May 2023 - Linux-stable-mirror

[PATCH 1/2] drm/dsc: fix drm_edp_dsc_sink_output_bpp() DPCD high byte usage

by Jani Nikula

The operator precedence between << and & is wrong, leading to the high byte being completely ignored. For example, with the 6.4 format, 32 becomes 0 and 24 becomes 8. Fix it, and remove the slightly confusing and unnecessary DP_DSC_MAX_BITS_PER_PIXEL_HI_SHIFT macro while at it. Fixes: 0575650077ea ("drm/dp: DRM DP helper/macros to get DP sink DSC parameters") Cc: Stanislav Lisovskiy <stanislav.lisovskiy(a)intel.com> Cc: Manasi Navare <navaremanasi(a)google.com> Cc: Anusha Srivatsa <anusha.srivatsa(a)intel.com> Cc: <stable(a)vger.kernel.org> # v5.0+ Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> --- include/drm/display/drm_dp.h | 1 - include/drm/display/drm_dp_helper.h | 5 ++--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/include/drm/display/drm_dp.h b/include/drm/display/drm_dp.h index 358db4a9f167..89d5a700b04d 100644 --- a/include/drm/display/drm_dp.h +++ b/include/drm/display/drm_dp.h @@ -286,7 +286,6 @@ #define DP_DSC_MAX_BITS_PER_PIXEL_HI 0x068 /* eDP 1.4 */ # define DP_DSC_MAX_BITS_PER_PIXEL_HI_MASK (0x3 << 0) -# define DP_DSC_MAX_BITS_PER_PIXEL_HI_SHIFT 8 # define DP_DSC_MAX_BPP_DELTA_VERSION_MASK 0x06 # define DP_DSC_MAX_BPP_DELTA_AVAILABILITY 0x08 diff --git a/include/drm/display/drm_dp_helper.h b/include/drm/display/drm_dp_helper.h index 533d3ee7fe05..86f24a759268 100644 --- a/include/drm/display/drm_dp_helper.h +++ b/include/drm/display/drm_dp_helper.h @@ -181,9 +181,8 @@ static inline u16 drm_edp_dsc_sink_output_bpp(const u8 dsc_dpcd[DP_DSC_RECEIVER_CAP_SIZE]) { return dsc_dpcd[DP_DSC_MAX_BITS_PER_PIXEL_LOW - DP_DSC_SUPPORT] | - (dsc_dpcd[DP_DSC_MAX_BITS_PER_PIXEL_HI - DP_DSC_SUPPORT] & - DP_DSC_MAX_BITS_PER_PIXEL_HI_MASK << - DP_DSC_MAX_BITS_PER_PIXEL_HI_SHIFT); + ((dsc_dpcd[DP_DSC_MAX_BITS_PER_PIXEL_HI - DP_DSC_SUPPORT] & + DP_DSC_MAX_BITS_PER_PIXEL_HI_MASK) << 8); } static inline u32 -- 2.39.2

1 year, 10 months

2
2
0 0

[PATCH 5.10 0/1] Request to cherry-pick 026d0d27c488 to 5.10.y

by Meena Shanmugam

The commit 026d0d27c488 (ext4: reduce computation of overhead during resize) reduces the time taken to resize large bigalloc filesystems(reduces 3+ hours to milliseconds for a 64TB FS). This is a good candidate to cherry-pick to stable releases. Kiselev, Oleg (1): ext4: reduce computation of overhead during resize fs/ext4/resize.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.40.1.495.gc816e09b53d-goog

