May 2022 - Linux-stable-mirror

[PATCH AUTOSEL 5.17 001/135] iommu/vt-d: Add RPLS to quirk list to skip TE disabling

by Sasha Levin

From: Tejas Upadhyay <tejaskumarx.surendrakumar.upadhyay(a)intel.com> [ Upstream commit 0a967f5bfd9134b89681cae58deb222e20840e76 ] The VT-d spec requires (10.4.4 Global Command Register, TE field) that: Hardware implementations supporting DMA draining must drain any in-flight DMA read/write requests queued within the Root-Complex before completing the translation enable command and reflecting the status of the command through the TES field in the Global Status register. Unfortunately, some integrated graphic devices fail to do so after some kind of power state transition. As the result, the system might stuck in iommu_disable_translati on(), waiting for the completion of TE transition. This adds RPLS to a quirk list for those devices and skips TE disabling if the qurik hits. Link: https://gitlab.freedesktop.org/drm/intel/-/issues/4898 Tested-by: Raviteja Goud Talla <ravitejax.goud.talla(a)intel.com> Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Acked-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Tejas Upadhyay <tejaskumarx.surendrakumar.upadhyay(a)intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220302043256.191529-1-tejas… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/iommu/intel/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index ab2273300346..e3f15e0cae34 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -5764,7 +5764,7 @@ static void quirk_igfx_skip_te_disable(struct pci_dev *dev) ver = (dev->device >> 8) & 0xff; if (ver != 0x45 && ver != 0x46 && ver != 0x4c && ver != 0x4e && ver != 0x8a && ver != 0x98 && - ver != 0x9a) + ver != 0x9a && ver != 0xa7) return; if (risky_device(dev)) -- 2.35.1

1 year, 11 months

5
141
0 0

[PATCH 01/18] KVM: arm64: Always start with clearing SVE flag on load

by Marc Zyngier

On each vcpu load, we set the KVM_ARM64_HOST_SVE_ENABLED flag if SVE is enabled for EL0 on the host. This is used to restore the correct state on vpcu put. However, it appears that nothing ever clears this flag. Once set, it will stick until the vcpu is destroyed, which has the potential to spuriously enable SVE for userspace. We probably never saw the issue because no VMM uses SVE, but that's still pretty bad. Unconditionally clearing the flag on vcpu load addresses the issue. Fixes: 8383741ab2e7 ("KVM: arm64: Get rid of host SVE tracking/saving") Signed-off-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org --- arch/arm64/kvm/fpsimd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c index 441edb9c398c..3c2cfc3adc51 100644 --- a/arch/arm64/kvm/fpsimd.c +++ b/arch/arm64/kvm/fpsimd.c @@ -80,6 +80,7 @@ void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu) vcpu->arch.flags &= ~KVM_ARM64_FP_ENABLED; vcpu->arch.flags |= KVM_ARM64_FP_HOST; + vcpu->arch.flags &= ~KVM_ARM64_HOST_SVE_ENABLED; if (read_sysreg(cpacr_el1) & CPACR_EL1_ZEN_EL0EN) vcpu->arch.flags |= KVM_ARM64_HOST_SVE_ENABLED; -- 2.34.1

1 year, 11 months

2
3
0 0

[PATCH net v2 0/2] ixgbe: fix promiscuous mode on VF

by Olivier Matz

These 2 patches fix issues related to the promiscuous mode on VF. Comments are welcome, Olivier Cc: stable(a)vger.kernel.org Cc: Nicolas Dichtel <nicolas.dichtel(a)6wind.com> Changes since v1: - resend with CC intel-wired-lan - remove CC Hiroshi Shimamoto (address does not exist anymore) Olivier Matz (2): ixgbe: fix bcast packets Rx on VF after promisc removal ixgbe: fix unexpected VLAN Rx in promisc mode on VF drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.30.2

