December 2022 - Linux-stable-mirror

FAILED: patch "[PATCH] ipc/sem: Fix dangling sem_array access in semtimedop race" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b52be557e24c47286738276121177a41f54e3b83 Mon Sep 17 00:00:00 2001 From: Jann Horn <jannh(a)google.com> Date: Mon, 5 Dec 2022 17:59:27 +0100 Subject: [PATCH] ipc/sem: Fix dangling sem_array access in semtimedop race When __do_semtimedop() goes to sleep because it has to wait for a semaphore value becoming zero or becoming bigger than some threshold, it links the on-stack sem_queue to the sem_array, then goes to sleep without holding a reference on the sem_array. When __do_semtimedop() comes back out of sleep, one of two things must happen: a) We prove that the on-stack sem_queue has been disconnected from the (possibly freed) sem_array, making it safe to return from the stack frame that the sem_queue exists in. b) We stabilize our reference to the sem_array, lock the sem_array, and detach the sem_queue from the sem_array ourselves. sem_array has RCU lifetime, so for case (b), the reference can be stabilized inside an RCU read-side critical section by locklessly checking whether the sem_queue is still connected to the sem_array. However, the current code does the lockless check on sem_queue before starting an RCU read-side critical section, so the result of the lockless check immediately becomes useless. Fix it by doing rcu_read_lock() before the lockless check. Now RCU ensures that if we observe the object being on our queue, the object can't be freed until rcu_read_unlock(). This bug is only hittable on kernel builds with full preemption support (either CONFIG_PREEMPT or PREEMPT_DYNAMIC with preempt=full). Fixes: 370b262c896e ("ipc/sem: avoid idr tree lookup for interrupted semop") Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> diff --git a/ipc/sem.c b/ipc/sem.c index c8496f98b139..00f88aa01ac5 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -2179,14 +2179,15 @@ long __do_semtimedop(int semid, struct sembuf *sops, * scenarios where we were awakened externally, during the * window between wake_q_add() and wake_up_q(). */ + rcu_read_lock(); error = READ_ONCE(queue.status); if (error != -EINTR) { /* see SEM_BARRIER_2 for purpose/pairing */ smp_acquire__after_ctrl_dep(); + rcu_read_unlock(); goto out; } - rcu_read_lock(); locknum = sem_lock(sma, sops, nsops); if (!ipc_valid_object(&sma->sem_perm))

1 year, 10 months

1
0
0 0

FAILED: patch "[PATCH] ipc/sem: Fix dangling sem_array access in semtimedop race" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b52be557e24c47286738276121177a41f54e3b83 Mon Sep 17 00:00:00 2001 From: Jann Horn <jannh(a)google.com> Date: Mon, 5 Dec 2022 17:59:27 +0100 Subject: [PATCH] ipc/sem: Fix dangling sem_array access in semtimedop race When __do_semtimedop() goes to sleep because it has to wait for a semaphore value becoming zero or becoming bigger than some threshold, it links the on-stack sem_queue to the sem_array, then goes to sleep without holding a reference on the sem_array. When __do_semtimedop() comes back out of sleep, one of two things must happen: a) We prove that the on-stack sem_queue has been disconnected from the (possibly freed) sem_array, making it safe to return from the stack frame that the sem_queue exists in. b) We stabilize our reference to the sem_array, lock the sem_array, and detach the sem_queue from the sem_array ourselves. sem_array has RCU lifetime, so for case (b), the reference can be stabilized inside an RCU read-side critical section by locklessly checking whether the sem_queue is still connected to the sem_array. However, the current code does the lockless check on sem_queue before starting an RCU read-side critical section, so the result of the lockless check immediately becomes useless. Fix it by doing rcu_read_lock() before the lockless check. Now RCU ensures that if we observe the object being on our queue, the object can't be freed until rcu_read_unlock(). This bug is only hittable on kernel builds with full preemption support (either CONFIG_PREEMPT or PREEMPT_DYNAMIC with preempt=full). Fixes: 370b262c896e ("ipc/sem: avoid idr tree lookup for interrupted semop") Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> diff --git a/ipc/sem.c b/ipc/sem.c index c8496f98b139..00f88aa01ac5 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -2179,14 +2179,15 @@ long __do_semtimedop(int semid, struct sembuf *sops, * scenarios where we were awakened externally, during the * window between wake_q_add() and wake_up_q(). */ + rcu_read_lock(); error = READ_ONCE(queue.status); if (error != -EINTR) { /* see SEM_BARRIER_2 for purpose/pairing */ smp_acquire__after_ctrl_dep(); + rcu_read_unlock(); goto out; } - rcu_read_lock(); locknum = sem_lock(sma, sops, nsops); if (!ipc_valid_object(&sma->sem_perm))

1 year, 10 months

1
0
0 0

Very Urgent,

by Dr. Mimi Aminu

-- Hello, I tried e-mailing you more than twice but my email bounced back failure, Note this, soonest you receive this email revert to me before I deliver the message it's importunate, pressing, crucial. Await your response. Best regards Dr. Mimi Aminu

