full_hit() directly uses cpu as an array index. Since
RING_BUFFER_ALL_CPUS == -1, calling full_hit() with cpu ==
RING_BUFFER_ALL_CPUS will cause an invalid memory access.
The upstream commit 42fb0a1e84ff ("tracing/ring-buffer: Have polling
block on watermark") already does this. This was missed when backporting
to v5.4.y.
This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.
Fixes: e65ac2bdda54 ("tracing/ring-buffer: Have polling block on watermark")
Signed-off-by: Pratyush Yadav <ptyadav(a)amazon.de>
---
I am not familiar with this code. This was just pointed out by our
static analysis tool and I wrote a quick patch fixing this. Only
compile-tested.
kernel/trace/ring_buffer.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 176d858903bd..11e8189dd8ae 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -727,6 +727,7 @@ __poll_t ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu,
if (cpu == RING_BUFFER_ALL_CPUS) {
work = &buffer->irq_work;
+ full = 0;
} else {
if (!cpumask_test_cpu(cpu, buffer->cpumask))
return -EINVAL;
--
2.38.1
Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879
Hi Stable maintainers,
On 12/5/22 06:21, irqchip-bot for Sean Anderson wrote:
> The following commit has been merged into the irq/irqchip-next branch of irqchip:
>
> Commit-ID: 3ae977d0e4e3a2a2ccc912ca2d20c9430508ecdd
> Gitweb: https://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms/3ae977d0e…
> Author: Sean Anderson <sean.anderson(a)seco.com>
> AuthorDate: Thu, 01 Dec 2022 16:28:07 -05:00
> Committer: Marc Zyngier <maz(a)kernel.org>
> CommitterDate: Mon, 05 Dec 2022 10:39:52
>
> irqchip/ls-extirq: Fix endianness detection
>
> parent is the interrupt parent, not the parent of node. Use
> node->parent. This fixes endianness detection on big-endian platforms.
>
> Fixes: 1b00adce8afd ("irqchip/ls-extirq: Fix invalid wait context by avoiding to use regmap")
> Signed-off-by: Sean Anderson <sean.anderson(a)seco.com>
> Signed-off-by: Marc Zyngier <maz(a)kernel.org>
> Link: https://lore.kernel.org/r/20221201212807.616191-1-sean.anderson@seco.com
> ---
> drivers/irqchip/irq-ls-extirq.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/irqchip/irq-ls-extirq.c b/drivers/irqchip/irq-ls-extirq.c
> index d8d48b1..139f26b 100644
> --- a/drivers/irqchip/irq-ls-extirq.c
> +++ b/drivers/irqchip/irq-ls-extirq.c
> @@ -203,7 +203,7 @@ ls_extirq_of_init(struct device_node *node, struct device_node *parent)
> if (ret)
> goto err_parse_map;
>
> - priv->big_endian = of_device_is_big_endian(parent);
> + priv->big_endian = of_device_is_big_endian(node->parent);
> priv->is_ls1021a_or_ls1043a = of_device_is_compatible(node, "fsl,ls1021a-extirq") ||
> of_device_is_compatible(node, "fsl,ls1043a-extirq");
> raw_spin_lock_init(&priv->lock);
This patch has made it into linux/master, but it should also get
backported to 6.1. Just want to make sure this doesn't fall through the
cracks, since this was a really annoying bug to deal with (causes an IRQ
storm).
--Sean
Hi stable team,
I would like to request for cherry picking to the linux-6.1.y branch:
19098934f910 ("PCI: mt7621: Add sentinel to quirks table")
a2cab953b4c0 ("mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem")
b4767d4c0725 ("mips: ralink: mt7621: soc queries and tests as functions")
7c18b64bba3b ("mips: ralink: mt7621: do not use kzalloc too early")
On the mips mt7621 SoC, a kzalloc is used too early and returns before reaching a soc_device_register.
soc_device_attribute->revision is used to identify MT7621 ver:1 eco:1 devices for a pci & phy-pci quirk.
A SLUB change in kernel 6.1 caused the device to fail to boot, rather than silently continue.
In fixing this, it was then seen that the pci & phy-pci drivers would oops,
as they were missing a sentinel in their soc_device_match quirks table.
The phy-pci fix has already been applied to stable.
The pci & early kzalloc fixes missed the 6.1rc window and are being taken for 6.2
In a quick web search I cannot find any reference to bootlogs for "ver:1 eco:1"
(which would use the quirk for PCI), so cannot see a current need to backport this
further than fixing the 6.1 boot error.
Link: https://lore.kernel.org/linux-mm/becf2ac3-2a90-4f3a-96d9-a70f67c66e4a@app.f…
Link: https://lore.kernel.org/lkml/20221205204645.301301-1-git@johnthomson.fastma…
Link: https://lore.kernel.org/lkml/20221114015658.2873120-1-git@johnthomson.fastm…
cc'ed the maintainer, Sergio.
Thank you,
Cheers,
--
John Thomson
I'm announcing the release of the 6.0.14 kernel.
All users of the 6.0 kernel series must upgrade.