1 year, 11 months

4
9
0 0

[PATCH AUTOSEL 5.4 01/55] drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes

by Sasha Levin

From: Liu Zixian <liuzixian4(a)huawei.com> [ Upstream commit 194d250cdc4a40ccbd179afd522a9e9846957402 ] drm_cvt_mode may return NULL and we should check it. This bug is found by syzkaller: FAULT_INJECTION stacktrace: [ 168.567394] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 [ 168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567408] Call trace: [ 168.567414] dump_backtrace+0x0/0x310 [ 168.567418] show_stack+0x28/0x38 [ 168.567423] dump_stack+0xec/0x15c [ 168.567427] should_fail+0x3ac/0x3d0 [ 168.567437] __should_failslab+0xb8/0x120 [ 168.567441] should_failslab+0x28/0xc0 [ 168.567445] kmem_cache_alloc_trace+0x50/0x640 [ 168.567454] drm_mode_create+0x40/0x90 [ 168.567458] drm_cvt_mode+0x48/0xc78 [ 168.567477] virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu] [ 168.567485] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567492] drm_mode_getconnector+0x2e0/0xa70 [ 168.567496] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567514] drm_ioctl+0x558/0x6d0 [ 168.567522] do_vfs_ioctl+0x160/0xf30 [ 168.567525] ksys_ioctl+0x98/0xd8 [ 168.567530] __arm64_sys_ioctl+0x50/0xc8 [ 168.567536] el0_svc_common+0xc8/0x320 [ 168.567540] el0_svc_handler+0xf8/0x160 [ 168.567544] el0_svc+0x10/0x218 KASAN stacktrace: [ 168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425 [ 168.567566] [ 168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567575] Call trace: [ 168.567578] dump_backtrace+0x0/0x310 [ 168.567582] show_stack+0x28/0x38 [ 168.567586] dump_stack+0xec/0x15c [ 168.567591] kasan_report+0x244/0x2f0 [ 168.567594] __asan_load4+0x58/0xb0 [ 168.567607] virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567612] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567617] drm_mode_getconnector+0x2e0/0xa70 [ 168.567621] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567624] drm_ioctl+0x558/0x6d0 [ 168.567628] do_vfs_ioctl+0x160/0xf30 [ 168.567632] ksys_ioctl+0x98/0xd8 [ 168.567636] __arm64_sys_ioctl+0x50/0xc8 [ 168.567641] el0_svc_common+0xc8/0x320 [ 168.567645] el0_svc_handler+0xf8/0x160 [ 168.567649] el0_svc+0x10/0x218 Signed-off-by: Liu Zixian <liuzixian4(a)huawei.com> Link: http://patchwork.freedesktop.org/patch/msgid/20220322091730.1653-1-liuzixia… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/virtio/virtgpu_display.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c index e622485ae826..7e34307eb075 100644 --- a/drivers/gpu/drm/virtio/virtgpu_display.c +++ b/drivers/gpu/drm/virtio/virtgpu_display.c @@ -174,6 +174,8 @@ static int virtio_gpu_conn_get_modes(struct drm_connector *connector) DRM_DEBUG("add mode: %dx%d\n", width, height); mode = drm_cvt_mode(connector->dev, width, height, 60, false, false, false); + if (!mode) + return count; mode->type |= DRM_MODE_TYPE_PREFERRED; drm_mode_probed_add(connector, mode); count++; -- 2.35.1

