May 2022 - Linux-stable-mirror

by Greg Kroah-Hartman

I'm announcing the release of the 5.17.5 kernel. All users of the 5.17 kernel series must upgrade. The updated 5.17.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.17.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/filesystems/ext4/attributes.rst | 2 Makefile | 2 arch/arc/kernel/entry.S | 1 arch/arm/mach-vexpress/spc.c | 2 arch/arm/xen/enlighten.c | 9 - arch/arm64/boot/dts/freescale/imx8mm-var-som.dtsi | 8 - arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi | 8 - arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 arch/arm64/include/asm/pgtable.h | 4 arch/powerpc/kernel/time.c | 29 +--- arch/powerpc/kvm/book3s_64_vio.c | 45 +++--- arch/powerpc/kvm/book3s_64_vio_hv.c | 44 +++--- arch/powerpc/perf/power10-pmu.c | 2 arch/powerpc/perf/power9-pmu.c | 8 - arch/riscv/kvm/vcpu.c | 21 +- arch/x86/include/asm/compat.h | 6 arch/x86/include/asm/kvm_host.h | 4 arch/x86/kvm/hyperv.c | 40 +---- arch/x86/kvm/hyperv.h | 2 arch/x86/kvm/pmu.h | 9 + arch/x86/kvm/svm/pmu.c | 1 arch/x86/kvm/svm/sev.c | 61 +++----- arch/x86/kvm/vmx/nested.c | 5 arch/x86/kvm/vmx/pmu_intel.c | 8 - arch/x86/kvm/vmx/vmx.c | 5 arch/x86/kvm/vmx/vmx.h | 1 arch/x86/kvm/x86.c | 29 ++-- arch/xtensa/kernel/coprocessor.S | 4 arch/xtensa/kernel/jump_label.c | 2 block/ioctl.c | 2 drivers/ata/pata_marvell.c | 2 drivers/dma/at_xdmac.c | 12 - drivers/dma/dw-edma/dw-edma-v0-core.c | 7 drivers/dma/idxd/device.c | 6 drivers/dma/idxd/submit.c | 5 drivers/dma/idxd/sysfs.c | 6 drivers/dma/imx-sdma.c | 32 ++-- drivers/dma/mediatek/mtk-uart-apdma.c | 9 - drivers/edac/synopsys_edac.c | 16 +- drivers/firmware/cirrus/cs_dsp.c | 3 drivers/gpio/gpiolib.c | 4 drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c | 4 drivers/gpu/drm/i915/display/intel_psr.c | 38 ++--- drivers/gpu/drm/msm/adreno/adreno_device.c | 17 -- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 2 drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c | 13 + drivers/gpu/drm/radeon/radeon_sync.c | 2 drivers/gpu/drm/vc4/vc4_dsi.c | 2 drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 43 ++---- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 8 - drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 7 drivers/input/keyboard/omap4-keypad.c | 2 drivers/net/ethernet/Kconfig | 26 +-- drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 8 - drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 8 - drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 24 +-- drivers/net/ethernet/cadence/macb_main.c | 8 + drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 8 - drivers/net/ethernet/intel/e1000e/ich8lan.c | 4 drivers/net/ethernet/intel/ice/ice_eswitch.c | 3 drivers/net/ethernet/intel/ice/ice_eswitch.h | 2 drivers/net/ethernet/intel/ice/ice_nvm.c | 1 drivers/net/ethernet/intel/igc/igc_i225.c | 11 + drivers/net/ethernet/intel/igc/igc_phy.c | 4 drivers/net/ethernet/intel/igc/igc_ptp.c | 15 +- drivers/net/ethernet/mscc/ocelot.c | 2 drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 4 drivers/net/vxlan.c | 4 drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 drivers/net/wireless/mediatek/mt76/mt76x2/pci.c | 2 drivers/nvme/host/core.c | 24 ++- drivers/nvme/host/nvme.h | 5 drivers/nvme/host/pci.c | 9 + drivers/perf/arm_pmu.c | 10 - drivers/platform/x86/samsung-laptop.c | 2 drivers/reset/reset-rzg2l-usbphy-ctrl.c | 4 drivers/reset/tegra/reset-bpmp.c | 9 + drivers/scsi/bnx2i/bnx2i_hwi.c | 2 drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 drivers/scsi/cxgbi/libcxgbi.c | 6 drivers/scsi/libiscsi.c | 27 ++- drivers/scsi/libiscsi_tcp.c | 2 drivers/scsi/qedi/qedi_iscsi.c | 69 ++++----- drivers/scsi/scsi_transport_iscsi.c | 71 ++++------ drivers/scsi/sr_ioctl.c | 15 +- drivers/scsi/ufs/ufshcd.c | 5 drivers/spi/atmel-quadspi.c | 3 drivers/spi/spi-cadence-quadspi.c | 19 ++ drivers/spi/spi-mtk-nor.c | 12 + fs/cifs/cifsfs.c | 2 fs/cifs/connect.c | 11 + fs/cifs/dfs_cache.c | 19 +- fs/ext4/ext4.h | 7 fs/ext4/extents.c | 32 +++- fs/ext4/inode.c | 18 ++ fs/ext4/ioctl.c | 16 ++ fs/ext4/namei.c | 4 fs/ext4/page-io.c | 4 fs/ext4/super.c | 21 ++ fs/gfs2/rgrp.c | 9 - fs/hugetlbfs/inode.c | 9 - fs/io_uring.c | 11 - fs/jbd2/commit.c | 4 fs/namei.c | 22 +-- fs/posix_acl.c | 10 + fs/stat.c | 19 +- fs/xattr.c | 6 include/linux/etherdevice.h | 5 include/linux/memcontrol.h | 5 include/linux/posix_acl_xattr.h | 4 include/linux/sched.h | 1 include/linux/sched/mm.h | 8 + include/net/esp.h | 2 include/net/netns/ipv6.h | 4 include/scsi/libiscsi.h | 9 - include/scsi/scsi_transport_iscsi.h | 2 kernel/events/core.c | 2 kernel/events/internal.h | 5 kernel/events/ring_buffer.c | 5 kernel/irq_work.c | 2 kernel/sched/fair.c | 10 - lib/xarray.c | 2 mm/memcontrol.c | 12 + mm/memory-failure.c | 13 + mm/mmap.c | 8 - mm/mmu_notifier.c | 14 + mm/oom_kill.c | 54 +++++-- mm/userfaultfd.c | 15 +- mm/workingset.c | 2 net/can/isotp.c | 10 + net/dsa/tag_hellcreek.c | 8 + net/ipv4/esp4.c | 5 net/ipv6/esp6.c | 5 net/ipv6/ip6_gre.c | 14 + net/ipv6/route.c | 11 - net/l3mdev/l3mdev.c | 2 net/netlink/af_netlink.c | 7 net/openvswitch/flow_netlink.c | 2 net/packet/af_packet.c | 13 + net/rxrpc/net_ns.c | 2 net/sched/cls_u32.c | 24 +-- net/smc/af_smc.c | 4 sound/hda/intel-dsp-config.c | 18 ++ sound/pci/hda/patch_hdmi.c | 6 sound/pci/hda/patch_realtek.c | 1 sound/soc/atmel/sam9g20_wm8731.c | 61 -------- sound/soc/codecs/msm8916-wcd-digital.c | 9 + sound/soc/codecs/rk817_codec.c | 2 sound/soc/codecs/rt5682.c | 11 - sound/soc/codecs/rt5682s.c | 11 - sound/soc/codecs/wcd934x.c | 26 --- sound/soc/soc-dapm.c | 6 sound/soc/soc-topology.c | 4 sound/soc/sof/topology.c | 43 ++++++ sound/usb/midi.c | 1 sound/usb/mixer_maps.c | 4 sound/usb/usbaudio.h | 2 tools/lib/perf/evlist.c | 3 tools/perf/builtin-report.c | 14 + tools/perf/builtin-script.c | 2 tools/testing/selftests/drivers/net/mlxsw/spectrum-2/vxlan_flooding_ipv6.sh | 17 ++ tools/testing/selftests/drivers/net/mlxsw/vxlan_flooding.sh | 17 ++ tools/testing/selftests/kvm/aarch64/arch_timer.c | 15 +- 166 files changed, 1109 insertions(+), 724 deletions(-) Adrian Hunter (1): perf tools: Fix segfault accessing sample_id xyarray Alex Elder (1): arm64: dts: qcom: add IPA qcom,qmp property Alexey Kardashevskiy (1): KVM: PPC: Fix TCE handling for VFIO Alistair Popple (1): mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() Allen-KH Cheng (1): spi: spi-mtk-nor: initialize spi controller after resume Athira Rajeev (2): powerpc/perf: Fix power9 event alternatives powerpc/perf: Fix power10 event alternatives Atish Patra (2): RISC-V: KVM: Remove 's' & 'u' as valid ISA extension RISC-V: KVM: Restrict the extensions that can be disabled Bob Peterson (1): gfs2: assign rgrp glock before compute_bitstructs Borislav Petkov (3): ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant mt76: Fix undefined behavior due to shift overflowing the constant brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant Christian Brauner (1): fs: fix acl translation Christian König (1): drm/radeon: fix logic inversion in radeon_sync_resv Christoph Hellwig (3): nvme: add a quirk to disable namespace identifiers nvme-pci: disable namespace identifiers for the MAXIO MAP1002/1202 nvme-pci: disable namespace identifiers for Qemu controllers Christophe Leroy (1): mm, hugetlb: allow for "high" userspace addresses Darrick J. Wong (1): ext4: fix fallocate to use file_modified to update permissions consistently Dave Jiang (6): dmaengine: idxd: fix device cleanup on disable dmaengine: idxd: match type for retries var in idxd_enqcmds() dmaengine: idxd: fix retry value to be constant for duration of function call dmaengine: idxd: add RO check for wq max_batch_size write dmaengine: idxd: add RO check for wq max_transfer_size write dmaengine: idxd: skip clearing device context when device is read-only Dave Stevenson (2): drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare David Ahern (1): l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu David Howells (2): rxrpc: Restore removed timer deletion cifs: Check the IOCB_DIRECT flag, not O_DIRECT Eric Dumazet (4): net/sched: cls_u32: fix netns refcount changes in u32_change() net/sched: cls_u32: fix possible leak in u32_init_knode() ipv6: make ip6_rt_gc_expire an atomic_t netlink: reset network and mac headers in netlink_dump() Greg Kroah-Hartman (1): Linux 5.17.5 Guo Ren (1): xtensa: patch_text: Fixup last cpu should be master Hangbin Liu (1): net/packet: fix packet_sock xmit return value checking Heiner Kallweit (1): reset: renesas: Check return value of reset_control_deassert() Herve Codina (1): dmaengine: dw-edma: Fix unaligned 64bit access Hongbin Wang (1): vxlan: fix error return code in vxlan_fdb_append Ido Schimmel (2): selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets selftests: mlxsw: vxlan_flooding_ipv6: Prevent flooding of unwanted packets Jens Axboe (1): io_uring: free iovec if file assignment fails Jianglei Nie (1): ice: Fix memory leak in ice_get_orom_civd_data() Jiapeng Chong (1): platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative José Roberto de Souza (1): drm/i915/display/psr: Unset enable_psr2_sel_fetch if other checks in intel_psr2_config_valid() fails Kai Vehmanen (1): ALSA: hda/hdmi: fix warning about PCM count when used with SOF Kai-Heng Feng (1): net: atlantic: Avoid out-of-bounds indexing Kees Cook (2): etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead ARM: vexpress/spc: Avoid negative array index when !SMP Kevin Groeneveld (1): dmaengine: imx-sdma: fix init of uart scripts Kevin Hao (1): net: stmmac: Use readl_poll_timeout_atomic() in atomic state Khazhismel Kumykov (1): block/compat_ioctl: fix range check in BLKGETSIZE Kurt Kanzenbach (1): net: dsa: hellcreek: Calculate checksums in tagger Leo Yan (2): perf script: Always allow field 'data_src' for auxtrace perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event Like Xu (1): KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog Lv Ruyi (1): dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info() Maciej Fijalkowski (1): ice: allow creating VFs for !CONFIG_NET_SWITCHDEV Manuel Ullmann (1): net: atlantic: invert deep par in pm functions, preventing null derefs Mario Limonciello (1): gpio: Request interrupts after IRQ is initialized Mark Brown (1): ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek Matthew Wilcox (Oracle) (1): XArray: Disallow sibling entries of nodes Matthias Schiffer (1): spi: cadence-quadspi: fix incorrect supports_op() return value Maurizio Avogadro (1): ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. Max Filippov (1): xtensa: fix a7 clobbering in coprocessor context load/store Miaoqian Lin (6): ASoC: rk817: Use