- Linux-stable-mirror - lists.linaro.org

[Linux-stable-mirror] [PATCH 3.18 00/46] 3.18.92-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 3.18.92 release. There are 46 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Jan 17 12:32:57 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.92-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 3.18.92-rc1 Benjamin Poirier <bpoirier(a)suse.com> e1000e: Fix e1000_check_for_copper_link_ich8lan return value. Icenowy Zheng <icenowy(a)aosc.io> uas: ignore UAS for Norelsys NS1068(X) chips Ben Seri <ben(a)armis.com> Bluetooth: Prevent stack info leak from the EFS element. Viktor Slavkovic <viktors(a)google.com> staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl Shuah Khan <shuahkh(a)osg.samsung.com> usbip: remove kernel addresses from usb device and urb debug msgs Pete Zaitcev <zaitcev(a)redhat.com> USB: fix usbmon BUG trigger Stefan Agner <stefan(a)agner.ch> usb: misc: usb3503: make sure reset is low for at least 100us Christian Holl <cyborgx1(a)gmail.com> USB: serial: cp210x: add new device ID ELV ALC 8xxx Diego Elio Pettenò <flameeyes(a)flameeyes.eu> USB: serial: cp210x: add IDs for LifeScan OneTouch Verio IQ Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "can: kvaser_usb: free buf in error paths" Nicholas Bellinger <nab(a)linux-iscsi.org> target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK Nicholas Bellinger <nab(a)linux-iscsi.org> iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref Jia Zhang <qianyue.zj(a)alibaba-inc.com> x86/microcode/intel: Extend BDW late-loading with a revision check Eric Biggers <ebiggers(a)google.com> crypto: algapi - fix NULL dereference in crypto_remove_spawns() Jerome Brunet <jbrunet(a)baylibre.com> net: stmmac: enable EEE in MII, GMII or RGMII only Sergei Shtylyov <sergei.shtylyov(a)cogentembedded.com> sh_eth: fix SH7757 GEther initialization Sergei Shtylyov <sergei.shtylyov(a)cogentembedded.com> sh_eth: fix TSU resource handling Mohamed Ghannam <simo.ghannam(a)gmail.com> RDS: null pointer dereference in rds_atomic_free_op Mohamed Ghannam <simo.ghannam(a)gmail.com> RDS: Heap OOB write in rds_message_alloc_sgs() Cong Wang <xiyou.wangcong(a)gmail.com> 8021q: fix a memory leak for VLAN 0 device Vikas C Sajjan <vikas.cha.sajjan(a)hpe.com> x86/acpi: Reduce code duplication in mp_override_legacy_irq() Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Fix racy hw constraints adjustment Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Fix inconsistent format due to incomplete rule Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Release cable upon open error path Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Allow aborting mutex lock at OSS read/write loops Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Abort properly at pending signal in OSS read/write loops Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Add missing error checks in OSS emulation plugin builder Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Remove incorrect snd_BUG_ON() usages Vikas C Sajjan <vikas.cha.sajjan(a)hpe.com> x86/acpi: Handle SCI interrupts above legacy space gracefully Jim Mattson <jmattson(a)google.com> kvm: vmx: Scrub hardware GPRs at VM-exit Peter Zijlstra <peterz(a)infradead.org> perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race Maciej W. Rozycki <macro(a)mips.com> MIPS: Also verify sizeof `elf_fpreg_t' with PTRACE_SETREGSET Maciej W. Rozycki <macro(a)mips.com> MIPS: Disallow outsized PTRACE_SETREGSET NT_PRFPREG regset accesses Maciej W. Rozycki <macro(a)mips.com> MIPS: Fix an FCSR access API regression with NT_PRFPREG and MSA Maciej W. Rozycki <macro(a)mips.com> MIPS: Consistently handle buffer counter with PTRACE_SETREGSET Maciej W. Rozycki <macro(a)mips.com> MIPS: Guard against any partial write attempt with PTRACE_SETREGSET Maciej W. Rozycki <macro(a)mips.com> MIPS: Factor out NT_PRFPREG regset access helpers Bart Van Assche <bart.vanassche(a)wdc.com> IB/srpt: Disable RDMA access by the initiator Wolfgang Grandegger <wg(a)grandegger.com> can: gs_usb: fix return value of the "set_bittiming" callback Aaron Ma <aaron.ma(a)canonical.com> Input: elantech - add new icbody type 15 Oleg Nesterov <oleg(a)redhat.com> kernel/signal.c: remove the no longer needed SIGNAL_UNKILLABLE check in complete_signal() Oleg Nesterov <oleg(a)redhat.com> kernel/signal.c: protect the SIGNAL_UNKILLABLE tasks from !sig_kernel_only() signals Oleg Nesterov <oleg(a)redhat.com> kernel/signal.c: protect the traced SIGNAL_UNKILLABLE tasks from SIGKILL David Howells <dhowells(a)redhat.com> fscache: Fix the default for fscache_maybe_release_page() Jan Engelhardt <jengelh(a)inai.de> crypto: n2 - cure use after free Oleg Nesterov <oleg(a)redhat.com> kernel/acct.c: fix the acct->needcheck check in check_free_space() ------------- Diffstat: Makefile | 4 +- arch/mips/kernel/ptrace.c | 147 ++++++++++++++++++---- arch/x86/kernel/acpi/boot.c | 60 +++++---- arch/x86/kernel/cpu/microcode/intel.c | 13 +- arch/x86/kvm/svm.c | 19 +++ arch/x86/kvm/vmx.c | 14 ++- crypto/algapi.c | 12 ++ drivers/crypto/n2_core.c | 3 + drivers/infiniband/ulp/srpt/ib_srpt.c | 3 +- drivers/input/mouse/elantech.c | 2 +- drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/can/usb/kvaser_usb.c | 2 - drivers/net/ethernet/intel/e1000e/ich8lan.c | 11 +- drivers/net/ethernet/renesas/sh_eth.c | 29 ++++- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 + drivers/staging/android/ashmem.c | 2 + drivers/target/iscsi/iscsi_target.c | 21 ++-- drivers/target/target_core_tmr.c | 9 ++ drivers/target/target_core_transport.c | 2 + drivers/usb/misc/usb3503.c | 2 + drivers/usb/mon/mon_bin.c | 8 +- drivers/usb/serial/cp210x.c | 2 + drivers/usb/storage/unusual_uas.h | 7 ++ drivers/usb/usbip/usbip_common.c | 17 +-- include/linux/fscache.h | 2 +- include/linux/phy.h | 11 ++ include/linux/sh_eth.h | 1 - include/target/target_core_base.h | 1 + kernel/acct.c | 2 +- kernel/events/core.c | 61 ++++++++- kernel/signal.c | 18 +-- net/8021q/vlan.c | 7 +- net/bluetooth/l2cap_core.c | 20 +-- net/rds/rdma.c | 4 + sound/core/oss/pcm_oss.c | 41 +++--- sound/core/oss/pcm_plugin.c | 14 ++- sound/core/pcm_lib.c | 4 +- sound/drivers/aloop.c | 98 ++++++++------- 38 files changed, 488 insertions(+), 193 deletions(-)