1 year, 10 months

2
2
0 0

[PATCH 5.15 00/13] 5.15.110-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.110 release. There are 13 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 30 Apr 2023 11:20:30 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.110-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.110-rc1 Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: No need to relocate the dtb as it lies in the fixmap region Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: Do not set initial_boot_params to the linear address of the dtb Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: Move early dtb mapping into the fixmap region Matthieu Baerts <matthieu.baerts(a)tessares.net> selftests: mptcp: join: fix "invalid address, ADD_ADDR timeout" Stephen Boyd <swboyd(a)chromium.org> driver core: Don't require dynamic_debug for initcall_debug probe timing Arınç ÜNAL <arinc.unal(a)arinc9.com> USB: serial: option: add UNISOC vendor and TOZED LT70C product Ruihan Li <lrh2000(a)pku.edu.cn> bluetooth: Perform careful capability checks in hci_sock_ioctl() Daniel Vetter <daniel.vetter(a)ffwll.ch> drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Dan Carpenter <dan.carpenter(a)linaro.org> KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg() David Matlack <dmatlack(a)google.com> KVM: arm64: Retry fault if vma_lookup() results become invalid SeongJae Park <sjpark(a)amazon.de> selftests/kselftest/runner/run_one(): allow running non-executable files Kai-Heng Feng <kai.heng.feng(a)canonical.com> PCI/ASPM: Remove pcie_aspm_pm_state_change() ------------- Diffstat: Documentation/riscv/vm-layout.rst | 2 +- Makefile | 4 +- arch/arm64/kvm/mmu.c | 47 +++++++-------- arch/arm64/kvm/psci.c | 2 + arch/riscv/include/asm/fixmap.h | 8 +++ arch/riscv/include/asm/pgtable.h | 8 ++- arch/riscv/kernel/setup.c | 6 +- arch/riscv/mm/init.c | 68 ++++++++++++---------- drivers/base/dd.c | 7 ++- drivers/gpu/drm/drm_fb_helper.c | 3 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 5 ++ drivers/pci/pci.c | 3 - drivers/pci/pci.h | 2 - drivers/pci/pcie/aspm.c | 19 ------ drivers/usb/serial/option.c | 6 ++ net/bluetooth/hci_sock.c | 9 ++- tools/testing/selftests/kselftest/runner.sh | 28 +++++---- tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 18 files changed, 124 insertions(+), 105 deletions(-)

1 year, 10 months

8
20
0 0

[PATCH 6.1 00/16] 6.1.27-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.27 release. There are 16 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 30 Apr 2023 11:20:30 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.27-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.27-rc1 Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: No need to relocate the dtb as it lies in the fixmap region Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: Do not set initial_boot_params to the linear address of the dtb Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: Move early dtb mapping into the fixmap region Stephen Boyd <swboyd(a)chromium.org> driver core: Don't require dynamic_debug for initcall_debug probe timing Arınç ÜNAL <arinc.unal(a)arinc9.com> USB: serial: option: add UNISOC vendor and TOZED LT70C product Genjian Zhang <zhanggenjian(a)kylinos.cn> btrfs: fix uninitialized variable warnings Ruihan Li <lrh2000(a)pku.edu.cn> bluetooth: Perform careful capability checks in hci_sock_ioctl() Werner Sembach <wse(a)tuxedocomputers.com> gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xNU Daniel Vetter <daniel.vetter(a)ffwll.ch> drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Paolo Abeni <pabeni(a)redhat.com> mptcp: fix accept vs worker race Paolo Abeni <pabeni(a)redhat.com> mptcp: stops worker on unaccepted sockets at listener close Liam R. Howlett <Liam.Howlett(a)oracle.com> mm/mempolicy: fix use-after-free of VMA iterator David Matlack <dmatlack(a)google.com> KVM: arm64: Retry fault if vma_lookup() results become invalid Florian Fainelli <f.fainelli(a)gmail.com> phy: phy-brcm-usb: Utilize platform_get_irq_byname_optional() David Gow <davidgow(a)google.com> um: Only disable SSE on clang to work around old GCC bugs ------------- Diffstat: Documentation/riscv/vm-layout.rst | 4 +- Makefile | 4 +- arch/arm64/kvm/mmu.c | 47 ++++----- arch/riscv/include/asm/fixmap.h | 8 ++ arch/riscv/include/asm/pgtable.h | 8 +- arch/riscv/kernel/setup.c | 6 +- arch/riscv/mm/init.c | 82 +++++++-------- arch/x86/Makefile.um | 5 + drivers/base/dd.c | 7 +- drivers/gpio/gpiolib-acpi.c | 13 +++ drivers/gpu/drm/drm_fb_helper.c | 3 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 5 + drivers/phy/broadcom/phy-brcm-usb.c | 4 +- drivers/usb/serial/option.c | 6 ++ fs/btrfs/send.c | 2 +- fs/btrfs/volumes.c | 2 +- mm/mempolicy.c | 115 ++++++++++----------- net/bluetooth/hci_sock.c | 9 +- net/mptcp/protocol.c | 74 ++++++++----- net/mptcp/protocol.h | 2 + net/mptcp/subflow.c | 80 +++++++++++++- 21 files changed, 309 insertions(+), 177 deletions(-)