devm_clk_get() in rk817_platform_probe ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component dmaengine: imx-sdma: Fix error checking in sdma_event_remap Input: omap4-keypad - fix pm_runtime_get_sync() error checking drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage arm/xen: Fix some refcount leaks Michael Ellerman (1): powerpc/time: Always set decrementer in timer_interrupt() Mike Christie (4): scsi: iscsi: Release endpoint ID when its freed scsi: iscsi: Merge suspend fields scsi: iscsi: Fix NOP handling during conn recovery scsi: qedi: Fix failed disconnect handling Mikulas Patocka (1): stat: fix inconsistency between struct stat and struct compat_stat Mingwei Zhang (1): KVM: SVM: Flush when freeing encrypted pages even on SME_COHERENT CPUs Muchun Song (1): arm64: mm: fix p?d_leaf() Nadav Amit (1): userfaultfd: mark uffd_wp regardless of VM_WRITE flag NeilBrown (1): VFS: filename_create(): fix incorrect intent. Nicholas Kazlauskas (1): drm/amd/display: Only set PSR version when valid Nico Pache (1): oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup Oliver Hartkopp (1): can: isotp: stop timeout monitoring when no first frame was sent Oliver Upton (1): selftests: KVM: Free the GIC FD when cleaning up in arch_timer Paolo Valerio (1): openvswitch: fix OOB access in reserve_sfa_size() Paulo Alcantara (2): cifs: fix NULL ptr dereference in refresh_mounts() cifs: use correct lock type in cifs_reconnect() Pavel Begunkov (1): io_uring: fix leaks on IOPOLL and CQE_SKIP Peilin Ye (2): ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() ip6_gre: Fix skb_under_panic in __gre6_xmit() Peter Ujfalusi (1): ASoC: topology: Correct error handling in soc_tplg_dapm_widget_create() Peter Wang (1): scsi: ufs: core: scsi_get_lba() error fix Pierre-Louis Bossart (2): ALSA: hda: intel-dsp-config: update AlderLake PCI IDs ASoC: SOF: topology: cleanup dailinks on widget unload Richard Fitzgerald (1): firmware: cs_dsp: Fix overrun of unterminated control name string Rob Clark (2): drm/msm/gpu: Rename runtime suspend/resume functions drm/msm/gpu: Remove mutex from wait_event condition Rob Herring (2): arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes arm_pmu: Validate single/group leader events Sabrina Dubroca (1): esp: limit skb_page_frag_refill use to a single page Sameer Pujar (1): reset: tegra-bpmp: Restore Handle errors in BPMP response Sasha Neftin (3): igc: Fix infinite loop in release_swfw_sync igc: Fix BUG: scheduling while atomic e1000e: Fix possible overflow in LTR decoding Sean Christopherson (4): KVM: x86: Don't re-acquire SRCU lock in complete_emulated_io() KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race KVM: nVMX: Defer APICv updates while L2 is active until L1 is active KVM: SVM: Simplify and harden helper to flush SEV guest page(s) Sergey Matyukevich (1): ARC: entry: fix syscall_trace_exit argument Shakeel Butt (1): memcg: sync flush only if periodic flush is delayed Shubhrajyoti Datta (1): EDAC/synopsys: Read the error count from the correct register Srinivas Kandagatla (1): ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use Stephen Hemminger (1): net: restore alpha order to Ethernet devices in config Tadeusz Struk (1): ext4: limit length to bitmap_maxbytes - blocksize in punch_hole Takashi Iwai (1): ALSA: usb-audio: Clear MIDI port active flag after draining Theodore Ts'o (3): ext4: fix overhead calculation to account for the reserved gdt blocks ext4: force overhead calculation if the s_overhead_cluster makes no sense ext4: update the cached overhead value in the superblock Tim Crawford (1): ALSA: hda/realtek: Add quirk for Clevo NP70PNP Tom Rix (1): scsi: sr: Do not leak information in ioctl Tomas Melin (1): net: macb: Restart tx only if queue pointer is lagging Tony Lu (1): net/smc: Fix sock leak when release after smc_shutdown() Tudor Ambarus (1): spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller Vinicius Costa Gomes (1): igc: Fix suspending when PTM is active Vitaly Kuznetsov (1): KVM: x86: hyper-v: Avoid writing to TSC page without an active vCPU Vladimir Oltean (1): net: mscc: ocelot: fix broken IP multicast flooding Wojciech Drewek (1): ice: fix crash in switchdev mode Xiaoke Wang (2): drm/msm/disp: check the return value of kzalloc() drm/msm/mdp5: check the return of kzalloc() Xiaomeng Tong (4): dma: at_xdmac: fix a missing check on list iterator ASoC: rt5682: fix an incorrect NULL check on list iterator ASoC: soc-dapm: fix two incorrect uses of list iterator codecs: rt5682s: fix an incorrect NULL check on list iterator Xu Yu (1): mm/memory-failure.c: skip huge_zero_page in memory_failure() Ye Bin (3): ext4: fix symlink file size not match to file content ext4: fix use-after-free in ext4_search_dir jbd2: fix a potential race while discarding reserved buffers after an abort Zack Rusin (1): drm/vmwgfx: Fix gem refcounting and memory evictions Zheyu Ma (1): ata: pata_marvell: Check the 'bmdma_addr' beforing reading Zhipeng Xie (1): perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled Zqiang (1): irq_work: use kasan_record_aux_stack_noalloc() record callstack kuyo chang (1): sched/pelt: Fix attach_entity_load_avg() corner case wangjianjian (C) (1): ext4, doc: fix incorrect h_reserved size zhangqilong (1): dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resources