1 year, 10 months

1
0
0 0

[PATCH 5.15 000/120] 5.15.82-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.82 release. There are 120 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 07 Dec 2022 19:07:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.82-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.82-rc1 Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() Jan Dabros <jsd(a)semihalf.com> char: tpm: Protect tpm_pm_suspend with locks Conor Dooley <conor.dooley(a)microchip.com> Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" Vishal Verma <vishal.l.verma(a)intel.com> ACPI: HMAT: Fix initiator registration for single-initiator systems Vishal Verma <vishal.l.verma(a)intel.com> ACPI: HMAT: remove unnecessary variable initialization Andrew Lunn <andrew(a)lunn.ch> i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set Yuan Can <yuancan(a)huawei.com> i2c: npcm7xx: Fix error handling in npcm_i2c_init() Lukas Wunner <lukas(a)wunner.de> serial: stm32: Deassert Transmit Enable on ->rs485_config() Marek Vasut <marex(a)denx.de> serial: stm32: Use TC interrupt to deassert GPIO RTS in RS485 mode Marek Vasut <marex(a)denx.de> serial: stm32: Factor out GPIO RTS toggling into separate function Ido Schimmel <idosch(a)nvidia.com> ipv4: Fix route deletion when nexthop info is not specified David Ahern <dsahern(a)kernel.org> ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference Nikolay Aleksandrov <razor(a)blackwall.org> selftests: net: fix nexthop warning cleanup double ip typo Nikolay Aleksandrov <razor(a)blackwall.org> selftests: net: add delete nexthop route warning test Lee Jones <lee(a)kernel.org> Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled Helge Deller <deller(a)gmx.de> parisc: Increase FRAME_WARN to 2048 bytes on parisc Gavin Shan <gshan(a)redhat.com> mm: migrate: fix THP's mapcount on isolation Hugh Dickins <hughd(a)google.com> mm: __isolate_lru_page_prepare() in isolate_migratepages_block() Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/vt-d: Fix PCI device refcount leak in has_external_pci() Caleb Sander <csander(a)purestorage.com> nvme: fix SRCU protection of nvme_ns_head list Guo Ren <guoren(a)linux.alibaba.com> riscv: kexec: Fixup crash_smp_send_stop without multi cores Guo Ren <guoren(a)linux.alibaba.com> riscv: kexec: Fixup irq controller broken in kexec crash path Jisheng Zhang <jszhang(a)kernel.org> riscv: fix race when vmap stack overflow Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: Sync efi page table's kernel mappings before switching Maxim Korotkov <korotkov.maxim.s(a)gmail.com> pinctrl: single: Fix potential division by zero Mark Brown <broonie(a)kernel.org> ASoC: ops: Fix bounds check for _sx controls Kazuki Takiguchi <takiguchi.kazuki171(a)gmail.com> KVM: x86/mmu: Fix race condition in direct_page_fault Lin Ma <linma(a)zju.edu.cn> io_uring/poll: fix poll_refs race with cancelation Pavel Begunkov <asml.silence(a)gmail.com> io_uring: make poll refs more robust Pavel Begunkov <asml.silence(a)gmail.com> io_uring: cmpxchg for poll arm refs release Pavel Begunkov <asml.silence(a)gmail.com> io_uring: fix tw losing poll events Pavel Begunkov <asml.silence(a)gmail.com> io_uring: update res mask in io_poll_check_events Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Free buffers when a used dynamic event is removed Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Fix race where histograms can be called before the event Daniel Bristot de Oliveira <bristot(a)kernel.org> tracing/osnoise: Fix duration type Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Never return 0 if not all requests retired Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Fix negative value passed as remaining time Leo Liu <leo.liu(a)amd.com> drm/amdgpu: enable Vangogh VCN indirect sram mode Lee Jones <lee(a)kernel.org> drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame Adrian Hunter <adrian.hunter(a)intel.com> mmc: sdhci: Fix voltage switch delay Wenchao Chen <wenchao.chen(a)unisoc.com> mmc: sdhci-sprd: Fix no reset data and command after voltage switch Sebastian Falbesoner <sebastian.falbesoner(a)gmail.com> mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check Christian Löhle <CLoehle(a)hyperstone.com> mmc: core: Fix ambiguous TRIM and DISCARD arg Ye Bin <yebin10(a)huawei.com> mmc: mmc_test: Fix removal of debugfs file Goh, Wei Sheng <wei.sheng.goh(a)intel.com> net: stmmac: Set MAC's flow control register to reflect current settings Linus Torvalds <torvalds(a)linux-foundation.org> v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Save and restore pins in "direct IRQ" mode Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 ZhangPeng <zhangpeng362(a)huawei.com> nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Tiezhu Yang <yangtiezhu(a)loongson.cn> tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" Steven Rostedt (Google) <rostedt(a)goodmis.org> error-injection: Add prompt for function error injection Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: dice: fix regression for Lexicon I-ONIX FW810S Björn Töpel <bjorn(a)rivosinc.com> riscv: mm: Proper page permissions after initmem free Jisheng Zhang <jszhang(a)kernel.org> riscv: vdso: fix section overlapping under some conditions Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() Phil Auld <pauld(a)redhat.com> hwmon: (coretemp) Check for null before removing sysfs attrs Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed Zhengchao Shao <shaozhengchao(a)huawei.com> sctp: fix memory leak in sctp_stream_outq_migrate() Willem de Bruijn <willemb(a)google.com> packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE Shigeru Yoshida <syoshida(a)redhat.com> net: tun: Fix use-after-free in tun_detach() David Howells <dhowells(a)redhat.com> afs: Fix fileserver probe RTT handling Yang Yingliang <yangyingliang(a)huawei.com> net: mdiobus: fix unbalanced node reference count YueHaibing <yuehaibing(a)huawei.com> net: hsr: Fix potential use-after-free Xin Long <lucien.xin(a)gmail.com> tipc: re-fetch skb cb after tipc_msg_validate Jerry Ray <jerry.ray(a)microchip.com> dsa: lan9303: Correct stat name M Chetan Kumar <m.chetan.kumar(a)linux.intel.com> net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type M Chetan Kumar <m.chetan.kumar(a)linux.intel.com> net: wwan: iosm: fix kernel test robot reported error Yuri Karpov <YKarpov(a)ispras.ru> net: ethernet: nixge: fix NULL dereference Wang Hai <wanghai38(a)huawei.com> net/9p: Fix a potential socket leak in p9_socket_open Yuan Can <yuancan(a)huawei.com> net: net_netdev: Fix error handling in ntb_netdev_init_module() Zhang Changzhong <zhangchangzhong(a)huawei.com> net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() Yang Yingliang <yangyingliang(a)huawei.com> net: phy: fix null-ptr-deref while probe() failed Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: don't allow multi-BSSID in S1G Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: fix buffer overflow in elem comparison Izabela Bakollari <ibakolla(a)redhat.com> aquantia: Do not purge addresses when setting the number of rings Duoming Zhou <duoming(a)zju.edu.cn> qlcnic: fix sleep-in-atomic-context bugs caused by msleep Jiasheng Jiang <jiasheng(a)iscas.ac.cn> can: m_can: Add check for devm_clk_get Zhang Changzhong <zhangchangzhong(a)huawei.com> can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods Zhang Changzhong <zhangchangzhong(a)huawei.com> can: etas_es58x: es58x_init_netdev(): free netdev when register_candev() Zhang Changzhong <zhangchangzhong(a)huawei.com> can: cc770: cc770_isa_probe(): add missing free_cc770dev() Zhang Changzhong <zhangchangzhong(a)huawei.com> can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() Roi Dayan <roid(a)nvidia.com> net/mlx5e: Fix use-after-free when reverting termination table YueHaibing <yuehaibing(a)huawei.com> net/mlx5: Fix uninitialized variable bug in outlen_write() YueHaibing <yuehaibing(a)huawei.com> net/mlx5: DR, Fix uninitialized var warning Yevgeny Kliteynik <kliteyn(a)nvidia.com> net/mlx5: DR, Rename list field in matcher struct to list_node Wang Hai <wanghai38(a)huawei.com> e100: Fix possible use after free in e100_xmit_prepare Yuan Can <yuancan(a)huawei.com> iavf: Fix error handling in iavf_init_module() Minghao Chi <chi.minghao(a)zte.com.cn> iavf: remove redundant ret variable Yuan Can <yuancan(a)huawei.com> fm10k: Fix error handling in fm10k_init_module() Shang XiaoJing <shangxiaojing(a)huawei.com> i40e: Fix error handling in i40e_init_module() Shang XiaoJing <shangxiaojing(a)huawei.com> ixgbevf: Fix resource leak in ixgbevf_init_module() Yang Yingliang <yangyingliang(a)huawei.com> of: property: decrement node refcount in of_fwnode_get_reference_args() Wei Yongjun <weiyongjun1(a)huawei.com> nvmem: rmem: Fix return value check in rmem_read() Xu Kuohai <xukuohai(a)huawei.com> bpf: Do not copy spin lock field from user in bpf_selem_alloc Gaosheng Cui <cuigaosheng1(a)huawei.com> hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (i5500_temp) fix missing pci_disable_device() Ninad Malwade <nmalwade(a)nvidia.com> hwmon: (ina3221) Fix shunt sum critical calculation Derek Nguyen <derek.nguyen(a)collins.com> hwmon: (ltc2947) fix temperature scaling Hou Tao <houtao1(a)huawei.com> libbpf: Handle size overflow for ringbuf mmap Michael Grzeschik <m.grzeschik(a)pengutronix.de> ARM: at91: rm9200: fix usb device clock id Srikar Dronamraju <srikar(a)linux.vnet.ibm.com> scripts/faddr2line: Fix regression in name resolution on ppc64le Hou Tao <houtao1(a)huawei.com> bpf, perf: Use subprog name when reporting subprog ksymbol Paul Gazzillo <paul(a)pgazz.com> iio: light: rpr0521: add missing Kconfig dependencies Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4403: Fix oob read in afe4403_read_raw Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" Claudio Suarez <cssk(a)net-c.es> drm/amdgpu: update drm_display_info correctly when the edid is read Sam James <sam(a)gentoo.org> kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible Lyude Paul <lyude(a)redhat.com> drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code ChenXiaoSong <chenxiaosong2(a)huawei.com> btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Nikolay Borisov <nborisov(a)suse.com> btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker Frieder Schrempf <frieder.schrempf(a)kontron.de> spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock Anand Jain <anand.jain(a)oracle.com> btrfs: free btrfs_path before copying inodes to userspace David Sterba <dsterba(a)suse.com> btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino Gao Xiang <hsiangkao(a)linux.alibaba.com> erofs: fix order >= MAX_ORDER warning due to