The updated 6.0.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.0.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
arch/x86/entry/vdso/vdso.lds.S | 2 +
drivers/net/can/usb/mcba_usb.c | 10 ++++++--
drivers/net/ethernet/freescale/fec_main.c | 23 ++++++-------------
drivers/nvme/host/pci.c | 2 +
drivers/pinctrl/mediatek/mtk-eint.c | 9 +++++--
drivers/rtc/rtc-cmos.c | 35 ++++++++++++++++++++++--------
include/linux/can/platform/sja1000.h | 2 -
kernel/events/core.c | 17 +++++++++++---
sound/soc/codecs/cs42l51.c | 2 -
sound/soc/fsl/fsl_micfil.c | 19 ++++++++++++++++
sound/soc/soc-ops.c | 9 ++++++-
tools/lib/bpf/btf_dump.c | 2 -
tools/lib/bpf/libbpf_probes.c | 2 -
14 files changed, 94 insertions(+), 42 deletions(-)
Alexandre Belloni (1):
rtc: cmos: fix build on non-ACPI platforms
Charles Keepax (2):
ASoC: cs42l51: Correct PGA Volume minimum value
ASoC: ops: Correct bounds check for second channel on SX controls
David Michael (1):
libbpf: Fix uninitialized warning in btf_dump_dump_type_data
Greg Kroah-Hartman (1):
Linux 6.0.14
Heiko Schocher (1):
can: sja1000: fix size of OCR_MODE_MASK define
Hou Tao (1):
libbpf: Use page size as max_entries when probing ring buffer map
Lei Rao (1):
nvme-pci: clear the prp2 field when not used
Mark Brown (1):
ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
Nathan Chancellor (1):
x86/vdso: Conditionally export __vdso_sgx_enter_enclave()
Peter Zijlstra (1):
perf: Fix perf_pending_task() UaF
Rafael J. Wysocki (2):
rtc: cmos: Fix event handler registration ordering issue
rtc: cmos: Fix wake alarm breakage
Rasmus Villemoes (2):
net: fec: don't reset irq coalesce settings to defaults on "ip link up"
net: fec: properly guard irq coalesce setup
Ricardo Ribalda (1):
pinctrl: meditatek: Startup with the IRQs disabled
Shengjiu Wang (2):
ASoC: fsl_micfil: explicitly clear software reset bit
ASoC: fsl_micfil: explicitly clear CHnF flags
Yasushi SHOJI (1):
can: mcba_usb: Fix termination command argument
I'm announcing the release of the 5.10.160 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/x86/kernel/cpu/mtrr/mtrr.c | 2
arch/x86/kernel/smpboot.c | 1
drivers/net/can/usb/mcba_usb.c | 10 +
drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c | 3
drivers/nvme/host/pci.c | 2
drivers/pinctrl/mediatek/mtk-eint.c | 9 +
fs/fuse/dir.c | 2
fs/io_uring.c | 2
fs/nfsd/vfs.c | 8 +
fs/read_write.c | 90 +++++++++------
include/linux/can/platform/sja1000.h | 2
include/linux/fs.h | 8 +
sound/soc/codecs/cs42l51.c | 2
sound/soc/fsl/fsl_micfil.c | 19 +++
sound/soc/soc-ops.c | 9 +
tools/lib/bpf/libbpf_probes.c | 2
17 files changed, 121 insertions(+), 52 deletions(-)
Amir Goldstein (2):
vfs: fix copy_file_range() regression in cross-fs copies
vfs: fix copy_file_range() averts filesystem freeze protection
Bing-Jhong Billy Jheng (1):
io_uring: add missing item types for splice request
Charles Keepax (2):
ASoC: cs42l51: Correct PGA Volume minimum value
ASoC: ops: Correct bounds check for second channel on SX controls
Greg Kroah-Hartman (1):
Linux 5.10.160
Heiko Schocher (1):
can: sja1000: fix size of OCR_MODE_MASK define
Hou Tao (1):
libbpf: Use page size as max_entries when probing ring buffer map
Jialiang Wang (1):
nfp: fix use-after-free in area_cache_get()
Lei Rao (1):
nvme-pci: clear the prp2 field when not used
Mark Brown (1):
ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
Miklos Szeredi (1):
fuse: always revalidate if exclusive create
Paul E. McKenney (1):
x86/smpboot: Move rcu_cpu_starting() earlier
Ricardo Ribalda (1):
pinctrl: meditatek: Startup with the IRQs disabled
Shengjiu Wang (2):
ASoC: fsl_micfil: explicitly clear software reset bit
ASoC: fsl_micfil: explicitly clear CHnF flags
Yasushi SHOJI (1):
can: mcba_usb: Fix termination command argument
I'm announcing the release of the 5.4.228 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
arch/x86/kernel/cpu/mtrr/mtrr.c | 2 -
arch/x86/kernel/smpboot.c | 1
block/partition-generic.c | 7 +++
drivers/net/can/usb/mcba_usb.c | 10 +++--
drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c | 3 +
drivers/pinctrl/mediatek/mtk-eint.c | 9 +++-
include/linux/can/platform/sja1000.h | 2 -
include/linux/hugetlb.h | 6 +--
mm/gup.c | 13 ++++++
mm/hugetlb.c | 30 +++++++--------
net/core/filter.c | 2 +
sound/soc/soc-ops.c | 9 ++++
13 files changed, 65 insertions(+), 31 deletions(-)
Baolin Wang (1):
mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
Charles Keepax (1):
ASoC: ops: Correct bounds check for second channel on SX controls
Greg Kroah-Hartman (1):
Linux 5.4.228
Heiko Schocher (1):
can: sja1000: fix size of OCR_MODE_MASK define
Jialiang Wang (1):
nfp: fix use-after-free in area_cache_get()
Lorenzo Colitti (1):
net: bpf: Allow TC programs to call BPF_FUNC_skb_change_head
Mark Brown (1):
ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
Ming Lei (1):
block: unhash blkdev part inode when the part is deleted
Paul E. McKenney (1):
x86/smpboot: Move rcu_cpu_starting() earlier
Ricardo Ribalda (1):
pinctrl: meditatek: Startup with the IRQs disabled
Yasushi SHOJI (1):
can: mcba_usb: Fix termination command argument