March 2023 - Linux-stable-mirror

[PATCH net] net: tls: avoid hanging tasks on the tx_lock

by Jakub Kicinski

syzbot sent a hung task report and Eric explains that adversarial receiver may keep RWIN at 0 for a long time, so we are not guaranteed to make forward progress. Thread which took tx_lock and went to sleep may not release tx_lock for hours. Use interruptible sleep where possible and reschedule the work if it can't take the lock. Testing: existing selftest passes Reported-by: syzbot+9c0268252b8ef967c62e(a)syzkaller.appspotmail.com Fixes: 79ffe6087e91 ("net/tls: add a TX lock") Link: https://lore.kernel.org/all/000000000000e412e905f5b46201@google.com/ Cc: stable(a)vger.kernel.org # wait 4 weeks Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> --- CC: borisp(a)nvidia.com CC: john.fastabend(a)gmail.com CC: simon.horman(a)netronome.com --- net/tls/tls_sw.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 021d760f9133..635b8bf6b937 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -956,7 +956,9 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) MSG_CMSG_COMPAT)) return -EOPNOTSUPP; - mutex_lock(&tls_ctx->tx_lock); + ret = mutex_lock_interruptible(&tls_ctx->tx_lock); + if (ret) + return ret; lock_sock(sk); if (unlikely(msg->msg_controllen)) { @@ -1290,7 +1292,9 @@ int tls_sw_sendpage(struct sock *sk, struct page *page, MSG_SENDPAGE_NOTLAST | MSG_SENDPAGE_NOPOLICY)) return -EOPNOTSUPP; - mutex_lock(&tls_ctx->tx_lock); + ret = mutex_lock_interruptible(&tls_ctx->tx_lock); + if (ret) + return ret; lock_sock(sk); ret = tls_sw_do_sendpage(sk, page, offset, size, flags); release_sock(sk); @@ -2435,11 +2439,19 @@ static void tx_work_handler(struct work_struct *work) if (!test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) return; - mutex_lock(&tls_ctx->tx_lock); - lock_sock(sk); - tls_tx_records(sk, -1); - release_sock(sk); - mutex_unlock(&tls_ctx->tx_lock); + + if (mutex_trylock(&tls_ctx->tx_lock)) { + lock_sock(sk); + tls_tx_records(sk, -1); + release_sock(sk); + mutex_unlock(&tls_ctx->tx_lock); + } else if (!test_and_set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { + /* Someone is holding the tx_lock, they will likely run Tx + * and cancel the work on their way out of the lock section. + * Schedule a long delay just in case. + */ + schedule_delayed_work(&ctx->tx_work.work, msecs_to_jiffies(10)); + } } static bool tls_is_tx_ready(struct tls_sw_context_tx *ctx) -- 2.39.2

1 year, 8 months

3
2
0 0

[PATCH v2] ceph: do not print the whole xattr value if it's too long

by xiubli＠redhat.com

From: Xiubo Li <xiubli(a)redhat.com> If the xattr's value size is long enough the kernel will warn and then will fail the xfstests test case. Just print part of the value string if it's too long. Cc: stable(a)vger.kernel.org URL: https://tracker.ceph.com/issues/58404 Signed-off-by: Xiubo Li <xiubli(a)redhat.com> --- V2: - switch to use min() from Jeff's comment - s/XATTR_MAX_VAL/MAX_XATTR_VAL/g fs/ceph/xattr.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c index b10d459c2326..887a65279fcf 100644 --- a/fs/ceph/xattr.c +++ b/fs/ceph/xattr.c @@ -561,6 +561,7 @@ static struct ceph_vxattr *ceph_match_vxattr(struct inode *inode, return NULL; } +#define MAX_XATTR_VAL 256 static int __set_xattr(struct ceph_inode_info *ci, const char *name, int name_len, const char *val, int val_len, @@ -654,8 +655,10 @@ static int __set_xattr(struct ceph_inode_info *ci, dout("__set_xattr_val p=%p\n", p); } - dout("__set_xattr_val added %llx.%llx xattr %p %.*s=%.*s\n", - ceph_vinop(&ci->netfs.inode), xattr, name_len, name, val_len, val); + dout("__set_xattr_val added %llx.%llx xattr %p %.*s=%.*s%s\n", + ceph_vinop(&ci->netfs.inode), xattr, name_len, name, + min(val_len, MAX_XATTR_VAL), val, + val_len > MAX_XATTR_VAL ? "..." : ""); return 0; } @@ -681,8 +684,9 @@ static struct ceph_inode_xattr *__get_xattr(struct ceph_inode_info *ci, else if (c > 0) p = &(*p)->rb_right; else { - dout("__get_xattr %s: found %.*s\n", name, - xattr->val_len, xattr->val); + dout("__get_xattr %s: found %.*s%s\n", name, + min(xattr->val_len, MAX_XATTR_VAL), xattr->val, + xattr->val_len > MAX_XATTR_VAL ? "..." : ""); return xattr; } } -- 2.31.1