1 year, 10 months

11
26
0 0

[PATCH 6.2 00/15] 6.2.14-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.2.14 release. There are 15 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 30 Apr 2023 11:20:30 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.2.14-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.2.14-rc1 Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: No need to relocate the dtb as it lies in the fixmap region Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: Do not set initial_boot_params to the linear address of the dtb Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: Move early dtb mapping into the fixmap region Stephen Boyd <swboyd(a)chromium.org> driver core: Don't require dynamic_debug for initcall_debug probe timing Arınç ÜNAL <arinc.unal(a)arinc9.com> USB: serial: option: add UNISOC vendor and TOZED LT70C product Genjian Zhang <zhanggenjian(a)kylinos.cn> btrfs: fix uninitialized variable warnings Marek Vasut <marex(a)denx.de> wifi: brcmfmac: add Cypress 43439 SDIO ids Ruihan Li <lrh2000(a)pku.edu.cn> bluetooth: Perform careful capability checks in hci_sock_ioctl() Werner Sembach <wse(a)tuxedocomputers.com> gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xNU Daniel Vetter <daniel.vetter(a)ffwll.ch> drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Liam R. Howlett <Liam.Howlett(a)oracle.com> mm/mempolicy: fix use-after-free of VMA iterator Ziwei Dai <ziwei.dai(a)unisoc.com> rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period David Gow <davidgow(a)google.com> um: Only disable SSE on clang to work around old GCC bugs David Gow <davidgow(a)google.com> rust: arch/um: Disable FP/SIMD instruction to match x86 ------------- Diffstat: Documentation/riscv/vm-layout.rst | 6 +- Makefile | 4 +- arch/riscv/include/asm/fixmap.h | 8 ++ arch/riscv/include/asm/pgtable.h | 8 +- arch/riscv/kernel/setup.c | 6 +- arch/riscv/mm/init.c | 82 +++++++-------- arch/x86/Makefile.um | 11 ++ drivers/base/dd.c | 7 +- drivers/gpio/gpiolib-acpi.c | 13 +++ drivers/gpu/drm/drm_fb_helper.c | 3 + .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 9 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 5 + drivers/usb/serial/option.c | 6 ++ fs/btrfs/send.c | 2 +- fs/btrfs/volumes.c | 2 +- include/linux/mmc/sdio_ids.h | 5 +- kernel/rcu/tree.c | 27 +++-- mm/mempolicy.c | 115 ++++++++++----------- net/bluetooth/hci_sock.c | 9 +- 19 files changed, 194 insertions(+), 134 deletions(-)

1 year, 10 months

10
24
0 0

[PATCH 5.15 0/1] Request to cherry-pick 026d0d27c488 to 5.15.y

by Meena Shanmugam

The commit 026d0d27c488 (ext4: reduce computation of overhead during resize) reduces the time taken to resize large bigalloc filesystems(reduces 3+ hours to milliseconds for a 64TB FS). This is a good candidate to cherry-pick to stable releases. Kiselev, Oleg (1): ext4: reduce computation of overhead during resize fs/ext4/resize.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.40.1.495.gc816e09b53d-goog