7 years, 3 months

3
47
0 0

[Linux-stable-mirror] [merged] kdump-write-a-correct-address-of-mem_section-into-vmcoreinfo.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: kdump: write correct address of mem_section into vmcoreinfo has been removed from the -mm tree. Its filename was kdump-write-a-correct-address-of-mem_section-into-vmcoreinfo.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> Subject: kdump: write correct address of mem_section into vmcoreinfo Depending on configuration mem_section can now be an array or a pointer to an array allocated dynamically. In most cases, we can continue to refer to it as 'mem_section' regardless of what it is. But there's one exception: '&mem_section' means "address of the array" if mem_section is an array, but if mem_section is a pointer, it would mean "address of the pointer". We've stepped onto this in kdump code. VMCOREINFO_SYMBOL(mem_section) writes down address of pointer into vmcoreinfo, not array as we wanted. Let's introduce VMCOREINFO_SYMBOL_ARRAY() that would handle the situation correctly for both cases. Link: http://lkml.kernel.org/r/20180112162532.35896-1-kirill.shutemov@linux.intel… Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Fixes: 83e3c48729d9 ("mm/sparsemem: Allocate mem_section at runtime for CONFIG_SPARSEMEM_EXTREME=y") Acked-by: Baoquan He <bhe(a)redhat.com> Acked-by: Dave Young <dyoung(a)redhat.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Dave Young <dyoung(a)redhat.com> Cc: Baoquan He <bhe(a)redhat.com> Cc: Vivek Goyal <vgoyal(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/crash_core.h | 2 ++ kernel/crash_core.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff -puN include/linux/crash_core.h~kdump-write-a-correct-address-of-mem_section-into-vmcoreinfo include/linux/crash_core.h --- a/include/linux/crash_core.h~kdump-write-a-correct-address-of-mem_section-into-vmcoreinfo +++ a/include/linux/crash_core.h @@ -42,6 +42,8 @@ phys_addr_t paddr_vmcoreinfo_note(void); vmcoreinfo_append_str("PAGESIZE=%ld\n", value) #define VMCOREINFO_SYMBOL(name) \ vmcoreinfo_append_str("SYMBOL(%s)=%lx\n", #name, (unsigned long)&name) +#define VMCOREINFO_SYMBOL_ARRAY(name) \ + vmcoreinfo_append_str("SYMBOL(%s)=%lx\n", #name, (unsigned long)name) #define VMCOREINFO_SIZE(name) \ vmcoreinfo_append_str("SIZE(%s)=%lu\n", #name, \ (unsigned long)sizeof(name)) diff -puN kernel/crash_core.c~kdump-write-a-correct-address-of-mem_section-into-vmcoreinfo kernel/crash_core.c --- a/kernel/crash_core.c~kdump-write-a-correct-address-of-mem_section-into-vmcoreinfo +++ a/kernel/crash_core.c @@ -410,7 +410,7 @@ static int __init crash_save_vmcoreinfo_ VMCOREINFO_SYMBOL(contig_page_data); #endif #ifdef CONFIG_SPARSEMEM - VMCOREINFO_SYMBOL(mem_section); + VMCOREINFO_SYMBOL_ARRAY(mem_section); VMCOREINFO_LENGTH(mem_section, NR_SECTION_ROOTS); VMCOREINFO_STRUCT_SIZE(mem_section); VMCOREINFO_OFFSET(mem_section, section_mem_map); _ Patches currently in -mm which might be from kirill.shutemov(a)linux.intel.com are asm-generic-provide-generic_pmdp_establish.patch arc-use-generic_pmdp_establish-as-pmdp_establish.patch arm-mm-provide-pmdp_establish-helper.patch mips-use-generic_pmdp_establish-as-pmdp_establish.patch x86-mm-provide-pmdp_establish-helper.patch mm-do-not-lose-dirty-and-access-bits-in-pmdp_invalidate.patch mm-use-updated-pmdp_invalidate-interface-to-track-dirty-accessed-bits.patch