3 years, 7 months

5
15
0 0

[PATCH v9 2/4] fs: Add missing umask strip in vfs_tmpfile

by Yang Xu

All creation paths except for O_TMPFILE handle umask in the vfs directly if the filesystem doesn't support or enable POSIX ACLs. If the filesystem does then umask handling is deferred until posix_acl_create(). Because, O_TMPFILE misses umask handling in the vfs it will not honor umask settings. Fix this by adding the missing umask handling. Fixes: 60545d0d4610 ("[O_TMPFILE] it's still short a few helpers, but infrastructure should be OK now...") Cc: <stable(a)vger.kernel.org> # 4.19+ Reported-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Acked-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-and-Tested-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Yang Xu <xuyang2018.jy(a)fujitsu.com> --- fs/namei.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/namei.c b/fs/namei.c index 509657fdf4f5..73646e28fae0 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -3521,6 +3521,8 @@ struct dentry *vfs_tmpfile(struct user_namespace *mnt_userns, child = d_alloc(dentry, &slash_name); if (unlikely(!child)) goto out_err; + if (!IS_POSIXACL(dir)) + mode &= ~current_umask(); error = dir->i_op->tmpfile(mnt_userns, dir, child, mode); if (error) goto out_err; -- 2.27.0

3 years, 7 months

1
0
0 0

[PATCH v2] x86/sgx: Set active memcg prior to shmem allocation

by Kristen Carlson Accardi

When the system runs out of enclave memory, SGX can reclaim EPC pages by swapping to normal RAM. These backing pages are allocated via a per-enclave shared memory area. Since SGX allows unlimited over commit on EPC memory, the reclaimer thread can allocate a large number of backing RAM pages in response to EPC memory pressure. When the shared memory backing RAM allocation occurs during the reclaimer thread context, the shared memory is charged to the root memory control group, and the shmem usage of the enclave is not properly accounted for, making cgroups ineffective at limiting the amount of RAM an enclave can consume. For example, when using a cgroup to launch a set of test enclaves, the kernel does not properly account for 50% - 75% of shmem page allocations on average. In the worst case, when nearly all allocations occur during the reclaimer thread, the kernel accounts less than a percent of the amount of shmem used by the enclave's cgroup to the correct cgroup. SGX stores a list of mm_structs that are associated with an enclave. Pick one of them during reclaim and charge that mm's memcg with the shmem allocation. The one that gets picked is arbitrary, but this list almost always only has one mm. The cases where there is more than one mm with different memcg's are not worth considering. Create a new function - sgx_encl_alloc_backing(). This function is used whenever a new backing storage page needs to be allocated. Previously the same function was used for page allocation as well as retrieving a previously allocated page. Prior to backing page allocation, if there is a mm_struct associated with the enclave that is requesting the allocation, it is set as the active memory control group. Signed-off-by: Kristen Carlson Accardi <kristen(a)linux.intel.com> --- V1 -> V2: Changed sgx_encl_set_active_memcg() to simply return the correct memcg for the enclave and renamed to sgx_encl_get_mem_cgroup(). Created helper function current_is_ksgxd() to improve readability. Use mmget_not_zero()/mmput_async() when searching mm_list. Move call to set_active_memcg() to sgx_encl_alloc_backing() and use mem_cgroup_put() to avoid leaking a memcg reference. Address review feedback regarding comments and commit log. arch/x86/kernel/cpu/sgx/encl.c | 109 ++++++++++++++++++++++++++++++++- arch/x86/kernel/cpu/sgx/encl.h | 11 +++- arch/x86/kernel/cpu/sgx/main.c | 4 +- 3 files changed, 118 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c index 001808e3901c..6d10202612d6 100644 --- a/arch/x86/kernel/cpu/sgx/encl.c +++ b/arch/x86/kernel/cpu/sgx/encl.c @@ -32,7 +32,7 @@ static int __sgx_encl_eldu(struct sgx_encl_page *encl_page, else page_index = PFN_DOWN(encl->size); - ret = sgx_encl_get_backing(encl, page_index, &b); + ret = sgx_encl_lookup_backing(encl, page_index, &b); if (ret) return ret; @@ -574,7 +574,7 @@ static struct page *sgx_encl_get_backing_page(struct sgx_encl *encl, * 0 on success, * -errno otherwise. */ -int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index, +static int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index, struct sgx_backing *backing) { pgoff_t pcmd_index = PFN_DOWN(encl->size) + 1 + (page_index >> 5); @@ -601,6 +601,111 @@ int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index, return 0; } +/* + * When called from ksgxd, returns the mem_cgroup of a struct mm stored + * in the enclave's mm_list. When not called from ksgxd, just returns + * the mem_cgroup of the current task. + */ +static struct mem_cgroup *sgx_encl_get_mem_cgroup(struct sgx_encl *encl) +{ + struct mem_cgroup *memcg = NULL; + struct sgx_encl_mm *encl_mm; + int idx; + + /* + * If called from normal task context, return the mem_cgroup + * of the current task's mm. The remainder of the handling is for + * ksgxd. + */ + if (!current_is_ksgxd()) + return get_mem_cgroup_from_mm(current->mm); + + /* + * Search the enclave's mm_list to find an mm associated with + * this enclave to charge the allocation to. + */ + idx = srcu_read_lock(&encl->srcu); + + list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) { + if (!mmget_not_zero(encl_mm->mm)) + continue; + + memcg = get_mem_cgroup_from_mm(encl_mm->mm); + + mmput_async(encl_mm->mm); + + break; + } + + srcu_read_unlock(&encl->srcu, idx); + + /* + * In the rare case that there isn't an mm associated with + * the enclave, set memcg to the current active mem_cgroup. + * This will be the root mem_cgroup if there is no active + * mem_cgroup. + */ + if (!memcg) + return get_mem_cgroup_from_mm(NULL); + + return memcg; +} + +/** + * sgx_encl_alloc_backing() - allocate a new backing storage page + * @encl: an enclave pointer + * @page_index: enclave page index + * @backing: data for accessing backing storage for the page + * + * When called from ksgxd, sets the active memcg from one of the + * mms in the enclave's mm_list prior to any backing page allocation, + * in order to ensure that shmem page allocations are charged to the + * enclave. + * + * Return: + * 0 on success, + * -errno otherwise. + */ +int sgx_encl_alloc_backing(struct sgx_encl *encl, unsigned long page_index, + struct sgx_backing *backing) +{ + struct mem_cgroup *memcg, *old_memcg; + int ret; + + memcg = sgx_encl_get_mem_cgroup(encl); + + old_memcg = set_active_memcg(memcg); + + ret = sgx_encl_get_backing(encl, page_index, backing); + + set_active_memcg(old_memcg); + + mem_cgroup_put(memcg); + + return ret; +} + +/** + * sgx_encl_lookup_backing() - retrieve an existing backing storage page + * @encl: an enclave pointer + * @page_index: enclave page index + * @backing: data for accessing backing storage for the page + * + * Retrieve a backing page for loading data back into an EPC page with ELDU. + * It is the caller's responsibility to ensure that it is appropriate to use + * sgx_encl_lookup_backing() rather than sgx_encl_alloc_backing(). If lookup is + * not used correctly, this will cause an allocation which is not accounted for. + * + * Return: + * 0 on success, + * -errno otherwise. + */ +int sgx_encl_lookup_backing(struct sgx_encl *encl, unsigned long page_index, + struct sgx_backing *backing) +{ + return sgx_encl_get_backing(encl, page_index, backing); +} + /** * sgx_encl_put_backing() - Unpin the backing storage * @backing: data for accessing backing storage for the page diff --git a/arch/x86/kernel/cpu/sgx/encl.h b/arch/x86/kernel/cpu/sgx/encl.h index fec43ca65065..2de3b150ab00 100644 --- a/arch/x86/kernel/cpu/sgx/encl.h +++ b/arch/x86/kernel/cpu/sgx/encl.h @@ -100,13 +100,20 @@ static inline int sgx_encl_find(struct mm_struct *mm, unsigned long addr, return 0; } +static inline bool current_is_ksgxd(void) +{ + return current->mm ? false : true; +} + int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start, unsigned long end, unsigned long vm_flags); void sgx_encl_release(struct kref *ref); int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm); -int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index, - struct sgx_backing *backing); +int sgx_encl_lookup_backing(struct sgx_encl *encl, unsigned long page_index, + struct sgx_backing *backing); +int sgx_encl_alloc_backing(struct sgx_encl *encl, unsigned long page_index, + struct sgx_backing *backing); void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write); int sgx_encl_test_and_clear_young(struct mm_struct *mm, struct sgx_encl_page *page); diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c index 4b41efc9e367..7d41c8538795 100644 --- a/arch/x86/kernel/cpu/sgx/main.c +++ b/arch/x86/kernel/cpu/sgx/main.c @@ -310,7 +310,7 @@ static void sgx_reclaimer_write(struct sgx_epc_page *epc_page, encl->secs_child_cnt--; if (!encl->secs_child_cnt && test_bit(SGX_ENCL_INITIALIZED, &encl->flags)) { - ret = sgx_encl_get_backing(encl, PFN_DOWN(encl->size), + ret = sgx_encl_alloc_backing(encl, PFN_DOWN(encl->size), &secs_backing); if (ret) goto out; @@ -381,7 +381,7 @@ static void sgx_reclaim_pages(void) goto skip; page_index = PFN_DOWN(encl_page->desc - encl_page->encl->base); - ret = sgx_encl_get_backing(encl_page->encl, page_index, &backing[i]); + ret = sgx_encl_alloc_backing(encl_page->encl, page_index, &backing[i]); if (ret) goto skip; -- 2.20.1