crafted negative i_size Chris Wilson <chris.p.wilson(a)intel.com> drm/i915/gt: Use i915_vm_put on ppgtt_create error paths Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> drm/i915: Create a dummy object for gen6 ppgtt Catalin Marinas <catalin.marinas(a)arm.com> arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/at91rm9200.dtsi | 2 +- arch/arm64/kernel/mte.c | 9 +- arch/arm64/mm/mteswap.c | 7 +- arch/riscv/include/asm/asm.h | 1 + arch/riscv/include/asm/efi.h | 6 +- arch/riscv/include/asm/pgalloc.h | 11 +- arch/riscv/include/asm/smp.h | 3 + arch/riscv/kernel/entry.S | 13 ++ arch/riscv/kernel/machine_kexec.c | 46 +++++-- arch/riscv/kernel/setup.c | 9 +- arch/riscv/kernel/smp.c | 93 +++++++++++++- arch/riscv/kernel/traps.c | 18 +++ arch/riscv/kernel/vdso/Makefile | 1 + arch/x86/include/asm/nospec-branch.h | 2 +- arch/x86/kernel/cpu/bugs.c | 21 ++-- arch/x86/kernel/process.c | 2 +- arch/x86/kvm/mmu/mmu.c | 12 +- drivers/acpi/numa/hmat.c | 27 ++-- drivers/char/tpm/tpm-interface.c | 5 +- drivers/clk/at91/at91rm9200.c | 2 +- drivers/clocksource/timer-riscv.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 3 + drivers/gpu/drm/amd/display/Kconfig | 7 ++ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- drivers/gpu/drm/drm_dp_mst_topology.c | 2 +- drivers/gpu/drm/i915/gem/i915_gem_internal.c | 44 ++++--- drivers/gpu/drm/i915/gt/gen6_ppgtt.c | 137 ++++++++++++--------- drivers/gpu/drm/i915/gt/gen6_ppgtt.h | 1 - drivers/gpu/drm/i915/gt/gen8_ppgtt.c | 56 +++++---- drivers/gpu/drm/i915/gt/intel_gt.c | 9 +- drivers/gpu/drm/i915/gt/intel_gt_requests.c | 2 +- drivers/gpu/drm/i915/gt/intel_gtt.c | 3 + drivers/gpu/drm/i915/i915_drv.h | 4 + drivers/hwmon/coretemp.c | 9 +- drivers/hwmon/i5500_temp.c | 2 +- drivers/hwmon/ibmpex.c | 1 + drivers/hwmon/ina3221.c | 4 +- drivers/hwmon/ltc2947-core.c | 2 +- drivers/i2c/busses/i2c-imx.c | 6 +- drivers/i2c/busses/i2c-npcm7xx.c | 11 +- drivers/iio/health/afe4403.c | 5 +- drivers/iio/health/afe4404.c | 12 +- drivers/iio/light/Kconfig | 2 + drivers/input/touchscreen/raydium_i2c_ts.c | 4 +- drivers/iommu/intel/dmar.c | 1 + drivers/iommu/intel/iommu.c | 4 +- drivers/media/common/videobuf2/frame_vector.c | 53 ++------ drivers/mmc/core/core.c | 9 +- drivers/mmc/core/mmc_test.c | 3 +- drivers/mmc/host/sdhci-esdhc-imx.c | 2 +- drivers/mmc/host/sdhci-sprd.c | 4 +- drivers/mmc/host/sdhci.c | 61 +++++++-- drivers/mmc/host/sdhci.h | 2 + drivers/net/can/cc770/cc770_isa.c | 10 +- drivers/net/can/m_can/m_can.c | 2 +- drivers/net/can/m_can/m_can_pci.c | 9 +- drivers/net/can/sja1000/sja1000_isa.c | 10 +- drivers/net/can/usb/etas_es58x/es58x_core.c | 5 +- drivers/net/dsa/lan9303-core.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_ethtool.c | 5 +- drivers/net/ethernet/aquantia/atlantic/aq_main.c | 4 +- drivers/net/ethernet/aquantia/atlantic/aq_main.h | 2 + drivers/net/ethernet/intel/e100.c | 5 +- drivers/net/ethernet/intel/fm10k/fm10k_main.c | 10 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 11 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 8 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 +- .../mellanox/mlx5/core/eswitch_offloads_termtbl.c | 2 + .../mellanox/mlx5/core/steering/dr_matcher.c | 26 ++-- .../mellanox/mlx5/core/steering/dr_table.c | 7 +- .../mellanox/mlx5/core/steering/dr_types.h | 2 +- drivers/net/ethernet/ni/nixge.c | 29 ++--- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +- drivers/net/ethernet/renesas/ravb_main.c | 1 + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +- drivers/net/mdio/fwnode_mdio.c | 2 +- drivers/net/ntb_netdev.c | 9 +- drivers/net/phy/phy_device.c | 2 + drivers/net/tun.c | 4 +- drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 3 +- drivers/net/wwan/iosm/iosm_ipc_protocol.h | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/multipath.c | 3 + drivers/nvmem/rmem.c | 4 +- drivers/of/property.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 27 +++- drivers/pinctrl/pinctrl-single.c | 2 +- drivers/spi/spi-imx.c | 3 +- drivers/tty/serial/stm32-usart.c | 131 ++++++++++++++------ drivers/tty/serial/stm32-usart.h | 1 + fs/afs/fs_probe.c | 4 +- fs/btrfs/backref.c | 25 +++- fs/btrfs/backref.h | 3 +- fs/btrfs/ioctl.c | 38 ++---- fs/btrfs/qgroup.c | 22 ++-- fs/erofs/inode.c | 2 +- fs/io_uring.c | 57 +++++++-- fs/nilfs2/dat.c | 7 ++ include/linux/license.h | 2 + include/linux/mmc/mmc.h | 2 +- include/linux/swap.h | 1 - include/net/sctp/stream_sched.h | 2 + kernel/bpf/bpf_local_storage.c | 2 +- kernel/events/core.c | 2 +- kernel/trace/trace_dynevent.c | 2 + kernel/trace/trace_events.c | 11 +- kernel/trace/trace_events_hist.c | 3 + kernel/trace/trace_osnoise.c | 6 +- lib/Kconfig.debug | 14 ++- mm/compaction.c | 67 +++++++--- mm/vmscan.c | 101 +++------------ net/9p/trans_fd.c | 4 +- net/hsr/hsr_forward.c | 5 +- net/ipv4/fib_semantics.c | 10 +- net/mac80211/airtime.c | 3 + net/packet/af_packet.c | 6 +- net/sctp/stream.c | 25 ++-- net/sctp/stream_sched.c | 5 + net/sctp/stream_sched_prio.c | 19 +++ net/sctp/stream_sched_rr.c | 5 + net/tipc/crypto.c | 3 + net/wireless/scan.c | 10 +- scripts/faddr2line | 7 +- sound/firewire/dice/dice-stream.c | 12 +- sound/soc/soc-ops.c | 2 +- tools/lib/bpf/ringbuf.c | 12 +- tools/testing/selftests/net/fib_nexthops.sh | 30 +++++ tools/vm/slabinfo-gnuplot.sh | 4 +- 133 files changed, 1132 insertions(+), 554 deletions(-)