1 year, 11 months

4
59
0 0

[PATCH AUTOSEL 4.19 01/38] drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes

by Sasha Levin

From: Liu Zixian <liuzixian4(a)huawei.com> [ Upstream commit 194d250cdc4a40ccbd179afd522a9e9846957402 ] drm_cvt_mode may return NULL and we should check it. This bug is found by syzkaller: FAULT_INJECTION stacktrace: [ 168.567394] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 [ 168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567408] Call trace: [ 168.567414] dump_backtrace+0x0/0x310 [ 168.567418] show_stack+0x28/0x38 [ 168.567423] dump_stack+0xec/0x15c [ 168.567427] should_fail+0x3ac/0x3d0 [ 168.567437] __should_failslab+0xb8/0x120 [ 168.567441] should_failslab+0x28/0xc0 [ 168.567445] kmem_cache_alloc_trace+0x50/0x640 [ 168.567454] drm_mode_create+0x40/0x90 [ 168.567458] drm_cvt_mode+0x48/0xc78 [ 168.567477] virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu] [ 168.567485] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567492] drm_mode_getconnector+0x2e0/0xa70 [ 168.567496] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567514] drm_ioctl+0x558/0x6d0 [ 168.567522] do_vfs_ioctl+0x160/0xf30 [ 168.567525] ksys_ioctl+0x98/0xd8 [ 168.567530] __arm64_sys_ioctl+0x50/0xc8 [ 168.567536] el0_svc_common+0xc8/0x320 [ 168.567540] el0_svc_handler+0xf8/0x160 [ 168.567544] el0_svc+0x10/0x218 KASAN stacktrace: [ 168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425 [ 168.567566] [ 168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567575] Call trace: [ 168.567578] dump_backtrace+0x0/0x310 [ 168.567582] show_stack+0x28/0x38 [ 168.567586] dump_stack+0xec/0x15c [ 168.567591] kasan_report+0x244/0x2f0 [ 168.567594] __asan_load4+0x58/0xb0 [ 168.567607] virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567612] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567617] drm_mode_getconnector+0x2e0/0xa70 [ 168.567621] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567624] drm_ioctl+0x558/0x6d0 [ 168.567628] do_vfs_ioctl+0x160/0xf30 [ 168.567632] ksys_ioctl+0x98/0xd8 [ 168.567636] __arm64_sys_ioctl+0x50/0xc8 [ 168.567641] el0_svc_common+0xc8/0x320 [ 168.567645] el0_svc_handler+0xf8/0x160 [ 168.567649] el0_svc+0x10/0x218 Signed-off-by: Liu Zixian <liuzixian4(a)huawei.com> Link: http://patchwork.freedesktop.org/patch/msgid/20220322091730.1653-1-liuzixia… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/virtio/virtgpu_display.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c index 25503b933599..7511f416eb67 100644 --- a/drivers/gpu/drm/virtio/virtgpu_display.c +++ b/drivers/gpu/drm/virtio/virtgpu_display.c @@ -180,6 +180,8 @@ static int virtio_gpu_conn_get_modes(struct drm_connector *connector) DRM_DEBUG("add mode: %dx%d\n", width, height); mode = drm_cvt_mode(connector->dev, width, height, 60, false, false, false); + if (!mode) + return count; mode->type |= DRM_MODE_TYPE_PREFERRED; drm_mode_probed_add(connector, mode); count++; -- 2.35.1

1 year, 11 months

4
41
0 0

[PATCH AUTOSEL 5.18 001/159] iommu/vt-d: Add RPLS to quirk list to skip TE disabling

by Sasha Levin

From: Tejas Upadhyay <tejaskumarx.surendrakumar.upadhyay(a)intel.com> [ Upstream commit 0a967f5bfd9134b89681cae58deb222e20840e76 ] The VT-d spec requires (10.4.4 Global Command Register, TE field) that: Hardware implementations supporting DMA draining must drain any in-flight DMA read/write requests queued within the Root-Complex before completing the translation enable command and reflecting the status of the command through the TES field in the Global Status register. Unfortunately, some integrated graphic devices fail to do so after some kind of power state transition. As the result, the system might stuck in iommu_disable_translati on(), waiting for the completion of TE transition. This adds RPLS to a quirk list for those devices and skips TE disabling if the qurik hits. Link: https://gitlab.freedesktop.org/drm/intel/-/issues/4898 Tested-by: Raviteja Goud Talla <ravitejax.goud.talla(a)intel.com> Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Acked-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Tejas Upadhyay <tejaskumarx.surendrakumar.upadhyay(a)intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220302043256.191529-1-tejas… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/iommu/intel/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 0ea47e17b379..ba9a63cac47c 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -5031,7 +5031,7 @@ static void quirk_igfx_skip_te_disable(struct pci_dev *dev) ver = (dev->device >> 8) & 0xff; if (ver != 0x45 && ver != 0x46 && ver != 0x4c && ver != 0x4e && ver != 0x8a && ver != 0x98 && - ver != 0x9a) + ver != 0x9a && ver != 0xa7) return; if (risky_device(dev)) -- 2.35.1