3 years, 7 months

5
7
0 0

[tip: objtool/core] objtool: Fix symbol creation

by tip-bot2 for Peter Zijlstra

The following commit has been merged into the objtool/core branch of tip: Commit-ID: ead165fa1042247b033afad7be4be9b815d04ade Gitweb: https://git.kernel.org/tip/ead165fa1042247b033afad7be4be9b815d04ade Author: Peter Zijlstra <peterz(a)infradead.org> AuthorDate: Tue, 17 May 2022 17:42:04 +02:00 Committer: Borislav Petkov <bp(a)suse.de> CommitterDate: Fri, 20 May 2022 12:42:06 +02:00 objtool: Fix symbol creation Nathan reported objtool failing with the following messages: warning: objtool: no non-local symbols !? warning: objtool: gelf_update_symshndx: invalid section index The problem is due to commit 4abff6d48dbc ("objtool: Fix code relocs vs weak symbols") failing to consider the case where an object would have no non-local symbols. The problem that commit tries to address is adding a STB_LOCAL symbol to the symbol table in light of the ELF spec's requirement that: In each symbol table, all symbols with STB_LOCAL binding preced the weak and global symbols. As ``Sections'' above describes, a symbol table section's sh_info section header member holds the symbol table index for the first non-local symbol. The approach taken is to find this first non-local symbol, move that to the end and then re-use the freed spot to insert a new local symbol and increment sh_info. Except it never considered the case of object files without global symbols and got a whole bunch of details wrong -- so many in fact that it is a wonder it ever worked :/ Specifically: - It failed to re-hash the symbol on the new index, so a subsequent find_symbol_by_index() would not find it at the new location and a query for the old location would now return a non-deterministic choice between the old and new symbol. - It failed to appreciate that the GElf wrappers are not a valid disk format (it works because GElf is basically Elf64 and we only support x86_64 atm.) - It failed to fully appreciate how horrible the libelf API really is and got the gelf_update_symshndx() call pretty much completely wrong; with the direct consequence that if inserting a second STB_LOCAL symbol would require moving the same STB_GLOBAL symbol again it would completely come unstuck. Write a new elf_update_symbol() function that wraps all the magic required to update or create a new symbol at a given index. Specifically, gelf_update_sym*() require an @ndx argument that is relative to the @data argument; this means you have to manually iterate the section data descriptor list and update @ndx. Fixes: 4abff6d48dbc ("objtool: Fix code relocs vs weak symbols") Reported-by: Nathan Chancellor <nathan(a)kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Borislav Petkov <bp(a)suse.de> Acked-by: Josh Poimboeuf <jpoimboe(a)kernel.org> Tested-by: Nathan Chancellor <nathan(a)kernel.org> Cc: <stable(a)vger.kernel.org> Link: https://lkml.kernel.org/r/YoPCTEYjoPqE4ZxB@hirez.programming.kicks-ass.net --- tools/objtool/elf.c | 198 ++++++++++++++++++++++++++++--------------- 1 file changed, 129 insertions(+), 69 deletions(-) diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c index 583a3ec..7fb6720 100644 --- a/tools/objtool/elf.c +++ b/tools/objtool/elf.c @@ -374,6 +374,9 @@ static void elf_add_symbol(struct elf *elf, struct symbol *sym) struct list_head *entry; struct rb_node *pnode; + INIT_LIST_HEAD(&sym->pv_target); + sym->alias = sym; + sym->type = GELF_ST_TYPE(sym->sym.st_info); sym->bind = GELF_ST_BIND(sym->sym.st_info); @@ -438,8 +441,6 @@ static int read_symbols(struct elf *elf) return -1; } memset(sym, 0, sizeof(*sym)); - INIT_LIST_HEAD(&sym->pv_target); - sym->alias = sym; sym->idx = i; @@ -603,24 +604,21 @@ static void elf_dirty_reloc_sym(struct elf *elf, struct symbol *sym) } /* - * Move the first global symbol, as per sh_info, into a new, higher symbol - * index. This fees up the shndx for a new local symbol. + * The libelf API is terrible; gelf_update_sym*() takes a data block relative + * index value, *NOT* the symbol index. As such, iterate the data blocks and + * adjust index until it fits. + * + * If no data block is found, allow adding a new data block provided the index + * is only one past the end. */ -static int elf_move_global_symbol(struct elf *elf, struct section *symtab, - struct section *symtab_shndx) +static int elf_update_symbol(struct elf *elf, struct section *symtab, + struct section *symtab_shndx, struct symbol *sym) { - Elf_Data *data, *shndx_data = NULL; - Elf32_Word first_non_local; - struct symbol *sym; - Elf_Scn *s; - - first_non_local = symtab->sh.sh_info; - - sym = find_symbol_by_index(elf, first_non_local); - if (!sym) { - WARN("no non-local symbols !?"); - return first_non_local; - } + Elf32_Word shndx = sym->sec ? sym->sec->idx : SHN_UNDEF; + Elf_Data *symtab_data = NULL, *shndx_data = NULL; + Elf64_Xword entsize = symtab->sh.sh_entsize; + int max_idx, idx = sym->idx; + Elf_Scn *s, *t = NULL; s = elf_getscn(elf->elf, symtab->idx); if (!s) { @@ -628,79 +626,124 @@ static int elf_move_global_symbol(struct elf *elf, struct section *symtab, return -1; } - data = elf_newdata(s); - if (!data) { - WARN_ELF("elf_newdata"); - return -1; + if (symtab_shndx) { + t = elf_getscn(elf->elf, symtab_shndx->idx); + if (!t) { + WARN_ELF("elf_getscn"); + return -1; + } } - data->d_buf = &sym->sym; - data->d_size = sizeof(sym->sym); - data->d_align = 1; - data->d_type = ELF_T_SYM; + for (;;) { + /* get next data descriptor for the relevant sections */ + symtab_data = elf_getdata(s, symtab_data); + if (t) + shndx_data = elf_getdata(t, shndx_data); - sym->idx = symtab->sh.sh_size / sizeof(sym->sym); - elf_dirty_reloc_sym(elf, sym); + /* end-of-list */ + if (!symtab_data) { + void *buf; - symtab->sh.sh_info += 1; - symtab->sh.sh_size += data->d_size; - symtab->changed = true; + if (idx) { + /* we don't do holes in symbol tables */ + WARN("index out of range"); + return -1; + } - if (symtab_shndx) { - s = elf_getscn(elf->elf, symtab_shndx->idx); - if (!s) { - WARN_ELF("elf_getscn"); + /* if @idx == 0, it's the next contiguous entry, create it */ + symtab_data = elf_newdata(s); + if (t) + shndx_data = elf_newdata(t); + + buf = calloc(1, entsize); + if (!buf) { + WARN("malloc"); + return -1; + } + + symtab_data->d_buf = buf; + symtab_data->d_size = entsize; + symtab_data->d_align = 1; + symtab_data->d_type = ELF_T_SYM; + + symtab->sh.sh_size += entsize; + symtab->changed = true; + + if (t) { + shndx_data->d_buf = &sym->sec->idx; + shndx_data->d_size = sizeof(Elf32_Word); + shndx_data->d_align = sizeof(Elf32_Word); + shndx_data->d_type = ELF_T_WORD; + + symtab_shndx->sh.sh_size += sizeof(Elf32_Word); + symtab_shndx->changed = true; + } + + break; + } + + /* empty blocks should not happen */ + if (!symtab_data->d_size) { + WARN("zero size data"); return -1; } - shndx_data = elf_newdata(s); + /* is this the right block? */ + max_idx = symtab_data->d_size / entsize; + if (idx < max_idx) + break; + + /* adjust index and try again */ + idx -= max_idx; + } + + /* something went side-ways */ + if (idx < 0) { + WARN("negative index"); + return -1; + } + + /* setup extended section index magic and write the symbol */ + if (shndx >= SHN_UNDEF && shndx < SHN_LORESERVE) { + sym->sym.st_shndx = shndx; + if (!shndx_data) + shndx = 0; + } else { + sym->sym.st_shndx = SHN_XINDEX; if (!shndx_data) { - WARN_ELF("elf_newshndx_data"); + WARN("no .symtab_shndx"); return -1; } + } - shndx_data->d_buf = &sym->sec->idx; - shndx_data->d_size = sizeof(Elf32_Word); - shndx_data->d_align = 4; - shndx_data->d_type = ELF_T_WORD; - - symtab_shndx->sh.sh_size += 4; - symtab_shndx->changed = true; + if (!gelf_update_symshndx(symtab_data, shndx_data, idx, &sym->sym, shndx)) { + WARN_ELF("gelf_update_symshndx"); + return -1; } - return first_non_local; + return 0; } static struct symbol * elf_create_section_symbol(struct elf *elf, struct section *sec) { struct section *symtab, *symtab_shndx; - Elf_Data *shndx_data = NULL; - struct symbol *sym; - Elf32_Word shndx; + Elf32_Word first_non_local, new_idx; + struct symbol *sym, *old; symtab = find_section_by_name(elf, ".symtab"); if (symtab) { symtab_shndx = find_section_by_name(elf, ".symtab_shndx"); - if (symtab_shndx) - shndx_data = symtab_shndx->data; } else { WARN("no .symtab"); return NULL; } - sym = malloc(sizeof(*sym)); + sym = calloc(1, sizeof(*sym)); if (!sym) { perror("malloc"); return NULL; } - memset(sym, 0, sizeof(*sym)); - - sym->idx = elf_move_global_symbol(elf, symtab, symtab_shndx); - if (sym->idx < 0) { - WARN("elf_move_global_symbol"); - return NULL; - } sym->name = sec->name; sym->sec = sec; @@ -710,24 +753,41 @@ elf_create_section_symbol(struct elf *elf, struct section *sec) // st_other 0 // st_value 0 // st_size 0 - shndx = sec->idx; - if (shndx >= SHN_UNDEF && shndx < SHN_LORESERVE) { - sym->sym.st_shndx = shndx; - if (!shndx_data) - shndx = 0; - } else { - sym->sym.st_shndx = SHN_XINDEX; - if (!shndx_data) { - WARN("no .symtab_shndx"); + + /* + * Move the first global symbol, as per sh_info, into a new, higher + * symbol index. This fees up a spot for a new local symbol. + */ + first_non_local = symtab->sh.sh_info; + new_idx = symtab->sh.sh_size / symtab->sh.sh_entsize; + old = find_symbol_by_index(elf, first_non_local); + if (old) { + old->idx = new_idx; + + hlist_del(&old->hash); + elf_hash_add(symbol, &old->hash, old->idx); + + elf_dirty_reloc_sym(elf, old); + + if (elf_update_symbol(elf, symtab, symtab_shndx, old)) { + WARN("elf_update_symbol move"); return NULL; } + + new_idx = first_non_local; } - if (!gelf_update_symshndx(symtab->data, shndx_data, sym->idx, &sym->sym, shndx)) { - WARN_ELF("gelf_update_symshndx"); + sym->idx = new_idx; + if (elf_update_symbol(elf, symtab, symtab_shndx, sym)) { + WARN("elf_update_symbol"); return NULL; } + /* + * Either way, we added a LOCAL symbol. + */ + symtab->sh.sh_info += 1; + elf_add_symbol(elf, sym); return sym;