1 year, 10 months

7
126
0 0

[PATCH net] net: mana: Fix race on per-CQ variable napi work_done

by Haiyang Zhang

After calling napi_complete_done(), the NAPIF_STATE_SCHED bit may be cleared, and another CPU can start napi thread and access per-CQ variable, cq->work_done. If the other thread (for example, from busy_poll) sets it to a value >= budget, this thread will continue to run when it should stop, and cause memory corruption and panic. To fix this issue, save the per-CQ work_done variable in a local variable before napi_complete_done(), so it won't be corrupted by a possible concurrent thread after napi_complete_done(). Also, add a flag bit to advertise to the NIC firmware: the NAPI work_done variable race is fixed, so the driver is able to reliably support features like busy_poll. Cc: stable(a)vger.kernel.org Fixes: e1b5683ff62e ("net: mana: Move NAPI from EQ to CQ") Signed-off-by: Haiyang Zhang <haiyangz(a)microsoft.com> --- drivers/net/ethernet/microsoft/mana/gdma.h | 9 ++++++++- drivers/net/ethernet/microsoft/mana/mana_en.c | 16 +++++++++++----- 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/microsoft/mana/gdma.h b/drivers/net/ethernet/microsoft/mana/gdma.h index 4a6efe6ada08..65c24ee49efd 100644 --- a/drivers/net/ethernet/microsoft/mana/gdma.h +++ b/drivers/net/ethernet/microsoft/mana/gdma.h @@ -498,7 +498,14 @@ enum { #define GDMA_DRV_CAP_FLAG_1_EQ_SHARING_MULTI_VPORT BIT(0) -#define GDMA_DRV_CAP_FLAGS1 GDMA_DRV_CAP_FLAG_1_EQ_SHARING_MULTI_VPORT +/* Advertise to the NIC firmware: the NAPI work_done variable race is fixed, + * so the driver is able to reliably support features like busy_poll. + */ +#define GDMA_DRV_CAP_FLAG_1_NAPI_WKDONE_FIX BIT(2) + +#define GDMA_DRV_CAP_FLAGS1 \ + (GDMA_DRV_CAP_FLAG_1_EQ_SHARING_MULTI_VPORT | \ + GDMA_DRV_CAP_FLAG_1_NAPI_WKDONE_FIX) #define GDMA_DRV_CAP_FLAGS2 0 diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c index 9259a74eca40..27a0f3af8aab 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -1303,10 +1303,11 @@ static void mana_poll_rx_cq(struct mana_cq *cq) xdp_do_flush(); } -static void mana_cq_handler(void *context, struct gdma_queue *gdma_queue) +static int mana_cq_handler(void *context, struct gdma_queue *gdma_queue) { struct mana_cq *cq = context; u8 arm_bit; + int w; WARN_ON_ONCE(cq->gdma_cq != gdma_queue); @@ -1315,26 +1316,31 @@ static void mana_cq_handler(void *context, struct gdma_queue *gdma_queue) else mana_poll_tx_cq(cq); - if (cq->work_done < cq->budget && - napi_complete_done(&cq->napi, cq->work_done)) { + w = cq->work_done; + + if (w < cq->budget && + napi_complete_done(&cq->napi, w)) { arm_bit = SET_ARM_BIT; } else { arm_bit = 0; } mana_gd_ring_cq(gdma_queue, arm_bit); + + return w; } static int mana_poll(struct napi_struct *napi, int budget) { struct mana_cq *cq = container_of(napi, struct mana_cq, napi); + int w; cq->work_done = 0; cq->budget = budget; - mana_cq_handler(cq, cq->gdma_cq); + w = mana_cq_handler(cq, cq->gdma_cq); - return min(cq->work_done, budget); + return min(w, budget); } static void mana_schedule_napi(void *context, struct gdma_queue *gdma_queue) -- 2.25.1

