On Fri, Dec 01, 2023 at 05:21:33PM +0000, Carlos Llamas wrote:
> Move the padding of 0-sized buffers to an earlier stage to account for
> this round up during the alloc->free_async_space check.
>
> Fixes: 74310e06be4d ("android: binder: Move buffer out of area shared with user space")
> Reviewed-by: Alice Ryhl <aliceryhl(a)google.com>
> Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
> ---
Sorry, I forgot to Cc: stable(a)vger.kernel.org.
--
Carlos Llamas
On Wed, Jan 10, 2024 at 10:12 PM David Howells <dhowells(a)redhat.com> wrote:
>
>
> Fix the size check added to dns_resolver_preparse() for the V1 server-list
> header so that it doesn't give EINVAL if the size supplied is the same as
> the size of the header struct (which should be valid).
>
> This can be tested with:
>
> echo -n -e '\0\0\01\xff\0\0' | keyctl padd dns_resolver desc @p
>
> which will give "add_key: Invalid argument" without this fix.
>
> Fixes: 1997b3cb4217 ("keys, dns: Fix missing size check of V1 server-list header")
[ CC stable(a)vger.kernel.org ]
Your (follow-up) patch is now upstream.
https://git.kernel.org/linus/acc657692aed438e9931438f8c923b2b107aebf9
This misses CC: Stable Tag as suggested by Linus.
Looks like linux-6.1.y and linux-6.6.y needs it, too.
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=…https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=…
BG,
-Sedat-
> Reported-by: Pengfei Xu <pengfei.xu(a)intel.com>
> Link: https://lore.kernel.org/r/ZZ4fyY4r3rqgZL+4@xpf.sh.intel.com/
> Signed-off-by: David Howells <dhowells(a)redhat.com>
> cc: Edward Adam Davis <eadavis(a)qq.com>
> cc: Linus Torvalds <torvalds(a)linux-foundation.org>
> cc: Simon Horman <horms(a)kernel.org>
> Cc: Jarkko Sakkinen <jarkko(a)kernel.org>
> Cc: Jeffrey E Altman <jaltman(a)auristor.com>
> Cc: Wang Lei <wang840925(a)gmail.com>
> Cc: Jeff Layton <jlayton(a)redhat.com>
> Cc: Steve French <sfrench(a)us.ibm.com>
> Cc: Marc Dionne <marc.dionne(a)auristor.com>
> Cc: "David S. Miller" <davem(a)davemloft.net>
> Cc: Eric Dumazet <edumazet(a)google.com>
> Cc: Jakub Kicinski <kuba(a)kernel.org>
> Cc: Paolo Abeni <pabeni(a)redhat.com>
> ---
> net/dns_resolver/dns_key.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
> index f18ca02aa95a..c42ddd85ff1f 100644
> --- a/net/dns_resolver/dns_key.c
> +++ b/net/dns_resolver/dns_key.c
> @@ -104,7 +104,7 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
> const struct dns_server_list_v1_header *v1;
>
> /* It may be a server list. */
> - if (datalen <= sizeof(*v1))
> + if (datalen < sizeof(*v1))
> return -EINVAL;
>
> v1 = (const struct dns_server_list_v1_header *)data;
>
>
On reception of a completion interrupt the SMT memory area is accessed to
retrieve the message header at first and then, if the message sequence
number identifies a transaction which is still pending, the related
payload is fetched too.
When an SCMI command times out the channel ownership remains with the
platform until eventually a late reply is received and, as a consequence,
any further transmission attempt remains pending, waiting for the channel
to be relinquished by the platform.
Once that late reply is received the channel ownership is given back
to the agent and any pending request is then allowed to proceed and
overwrite the SMT area of the just delivered late reply; then the wait for
the reply to the new request starts.
It has been observed that the spurious IRQ related to the late reply can
be wrongly associated with the freshly enqueued request: when that happens
the SCMI stack in-flight lookup procedure is fooled by the fact that the
message header now present in the SMT area is related to the new pending
transaction, even though the real reply has still to arrive.
This race-condition on the A2P channel can be detected by looking at the
channel status bits: a genuine reply from the platform will have set the
channel free bit before triggering the completion IRQ.
Add a consistency check to validate such condition in the A2P ISR.