7 years, 3 months

1
0
0 0

[Linux-stable-mirror] [PATCH v4] brcmfmac: fix CLM load error for legacy chips when user helper is enabled

by Wright Feng

For legacy chips without CLM blob files, kernel with user helper function returns -EAGAIN when we request_firmware(), and then driver got failed when bringing up legacy chips. We expect the CLM blob file for legacy chip is not existence in firmware path, but the -ENOENT error is transferred to -EAGAIN in firmware_class.c with user helper. Because of that, we continue with CLM data currently present in firmware if getting error from doing request_firmware(). Cc: stable(a)vger.kernel.org # v4.15.y Reviewed-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Wright Feng <wright.feng(a)cypress.com> --- v2: remove retry from patch v1 v3: remove redundant log print v4: modify log print --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c index 6a59d06..9be0b05 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c @@ -182,12 +182,9 @@ static int brcmf_c_process_clm_blob(struct brcmf_if *ifp) err = request_firmware(&clm, clm_name, dev); if (err) { - if (err == -ENOENT) { - brcmf_dbg(INFO, "continue with CLM data currently present in firmware\n"); - return 0; - } - brcmf_err("request CLM blob file failed (%d)\n", err); - return err; + brcmf_info("no clm_blob available(err=%d), device may have limited channels available\n", + err); + return 0; } chunk_buf = kzalloc(sizeof(*chunk_buf) + MAX_CHUNK_LEN - 1, GFP_KERNEL); -- 1.9.1

7 years, 3 months

2
2
0 0

[Linux-stable-mirror] [PATCH 1/2] can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once

by Marc Kleine-Budde

If an invalid CAN frame is received, from a driver or from a tun interface, a Kernel warning is generated. This patch replaces the WARN_ONCE by a simple pr_warn_once, so that a kernel, bootet with panic_on_warn, does not panic. A printk seems to be more appropriate here. Reported-by: syzbot+4386709c0c1284dca827(a)syzkaller.appspotmail.com Suggested-by: Dmitry Vyukov <dvyukov(a)google.com> Cc: linux-stable <stable(a)vger.kernel.org> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> --- net/can/af_can.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/net/can/af_can.c b/net/can/af_can.c index 003b2d6d655f..ae835382e678 100644 --- a/net/can/af_can.c +++ b/net/can/af_can.c @@ -721,20 +721,16 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, { struct canfd_frame *cfd = (struct canfd_frame *)skb->data; - if (WARN_ONCE(dev->type != ARPHRD_CAN || - skb->len != CAN_MTU || - cfd->len > CAN_MAX_DLEN, - "PF_CAN: dropped non conform CAN skbuf: " - "dev type %d, len %d, datalen %d\n", - dev->type, skb->len, cfd->len)) - goto drop; + if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU || + cfd->len > CAN_MAX_DLEN)) { + pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n", + dev->type, skb->len, cfd->len); + kfree_skb(skb); + return NET_RX_DROP; + } can_receive(skb, dev); return NET_RX_SUCCESS; - -drop: - kfree_skb(skb); - return NET_RX_DROP; } static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, -- 2.15.1

7 years, 3 months

1
1
0 0

[Linux-stable-mirror] [PULL v2 3/3] arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls

by Christoffer Dall

From: Marc Zyngier <marc.zyngier(a)arm.com> KVM doesn't follow the SMCCC when it comes to unimplemented calls, and inject an UNDEF instead of returning an error. Since firmware calls are now used for security mitigation, they are becoming more common, and the undef is counter productive. Instead, let's follow the SMCCC which states that -1 must be returned to the caller when getting an unknown function number. Cc: <stable(a)vger.kernel.org> Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com> Signed-off-by: Christoffer Dall <christoffer.dall(a)linaro.org> --- arch/arm64/kvm/handle_exit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c index 304203fa9e33..e60494f1eef9 100644 --- a/arch/arm64/kvm/handle_exit.c +++ b/arch/arm64/kvm/handle_exit.c @@ -45,7 +45,7 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run) ret = kvm_psci_call(vcpu); if (ret < 0) { - kvm_inject_undefined(vcpu); + vcpu_set_reg(vcpu, 0, ~0UL); return 1; } @@ -54,7 +54,7 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run) static int handle_smc(struct kvm_vcpu *vcpu, struct kvm_run *run) { - kvm_inject_undefined(vcpu); + vcpu_set_reg(vcpu, 0, ~0UL); return 1; } -- 2.14.2