1 year, 10 months

2
1
0 0

[PATCH 4.19 000/105] 4.19.268-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.268 release. There are 105 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 07 Dec 2022 19:07:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.268-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.268-rc1 Adrian Hunter <adrian.hunter(a)intel.com> mmc: sdhci: Fix voltage switch delay Masahiro Yamada <yamada.masahiro(a)socionext.com> mmc: sdhci: use FIELD_GET for preset value bit masks Michael Kelley <mikelley(a)microsoft.com> x86/ioremap: Fix page aligned size calculation in __ioremap_caller() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/pm: Add enumeration check before spec MSRs save/restore setup Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/tsx: Add a feature bit for TSX control MSR support Keith Busch <kbusch(a)kernel.org> nvme: restrict management ioctls to admin Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp/udp: Fix memory leak in ipv6_renew_options(). Lee Jones <lee(a)kernel.org> Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled Helge Deller <deller(a)gmx.de> parisc: Increase FRAME_WARN to 2048 bytes on parisc Guenter Roeck <linux(a)roeck-us.net> xtensa: increase size of gcc stack frame check Helge Deller <deller(a)gmx.de> parisc: Increase size of gcc stack frame check Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() Maxim Korotkov <korotkov.maxim.s(a)gmail.com> pinctrl: single: Fix potential division by zero Mark Brown <broonie(a)kernel.org> ASoC: ops: Fix bounds check for _sx controls Nathan Chancellor <nathan(a)kernel.org> mm: Fix '.data.once' orphan section warning James Morse <james.morse(a)arm.com> arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72 James Morse <james.morse(a)arm.com> arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Save and restore pins in "direct IRQ" mode Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 ZhangPeng <zhangpeng362(a)huawei.com> nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Tiezhu Yang <yangtiezhu(a)loongson.cn> tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" Steven Rostedt (Google) <rostedt(a)goodmis.org> error-injection: Add prompt for function error injection ChenXiaoSong <chenxiaosong2(a)huawei.com> btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() Phil Auld <pauld(a)redhat.com> hwmon: (coretemp) Check for null before removing sysfs attrs Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed Willem de Bruijn <willemb(a)google.com> packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE Shigeru Yoshida <syoshida(a)redhat.com> net: tun: Fix use-after-free in tun_detach() YueHaibing <yuehaibing(a)huawei.com> net: hsr: Fix potential use-after-free Jerry Ray <jerry.ray(a)microchip.com> dsa: lan9303: Correct stat name Wang Hai <wanghai38(a)huawei.com> net/9p: Fix a potential socket leak in p9_socket_open Yuan Can <yuancan(a)huawei.com> net: net_netdev: Fix error handling in ntb_netdev_init_module() Yang Yingliang <yangyingliang(a)huawei.com> net: phy: fix null-ptr-deref while probe() failed Duoming Zhou <duoming(a)zju.edu.cn> qlcnic: fix sleep-in-atomic-context bugs caused by msleep Zhang Changzhong <zhangchangzhong(a)huawei.com> can: cc770: cc770_isa_probe(): add missing free_cc770dev() Zhang Changzhong <zhangchangzhong(a)huawei.com> can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() YueHaibing <yuehaibing(a)huawei.com> net/mlx5: Fix uninitialized variable bug in outlen_write() Yang Yingliang <yangyingliang(a)huawei.com> of: property: decrement node refcount in of_fwnode_get_reference_args() Gaosheng Cui <cuigaosheng1(a)huawei.com> hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (i5500_temp) fix missing pci_disable_device() Srikar Dronamraju <srikar(a)linux.vnet.ibm.com> scripts/faddr2line: Fix regression in name resolution on ppc64le Paul Gazzillo <paul(a)pgazz.com> iio: light: rpr0521: add missing Kconfig dependencies Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4403: Fix oob read in afe4403_read_raw Sam James <sam(a)gentoo.org> kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible Frieder Schrempf <frieder.schrempf(a)kontron.de> spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock Anand Jain <anand.jain(a)oracle.com> btrfs: free btrfs_path before copying inodes to userspace Christian König <christian.koenig(a)amd.com> drm/amdgpu: always register an MMU notifier for userptr Lyude Paul <lyude(a)redhat.com> drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN Anand Jain <anand.jain(a)oracle.com> btrfs: free btrfs_path before copying subvol info to userspace Anand Jain <anand.jain(a)oracle.com> btrfs: free btrfs_path before copying fspath to userspace Josef Bacik <josef(a)toxicpanda.com> btrfs: free btrfs_path before copying root refs to userspace Mikulas Patocka <mpatocka(a)redhat.com> dm integrity: flush the journal on suspend Enrico Sau <enrico.sau(a)gmail.com> net: usb: qmi_wwan: add Telit 0x103a composition Gleb Mazovetskiy <glex.spb(a)gmail.com> tcp: configurable source port perturb table size Kai-Heng Feng <kai.heng.feng(a)canonical.com> platform/x86: hp-wmi: Ignore Smart Experience App event Hans de Goede <hdegoede(a)redhat.com> platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) Xiongfeng Wang <wangxiongfeng2(a)huawei.com> platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() ruanjinjie <ruanjinjie(a)huawei.com> xen/platform-pci: add missing free_irq() in error path Lukas Wunner <lukas(a)wunner.de> serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() Aman Dhoot <amandhoot12(a)gmail.com> Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode Chen Zhongjin <chenzhongjin(a)huawei.com> nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty Xiubo Li <xiubli(a)redhat.com> ceph: avoid putting the realm twice when decoding snaps fails Xiubo Li <xiubli(a)redhat.com> ceph: do not update snapshot context when there is no new snapshot Mitja Spes <mitja(a)lxnav.com> iio: pressure: ms5611: fixed value compensation bug Lars-Peter Clausen <lars(a)metafoo.de> iio: ms5611: Simplify IO callback parameters Randy Dunlap <rdunlap(a)infradead.org> nios2: add FORCE for vmlinuz.gz Chen Zhongjin <chenzhongjin(a)huawei.com> iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails Alejandro Concepción Rodríguez <asconcepcion(a)acoro.eu> iio: light: apds9960: fix wrong register for gesture gain Jakob Unterwurzacher <jakob.unterwurzacher(a)theobroma-systems.com> arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency Heiko Carstens <hca(a)linux.ibm.com> s390/crashdump: fix TOD programmable field size Yu Liao <liaoyu15(a)huawei.com> net: thunderx: Fix the ACPI memory leak Martin Faltesek <mfaltesek(a)google.com> nfc: st-nci: fix memory leaks in EVT_TRANSACTION Martin Faltesek <mfaltesek(a)google.com> nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: fix no record found for raw_track_access Kuniyuki Iwashima <kuniyu(a)amazon.com> dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). Yang Yingliang <yangyingliang(a)huawei.com> bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() Liu Shixin <liushixin2(a)huawei.com> NFC: nci: fix memory leak in nci_rx_data_packet() Chen Zhongjin <chenzhongjin(a)huawei.com> xfrm: Fix ignored return value in xfrm6_init() YueHaibing <yuehaibing(a)huawei.com> tipc: check skb_linearize() return value in tipc_disc_rcv() Xin Long <lucien.xin(a)gmail.com> tipc: add an extra conn_get in tipc_conn_alloc Xin Long <lucien.xin(a)gmail.com> tipc: set con sock in tipc_conn_alloc Moshe Shemesh <moshe(a)nvidia.com> net/mlx5: Fix FW tracer timestamp calculation Yang Yingliang <yangyingliang(a)huawei.com> Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() Yang Yingliang <yangyingliang(a)huawei.com> Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() Yang Yingliang <yangyingliang(a)huawei.com> net: pch_gbe: fix pci device refcount leak while module exiting Zhang Changzhong <zhangchangzhong(a)huawei.com> net/qla3xxx: fix potential memleak in ql3xxx_send() Peter Kosyh <pkosyh(a)yandex.ru> net/mlx4: Check retval of mlx4_bitmap_init Zheng Yongjun <zhengyongjun3(a)huawei.com> ARM: mxs: fix memory leak in mxs_machine_init() Zhengchao Shao <shaozhengchao(a)huawei.com> 9p/fd: fix issue of list_del corruption in p9_fd_cancel() Wang Hai <wanghai38(a)huawei.com> net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() Lin Ma <linma(a)zju.edu.cn> nfc/nci: fix race with opening and closing Michael Grzeschik <m.grzeschik(a)pengutronix.de> ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl Samuel Holland <samuel(a)sholland.org> bus: sunxi-rsb: Support atomic transfers Detlev Casanova <detlev.casanova(a)collabora.com> ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove Dominik Haller <d.haller(a)phytec.de> ARM: dts: am335x-pcm-953: Define fixed regulators in root node Herbert Xu <herbert(a)gondor.apana.org.au> af_key: Fix send_acquire race with pfkey_register Jason A. Donenfeld <Jason(a)zx2c4.com> MIPS: pic32: treat port as signed integer Nathan Chancellor <nathan(a)kernel.org> RISC-V: vdso: Do not add missing symbols to version section in linker script Hans de Goede <hdegoede(a)redhat.com> drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) Sean Nyekjaer <sean(a)geanix.com> spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run Nicolas Cavallari <nicolas.cavallari(a)green-communications.fr> wifi: mac80211: Fix ack frame idr leak when mesh has no route Gaosheng Cui <cuigaosheng1(a)huawei.com> audit: fix undefined behavior in bit shift for AUDIT_BIT Jonas Jelonek <jelonek.jonas(a)gmail.com> wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/am335x-pcm-953.dtsi | 28 ++++----- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 9 +++ arch/arm/mach-mxs/mach-mxs.c | 4 +- .../arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 2 +- arch/arm64/kernel/cpu_errata.c | 24 ++++++-- arch/mips/include/asm/fw/fw.h | 2 +- arch/mips/pic32/pic32mzda/early_console.c | 13 ++-- arch/mips/pic32/pic32mzda/init.c | 2 +- arch/nios2/boot/Makefile | 2 +- arch/riscv/kernel/vdso/Makefile | 3 + arch/riscv/kernel/vdso/vdso.lds.S | 2 + arch/s390/kernel/crash_dump.c | 2 +- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/nospec-branch.h | 2 +- arch/x86/kernel/cpu/bugs.c | 21 ++++--- arch/x86/kernel/cpu/tsx.c | 33 +++++----- arch/x86/kernel/process.c | 2 +- arch/x86/mm/ioremap.c | 8 ++- arch/x86/power/cpu.c | 23 ++++--- drivers/bus/sunxi-rsb.c | 29 ++++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 8 +-- .../drm/amd/display/dc/dce120/dce120_resource.c | 3 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++ drivers/hv/channel_mgmt.c | 6 +- drivers/hv/vmbus_drv.c | 1 + drivers/hwmon/coretemp.c | 9 ++- drivers/hwmon/i5500_temp.c | 2 +- drivers/hwmon/ibmpex.c | 1 + drivers/iio/health/afe4403.c | 5 +- drivers/iio/health/afe4404.c | 12 ++-- drivers/iio/industrialio-sw-trigger.c | 6 +- drivers/iio/light/Kconfig | 2 + drivers/iio/light/apds9960.c | 12 ++-- drivers/iio/pressure/ms5611.h | 18 +++--- drivers/iio/pressure/ms5611_core.c | 56 +++++++++-------- drivers/iio/pressure/ms5611_i2c.c | 11 ++-- drivers/iio/pressure/ms5611_spi.c | 17 +++--- drivers/input/mouse/synaptics.c | 1 + drivers/iommu/dmar.c | 1 + drivers/md/dm-integrity.c | 7 +-- drivers/mmc/host/sdhci.c | 71 ++++++++++++++++++---- drivers/mmc/host/sdhci.h | 12 ++-- drivers/net/can/cc770/cc770_isa.c | 10 +-- drivers/net/can/sja1000/sja1000_isa.c | 10 +-- drivers/net/dsa/lan9303-core.c | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 12 ++-- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 +- drivers/net/ethernet/mellanox/mlx4/qp.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 6 +- drivers/net/ethernet/qlogic/qla3xxx.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +- drivers/net/ethernet/renesas/ravb_main.c | 1 + drivers/net/ntb_netdev.c | 9 ++- drivers/net/phy/phy_device.c | 1 + drivers/net/tun.c | 4 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/mac80211_hwsim.c | 5 ++ drivers/nfc/st-nci/se.c | 6 +- drivers/nvme/host/core.c | 6 ++ drivers/of/property.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 27 +++++++- drivers/pinctrl/pinctrl-single.c | 2 +- drivers/platform/x86/acer-wmi.c | 9 +++ drivers/platform/x86/asus-wmi.c | 2 + drivers/platform/x86/hp-wmi.c | 3 + drivers/s390/block/dasd_eckd.c | 6 +- drivers/spi/spi-imx.c | 3 +- drivers/spi/spi-stm32.c | 2 +- drivers/tty/serial/8250/8250_omap.c | 7 ++- drivers/xen/platform-pci.c | 7 ++- fs/btrfs/ioctl.c | 23 ++++--- fs/btrfs/qgroup.c | 9 +-- fs/ceph/snap.c | 31 +++++++--- fs/nilfs2/dat.c | 7 +++ fs/nilfs2/sufile.c | 8 +++ include/linux/license.h | 2 + include/linux/mmdebug.h | 2 +- include/uapi/linux/audit.h | 2 +- lib/Kconfig.debug | 14 ++++- net/9p/trans_fd.c | 6 +- net/bluetooth/l2cap_core.c | 13 ++++ net/dccp/ipv4.c | 2 + net/dccp/ipv6.c | 2 + net/hsr/hsr_forward.c | 5 +- net/ipv4/Kconfig | 10 +++ net/ipv4/inet_hashtables.c | 10 +-- net/ipv4/tcp_ipv4.c | 2 + net/ipv6/ipv6_sockglue.c | 7 +++ net/ipv6/tcp_ipv6.c | 2 + net/ipv6/xfrm6_policy.c | 6 +- net/key/af_key.c | 32 +++++++--- net/mac80211/mesh_pathtbl.c | 2 +- net/nfc/nci/core.c | 2 +- net/nfc/nci/data.c | 4 +- net/packet/af_packet.c | 6 +- net/tipc/discover.c | 5 +- net/tipc/topsrv.c | 20 +++--- scripts/faddr2line | 7 ++- sound/soc/codecs/sgtl5000.c | 1 + sound/soc/soc-ops.c | 2 +- tools/vm/slabinfo-gnuplot.sh | 4 +- 104 files changed, 596 insertions(+), 298 deletions(-)