3 years, 7 months

1
0
0 0

[tip: objtool/core] objtool: Fix objtool regression on x32 systems

by tip-bot2 for Mikulas Patocka

The following commit has been merged into the objtool/core branch of tip: Commit-ID: 22682a07acc308ef78681572e19502ce8893c4d4 Gitweb: https://git.kernel.org/tip/22682a07acc308ef78681572e19502ce8893c4d4 Author: Mikulas Patocka <mpatocka(a)redhat.com> AuthorDate: Mon, 16 May 2022 11:06:36 -04:00 Committer: Borislav Petkov <bp(a)suse.de> CommitterDate: Fri, 20 May 2022 12:45:30 +02:00 objtool: Fix objtool regression on x32 systems Commit c087c6e7b551 ("objtool: Fix type of reloc::addend") failed to appreciate cross building from ILP32 hosts, where 'int' == 'long' and the issue persists. As such, use s64/int64_t/Elf64_Sxword for this field and suffer the pain that is ISO C99 printf formats for it. Fixes: c087c6e7b551 ("objtool: Fix type of reloc::addend") Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> [peterz: reword changelog, s/long long/s64/] Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Borislav Petkov <bp(a)suse.de> Cc: <stable(a)vger.kernel.org> Link: https://lkml.kernel.org/r/alpine.LRH.2.02.2205161041260.11556@file01.intran… --- tools/objtool/check.c | 9 +++++---- tools/objtool/elf.c | 2 +- tools/objtool/include/objtool/elf.h | 4 ++-- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/tools/objtool/check.c b/tools/objtool/check.c index 2063f9f..190b2f6 100644 --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -5,6 +5,7 @@ #include <string.h> #include <stdlib.h> +#include <inttypes.h> #include <sys/mman.h> #include <arch/elf.h> @@ -561,12 +562,12 @@ static int add_dead_ends(struct objtool_file *file) else if (reloc->addend == reloc->sym->sec->sh.sh_size) { insn = find_last_insn(file, reloc->sym->sec); if (!insn) { - WARN("can't find unreachable insn at %s+0x%lx", + WARN("can't find unreachable insn at %s+0x%" PRIx64, reloc->sym->sec->name, reloc->addend); return -1; } } else { - WARN("can't find unreachable insn at %s+0x%lx", + WARN("can't find unreachable insn at %s+0x%" PRIx64, reloc->sym->sec->name, reloc->addend); return -1; } @@ -596,12 +597,12 @@ reachable: else if (reloc->addend == reloc->sym->sec->sh.sh_size) { insn = find_last_insn(file, reloc->sym->sec); if (!insn) { - WARN("can't find reachable insn at %s+0x%lx", + WARN("can't find reachable insn at %s+0x%" PRIx64, reloc->sym->sec->name, reloc->addend); return -1; } } else { - WARN("can't find reachable insn at %s+0x%lx", + WARN("can't find reachable insn at %s+0x%" PRIx64, reloc->sym->sec->name, reloc->addend); return -1; } diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c index 7fb6720..c25e957 100644 --- a/tools/objtool/elf.c +++ b/tools/objtool/elf.c @@ -550,7 +550,7 @@ static struct section *elf_create_reloc_section(struct elf *elf, int reltype); int elf_add_reloc(struct elf *elf, struct section *sec, unsigned long offset, - unsigned int type, struct symbol *sym, long addend) + unsigned int type, struct symbol *sym, s64 addend) { struct reloc *reloc; diff --git a/tools/objtool/include/objtool/elf.h b/tools/objtool/include/objtool/elf.h index de0cb2f..adebfbc 100644 --- a/tools/objtool/include/objtool/elf.h +++ b/tools/objtool/include/objtool/elf.h @@ -73,7 +73,7 @@ struct reloc { struct symbol *sym; unsigned long offset; unsigned int type; - long addend; + s64 addend; int idx; bool jump_table_start; }; @@ -145,7 +145,7 @@ struct elf *elf_open_read(const char *name, int flags); struct section *elf_create_section(struct elf *elf, const char *name, unsigned int sh_flags, size_t entsize, int nr); int elf_add_reloc(struct elf *elf, struct section *sec, unsigned long offset, - unsigned int type, struct symbol *sym, long addend); + unsigned int type, struct symbol *sym, s64 addend); int elf_add_reloc_to_insn(struct elf *elf, struct section *sec, unsigned long offset, unsigned int type, struct section *insn_sec, unsigned long insn_off);

3 years, 7 months

1
0
0 0

[PATCH v3] ksmbd: fix outstanding credits related bugs

by Hyunchul Lee

outstanding credits must be initialized to 0, because it means the sum of credits consumed by in-flight requests. And outstanding credits must be compared with total credits in smb2_validate_credit_charge(), because total credits are the sum of credits granted by ksmbd. This patch fix the following error, while frametest with Windows clients: Limits exceeding the maximum allowable outstanding requests, given : 128, pending : 8065 Fixes: b589f5db6d4a ("ksmbd: limits exceeding the maximum allowable outstanding requests") Cc: stable(a)vger.kernel.org Signed-off-by: Hyunchul Lee <hyc.lee(a)gmail.com> Reported-by: Yufan Chen <wiz.chen(a)gmail.com> Tested-by: Yufan Chen <wiz.chen(a)gmail.com> --- changes from v2: - fix underflow issue of outstanding credits while mutli-protocol negotiation with an Windows client changes from v1: - Add "Fixes" and stable tags fs/ksmbd/connection.c | 2 +- fs/ksmbd/smb2misc.c | 2 +- fs/ksmbd/smb_common.c | 4 +++- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/ksmbd/connection.c b/fs/ksmbd/connection.c index 7db87771884a..e8f476c5f189 100644 --- a/fs/ksmbd/connection.c +++ b/fs/ksmbd/connection.c @@ -62,7 +62,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void) atomic_set(&conn->req_running, 0); atomic_set(&conn->r_count, 0); conn->total_credits = 1; - conn->outstanding_credits = 1; + conn->outstanding_credits = 0; init_waitqueue_head(&conn->req_running_q); INIT_LIST_HEAD(&conn->conns_list); diff --git a/fs/ksmbd/smb2misc.c b/fs/ksmbd/smb2misc.c index 4a9460153b59..f8f456377a51 100644 --- a/fs/ksmbd/smb2misc.c +++ b/fs/ksmbd/smb2misc.c @@ -338,7 +338,7 @@ static int smb2_validate_credit_charge(struct ksmbd_conn *conn, ret = 1; } - if ((u64)conn->outstanding_credits + credit_charge > conn->vals->max_credits) { + if ((u64)conn->outstanding_credits + credit_charge > conn->total_credits) { ksmbd_debug(SMB, "Limits exceeding the maximum allowable outstanding requests, given : %u, pending : %u\n", credit_charge, conn->outstanding_credits); ret = 1; diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c index 9a7e211dbf4f..a336715e35e5 100644 --- a/fs/ksmbd/smb_common.c +++ b/fs/ksmbd/smb_common.c @@ -140,8 +140,10 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work) hdr = work->request_buf; if (*(__le32 *)hdr->Protocol == SMB1_PROTO_NUMBER && - hdr->Command == SMB_COM_NEGOTIATE) + hdr->Command == SMB_COM_NEGOTIATE) { + work->conn->outstanding_credits += 1; return 0; + } return -EINVAL; } -- 2.17.1