7 years, 3 months

1
0
0 0

[Linux-stable-mirror] [PULL v2 1/3] KVM: arm/arm64: Check pagesize when allocating a hugepage at Stage 2

by Christoffer Dall

From: Punit Agrawal <punit.agrawal(a)arm.com> KVM only supports PMD hugepages at stage 2 but doesn't actually check that the provided hugepage memory pagesize is PMD_SIZE before populating stage 2 entries. In cases where the backing hugepage size is smaller than PMD_SIZE (such as when using contiguous hugepages), KVM can end up creating stage 2 mappings that extend beyond the supplied memory. Fix this by checking for the pagesize of userspace vma before creating PMD hugepage at stage 2. Fixes: 66b3923a1a0f77a ("arm64: hugetlb: add support for PTE contiguous bit") Signed-off-by: Punit Agrawal <punit.agrawal(a)arm.com> Cc: Marc Zyngier <marc.zyngier(a)arm.com> Cc: <stable(a)vger.kernel.org> # v4.5+ Reviewed-by: Christoffer Dall <christoffer.dall(a)linaro.org> Signed-off-by: Christoffer Dall <christoffer.dall(a)linaro.org> --- virt/kvm/arm/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c index b4b69c2d1012..9dea96380339 100644 --- a/virt/kvm/arm/mmu.c +++ b/virt/kvm/arm/mmu.c @@ -1310,7 +1310,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, return -EFAULT; } - if (is_vm_hugetlb_page(vma) && !logging_active) { + if (vma_kernel_pagesize(vma) == PMD_SIZE && !logging_active) { hugetlb = true; gfn = (fault_ipa & PMD_MASK) >> PAGE_SHIFT; } else { -- 2.14.2