1 year, 10 months

6
110
0 0

[PATCH AUTOSEL 4.9 1/3] ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()

by Sasha Levin

From: Mark Brown <broonie(a)kernel.org> [ Upstream commit 97eea946b93961fffd29448dcda7398d0d51c4b2 ] The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks. Signed-off-by: Mark Brown <broonie(a)kernel.org> Link: https://lore.kernel.org/r/20220511134137.169575-2-broonie@kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/soc-ops.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 4fda8c24be29..7129bb685b63 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -465,6 +465,12 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, if (snd_soc_volsw_is_stereo(mc)) { val_mask = mask << rshift; val2 = (ucontrol->value.integer.value[1] + min) & mask; + + if (mc->platform_max && val2 > mc->platform_max) + return -EINVAL; + if (val2 > max) + return -EINVAL; + val2 = val2 << rshift; err = snd_soc_component_update_bits(component, reg2, val_mask, -- 2.35.1

1 year, 10 months

1
2
0 0

[PATCH AUTOSEL 4.14 1/4] ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()

by Sasha Levin

From: Mark Brown <broonie(a)kernel.org> [ Upstream commit 97eea946b93961fffd29448dcda7398d0d51c4b2 ] The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks. Signed-off-by: Mark Brown <broonie(a)kernel.org> Link: https://lore.kernel.org/r/20220511134137.169575-2-broonie@kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/soc-ops.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 81c9ecfa7c7f..63c0e61b1754 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -465,6 +465,12 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, if (snd_soc_volsw_is_stereo(mc)) { val_mask = mask << rshift; val2 = (ucontrol->value.integer.value[1] + min) & mask; + + if (mc->platform_max && val2 > mc->platform_max) + return -EINVAL; + if (val2 > max) + return -EINVAL; + val2 = val2 << rshift; err = snd_soc_component_update_bits(component, reg2, val_mask, -- 2.35.1

1 year, 10 months

1
3
0 0

[PATCH AUTOSEL 4.19 1/5] ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()

by Sasha Levin

From: Mark Brown <broonie(a)kernel.org> [ Upstream commit 97eea946b93961fffd29448dcda7398d0d51c4b2 ] The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks. Signed-off-by: Mark Brown <broonie(a)kernel.org> Link: https://lore.kernel.org/r/20220511134137.169575-2-broonie@kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/soc-ops.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 453b61b42dd9..00e6a6e46fe5 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -460,6 +460,12 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, if (snd_soc_volsw_is_stereo(mc)) { val_mask = mask << rshift; val2 = (ucontrol->value.integer.value[1] + min) & mask; + + if (mc->platform_max && val2 > mc->platform_max) + return -EINVAL; + if (val2 > max) + return -EINVAL; + val2 = val2 << rshift; err = snd_soc_component_update_bits(component, reg2, val_mask, -- 2.35.1

1 year, 10 months

1
4
0 0

[PATCH AUTOSEL 5.4 1/5] ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()

by Sasha Levin

From: Mark Brown <broonie(a)kernel.org> [ Upstream commit 97eea946b93961fffd29448dcda7398d0d51c4b2 ] The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks. Signed-off-by: Mark Brown <broonie(a)kernel.org> Link: https://lore.kernel.org/r/20220511134137.169575-2-broonie@kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/soc-ops.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 453b61b42dd9..00e6a6e46fe5 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -460,6 +460,12 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, if (snd_soc_volsw_is_stereo(mc)) { val_mask = mask << rshift; val2 = (ucontrol->value.integer.value[1] + min) & mask; + + if (mc->platform_max && val2 > mc->platform_max) + return -EINVAL; + if (val2 > max) + return -EINVAL; + val2 = val2 << rshift; err = snd_soc_component_update_bits(component, reg2, val_mask, -- 2.35.1

1 year, 10 months

1
4
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2022