3 years, 7 months

2
1
0 0

[PATCH v3] nvmem: brcm_nvram: check for allocation failure

by Dan Carpenter

Check for if the kcalloc() fails. Cc: stable(a)vger.kernel.org Fixes: 6e977eaa8280 ("nvmem: brcm_nvram: parse NVRAM content into NVMEM cells") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Rafał Miłecki <rafal(a)milecki.pl> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> --- v3: Update fixes tag v2: I don't think anything changed in v2? Added tags? drivers/nvmem/brcm_nvram.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c index 450b927691c3..48bb8c62cbbf 100644 --- a/drivers/nvmem/brcm_nvram.c +++ b/drivers/nvmem/brcm_nvram.c @@ -97,6 +97,8 @@ static int brcm_nvram_parse(struct brcm_nvram *priv) len = le32_to_cpu(header.len); data = kcalloc(1, len, GFP_KERNEL); + if (!data) + return -ENOMEM; memcpy_fromio(data, priv->base, len); data[len - 1] = '\0'; -- 2.21.0

3 years, 7 months

2
1
0 0

[PATCH v2] nvmem: brcm_nvram: check for allocation failure

by Srinivas Kandagatla

From: Dan Carpenter <dan.carpenter(a)oracle.com> Check for if the kcalloc() fails. Cc: stable(a)vger.kernel.org Fixes: 299dc152721f ("nvmem: brcm_nvram: parse NVRAM content into NVMEM cells") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Rafał Miłecki <rafal(a)milecki.pl> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> --- Hi Greg, This is the only patch that was not applied cleanly to char-misc-testing due some fixes that are already applied on the same file. Rebased this and resending just this one. Thanks, --srini drivers/nvmem/brcm_nvram.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c index 450b927691c3..48bb8c62cbbf 100644 --- a/drivers/nvmem/brcm_nvram.c +++ b/drivers/nvmem/brcm_nvram.c @@ -97,6 +97,8 @@ static int brcm_nvram_parse(struct brcm_nvram *priv) len = le32_to_cpu(header.len); data = kcalloc(1, len, GFP_KERNEL); + if (!data) + return -ENOMEM; memcpy_fromio(data, priv->base, len); data[len - 1] = '\0'; -- 2.21.0

3 years, 7 months

3
3
0 0

[PATCH] crypto: qat - set to zero DH parameters before free

by Giovanni Cabiddu

Set to zero the context buffers containing the DH key before they are freed. This is a defense in depth measure that avoids keys to be recovered from memory in case the system is compromised between the free of the buffer and when that area of memory (containing keys) gets overwritten. Cc: stable(a)vger.kernel.org Fixes: c9839143ebbf ("crypto: qat - Add DH support") Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Reviewed-by: Adam Guerin <adam.guerin(a)intel.com> Reviewed-by: Wojciech Ziemba <wojciech.ziemba(a)intel.com> --- drivers/crypto/qat/qat_common/qat_asym_algs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c index b0b78445418b..5633f9df3b6f 100644 --- a/drivers/crypto/qat/qat_common/qat_asym_algs.c +++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c @@ -420,14 +420,17 @@ static int qat_dh_set_params(struct qat_dh_ctx *ctx, struct dh *params) static void qat_dh_clear_ctx(struct device *dev, struct qat_dh_ctx *ctx) { if (ctx->g) { + memset(ctx->g, 0, ctx->p_size); dma_free_coherent(dev, ctx->p_size, ctx->g, ctx->dma_g); ctx->g = NULL; } if (ctx->xa) { + memset(ctx->xa, 0, ctx->p_size); dma_free_coherent(dev, ctx->p_size, ctx->xa, ctx->dma_xa); ctx->xa = NULL; } if (ctx->p) { + memset(ctx->p, 0, ctx->p_size); dma_free_coherent(dev, ctx->p_size, ctx->p, ctx->dma_p); ctx->p = NULL; } -- 2.35.1

3 years, 7 months

3
3
0 0

[PATCH v2] ksmbd: fix outstanding credits related bugs

by Hyunchul Lee

outstanding credits must be initialized to 0, because it means the sum of credits consumed by in-flight requests. And outstanding credits must be compared with total credits in smb2_validate_credit_charge(), because total credits are the sum of credits granted by ksmbd. This patch fix the following error, while frametest with Windows clients: Limits exceeding the maximum allowable outstanding requests, given : 128, pending : 8065 Fixes: b589f5db6d4a ("ksmbd: limits exceeding the maximum allowable outstanding requests") Cc: stable(a)vger.kernel.org Signed-off-by: Hyunchul Lee <hyc.lee(a)gmail.com> Reported-by: Yufan Chen <wiz.chen(a)gmail.com> Tested-by: Yufan Chen <wiz.chen(a)gmail.com> --- changes from v1: - Add "Fixes" and stable tags fs/ksmbd/connection.c | 2 +- fs/ksmbd/smb2misc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/connection.c b/fs/ksmbd/connection.c index 7db87771884a..e8f476c5f189 100644 --- a/fs/ksmbd/connection.c +++ b/fs/ksmbd/connection.c @@ -62,7 +62,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void) atomic_set(&conn->req_running, 0); atomic_set(&conn->r_count, 0); conn->total_credits = 1; - conn->outstanding_credits = 1; + conn->outstanding_credits = 0; init_waitqueue_head(&conn->req_running_q); INIT_LIST_HEAD(&conn->conns_list); diff --git a/fs/ksmbd/smb2misc.c b/fs/ksmbd/smb2misc.c index 4a9460153b59..f8f456377a51 100644 --- a/fs/ksmbd/smb2misc.c +++ b/fs/ksmbd/smb2misc.c @@ -338,7 +338,7 @@ static int smb2_validate_credit_charge(struct ksmbd_conn *conn, ret = 1; } - if ((u64)conn->outstanding_credits + credit_charge > conn->vals->max_credits) { + if ((u64)conn->outstanding_credits + credit_charge > conn->total_credits) { ksmbd_debug(SMB, "Limits exceeding the maximum allowable outstanding requests, given : %u, pending : %u\n", credit_charge, conn->outstanding_credits); ret = 1; -- 2.25.1

3 years, 7 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror May 2022