7 years, 3 months

1
0
0 0

[Linux-stable-mirror] [PATCH] x86/pti: Fix !PCID and sanitize defines

by Thomas Gleixner

The switch to the user space page tables in the low level ASM code sets unconditionally bit 12 and bit 11 of CR3. Bit 12 is switching the base address of the page directory to the user part, bit 11 is switching the PCID to the PCID associated with the user page tables. This fails on a machine which lacks PCID support because bit 11 is set in CR3. Bit 11 is reserved when PCID is inactive. While the Intel SDM claims that the reserved bits are ignored when PCID is disabled, the AMD APM states that they should be cleared. This went unnoticed as the AMD APM was not checked when the code was developed and reviewed and test systems with Intel CPUs never failed to boot. The report is against a Centos 6 host where the guest fails to boot, so it's not yet clear whether this is a virt issue or can happen on real hardware too, but thats irrelevant as the AMD APM clearly ask for clearing the reserved bits. Make sure that on non PCID machines bit 11 is not set by the page table switching code. Andy suggested to rename the related bits and masks so they are clearly describing what they should be used for, which is done as well for clarity. That split could have been done with alternatives but the macro hell is horrible and ugly. This can be done on top if someone cares to remove the extra orq. For now it's a straight forward fix. Fixes: 6fd166aae78c ("x86/mm: Use/Fix PCID to optimize user/kernel switches") Reported-by: Laura Abbott <labbott(a)redhat.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Willy Tarreau <w(a)1wt.eu> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Borislav Petkov <bp(a)alien8.de> Cc: stable(a)vger.kernel.org --- arch/x86/entry/calling.h | 36 +++++++++++++++++---------------- arch/x86/include/asm/processor-flags.h | 2 - arch/x86/include/asm/tlbflush.h | 6 ++--- 3 files changed, 23 insertions(+), 21 deletions(-) --- a/arch/x86/entry/calling.h +++ b/arch/x86/entry/calling.h @@ -198,8 +198,11 @@ For 32-bit we have the following convent * PAGE_TABLE_ISOLATION PGDs are 8k. Flip bit 12 to switch between the two * halves: */ -#define PTI_SWITCH_PGTABLES_MASK (1<<PAGE_SHIFT) -#define PTI_SWITCH_MASK (PTI_SWITCH_PGTABLES_MASK|(1<<X86_CR3_PTI_SWITCH_BIT)) +#define PTI_USER_PGTABLE_BIT PAGE_SHIFT +#define PTI_USER_PGTABLE_MASK (1 << PTI_USER_PGTABLE_BIT) +#define PTI_USER_PCID_BIT X86_CR3_PTI_PCID_USER_BIT +#define PTI_USER_PCID_MASK (1 << PTI_USER_PCID_BIT) +#define PTI_USER_PGTABLE_AND_PCID_MASK (PTI_USER_PCID_MASK | PTI_USER_PGTABLE_MASK) .macro SET_NOFLUSH_BIT reg:req bts $X86_CR3_PCID_NOFLUSH_BIT, \reg @@ -208,7 +211,7 @@ For 32-bit we have the following convent .macro ADJUST_KERNEL_CR3 reg:req ALTERNATIVE "", "SET_NOFLUSH_BIT \reg", X86_FEATURE_PCID /* Clear PCID and "PAGE_TABLE_ISOLATION bit", point CR3 at kernel pagetables: */ - andq $(~PTI_SWITCH_MASK), \reg + andq $(~PTI_USER_PGTABLE_AND_PCID_MASK), \reg .endm .macro SWITCH_TO_KERNEL_CR3 scratch_reg:req @@ -239,15 +242,19 @@ For 32-bit we have the following convent /* Flush needed, clear the bit */ btr \scratch_reg, THIS_CPU_user_pcid_flush_mask movq \scratch_reg2, \scratch_reg - jmp .Lwrcr3_\@ + jmp .Lwrcr3_pcid_\@ .Lnoflush_\@: movq \scratch_reg2, \scratch_reg SET_NOFLUSH_BIT \scratch_reg +.Lwrcr3_pcid_\@: + /* Flip the ASID to the user version */ + orq $(PTI_USER_PCID_MASK), \scratch_reg + .Lwrcr3_\@: - /* Flip the PGD and ASID to the user version */ - orq $(PTI_SWITCH_MASK), \scratch_reg + /* Flip the PGD to the user version */ + orq $(PTI_USER_PGTABLE_MASK), \scratch_reg mov \scratch_reg, %cr3 .Lend_\@: .endm @@ -263,17 +270,12 @@ For 32-bit we have the following convent movq %cr3, \scratch_reg movq \scratch_reg, \save_reg /* - * Is the "switch mask" all zero? That means that both of - * these are zero: - * - * 1. The user/kernel PCID bit, and - * 2. The user/kernel "bit" that points CR3 to the - * bottom half of the 8k PGD - * - * That indicates a kernel CR3 value, not a user CR3. + * Test the user pagetable bit. If set, then the user page tables + * are active. If clear CR3 already has the kernel page table + * active. */ - testq $(PTI_SWITCH_MASK), \scratch_reg - jz .Ldone_\@ + bt $PTI_USER_PGTABLE_BIT, \scratch_reg + jnc .Ldone_\@ ADJUST_KERNEL_CR3 \scratch_reg movq \scratch_reg, %cr3 @@ -290,7 +292,7 @@ For 32-bit we have the following convent * KERNEL pages can always resume with NOFLUSH as we do * explicit flushes. */ - bt $X86_CR3_PTI_SWITCH_BIT, \save_reg + bt $PTI_USER_PGTABLE_BIT, \save_reg jnc .Lnoflush_\@ /* --- a/arch/x86/include/asm/processor-flags.h +++ b/arch/x86/include/asm/processor-flags.h @@ -40,7 +40,7 @@ #define CR3_NOFLUSH BIT_ULL(63) #ifdef CONFIG_PAGE_TABLE_ISOLATION -# define X86_CR3_PTI_SWITCH_BIT 11 +# define X86_CR3_PTI_PCID_USER_BIT 11 #endif #else --- a/arch/x86/include/asm/tlbflush.h +++ b/arch/x86/include/asm/tlbflush.h @@ -81,13 +81,13 @@ static inline u16 kern_pcid(u16 asid) * Make sure that the dynamic ASID space does not confict with the * bit we are using to switch between user and kernel ASIDs. */ - BUILD_BUG_ON(TLB_NR_DYN_ASIDS >= (1 << X86_CR3_PTI_SWITCH_BIT)); + BUILD_BUG_ON(TLB_NR_DYN_ASIDS >= (1 << X86_CR3_PTI_PCID_USER_BIT)); /* * The ASID being passed in here should have respected the * MAX_ASID_AVAILABLE and thus never have the switch bit set. */ - VM_WARN_ON_ONCE(asid & (1 << X86_CR3_PTI_SWITCH_BIT)); + VM_WARN_ON_ONCE(asid & (1 << X86_CR3_PTI_PCID_USER_BIT)); #endif /* * The dynamically-assigned ASIDs that get passed in are small @@ -112,7 +112,7 @@ static inline u16 user_pcid(u16 asid) { u16 ret = kern_pcid(asid); #ifdef CONFIG_PAGE_TABLE_ISOLATION - ret |= 1 << X86_CR3_PTI_SWITCH_BIT; + ret |= 1 << X86_CR3_PTI_PCID_USER_BIT; #endif return ret; }

7 years, 3 months

6
5
0 0

[Linux-stable-mirror] [PATCH 3.10.y] [FIX BAD BACKPORT] Btrfs: add missing brelse when superblock checksum fails

by Jeff Mahoney

Commit b2acdddfad13c38a1e8b927d83c3cf321f63601a upstream. linux-3.10.y commit bf00d124e07 (Btrfs: add missing brelse when superblock checksum fails) was misapplied to a later error handling site. The result is that it doesn't actually free the buffer on checksum failure but does attempt to double free the buffer if unsupported features are used. The backport of b2acdddfad1 in other branches is correct. Cc: <stable(a)vger.kernel.org> # 3.10 Cc: Anand Jain <anand.jain(a)oracle.com> Signed-off-by: Jeff Mahoney <jeffm(a)suse.com> --- fs/btrfs/disk-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index 9612a01198df..c690886f2813 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -2311,6 +2311,7 @@ int open_ctree(struct super_block *sb, if (btrfs_check_super_csum(bh->b_data)) { printk(KERN_ERR "btrfs: superblock checksum mismatch\n"); err = -EINVAL; + brelse(bh); goto fail_alloc; } @@ -2437,7 +2438,6 @@ int open_ctree(struct super_block *sb, "unsupported option features (%Lx).\n", (unsigned long long)features); err = -EINVAL; - brelse(bh); goto fail_alloc; } -- 2.14.2 -- Jeff Mahoney SUSE Labs