1 year, 8 months

3
2
0 0

[PATCH 5.10 v3 0/5] Fix Build ID on arm64 if CONFIG_MODVERSIONS=y

by Tom Saeger

Build ID is missing for arm64 with CONFIG_MODVERSIONS=y using ld >= 2.36 on 5.4, 5.10, and 5.15 Backport Build ID fixes, which work-around ld behavior by modifying vmlinux linker script. This has been build tested this on {x86_64, arm64, riscv, powerpc, s390, sh}. Simple test case: $ readelf -n vmlinux | grep "Build ID" Changes for v3: - per Greg, add justification for backporting: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") which has "Fixes:" to v6.2 only content. - rebase to v5.15.96 Changes for v2: - rebase 5/5 c1c551bebf92 ("sh: define RUNTIME_DISCARD_EXIT") from upstream Previous threads: [1] v2 https://lore.kernel.org/all/20230210-tsaeger-upstream-linux-5-10-y-v2-0-ada… [2] v1 https://lore.kernel.org/all/cover.1674851705.git.tom.saeger@oracle.com/ [3] https://lore.kernel.org/all/3df32572ec7016e783d37e185f88495831671f5d.167114… [4] https://lore.kernel.org/all/cover.1670358255.git.tom.saeger@oracle.com/ Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com> --- Masahiro Yamada (2): arch: fix broken BuildID for arm64 and riscv s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 Michael Ellerman (2): powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds Tom Saeger (1): sh: define RUNTIME_DISCARD_EXIT arch/powerpc/kernel/vmlinux.lds.S | 6 +++++- arch/s390/kernel/vmlinux.lds.S | 2 ++ arch/sh/kernel/vmlinux.lds.S | 1 + include/asm-generic/vmlinux.lds.h | 5 +++++ 4 files changed, 13 insertions(+), 1 deletion(-) --- base-commit: 22d269bb30db7f5a4e71a8a813a0f4df5255f7de change-id: 20230210-tsaeger-upstream-linux-5-10-y-e443820440f6 Best regards, -- Tom Saeger <tom.saeger(a)oracle.com>