Reported-by: Xinglong Yang <xinglong.yang(a)cixtech.com>
Closes: https://lore.kernel.org/all/PUZPR06MB54981E6FA00D82BFDBB864FBF08DA@PUZPR06M…
Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type")
CC: stable(a)vger.kernel.org # 5.15+
Signed-off-by: Cristian Marussi <cristian.marussi(a)arm.com>
---
drivers/firmware/arm_scmi/common.h | 1 +
drivers/firmware/arm_scmi/mailbox.c | 14 ++++++++++++++
drivers/firmware/arm_scmi/shmem.c | 6 ++++++
3 files changed, 21 insertions(+)
diff --git a/drivers/firmware/arm_scmi/common.h b/drivers/firmware/arm_scmi/common.h
index 3b7c68a11fd0..0956c2443840 100644
--- a/drivers/firmware/arm_scmi/common.h
+++ b/drivers/firmware/arm_scmi/common.h
@@ -329,6 +329,7 @@ void shmem_fetch_notification(struct scmi_shared_mem __iomem *shmem,
void shmem_clear_channel(struct scmi_shared_mem __iomem *shmem);
bool shmem_poll_done(struct scmi_shared_mem __iomem *shmem,
struct scmi_xfer *xfer);
+bool shmem_channel_free(struct scmi_shared_mem __iomem *shmem);
/* declarations for message passing transports */
struct scmi_msg_payld;
diff --git a/drivers/firmware/arm_scmi/mailbox.c b/drivers/firmware/arm_scmi/mailbox.c
index 19246ed1f01f..b8d470417e8f 100644
--- a/drivers/firmware/arm_scmi/mailbox.c
+++ b/drivers/firmware/arm_scmi/mailbox.c
@@ -45,6 +45,20 @@ static void rx_callback(struct mbox_client *cl, void *m)
{
struct scmi_mailbox *smbox = client_to_scmi_mailbox(cl);
+ /*
+ * An A2P IRQ is NOT valid when received while the platform still has
+ * the ownership of the channel, because the platform at first releases
+ * the SMT channel and then sends the completion interrupt.
+ *
+ * This addresses a possible race condition in which a spurious IRQ from
+ * a previous timed-out reply which arrived late could be wrongly
+ * associated with the next pending transaction.
+ */
+ if (cl->knows_txdone && !shmem_channel_free(smbox->shmem)) {
+ dev_warn(smbox->cinfo->dev, "Ignoring spurious A2P IRQ !\n");
+ return;
+ }
+
scmi_rx_callback(smbox->cinfo, shmem_read_header(smbox->shmem), NULL);
}
diff --git a/drivers/firmware/arm_scmi/shmem.c b/drivers/firmware/arm_scmi/shmem.c
index 87b4f4d35f06..517d52fb3bcb 100644
--- a/drivers/firmware/arm_scmi/shmem.c
+++ b/drivers/firmware/arm_scmi/shmem.c
@@ -122,3 +122,9 @@ bool shmem_poll_done(struct scmi_shared_mem __iomem *shmem,
(SCMI_SHMEM_CHAN_STAT_CHANNEL_ERROR |
SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE);
}
+
+bool shmem_channel_free(struct scmi_shared_mem __iomem *shmem)
+{
+ return (ioread32(&shmem->channel_status) &
+ SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE);
+}
--
2.34.1
Greetings
Are you interested in purchasing HIMSS 2024 Attendees Email Database?
People You Meet: CIO'VP of it/is, CEO, chairman, pre, EXECDIR, ADM/Group practice mgr., CTO, chief executive director, digital health innovation,CMIO,CNIO,CCIO,COO,GM,CMO,CSO,CISO,Director of info security, site security, chief innovation officer, information management system,c-suit,general&finance management ,clinical management'consulant'govermant employee,academic,other, hospital, multihospital system, integrated delivery system, healthcare consulting firm, market supplier,enterpeneur,startup,disuptor,academic medical center,academic medical institution,pharma,lifescience,public health, Ancillary clinical service provider, other
Record in the list contains: Contact Name, Job Title, Company/Business Name, Complete Mailing Address, email, Telephone/Fax Number, Website/URL, Revenue, Employee Size, SIC Code, Industry.
If you are interested, I am happy to "Send Counts and Pricing".
Thanks,
Theresa- Executive Director
ksm_tests was previously mmapping a region of memory, aligning the
returned pointer to a PMD boundary, then setting MADV_HUGEPAGE, but was
setting it past the end of the mmapped area due to not taking the
pointer alignment into consideration. Fix this behaviour.
Up until commit efa7df3e3bb5 ("mm: align larger anonymous mappings on
THP boundaries"), this buggy behavior was (usually) masked because the
alignment difference was always less than PMD-size. But since the
mentioned commit, `ksm_tests -H -s 100` started failing.
Fixes: 325254899684 ("selftests: vm: add KSM huge pages merging time test")
Cc: stable(a)vger.kernel.org
Signed-off-by: Ryan Roberts <ryan.roberts(a)arm.com>
---
Applies on top of mm-unstable.
Thanks,
Ryan
tools/testing/selftests/mm/ksm_tests.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/mm/ksm_tests.c b/tools/testing/selftests/mm/ksm_tests.c
index 380b691d3eb9..b748c48908d9 100644
--- a/tools/testing/selftests/mm/ksm_tests.c
+++ b/tools/testing/selftests/mm/ksm_tests.c
@@ -566,7 +566,7 @@ static int ksm_merge_hugepages_time(int merge_type, int mapping, int prot,
if (map_ptr_orig == MAP_FAILED)
err(2, "initial mmap");
- if (madvise(map_ptr, len + HPAGE_SIZE, MADV_HUGEPAGE))
+ if (madvise(map_ptr, len, MADV_HUGEPAGE))
err(2, "MADV_HUGEPAGE");
pagemap_fd = open("/proc/self/pagemap", O_RDONLY);
--
2.25.1