7 years, 3 months

2
1
0 0

[Linux-stable-mirror] [PATCH 4.9 00/75] 4.9.74-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.74 release. There are 75 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Jan 3 14:00:03 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.74-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.74-rc1 Johan Hovold <johan(a)kernel.org> tty: fix tty_ldisc_receive_buf() documentation Linus Torvalds <torvalds(a)linux-foundation.org> n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD) Thomas Gleixner <tglx(a)linutronix.de> x86/smpboot: Remove stale TLB flush invocations Thomas Gleixner <tglx(a)linutronix.de> nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick() Thomas Gleixner <tglx(a)linutronix.de> timers: Reinitialize per cpu bases on hotplug Thomas Gleixner <tglx(a)linutronix.de> timers: Invoke timer_start_debug() where it makes sense Anna-Maria Gleixner <anna-maria(a)linutronix.de> timers: Use deferrable base independent of base::nohz_active Daniel Thompson <daniel.thompson(a)linaro.org> usb: xhci: Add XHCI_TRUST_TX_LENGTH for Renesas uPD720201 Mathias Nyman <mathias.nyman(a)linux.intel.com> USB: Fix off by one in type-specific length check of BOS SSP capability Oliver Neukum <oneukum(a)suse.com> usb: add RESET_RESUME for ELSA MicroLink 56K Dmitry Fleytman Dmitry Fleytman <dmitry.fleytman(a)gmail.com> usb: Add device quirk for Logitech HD Pro Webcam C925e SZ Lin (林上智) <sz.lin(a)moxa.com> USB: serial: option: adding support for YUGA CLM920-NC5 Daniele Palmas <dnlplm(a)gmail.com> USB: serial: option: add support for Telit ME910 PID 0x1101 Reinhard Speyerer <rspmn(a)arcor.de> USB: serial: qcserial: add Sierra Wireless EM7565 Max Schulze <max.schulze(a)posteo.de> USB: serial: ftdi_sio: add id for Airbus DS P8GR Shuah Khan <shuah(a)kernel.org> usbip: vhci: stop printing kernel pointer addresses in messages Shuah Khan <shuah(a)kernel.org> usbip: stub: stop printing kernel pointer addresses in messages Shuah Khan <shuah(a)kernel.org> usbip: prevent leaking socket pointer address in messages Juan Zea <juan.zea(a)qindel.com> usbip: fix usbip bind writing random string after command in match_busid Julian Wiedmann <jwi(a)linux.vnet.ibm.com> s390/qeth: update takeover IPs after configuration change Julian Wiedmann <jwi(a)linux.vnet.ibm.com> s390/qeth: lock IP table while applying takeover changes Julian Wiedmann <jwi(a)linux.vnet.ibm.com> s390/qeth: don't apply takeover changes to RXIP Julian Wiedmann <jwi(a)linux.vnet.ibm.com> s390/qeth: apply takeover changes when mode is toggled Moni Shoua <monis(a)mellanox.com> net/mlx5: Fix error flow in CREATE_QP command Gal Pressman <galp(a)mellanox.com> net/mlx5e: Prevent possible races in VXLAN control flow Gal Pressman <galp(a)mellanox.com> net/mlx5e: Add refcount to VXLAN structure Gal Pressman <galp(a)mellanox.com> net/mlx5e: Fix possible deadlock of VXLAN lock Gal Pressman <galp(a)mellanox.com> net/mlx5e: Fix features check of IPv6 traffic Eran Ben Elisha <eranbe(a)mellanox.com> net/mlx5: Fix rate limit packet pacing naming and struct Yousuk Seung <ysseung(a)google.com> tcp: invalidate rate samples during SACK reneging Willem de Bruijn <willemb(a)google.com> sock: free skb in skb_complete_tx_timestamp on error Grygorii Strashko <grygorii.strashko(a)ti.com> net: phy: micrel: ksz9031: reconfigure autoneg after phy autoneg workaround Eric W. Biederman <ebiederm(a)xmission.com> net: Fix double free and memory corruption in get_net_ns_by_id() Andrew Lunn <andrew(a)lunn.ch> net: fec: Allow reception of frames bigger than 1522 bytes Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks Ido Schimmel <idosch(a)mellanox.com> ipv4: Fix use-after-free when flushing FIB tables Nikita V. Shirokov <tehnerd(a)fb.com> adding missing rcu_read_unlock in ipxip6_rcv Tonghao Zhang <xiangxia.m.yue(a)gmail.com> sctp: Replace use of sockets_allocated with specified macro. Tobias Jordan <Tobias.Jordan(a)elektrobit.com> net: mvmdio: disable/unprepare clocks in EPROBE_DEFER case Mohamed Ghannam <simo.ghannam(a)gmail.com> net: ipv4: fix for a race condition in raw_sendmsg Brian King <brking(a)linux.vnet.ibm.com> tg3: Fix rx hang on MTU change with 5717/5719 Christoph Paasch <cpaasch(a)apple.com> tcp md5sig: Use skb's saddr when replying to an incoming segment Neal Cardwell <ncardwell(a)google.com> tcp_bbr: record "full bw reached" decision in new full_bw_reached bit Avinash Repaka <avinash.repaka(a)oracle.com> RDS: Check cmsg_len before dereferencing CMSG_DATA Michael S. Tsirkin <mst(a)redhat.com> ptr_ring: add barriers Shaohua Li <shli(a)fb.com> net: reevalulate autoflowlabel setting after sysctl setting Sebastian Sjoholm <ssjoholm(a)mac.com> net: qmi_wwan: add Sierra EM7565 1199:9091 Kevin Cernekee <cernekee(a)chromium.org> netlink: Add netns check on taps Kevin Cernekee <cernekee(a)chromium.org> net: igmp: Use correct source address on IGMPv3 reports Fugang Duan <fugang.duan(a)nxp.com> net: fec: unmap the xmit buffer that are not transferred by DMA Eric Dumazet <edumazet(a)google.com> ipv6: mcast: better catch silly mtu values Eric Dumazet <edumazet(a)google.com> ipv4: igmp: guard against silly MTU values Linus Torvalds <torvalds(a)linux-foundation.org> kbuild: add '-fno-stack-check' to kernel build options Andy Lutomirski <luto(a)kernel.org> x86/mm/64: Fix reboot interaction with CR4.PCIDE Andy Lutomirski <luto(a)kernel.org> x86/mm: Enable CR4.PCIDE on supported systems Andy Lutomirski <luto(a)kernel.org> x86/mm: Add the 'nopcid' boot option to turn off PCID Andy Lutomirski <luto(a)kernel.org> x86/mm: Disable PCID on 32-bit kernels Andy Lutomirski <luto(a)kernel.org> x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code Andy Lutomirski <luto(a)kernel.org> x86/mm: Reimplement flush_tlb_page() using flush_tlb_mm_range() Andy Lutomirski <luto(a)kernel.org> x86/mm: Make flush_tlb_mm_range() more predictable Andy Lutomirski <luto(a)kernel.org> x86/mm: Remove flush_tlb() and flush_tlb_current_task() Andy Lutomirski <luto(a)kernel.org> x86/vm86/32: Switch to flush_tlb_mm_range() in mark_screen_rdonly() Hui Wang <hui.wang(a)canonical.com> ALSA: hda - fix headset mic detection issue on a Dell machine Takashi Iwai <tiwai(a)suse.de> ALSA: hda: Drop useless WARN_ON() Andrew F. Davis <afd(a)ti.com> ASoC: tlv320aic31xx: Fix GPIO1 register definition Johan Hovold <johan(a)kernel.org> ASoC: twl4030: fix child-node lookup Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> ASoC: fsl_ssi: AC'97 ops need regmap, clock and cleaning up on failure Johan Hovold <johan(a)kernel.org> ASoC: da7218: fix fix child-node lookup Ben Hutchings <ben.hutchings(a)codethink.co.uk> ASoC: wm_adsp: Fix validation of firmware and coeff lengths Steve Wise <swise(a)opengridcomputing.com> iw_cxgb4: Only validate the MSN for successful completions Steven Rostedt (VMware) <rostedt(a)goodmis.org> ring-buffer: Mask out the info bits when returning buffer page length Jing Xia <jing.xia(a)spreadtrum.com> tracing: Fix crash when it fails to alloc ring buffer Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Fix possible double free on failure of allocating trace buffer Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Remove extra zeroing out of the ring buffer page Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> sync objtool's copy of x86-opcode-map.txt ------------- Diffstat: Documentation/kernel-parameters.txt | 2 + Makefile | 7 +- arch/x86/Kconfig | 2 +- arch/x86/include/asm/disabled-features.h | 4 +- arch/x86/include/asm/hardirq.h | 2 +- arch/x86/include/asm/mmu.h | 6 -- arch/x86/include/asm/mmu_context.h | 2 - arch/x86/include/asm/tlbflush.h | 99 +++-------------------- arch/x86/kernel/cpu/bugs.c | 8 ++ arch/x86/kernel/cpu/common.c | 40 +++++++++ arch/x86/kernel/reboot.c | 4 + arch/x86/kernel/smpboot.c | 9 --- arch/x86/kernel/vm86_32.c | 2 +- arch/x86/mm/init.c | 2 - arch/x86/mm/tlb.c | 73 +++-------------- arch/x86/xen/enlighten.c | 6 ++ drivers/infiniband/hw/cxgb4/cq.c | 6 +- drivers/net/ethernet/broadcom/tg3.c | 4 +- drivers/net/ethernet/freescale/fec_main.c | 14 +++- drivers/net/ethernet/marvell/mvmdio.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/qp.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/rl.c | 22 ++--- drivers/net/ethernet/mellanox/mlx5/core/vxlan.c | 64 ++++++++------- drivers/net/ethernet/mellanox/mlx5/core/vxlan.h | 1 + drivers/net/phy/micrel.c | 1 + drivers/net/usb/qmi_wwan.c | 1 + drivers/s390/net/qeth_core.h | 6 +- drivers/s390/net/qeth_core_main.c | 6 +- drivers/s390/net/qeth_l3.h | 2 +- drivers/s390/net/qeth_l3_main.c | 36 +++++++-- drivers/s390/net/qeth_l3_sys.c | 75 +++++++++-------- drivers/tty/n_tty.c | 4 +- drivers/tty/tty_buffer.c | 2 +- drivers/usb/core/config.c | 2 +- drivers/usb/core/quirks.c | 6 +- drivers/usb/host/xhci-pci.c | 3 + drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 ++ drivers/usb/serial/option.c | 17 ++++ drivers/usb/serial/qcserial.c | 3 + drivers/usb/usbip/stub_dev.c | 3 +- drivers/usb/usbip/stub_main.c | 5 +- drivers/usb/usbip/stub_rx.c | 7 +- drivers/usb/usbip/stub_tx.c | 6 +- drivers/usb/usbip/usbip_common.c | 14 +--- drivers/usb/usbip/vhci_hcd.c | 12 +-- drivers/usb/usbip/vhci_rx.c | 23 +++--- drivers/usb/usbip/vhci_tx.c | 3 +- include/linux/cpuhotplug.h | 2 +- include/linux/ipv6.h | 3 +- include/linux/mlx5/mlx5_ifc.h | 8 +- include/linux/ptr_ring.h | 9 +++ include/linux/tcp.h | 3 +- include/linux/timer.h | 4 +- include/net/ip.h | 2 + include/net/tcp.h | 2 +- kernel/cpu.c | 4 +- kernel/time/tick-sched.c | 19 ++++- kernel/time/timer.c | 35 +++++--- kernel/trace/ring_buffer.c | 6 +- kernel/trace/trace.c | 13 +-- net/bridge/br_netlink.c | 11 +-- net/core/net_namespace.c | 2 +- net/core/skbuff.c | 6 +- net/ipv4/devinet.c | 2 +- net/ipv4/fib_frontend.c | 9 ++- net/ipv4/igmp.c | 44 +++++++--- net/ipv4/ip_tunnel.c | 4 +- net/ipv4/raw.c | 15 ++-- net/ipv4/tcp.c | 1 + net/ipv4/tcp_bbr.c | 7 +- net/ipv4/tcp_input.c | 10 ++- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_rate.c | 10 ++- net/ipv6/af_inet6.c | 1 - net/ipv6/ip6_output.c | 12 ++- net/ipv6/ip6_tunnel.c | 2 +- net/ipv6/ipv6_sockglue.c | 1 + net/ipv6/mcast.c | 25 +++--- net/ipv6/tcp_ipv6.c | 2 +- net/netlink/af_netlink.c | 3 + net/rds/send.c | 3 + net/sctp/socket.c | 4 +- sound/hda/hdac_i915.c | 2 +- sound/pci/hda/patch_realtek.c | 5 ++ sound/soc/codecs/da7218.c | 2 +- sound/soc/codecs/tlv320aic31xx.h | 2 +- sound/soc/codecs/twl4030.c | 4 +- sound/soc/codecs/wm_adsp.c | 12 +-- sound/soc/fsl/fsl_ssi.c | 18 +++-- tools/objtool/arch/x86/insn/x86-opcode-map.txt | 2 +- tools/usb/usbip/src/utils.c | 9 ++- 94 files changed, 550 insertions(+), 429 deletions(-)