1 year, 11 months

8
171
0 0

[PATCH 4.9 00/48] 4.9.300-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.300 release. There are 48 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 09 Feb 2022 10:37:42 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.300-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.300-rc1 Ritesh Harjani <riteshh(a)linux.ibm.com> ext4: fix error handling in ext4_restore_inline_data() Sergey Shtylyov <s.shtylyov(a)omp.ru> EDAC/xgene: Fix deferred probing Sergey Shtylyov <s.shtylyov(a)omp.ru> EDAC/altera: Fix deferred probing Riwen Lu <luriwen(a)kylinos.cn> rtc: cmos: Evaluate century appropriate Dai Ngo <dai.ngo(a)oracle.com> nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. John Meneghini <jmeneghi(a)redhat.com> scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe Miaoqian Lin <linmq006(a)gmail.com> ASoC: fsl: Add missing error handling in pcm030_fabric_probe Lior Nahmanson <liorna(a)nvidia.com> net: macsec: Verify that send_sci is on when setting Tx sci explicitly Miquel Raynal <miquel.raynal(a)bootlin.com> net: ieee802154: Return meaningful error codes from the netlink helpers Benjamin Gaignard <benjamin.gaignard(a)collabora.com> spi: mediatek: Avoid NULL pointer crash in interrupt Kamal Dasu <kdasu.kdev(a)gmail.com> spi: bcm-qspi: check for valid cs before applying chip select Joerg Roedel <jroedel(a)suse.de> iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() Nick Lopez <github(a)glowingmonkey.org> drm/nouveau: fix off by one in BIOS boundary checking Mark Brown <broonie(a)kernel.org> ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() Mark Brown <broonie(a)kernel.org> ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() Mark Brown <broonie(a)kernel.org> ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() Eric Dumazet <edumazet(a)google.com> af_packet: fix data-race in packet_setsockopt / packet_setsockopt Eric Dumazet <edumazet(a)google.com> rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> net: amd-xgbe: Fix skb data length underflow Raju Rangoju <Raju.Rangoju(a)amd.com> net: amd-xgbe: ensure to reset the tx_timer_active flag Georgi Valkov <gvalkov(a)abv.bg> ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback Florian Westphal <fw(a)strlen.de> netfilter: nat: limit port clash resolution attempts Florian Westphal <fw(a)strlen.de> netfilter: nat: remove l4 protocol port rovers Eric Dumazet <edumazet(a)google.com> ipv4: tcp: send zero IPID in SYNACK messages Eric Dumazet <edumazet(a)google.com> ipv4: raw: lock the socket in raw_bind() Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Reduce maximum conversion rate for G781 Xianting Tian <xianting.tian(a)linux.alibaba.com> drm/msm: Fix wrong size calculation Jianguo Wu <wujianguo(a)chinatelecom.cn> net-procfs: show net devices bound packet types Trond Myklebust <trond.myklebust(a)hammerspace.com> NFSv4: nfs_atomic_open() can race when looking up a non-regular file Trond Myklebust <trond.myklebust(a)hammerspace.com> NFSv4: Handle case where the lookup of a directory fails Eric Dumazet <edumazet(a)google.com> ipv4: avoid using shared IP generator for connected sockets Congyu Liu <liu3101(a)purdue.edu> net: fix information leakage in /proc/net/ptype Ido Schimmel <idosch(a)nvidia.com> ipv6_tunnel: Rate limit warning messages John Meneghini <jmeneghi(a)redhat.com> scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/32: Fix boot failure with GCC latent entropy plugin Alan Stern <stern(a)rowland.harvard.edu> USB: core: Fix hang in usb_kill_urb by adding memory barriers Pavankumar Kondeti <quic_pkondeti(a)quicinc.com> usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS Alan Stern <stern(a)rowland.harvard.edu> usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge Cameron Williams <cang1(a)live.co.uk> tty: Add support for Brainboxes UC cards. daniel.starke(a)siemens.com <daniel.starke(a)siemens.com> tty: n_gsm: fix SW flow control encoding/handling Valentin Caron <valentin.caron(a)foss.st.com> serial: stm32: fix software flow control transfer Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> PM: wakeup: simplify the output logic of pm_show_wakelocks() Jan Kara <jack(a)suse.cz> udf: Fix NULL ptr deref when converting from inline format Jan Kara <jack(a)suse.cz> udf: Restore i_lenAlloc when inode expansion fails Steffen Maier <maier(a)linux.ibm.com> scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices Vasily Gorbik <gor(a)linux.ibm.com> s390/hypfs: include z/VM guests with access control group set Brian Gix <brian.gix(a)intel.com> Bluetooth: refactor malicious adv data check Ziyang Xuan <william.xuanziyang(a)huawei.com> can: bcm: fix UAF of bcm op ------------- Diffstat: Makefile | 4 +- arch/powerpc/kernel/Makefile | 1 + arch/powerpc/lib/Makefile | 3 + arch/s390/hypfs/hypfs_vm.c | 6 +- drivers/edac/altera_edac.c | 2 +- drivers/edac/xgene_edac.c | 2 +- drivers/gpu/drm/msm/msm_drv.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c | 2 +- drivers/hwmon/lm90.c | 2 +- drivers/iommu/amd_iommu_init.c | 2 + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 14 +++- drivers/net/macsec.c | 9 +++ drivers/net/usb/ipheth.c | 6 +- drivers/rtc/rtc-mc146818-lib.c | 2 +- drivers/s390/scsi/zfcp_fc.c | 13 ++- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 41 +++++----- drivers/spi/spi-bcm-qspi.c | 2 +- drivers/spi/spi-mt65xx.c | 2 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/serial/8250/8250_pci.c | 100 +++++++++++++++++++++++- drivers/tty/serial/stm32-usart.c | 2 +- drivers/usb/core/hcd.c | 14 ++++ drivers/usb/core/urb.c | 12 +++ drivers/usb/gadget/function/f_sourcesink.c | 1 + drivers/usb/storage/unusual_devs.h | 10 +++ fs/ext4/inline.c | 10 ++- fs/nfs/dir.c | 18 +++++ fs/nfsd/nfs4state.c | 4 +- fs/udf/inode.c | 9 +-- include/linux/netdevice.h | 1 + include/net/ip.h | 21 +++-- include/net/netfilter/nf_nat_l4proto.h | 2 +- kernel/power/wakelock.c | 12 +-- net/bluetooth/hci_event.c | 10 +-- net/can/bcm.c | 20 ++--- net/core/net-procfs.c | 38 ++++++++- net/core/rtnetlink.c | 6 +- net/ieee802154/nl802154.c | 8 +- net/ipv4/ip_output.c | 11 ++- net/ipv4/raw.c | 5 +- net/ipv6/ip6_tunnel.c | 8 +- net/netfilter/nf_nat_proto_common.c | 36 ++++++--- net/netfilter/nf_nat_proto_dccp.c | 5 +- net/netfilter/nf_nat_proto_sctp.c | 5 +- net/netfilter/nf_nat_proto_tcp.c | 5 +- net/netfilter/nf_nat_proto_udp.c | 5 +- net/netfilter/nf_nat_proto_udplite.c | 5 +- net/packet/af_packet.c | 10 ++- sound/soc/fsl/pcm030-audio-fabric.c | 11 ++- sound/soc/soc-ops.c | 29 ++++++- 50 files changed, 410 insertions(+), 142 deletions(-)

1 year, 11 months

9
57
0 0

FAILED: patch "[PATCH] exec: Force single empty string when argv is empty" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From dcd46d897adb70d63e025f175a00a89797d31a43 Mon Sep 17 00:00:00 2001 From: Kees Cook <keescook(a)chromium.org> Date: Mon, 31 Jan 2022 16:09:47 -0800 Subject: [PATCH] exec: Force single empty string when argv is empty Quoting[1] Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve(2) be the name of a program, thus prohibiting a scenario where argc < 1. POSIX 2017 also recommends this behaviour, but it is not an explicit requirement[2]: The argument arg0 should point to a filename string that is associated with the process being started by one of the exec functions. ... Interestingly, Michael Kerrisk opened an issue about this in 2008[3], but there was no consensus to support fixing this issue then. Hopefully now that CVE-2021-4034 shows practical exploitative use[4] of this bug in a shellcode, we can reconsider. This issue is being tracked in the KSPP issue tracker[5]." While the initial code searches[6][7] turned up what appeared to be mostly corner case tests, trying to that just reject argv == NULL (or an immediately terminated pointer list) quickly started tripping[8] existing userspace programs. The next best approach is forcing a single empty string into argv and adjusting argc to match. The number of programs depending on argc == 0 seems a smaller set than those calling execve with a NULL argv. Account for the additional stack space in bprm_stack_limits(). Inject an empty string when argc == 0 (and set argc = 1). Warn about the case so userspace has some notice about the change: process './argc0' launched './argc0' with NULL argv: empty string added Additionally WARN() and reject NULL argv usage for kernel threads. [1] https://lore.kernel.org/lkml/20220127000724.15106-1-ariadne@dereferenced.or… [2] https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html [3] https://bugzilla.kernel.org/show_bug.cgi?id=8408 [4] https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt [5] https://github.com/KSPP/linux/issues/176 [6] https://codesearch.debian.net/search?q=execve%5C+*%5C%28%5B%5E%2C%5D%2B%2C+… [7] https://codesearch.debian.net/search?q=execlp%3F%5Cs*%5C%28%5B%5E%2C%5D%2B%… [8] https://lore.kernel.org/lkml/20220131144352.GE16385@xsang-OptiPlex-9020/ Reported-by: Ariadne Conill <ariadne(a)dereferenced.org> Reported-by: Michael Kerrisk <mtk.manpages(a)gmail.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Christian Brauner <brauner(a)kernel.org> Cc: Rich Felker <dalias(a)libc.org> Cc: Eric Biederman <ebiederm(a)xmission.com> Cc: Alexander Viro <viro(a)zeniv.linux.org.uk> Cc: linux-fsdevel(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Kees Cook <keescook(a)chromium.org> Acked-by: Christian Brauner <brauner(a)kernel.org> Acked-by: Ariadne Conill <ariadne(a)dereferenced.org> Acked-by: Andy Lutomirski <luto(a)kernel.org> Link: https://lore.kernel.org/r/20220201000947.2453721-1-keescook@chromium.org diff --git a/fs/exec.c b/fs/exec.c index 79f2c9483302..40b1008fb0f7 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -495,8 +495,14 @@ static int bprm_stack_limits(struct linux_binprm *bprm) * the stack. They aren't stored until much later when we can't * signal to the parent that the child has run out of stack space. * Instead, calculate it here so it's possible to fail gracefully. + * + * In the case of argc = 0, make sure there is space for adding a + * empty string (which will bump argc to 1), to ensure confused + * userspace programs don't start processing from argv[1], thinking + * argc can never be 0, to keep them from walking envp by accident. + * See do_execveat_common(). */ - ptr_size = (bprm->argc + bprm->envc) * sizeof(void *); + ptr_size = (max(bprm->argc, 1) + bprm->envc) * sizeof(void *); if (limit <= ptr_size) return -E2BIG; limit -= ptr_size; @@ -1897,6 +1903,9 @@ static int do_execveat_common(int fd, struct filename *filename, } retval = count(argv, MAX_ARG_STRINGS); + if (retval == 0) + pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n", + current->comm, bprm->filename); if (retval < 0) goto out_free; bprm->argc = retval; @@ -1923,6 +1932,19 @@ static int do_execveat_common(int fd, struct filename *filename, if (retval < 0) goto out_free; + /* + * When argv is empty, add an empty string ("") as argv[0] to + * ensure confused userspace programs that start processing + * from argv[1] won't end up walking envp. See also + * bprm_stack_limits(). + */ + if (bprm->argc == 0) { + retval = copy_string_kernel("", bprm); + if (retval < 0) + goto out_free; + bprm->argc = 1; + } + retval = bprm_execve(bprm, fd, filename, flags); out_free: free_bprm(bprm); @@ -1951,6 +1973,8 @@ int kernel_execve(const char *kernel_filename, } retval = count_strings_kernel(argv); + if (WARN_ON_ONCE(retval == 0)) + retval = -EINVAL; if (retval < 0) goto out_free; bprm->argc = retval;

1 year, 11 months

3
2
0 0

[PATCH] BACKPORT: drm/amdgpu/disply: set num_crtc earlier

by Ryan Lin

From: Alex Deucher <alexander.deucher(a)amd.com> To avoid a recently added warning: Bogus possible_crtcs: [ENCODER:65:TMDS-65] possible_crtcs=0xf (full crtc mask=0x7) WARNING: CPU: 3 PID: 439 at drivers/gpu/drm/drm_mode_config.c:617 drm_mode_config_validate+0x178/0x200 [drm] In this case the warning is harmless, but confusing to users. Fixes: 0df108237433 ("drm: Validate encoder->possible_crtcs") Bug: https://bugzilla.kernel.org/show_bug.cgi?id=209123 Reviewed-by: Daniel Vetter <daniel(a)ffwll.ch> Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c [Ryan Lin: Fixed the conflict, remove the non-main changed part of this patch] --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index fb918b7890ac..5ef88a2d2161 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -766,9 +766,6 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) goto error; } - /* Update the actual used number of crtc */ - adev->mode_info.num_crtc = adev->dm.display_indexes_num; - /* TODO: Add_display_info? */ /* TODO use dynamic cursor width */ @@ -2448,6 +2445,10 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) enum dc_connection_type new_connection_type = dc_connection_none; const struct dc_plane_cap *plane; + dm->display_indexes_num = dm->dc->caps.max_streams; + /* Update the actual used number of crtc */ + adev->mode_info.num_crtc = adev->dm.display_indexes_num; + link_cnt = dm->dc->caps.max_links; if (amdgpu_dm_mode_config_init(dm->adev)) { DRM_ERROR("DM: Failed to initialize mode config\n"); @@ -2509,8 +2510,6 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) goto fail; } - dm->display_indexes_num = dm->dc->caps.max_streams; - /* loops over all connectors on the board */ for (i = 0; i < link_cnt; i++) { struct dc_link *link = NULL; -- 2.25.1

1 year, 11 months

3
3
0 0

exfat: check if cluster num is valid

by Tadeusz Struk

Hi, Please apply upstream commit: 64ba4b15e5c0 ("exfat: check if cluster num is valid") to stable 5.18.y and 5.17.y Backports for 5.15.y and 5.10.y will follow soon. -- Thanks, Tadeusz

1 year, 11 months

2
3
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror May 2022