.
Fix by calling del_timer_sync() to delete the timer in blk_throtl_exit().
Signed-off-by: Li Jinlin <lijinlin3(a)huawei.com>
Link: https://lore.kernel.org/r/20210907121242.2885564-1-lijinlin3@huawei.com
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
block/blk-throttle.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 17bdd6b55beb..fbd08c4569ce 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1588,6 +1588,7 @@ int blk_throtl_init(struct request_queue *q)
void blk_throtl_exit(struct request_queue *q)
{
BUG_ON(!q->td);
+ del_timer_sync(&q->td->service_queue.pending_timer);
throtl_shutdown_wq(q);
blkcg_deactivate_policy(q, &blkcg_policy_throtl);
kfree(q->td);
--
2.30.2
From: Li Jinlin <lijinlin3(a)huawei.com>
[ Upstream commit 884f0e84f1e3195b801319c8ec3d5774e9bf2710 ]
The pending timer has been set up in blk_throtl_init(). However, the
timer is not deleted in blk_throtl_exit(). This means that the timer
handler may still be running after freeing the timer, which would
result in a use-after-free.
Fix by calling del_timer_sync() to delete the timer in blk_throtl_exit().
Signed-off-by: Li Jinlin <lijinlin3(a)huawei.com>
Link: https://lore.kernel.org/r/20210907121242.2885564-1-lijinlin3@huawei.com
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
block/blk-throttle.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 3a4c9a3c1427..6435dc25be0a 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1584,6 +1584,7 @@ int blk_throtl_init(struct request_queue *q)
void blk_throtl_exit(struct request_queue *q)
{
BUG_ON(!q->td);
+ del_timer_sync(&q->td->service_queue.pending_timer);
throtl_shutdown_wq(q);
blkcg_deactivate_policy(q, &blkcg_policy_throtl);
kfree(q->td);
--
2.30.2
From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
[ Upstream commit 9d768cd7fd42bb0be16f36aec48548fca5260759 ]
A consumer is expected to disable a PWM before calling pwm_put(). And if
they didn't there is hopefully a good reason (or the consumer needs
fixing). Also if disabling an enabled PWM was the right thing to do,
this should better be done in the framework instead of in each low level
driver.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding(a)gmail.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/pwm/pwm-rockchip.c | 14 --------------
1 file changed, 14 deletions(-)
diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
index 48bcc853d57a..cf34fb00c054 100644
--- a/drivers/pwm/pwm-rockchip.c
+++ b/drivers/pwm/pwm-rockchip.c
@@ -392,20 +392,6 @@ static int rockchip_pwm_remove(struct platform_device *pdev)
{
struct rockchip_pwm_chip *pc = platform_get_drvdata(pdev);
- /*
- * Disable the PWM clk before unpreparing it if the PWM device is still
- * running. This should only happen when the last PWM user left it
- * enabled, or when nobody requested a PWM that was previously enabled
- * by the bootloader.
- *
- * FIXME: Maybe the core should disable all PWM devices in
- * pwmchip_remove(). In this case we'd only have to call
- * clk_unprepare() after pwmchip_remove().
- *
- */
- if (pwm_is_enabled(pc->chip.pwms))
- clk_disable(pc->clk);
-
clk_unprepare(pc->pclk);
clk_unprepare(pc->clk);
--
2.30.2