1 year, 8 months

1
5
0 0

[PATCH 5.15 v3 0/5] Fix Build ID on arm64 if CONFIG_MODVERSIONS=y

by Tom Saeger

Build ID is missing for arm64 with CONFIG_MODVERSIONS=y using ld >= 2.36 on 5.4, 5.10, and 5.15 Backport Build ID fixes, which work-around ld behavior by modifying vmlinux linker script. This has been build tested this on {x86_64, arm64, riscv, powerpc, s390, sh}. Simple test case: $ readelf -n vmlinux | grep "Build ID" Changes for v3: - per Greg, add justification for backporting: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") which has "Fixes:" to v6.2 only content. - rebase to v5.15.96 Changes for v2: - rebase 5/5 c1c551bebf92 ("sh: define RUNTIME_DISCARD_EXIT") from upstream Previous threads: [1] v2 https://lore.kernel.org/all/20230210-tsaeger-upstream-linux-stable-5-15-v2-… [2] v1 https://lore.kernel.org/all/cover.1674851705.git.tom.saeger@oracle.com/ [3] https://lore.kernel.org/all/3df32572ec7016e783d37e185f88495831671f5d.167114… [4] https://lore.kernel.org/all/cover.1670358255.git.tom.saeger@oracle.com/ Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com> --- Masahiro Yamada (2): arch: fix broken BuildID for arm64 and riscv s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 Michael Ellerman (2): powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds Tom Saeger (1): sh: define RUNTIME_DISCARD_EXIT arch/powerpc/kernel/vmlinux.lds.S | 6 +++++- arch/s390/kernel/vmlinux.lds.S | 2 ++ arch/sh/kernel/vmlinux.lds.S | 1 + include/asm-generic/vmlinux.lds.h | 5 +++++ 4 files changed, 13 insertions(+), 1 deletion(-) --- base-commit: d383d0f28ecac0f3375bdfb9a0c4bfac979f6f8f change-id: 20230210-tsaeger-upstream-linux-stable-5-15-f7bf45952c23 Best regards, -- Tom Saeger <tom.saeger(a)oracle.com>

1 year, 8 months

1
5
0 0

[PATCH 4.14 1/3] HID: asus: Remove check for same LED brightness on set

by Stefan Ghinea

From: "Luke D. Jones" <luke(a)ljones.dev> commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream Remove the early return on LED brightness set so that any controller application, daemon, or desktop may set the same brightness at any stage. This is required because many ASUS ROG keyboards will default to max brightness on laptop resume if the LEDs were set to off before sleep. Signed-off-by: Luke D Jones <luke(a)ljones.dev> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com> --- drivers/hid/hid-asus.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index a7a63abdea86..c7ae4b6d9fd3 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -298,9 +298,6 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); - if (led->brightness == brightness) - return; - led->brightness = brightness; schedule_work(&led->work); } -- 2.39.1

1 year, 8 months

1
2
0 0

[PATCH 4.19 1/3] HID: asus: Remove check for same LED brightness on set

by Stefan Ghinea

From: "Luke D. Jones" <luke(a)ljones.dev> commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream Remove the early return on LED brightness set so that any controller application, daemon, or desktop may set the same brightness at any stage. This is required because many ASUS ROG keyboards will default to max brightness on laptop resume if the LEDs were set to off before sleep. Signed-off-by: Luke D Jones <luke(a)ljones.dev> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com> --- drivers/hid/hid-asus.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 800b2364e29e..9ae8e3d5edf1 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -318,9 +318,6 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); - if (led->brightness == brightness) - return; - led->brightness = brightness; schedule_work(&led->work); } -- 2.39.1

1 year, 8 months

1
2
0 0

[PATCH 5.4 1/3] HID: asus: Remove check for same LED brightness on set

by Stefan Ghinea

From: "Luke D. Jones" <luke(a)ljones.dev> commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream Remove the early return on LED brightness set so that any controller application, daemon, or desktop may set the same brightness at any stage. This is required because many ASUS ROG keyboards will default to max brightness on laptop resume if the LEDs were set to off before sleep. Signed-off-by: Luke D Jones <luke(a)ljones.dev> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com> --- drivers/hid/hid-asus.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 7f84ed0afdfe..d3aca8f80de4 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -351,9 +351,6 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); - if (led->brightness == brightness) - return; - led->brightness = brightness; schedule_work(&led->work); } -- 2.39.1

1 year, 8 months

1
2
0 0

[PATCH 5.10 1/3] HID: asus: Remove check for same LED brightness on set

by Stefan Ghinea

From: "Luke D. Jones" <luke(a)ljones.dev> commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream Remove the early return on LED brightness set so that any controller application, daemon, or desktop may set the same brightness at any stage. This is required because many ASUS ROG keyboards will default to max brightness on laptop resume if the LEDs were set to off before sleep. Signed-off-by: Luke D Jones <luke(a)ljones.dev> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com> --- drivers/hid/hid-asus.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index f85c6e3309a0..9a6b63828634 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -402,9 +402,6 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); - if (led->brightness == brightness) - return; - led->brightness = brightness; schedule_work(&led->work); } -- 2.39.1

1 year, 8 months

1
2
0 0

[PATCH 5.15 1/2] HID: asus: use spinlock to protect concurrent accesses

by Stefan Ghinea

From: Pietro Borrello <borrello(a)diag.uniroma1.it> commit 315c537068a13f0b5681d33dd045a912f4bece6f upstream asus driver has a worker that may access data concurrently. Proct the accesses using a spinlock. Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") Signed-off-by: Pietro Borrello <borrello(a)diag.uniroma1.it> Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-4-7860c5763c38@di… Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com> --- drivers/hid/hid-asus.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index b59c3dafa6a4..37500b645ec4 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -98,6 +98,7 @@ struct asus_kbd_leds { struct hid_device *hdev; struct work_struct work; unsigned int brightness; + spinlock_t lock; bool removed; }; @@ -497,7 +498,12 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); + unsigned long flags; + + spin_lock_irqsave(&led->lock, flags); led->brightness = brightness; + spin_unlock_irqrestore(&led->lock, flags); + schedule_work(&led->work); } @@ -505,8 +511,14 @@ static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev) { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); + enum led_brightness brightness; + unsigned long flags; - return led->brightness; + spin_lock_irqsave(&led->lock, flags); + brightness = led->brightness; + spin_unlock_irqrestore(&led->lock, flags); + + return brightness; } static void asus_kbd_backlight_work(struct work_struct *work) @@ -514,11 +526,14 @@ static void asus_kbd_backlight_work(struct work_struct *work) struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work); u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, 0x00 }; int ret; + unsigned long flags; if (led->removed) return; + spin_lock_irqsave(&led->lock, flags); buf[4] = led->brightness; + spin_unlock_irqrestore(&led->lock, flags); ret = asus_kbd_set_report(led->hdev, buf, sizeof(buf)); if (ret < 0) @@ -586,6 +601,7 @@ static int asus_kbd_register_leds(struct hid_device *hdev) drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set; drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get; INIT_WORK(&drvdata->kbd_backlight->work, asus_kbd_backlight_work); + spin_lock_init(&drvdata->kbd_backlight->lock); ret = devm_led_classdev_register(&hdev->dev, &drvdata->kbd_backlight->cdev); if (ret < 0) { @@ -1121,9 +1137,13 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) static void asus_remove(struct hid_device *hdev) { struct asus_drvdata *drvdata = hid_get_drvdata(hdev); + unsigned long flags; if (drvdata->kbd_backlight) { + spin_lock_irqsave(&drvdata->kbd_backlight->lock, flags); drvdata->kbd_backlight->removed = true; + spin_unlock_irqrestore(&drvdata->kbd_backlight->lock, flags); + cancel_work_sync(&drvdata->kbd_backlight->work); } -- 2.39.1

1 year, 8 months

1
1
0 0

[PATCH] drm/vmwgfx: Avoid NULL-ptr dereference in vmw_cmd_dx_define_query()

by Thomas Zimmermann

There have been reports [1][2] that vmw_cmd_dx_define_query() can be called with ctx_node->ctx set to NULL, which results in undefined behavior in vmw_context_cotable(). Avoid this be returning an errno code. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Link: https://www.cve.org/CVERecord?id=CVE-2022-38096 # 1 Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2073 # 2 Cc: stable(a)vger.kernel.org --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 6b9aa2b4ef54..1e90362add96 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1256,7 +1256,7 @@ static int vmw_cmd_dx_define_query(struct vmw_private *dev_priv, struct vmw_resource *cotable_res; int ret; - if (!ctx_node) + if (!ctx_node || !ctx_node->ctx) return -EINVAL; cmd = container_of(header, typeof(*cmd), header); -- 2.39.2

1 year, 8 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2023