1 year, 10 months

1
1
0 0

[PATCH v2 2/2] tpm: Prevent hwrng from activating during resume

by Jarkko Sakkinen

Set TPM_CHIP_FLAG_SUSPENDED in tpm_pm_suspend() and reset in tpm_pm_resume(). While the flag is set, tpm_hwrng() gives back zero bytes. This prevents hwrng from racing during resume. Cc: stable(a)vger.kernel.org Fixes: 6e592a065d51 ("tpm: Move Linux RNG connection to hwrng") Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> --- drivers/char/tpm/tpm-chip.c | 4 ++++ drivers/char/tpm/tpm-interface.c | 10 ++++++++++ include/linux/tpm.h | 1 + 3 files changed, 15 insertions(+) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index c10a4aa97373..cd48033b804a 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -571,6 +571,10 @@ static int tpm_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait) { struct tpm_chip *chip = container_of(rng, struct tpm_chip, hwrng); + /* Give back zero bytes, as TPM chip has not yet fully resumed: */ + if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) + return 0; + return tpm_get_random(chip, data, max); } diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 4463d0018290..586ca10b0d72 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -412,6 +412,8 @@ int tpm_pm_suspend(struct device *dev) } suspended: + chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + if (rc) dev_err(dev, "Ignoring error %d while suspending\n", rc); return 0; @@ -429,6 +431,14 @@ int tpm_pm_resume(struct device *dev) if (chip == NULL) return -ENODEV; + chip->flags &= ~TPM_CHIP_FLAG_SUSPENDED; + + /* + * Guarantee that SUSPENDED is written last, so that hwrng does not + * activate before the chip has been fully resumed. + */ + wmb(); + return 0; } EXPORT_SYMBOL_GPL(tpm_pm_resume); diff --git a/include/linux/tpm.h b/include/linux/tpm.h index 77693389c3f9..6a1e8f157255 100644 --- a/include/linux/tpm.h +++ b/include/linux/tpm.h @@ -282,6 +282,7 @@ enum tpm_chip_flags { TPM_CHIP_FLAG_ALWAYS_POWERED = BIT(5), TPM_CHIP_FLAG_FIRMWARE_POWER_MANAGED = BIT(6), TPM_CHIP_FLAG_FIRMWARE_UPGRADE = BIT(7), + TPM_CHIP_FLAG_SUSPENDED = BIT(8), }; #define to_tpm_chip(d) container_of(d, struct tpm_chip, dev) -- 2.39.2

1 year, 10 months

1
0
0 0

[PATCH v2 1/2] tpm_tis: Use tpm_chip_{start,stop} decoration inside tpm_tis_resume

by Jarkko Sakkinen

Before sending a TPM command, CLKRUN protocol must be disabled. This is not done in the case of tpm1_do_selftest() call site inside tpm_tis_resume(). Address this by decorating the calls with tpm_chip_{start,stop}, which should be always used to arm and disarm the TPM chip for transmission. Finally, move the call to the main TPM driver callback as the last step because it should arm the chip by itself, if it needs that type of functionality. Cc: stable(a)vger.kernel.org Reported-by: Jason A. Donenfeld <Jason(a)zx2c4.com> Closes: https://lore.kernel.org/linux-integrity/CS68AWILHXS4.3M36M1EKZLUMS@suppilov… Fixes: a3fbfae82b4c ("tpm: take TPM chip power gating out of tpm_transmit()") Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> --- drivers/char/tpm/tpm_tis_core.c | 43 +++++++++++++++------------------ 1 file changed, 19 insertions(+), 24 deletions(-) diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c index 02945d53fcef..558144fa707a 100644 --- a/drivers/char/tpm/tpm_tis_core.c +++ b/drivers/char/tpm/tpm_tis_core.c @@ -1209,25 +1209,20 @@ static void tpm_tis_reenable_interrupts(struct tpm_chip *chip) u32 intmask; int rc; - if (chip->ops->clk_enable != NULL) - chip->ops->clk_enable(chip, true); - - /* reenable interrupts that device may have lost or - * BIOS/firmware may have disabled + /* + * Re-enable interrupts that device may have lost or BIOS/firmware may + * have disabled. */ rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), priv->irq); - if (rc < 0) - goto out; + if (rc < 0) { + dev_err(&chip->dev, "Setting IRQ failed.\n"); + return; + } intmask = priv->int_mask | TPM_GLOBAL_INT_ENABLE; - - tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask); - -out: - if (chip->ops->clk_enable != NULL) - chip->ops->clk_enable(chip, false); - - return; + rc = tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask); + if (rc < 0) + dev_err(&chip->dev, "Enabling interrupts failed.\n"); } int tpm_tis_resume(struct device *dev) @@ -1235,27 +1230,27 @@ int tpm_tis_resume(struct device *dev) struct tpm_chip *chip = dev_get_drvdata(dev); int ret; - ret = tpm_tis_request_locality(chip, 0); - if (ret < 0) + ret = tpm_chip_start(chip); + if (ret) return ret; if (chip->flags & TPM_CHIP_FLAG_IRQ) tpm_tis_reenable_interrupts(chip); - ret = tpm_pm_resume(dev); - if (ret) - goto out; - /* * TPM 1.2 requires self-test on resume. This function actually returns * an error code but for unknown reason it isn't handled. */ if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) tpm1_do_selftest(chip); -out: - tpm_tis_relinquish_locality(chip, 0); - return ret; + tpm_chip_stop(chip); + + ret = tpm_pm_resume(dev); + if (ret) + return ret; + + return 0; } EXPORT_SYMBOL_GPL(tpm_tis_resume); #endif -- 2.39.2

1 year, 10 months

1
0
0 0

stable-rc/queue/5.15 baseline: 170 runs, 9 regressions (v5.15.105-369-g658a97f61144)

by kernelci.org bot

stable-rc/queue/5.15 baseline: 170 runs, 9 regressions (v5.15.105-369-g658a97f61144) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ asus-CM1400CXA-dalboz | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 asus-cx9400-volteer | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 beagle-xm | arm | lab-baylibre | gcc-10 | omap2plus_defconfig | 1 cubietruck | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 hp-x360-12b-c...4020-octopus | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 hp-x360-14-G1-sona | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 hp-x360-14a-cb0001xx-zork | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 lenovo-TPad-C13-Yoga-zork | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 rk3328-rock64 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F5.15/kernel/v5.15.10… Test: baseline Tree: stable-rc Branch: queue/5.15 Describe: v5.15.105-369-g658a97f61144 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 658a97f611440b4858437152739b950488fba911 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ asus-CM1400CXA-dalboz | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/644fd30a500fdd19482e861f Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/644fd30a500fdd19482e8624 failing since 34 days (last pass: v5.15.104-76-g9168fe5021cf1, first fail: v5.15.104-83-ga131fb06fbdb) 2023-05-01T14:55:48.410309 + set<8>[ 11.658402] <LAVA_SIGNAL_ENDRUN 0_dmesg 10169639_1.4.2.3.1> 2023-05-01T14:55:48.410418 +x 2023-05-01T14:55:48.514857 / # # 2023-05-01T14:55:48.615613 export SHELL=/bin/sh 2023-05-01T14:55:48.615874 # 2023-05-01T14:55:48.716473 / # export SHELL=/bin/sh. /lava-10169639/environment 2023-05-01T14:55:48.716697 2023-05-01T14:55:48.817214 / # . /lava-10169639/environment/lava-10169639/bin/lava-test-runner /lava-10169639/1 2023-05-01T14:55:48.817551 2023-05-01T14:55:48.822162 / # /lava-10169639/bin/lava-test-runner /lava-10169639/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ asus-cx9400-volteer | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/644fd319936dae4bc92e8600 Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/644fd319936dae4bc92e8605 failing since 34 days (last pass: v5.15.104-76-g9168fe5021cf1, first fail: v5.15.104-83-ga131fb06fbdb) 2023-05-01T14:56:10.011999 <8>[ 10.004286] <LAVA_SIGNAL_ENDRUN 0_dmesg 10169716_1.4.2.3.1> 2023-05-01T14:56:10.015130 + set +x 2023-05-01T14:56:10.116666 2023-05-01T14:56:10.217244 / # #export SHELL=/bin/sh 2023-05-01T14:56:10.217449 2023-05-01T14:56:10.317986 / # export SHELL=/bin/sh. /lava-10169716/environment 2023-05-01T14:56:10.318201 2023-05-01T14:56:10.418752 / # . /lava-10169716/environment/lava-10169716/bin/lava-test-runner /lava-10169716/1 2023-05-01T14:56:10.419083 2023-05-01T14:56:10.424100 / # /lava-10169716/bin/lava-test-runner /lava-10169716/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ beagle-xm | arm | lab-baylibre | gcc-10 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/plan/id/644fd953915fbbb9682e85e6 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: omap2plus_defconfig Compiler: gcc-10 (arm-linux-gnueabihf-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/644fd953915fbbb9682e85e7 failing since 87 days (last pass: v5.15.91-12-g3290f78df1ab, first fail: v5.15.91-18-ga7afd81d41cb) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ cubietruck | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/644fd42bdeb705bffa2e8617 Results: 5 PASS, 1 FAIL, 1 SKIP Full config: multi_v7_defconfig Compiler: gcc-10 (arm-linux-gnueabihf-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/644fd42bdeb705bffa2e861c failing since 104 days (last pass: v5.15.82-123-gd03dbdba21ef, first fail: v5.15.87-100-ge215d5ead661) 2023-05-01T15:00:37.070902 <8>[ 10.041940] <LAVA_SIGNAL_ENDRUN 0_dmesg 3545959_1.5.2.4.1> 2023-05-01T15:00:37.180062 / # # 2023-05-01T15:00:37.283489 export SHELL=/bin/sh 2023-05-01T15:00:37.284438 # 2023-05-01T15:00:37.285016 / # <3>[ 10.193159] Bluetooth: hci0: command 0x0c03 tx timeout 2023-05-01T15:00:37.387076 export SHELL=/bin/sh. /lava-3545959/environment 2023-05-01T15:00:37.388087 2023-05-01T15:00:37.490057 / # . /lava-3545959/environment/lava-3545959/bin/lava-test-runner /lava-3545959/1 2023-05-01T15:00:37.496911 2023-05-01T15:00:37.500644 / # /lava-3545959/bin/lava-test-runner /lava-3545959/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ hp-x360-12b-c...4020-octopus | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/644fd318500fdd19482e8720 Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/644fd318500fdd19482e8725 failing since 34 days (last pass: v5.15.104-76-g9168fe5021cf1, first fail: v5.15.104-83-ga131fb06fbdb) 2023-05-01T14:56:07.585149 + set +x 2023-05-01T14:56:07.591868 <8>[ 10.306688] <LAVA_SIGNAL_ENDRUN 0_dmesg 10169694_1.4.2.3.1> 2023-05-01T14:56:07.699839 / # # 2023-05-01T14:56:07.802124 export SHELL=/bin/sh 2023-05-01T14:56:07.802833 # 2023-05-01T14:56:07.904238 / # export SHELL=/bin/sh. /lava-10169694/environment 2023-05-01T14:56:07.904399 2023-05-01T14:56:08.004920 / # . /lava-10169694/environment/lava-10169694/bin/lava-test-runner /lava-10169694/1 2023-05-01T14:56:08.005172 2023-05-01T14:56:08.009714 / # /lava-10169694/bin/lava-test-runner /lava-10169694/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ hp-x360-14-G1-sona | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/644fd2f83ff101771e2e85e6 Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/644fd2f83ff101771e2e85eb failing since 34 days (last pass: v5.15.104-76-g9168fe5021cf1, first fail: v5.15.104-83-ga131fb06fbdb) 2023-05-01T14:55:40.953317 + set +x 2023-05-01T14:55:40.959943 <8>[ 10.116654] <LAVA_SIGNAL_ENDRUN 0_dmesg 10169663_1.4.2.3.1> 2023-05-01T14:55:41.064514 / # # 2023-05-01T14:55:41.165286 export SHELL=/bin/sh 2023-05-01T14:55:41.165537 # 2023-05-01T14:55:41.266150 / # export SHELL=/bin/sh. /lava-10169663/environment 2023-05-01T14:55:41.266460 2023-05-01T14:55:41.367092 / # . /lava-10169663/environment/lava-10169663/bin/lava-test-runner /lava-10169663/1 2023-05-01T14:55:41.367432 2023-05-01T14:55:41.372240 / # /lava-10169663/bin/lava-test-runner /lava-10169663/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ hp-x360-14a-cb0001xx-zork | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/644fd313500fdd19482e8707 Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/644fd313500fdd19482e870c failing since 34 days (last pass: v5.15.104-76-g9168fe5021cf1, first fail: v5.15.104-83-ga131fb06fbdb) 2023-05-01T14:55:56.452542 + set<8>[ 11.003532] <LAVA_SIGNAL_ENDRUN 0_dmesg 10169662_1.4.2.3.1> 2023-05-01T14:55:56.452948 +x 2023-05-01T14:55:56.559850 / # # 2023-05-01T14:55:56.661805 export SHELL=/bin/sh 2023-05-01T14:55:56.662401 # 2023-05-01T14:55:56.763620 / # export SHELL=/bin/sh. /lava-10169662/environment 2023-05-01T14:55:56.764279 2023-05-01T14:55:56.865488 / # . /lava-10169662/environment/lava-10169662/bin/lava-test-runner /lava-10169662/1 2023-05-01T14:55:56.866577 2023-05-01T14:55:56.871344 / # /lava-10169662/bin/lava-test-runner /lava-10169662/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ lenovo-TPad-C13-Yoga-zork | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/644fd2fd3ff101771e2e85f1 Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/644fd2fd3ff101771e2e85f6 failing since 34 days (last pass: v5.15.104-76-g9168fe5021cf1, first fail: v5.15.104-83-ga131fb06fbdb) 2023-05-01T14:55:41.592012 <8>[ 8.749685] <LAVA_SIGNAL_ENDRUN 0_dmesg 10169679_1.4.2.3.1> 2023-05-01T14:55:41.696570 / # # 2023-05-01T14:55:41.797333 export SHELL=/bin/sh 2023-05-01T14:55:41.797595 # 2023-05-01T14:55:41.898174 / # export SHELL=/bin/sh. /lava-10169679/environment 2023-05-01T14:55:41.898419 2023-05-01T14:55:41.999015 / # . /lava-10169679/environment/lava-10169679/bin/lava-test-runner /lava-10169679/1 2023-05-01T14:55:41.999433 2023-05-01T14:55:42.004097 / # /lava-10169679/bin/lava-test-runner /lava-10169679/1 2023-05-01T14:55:42.009194 + export 'TESTRUN_ID=1_bootrr' ... (11 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ rk3328-rock64 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/644fd1beff2814c69f2e8614 Results: 5 PASS, 1 FAIL, 1 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… HTML log: https://storage.kernelci.org//stable-rc/queue-5.15/v5.15.105-369-g658a97f61… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/644fd1beff2814c69f2e8619 failing since 88 days (last pass: v5.15.72-36-g40cafafcdb983, first fail: v5.15.90-215-gdf99871482a0) 2023-05-01T14:50:21.481008 [ 16.043544] <LAVA_SIGNAL_ENDRUN 0_dmesg 3545872_1.5.2.4.1> 2023-05-01T14:50:21.585106 2023-05-01T14:50:21.585337 / # [ 16.097229] rockchip-drm display-subsystem: [drm] Cannot find any crtc or sizes 2023-05-01T14:50:21.686779 #export SHELL=/bin/sh 2023-05-01T14:50:21.687402 2023-05-01T14:50:21.789021 / # export SHELL=/bin/sh. /lava-3545872/environment 2023-05-01T14:50:21.789447 2023-05-01T14:50:21.890933 / # . /lava-3545872/environment/lava-3545872/bin/lava-test-runner /lava-3545872/1 2023-05-01T14:50:21.891648 2023-05-01T14:50:21.894125 / # /lava-3545872/bin/lava-test-runner /lava-3545872/1 ... (13 line(s) more)

1 year, 10 months

1
0
0 0

[PATCH] mm/mempolicy: Fix use-after-free of VMA iterator

by Liam R. Howlett

set_mempolicy_home_node() iterates over a list of VMAs and calls mbind_range() on each VMA, which also iterates over the singular list of the VMA passed in and potentially splits the VMA. Since the VMA iterator is not passed through, set_mempolicy_home_node() may now point to a stale node in the VMA tree. This can result in a UAF as reported by syzbot. Avoid the stale maple tree node by passing the VMA iterator through to the underlying call to split_vma(). mbind_range() is also overly complicated, since there are two calling functions and one already handles iterating over the VMAs. Simplify mbind_range() to only handle merging and splitting of the VMAs. Align the new loop in do_mbind() and existing loop in set_mempolicy_home_node() to use the reduced mbind_range() function. This allows for a single location of the range calculation and avoids constantly looking up the previous VMA (since this is a loop over the VMAs). Link: https://lore.kernel.org/linux-mm/000000000000c93feb05f87e24ad@google.com/ Reported-and-tested-by: syzbot+a7c1ec5b1d71ceaa5186(a)syzkaller.appspotmail.com Fixes: 66850be55e8e ("mm/mempolicy: use vma iterator & maple state instead of vma linked list") Cc: <stable(a)vger.kernel.org> Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> --- mm/mempolicy.c | 104 +++++++++++++++++++++++-------------------------- 1 file changed, 49 insertions(+), 55 deletions(-) diff --git a/mm/mempolicy.c b/mm/mempolicy.c index a256a241fd1d..2068b594dc88 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -790,61 +790,50 @@ static int vma_replace_policy(struct vm_area_struct *vma, return err; } -/* Step 2: apply policy to a range and do splits. */ -static int mbind_range(struct mm_struct *mm, unsigned long start, - unsigned long end, struct mempolicy *new_pol) +/* Split or merge the VMA (if required) and apply the new policy */ +static int mbind_range(struct vma_iterator *vmi, struct vm_area_struct *vma, + struct vm_area_struct **prev, unsigned long start, + unsigned long end, struct mempolicy *new_pol) { - VMA_ITERATOR(vmi, mm, start); - struct vm_area_struct *prev; - struct vm_area_struct *vma; - int err = 0; + struct vm_area_struct *merged; + unsigned long vmstart, vmend; pgoff_t pgoff; + int err; - prev = vma_prev(&vmi); - vma = vma_find(&vmi, end); - if (WARN_ON(!vma)) + vmend = min(end, vma->vm_end); + if (start > vma->vm_start) { + *prev = vma; + vmstart = start; + } else { + vmstart = vma->vm_start; + } + + if (mpol_equal(vma_policy(vma), new_pol)) return 0; - if (start > vma->vm_start) - prev = vma; - - do { - unsigned long vmstart = max(start, vma->vm_start); - unsigned long vmend = min(end, vma->vm_end); - - if (mpol_equal(vma_policy(vma), new_pol)) - goto next; - - pgoff = vma->vm_pgoff + - ((vmstart - vma->vm_start) >> PAGE_SHIFT); - prev = vma_merge(&vmi, mm, prev, vmstart, vmend, vma->vm_flags, - vma->anon_vma, vma->vm_file, pgoff, - new_pol, vma->vm_userfaultfd_ctx, - anon_vma_name(vma)); - if (prev) { - vma = prev; - goto replace; - } - if (vma->vm_start != vmstart) { - err = split_vma(&vmi, vma, vmstart, 1); - if (err) - goto out; - } - if (vma->vm_end != vmend) { - err = split_vma(&vmi, vma, vmend, 0); - if (err) - goto out; - } -replace: - err = vma_replace_policy(vma, new_pol); + pgoff = vma->vm_pgoff + ((vmstart - vma->vm_start) >> PAGE_SHIFT); + merged = vma_merge(vmi, vma->vm_mm, *prev, vmstart, vmend, vma->vm_flags, + vma->anon_vma, vma->vm_file, pgoff, new_pol, + vma->vm_userfaultfd_ctx, anon_vma_name(vma)); + if (merged) { + *prev = merged; + return vma_replace_policy(merged, new_pol); + } + + if (vma->vm_start != vmstart) { + err = split_vma(vmi, vma, vmstart, 1); if (err) - goto out; -next: - prev = vma; - } for_each_vma_range(vmi, vma, end); + return err; + } -out: - return err; + if (vma->vm_end != vmend) { + err = split_vma(vmi, vma, vmend, 0); + if (err) + return err; + } + + *prev = vma; + return vma_replace_policy(vma, new_pol); } /* Set the process memory policy */ @@ -1259,6 +1248,8 @@ static long do_mbind(unsigned long start, unsigned long len, nodemask_t *nmask, unsigned long flags) { struct mm_struct *mm = current->mm; + struct vm_area_struct *vma, *prev; + struct vma_iterator vmi; struct mempolicy *new; unsigned long end; int err; @@ -1328,7 +1319,13 @@ static long do_mbind(unsigned long start, unsigned long len, goto up_out; } - err = mbind_range(mm, start, end, new); + vma_iter_init(&vmi, mm, start); + prev = vma_prev(&vmi); + for_each_vma_range(vmi, vma, end) { + err = mbind_range(&vmi, vma, &prev, start, end, new); + if (err) + break; + } if (!err) { int nr_failed = 0; @@ -1489,10 +1486,8 @@ SYSCALL_DEFINE4(set_mempolicy_home_node, unsigned long, start, unsigned long, le unsigned long, home_node, unsigned long, flags) { struct mm_struct *mm = current->mm; - struct vm_area_struct *vma; + struct vm_area_struct *vma, *prev; struct mempolicy *new, *old; - unsigned long vmstart; - unsigned long vmend; unsigned long end; int err = -ENOENT; VMA_ITERATOR(vmi, mm, start); @@ -1521,6 +1516,7 @@ SYSCALL_DEFINE4(set_mempolicy_home_node, unsigned long, start, unsigned long, le if (end == start) return 0; mmap_write_lock(mm); + prev = vma_prev(&vmi); for_each_vma_range(vmi, vma, end) { /* * If any vma in the range got policy other than MPOL_BIND @@ -1541,9 +1537,7 @@ SYSCALL_DEFINE4(set_mempolicy_home_node, unsigned long, start, unsigned long, le } new->home_node = home_node; - vmstart = max(start, vma->vm_start); - vmend = min(end, vma->vm_end); - err = mbind_range(mm, vmstart, vmend, new); + err = mbind_range(&vmi, vma, &prev, start, end, new); mpol_put(new); if (err) break; -- 2.39.2

1 year, 10 months

4
4
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror May 2023