7 years, 3 months

9
97
0 0

[Linux-stable-mirror] patch "USB: cdc-acm: Do not log urb submission errors on disconnect" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: cdc-acm: Do not log urb submission errors on disconnect to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From f0386c083c2ce85284dc0b419d7b89c8e567c09f Mon Sep 17 00:00:00 2001 From: Hans de Goede <hdegoede(a)redhat.com> Date: Sun, 14 Jan 2018 16:09:00 +0100 Subject: USB: cdc-acm: Do not log urb submission errors on disconnect When disconnected sometimes the cdc-acm driver logs errors like these: [20278.039417] cdc_acm 2-2:2.1: urb 9 failed submission with -19 [20278.042924] cdc_acm 2-2:2.1: urb 10 failed submission with -19 [20278.046449] cdc_acm 2-2:2.1: urb 11 failed submission with -19 [20278.049920] cdc_acm 2-2:2.1: urb 12 failed submission with -19 [20278.053442] cdc_acm 2-2:2.1: urb 13 failed submission with -19 [20278.056915] cdc_acm 2-2:2.1: urb 14 failed submission with -19 [20278.060418] cdc_acm 2-2:2.1: urb 15 failed submission with -19 Silence these by not logging errors when the result is -ENODEV. Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Acked-by: Oliver Neukum <oneukum(a)suse.com> Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/cdc-acm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 8e0636c963a7..6c64ab6e80fa 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -425,7 +425,7 @@ static int acm_submit_read_urb(struct acm *acm, int index, gfp_t mem_flags) res = usb_submit_urb(acm->read_urbs[index], mem_flags); if (res) { - if (res != -EPERM) { + if (res != -EPERM && res != -ENODEV) { dev_err(&acm->data->dev, "urb %d failed submission with %d\n", index, res); -- 2.15.1

7 years, 3 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror