Hi Greg, can you please apply commit dc3ee32e96d7 ("netfilter: nf_queue: Make
the queue_handler pernet") to 4.4-stable? syzbot is hitting the crash in
nfqnl_nf_hook_drop() by interrupting thread creation in pg_net_init(). An OOM
condition is not required, contrary to what is suggested by the original commit
message.
Thanks,
Eric
Hi stable maintainers
Can I get you to consider including
bc137dfdbec2 watchdog: gpio_wdt: set WDOG_HW_RUNNING in gpio_wdt_stop
in -stable? Without that, any (always-running) gpio watchdog effectively
fails to honour the magic close feature, causing an unexpected reset
shortly after userspace gracefully closes the device.
Anything containing 3c10bbde10 ("watchdog: core: Clear WDOG_HW_RUNNING
before calling the stop function") probably needs it (i.e. 4.8+), but at
the very least 4.14 and 4.15.
Rasmus
On Sat, 10 Feb 2018, Tobias Jakobi wrote:
> Hello,
>
> I noticed a compile error with a recent version (4.4.115) of the 4.4.y branch:
> arch/x86/mm/kaiser.c: In function ‘kaiser_init’:
> arch/x86/mm/kaiser.c:348:8: error: ‘vsyscall_pgprot’ undeclared (first use in
> this function)
>
> It seems like my combination of kernel options doesn't work for KAISER.
> X86_VSYSCALL_EMULATION is not set on my system, while LEGACY_VSYSCALL is set to
> NONE (LEGACY_VSYSCALL_NONE=y). I have managed to get things compiling again, by
> moving the 'extern unsigned long vsyscall_pgprot' outside of the preprocessor
> statement. This works for me, I guess because the code in question is never
> called during runtime anyway (vsyscall_enabled() always returns false).
>
> With best wishes,
> Tobias
Yes, sorry about that, thanks Tobias. Same error on 4.9 too.
Here's the patch that you correctly suggest, and it's good for both:
[PATCH 4.4 and 4.9] kaiser: fix compile error without vsyscall
Tobias noticed a compile error on 4.4.115, and it's the same on 4.9.80:
arch/x86/mm/kaiser.c: In function ‘kaiser_init’:
arch/x86/mm/kaiser.c:348:8: error: ‘vsyscall_pgprot’ undeclared
(first use in this function)
It seems like his combination of kernel options doesn't work for KAISER.
X86_VSYSCALL_EMULATION is not set on his system, while LEGACY_VSYSCALL
is set to NONE (LEGACY_VSYSCALL_NONE=y). He managed to get things
compiling again, by moving the 'extern unsigned long vsyscall_pgprot'
outside of the preprocessor statement. This works because the optimizer
removes that code (vsyscall_enabled() is always false) - and that's how
it was done in some older backports.
Reported-by: Tobias Jakobi <tjakobi(a)math.uni-bielefeld.de>
Signed-off-by: Hugh Dickins <hughd(a)google.com>
---
arch/x86/include/asm/vsyscall.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/include/asm/vsyscall.h
+++ b/arch/x86/include/asm/vsyscall.h
@@ -13,7 +13,6 @@ extern void map_vsyscall(void);
*/
extern bool emulate_vsyscall(struct pt_regs *regs, unsigned long address);
extern bool vsyscall_enabled(void);
-extern unsigned long vsyscall_pgprot;
#else
static inline void map_vsyscall(void) {}
static inline bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
@@ -22,5 +21,6 @@ static inline bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
}
static inline bool vsyscall_enabled(void) { return false; }
#endif
+extern unsigned long vsyscall_pgprot;
#endif /* _ASM_X86_VSYSCALL_H */
On Mon, Feb 12, 2018 at 03:22:32PM +0000, James Hogan wrote:
> On Mon, Feb 12, 2018 at 05:08:10PM +0200, Kalle Valo wrote:
> > James Hogan <jhogan(a)kernel.org> writes:
> > > On Mon, Feb 05, 2018 at 01:23:31PM -0500, Adric Blake wrote:
> > >> I bisected to this "first bad commit:"
> > >>
> > >> commit 58eae1416b804d900014d84feadda7195007cc30
> > >> Author: James Hogan <jhogan(a)kernel.org>
> > >> Date: Mon Jan 15 21:17:14 2018 +0000
> > >>
> > >> ssb: Disable PCI host for PCI_DRIVERS_GENERIC
> > >
> > > Yes, really sorry about that and thanks for going to the effort of
> > > bisecting. There is a patch here:
> > > https://patchwork.kernel.org/patch/10185397/
> > >
> > > which is applied to linux-next as commit
> > > a9e6d44ddeccd3522670e641f1ed9b068e746ff7, and is tagged for stable,
> > > though I've just noticed the stable email address is incorrect... I'll
> > > make sure it gets applied to the 4.15 stable branch though as soon as
> > > I notice its merged.
> >
> > The commit is now in v4.16-rc1.
>
> Yes, thanks,
>
> Greg: Please can commit a9e6d44ddeccd3522670e641f1ed9b068e746ff7 ("ssb:
> Do not disable PCI host on non-Mips") be applied to 4.15 stable (the
> wrong stable email address was Cc'd in the commit message).
Now applied, thanks.
greg k-h
Please apply commit: 66b3bd2356e0a1531c71a3dcf96944621e25c17c (dmaengine:
dmatest: fix container_of member in dmatest_callback) to stable
This fixes a bug in dmatest that will cause the test to give a false negative.
--
Adam Wallis
Qualcomm Datacenter Technologies as an affiliate of Qualcomm Technologies, Inc.
Qualcomm Technologies, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project.
Hi,
On Tue, Feb 13, 2018 at 3:32 PM, James Hogan <jhogan(a)kernel.org> wrote:
> On Tue, Feb 13, 2018 at 03:03:24PM +0100, Mathieu Malaterre wrote:
>> James,
>>
>> On Tue, Feb 13, 2018 at 2:38 PM, James Hogan <jhogan(a)kernel.org> wrote:
>> > On Tue, Feb 13, 2018 at 01:14:29PM +0100, Mathieu Malaterre wrote:
>> >> Could you please review the patch v3 ?
>> >
>> > Yes, looks good to me, and Ralf had applied to his test branch so I
>> > presume he's happy with it too. I'll apply for 4.16.
>>
>> Hum, just to be sure I understand the process. Which branch are you
>> talking about:
>>
>> https://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git
>
> I was referring to upstream-sfr.git branch=mips-next-test
> https://git.linux-mips.org/cgit/ralf/upstream-sfr.git/log/?h=mips-next-test
>
> (The mips-next branch there is what Ralf puts into linux-next)
>
> I've applied the patch to my mips-fixes branch here:
> git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/mips.git
>
> Sorry it seems a bit haphazard with multiple trees in use.
I see it now, sorry for the noise. I was not looking at the right location.
Anyway if that answer earlier question 4.11 should be correct, since I
asked Greg to not backport the earlier patch:
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1505915.html
From: Eric Biggers <ebiggers(a)google.com>
Memslots must not overlap in guest physical memory, since otherwise some
guest physical addresses will not uniquely map to a memslot. Yet, the
overlap check in __kvm_set_memory_region() allows a memslot that
overlaps one of the "private" memslots, e.g. the memslot reserved for
the TSS on x86.
This seems to be a very old bug that was introduced years ago when
private memory slots were first added. It seems that later refactoring
incorrectly assumed this bug was intentional and preserved it.
Fix it by removing the loophole for private memslots, so we just check
for overlap against all memslots.
This bug was found by syzkaller, which used a memslot overlap to make
pte_list_remove() be called for the wrong memslot, hitting a BUG():
pte_list_remove: 000000007185ed42 0->BUG
kernel BUG at arch/x86/kvm/mmu.c:1209!
[...]
RIP: 0010:pte_list_remove+0x107/0x110 arch/x86/kvm/mmu.c:1208
[...]
Call Trace:
mmu_page_zap_pte+0x7e/0xd0 arch/x86/kvm/mmu.c:2499
kvm_mmu_page_unlink_children arch/x86/kvm/mmu.c:2521 [inline]
kvm_mmu_prepare_zap_page+0x4f/0x340 arch/x86/kvm/mmu.c:2565
kvm_zap_obsolete_pages arch/x86/kvm/mmu.c:5348 [inline]
kvm_mmu_invalidate_zap_all_pages+0xa6/0x100 arch/x86/kvm/mmu.c:5389
kvm_mmu_notifier_release+0x4f/0x80 arch/x86/kvm/../../../virt/kvm/kvm_main.c:468
__mmu_notifier_release+0x63/0x100 mm/mmu_notifier.c:75
mmu_notifier_release include/linux/mmu_notifier.h:244 [inline]
exit_mmap+0x160/0x170 mm/mmap.c:3009
__mmput kernel/fork.c:966 [inline]
mmput+0x44/0xd0 kernel/fork.c:987
exit_mm kernel/exit.c:544 [inline]
do_exit+0x24a/0xb50 kernel/exit.c:856
do_group_exit+0x34/0xb0 kernel/exit.c:972
SYSC_exit_group kernel/exit.c:983 [inline]
SyS_exit_group+0xb/0x10 kernel/exit.c:981
entry_SYSCALL_64_fastpath+0x1e/0x8b
Reproducer:
#include <fcntl.h>
#include <linux/kvm.h>
#include <sys/ioctl.h>
int main()
{
static char buf[4096*3] __attribute__((aligned(4096)));
int kvm, vm, cpu;
struct kvm_mp_state mp_state = { KVM_MP_STATE_SIPI_RECEIVED };
struct kvm_userspace_memory_region memreg = {
.memory_size = sizeof(buf),
.userspace_addr = (__u64)buf,
};
kvm = open("/dev/kvm", O_RDWR);
vm = ioctl(kvm, KVM_CREATE_VM, 0);
ioctl(vm, KVM_CREATE_IRQCHIP);
cpu = ioctl(vm, KVM_CREATE_VCPU, 0);
ioctl(cpu, KVM_SET_MP_STATE, &mp_state);
ioctl(vm, KVM_SET_TSS_ADDR, 0);
ioctl(cpu, KVM_RUN, 0);
ioctl(vm, KVM_SET_USER_MEMORY_REGION, &memreg);
}
Reported-by: syzbot <syzkaller(a)googlegroups.com>
Fixes: e0d62c7f4860 ("KVM: Add kernel-internal memory slots")
Cc: <stable(a)vger.kernel.org> # v2.6.25+
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
virt/kvm/kvm_main.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 210bf820385a..e536977e7b6d 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -974,8 +974,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
/* Check for overlaps */
r = -EEXIST;
kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) {
- if ((slot->id >= KVM_USER_MEM_SLOTS) ||
- (slot->id == id))
+ if (slot->id == id)
continue;
if (!((base_gfn + npages <= slot->base_gfn) ||
(base_gfn >= slot->base_gfn + slot->npages)))
--
2.16.0
James,
On Tue, Feb 13, 2018 at 2:38 PM, James Hogan <jhogan(a)kernel.org> wrote:
> On Tue, Feb 13, 2018 at 01:14:29PM +0100, Mathieu Malaterre wrote:
>> On Thu, Feb 1, 2018 at 1:12 PM, Mathieu Malaterre <malat(a)debian.org> wrote:
>> > On Thu, Feb 1, 2018 at 12:37 PM, Marcin Nowakowski
>> > <marcin.nowakowski(a)mips.com> wrote:
>> >> Commit 73fbc1eba7ff ("MIPS: fix mem=X@Y commandline processing") added a
>> >> fix to ensure that the memory range between PHYS_OFFSET and low memory
>> >> address specified by mem= cmdline argument is not later processed by
>> >> free_all_bootmem. This change was incorrect for systems where the
>> >> commandline specifies more than 1 mem argument, as it will cause all
>> >> memory between PHYS_OFFSET and each of the memory offsets to be marked
>> >> as reserved, which results in parts of the RAM marked as reserved
>> >> (Creator CI20's u-boot has a default commandline argument 'mem=256M@0x0
>> >> mem=768M@0x30000000').
>> >>
>> >> Change the behaviour to ensure that only the range between PHYS_OFFSET
>> >> and the lowest start address of the memories is marked as protected.
>> >>
>> >> This change also ensures that the range is marked protected even if it's
>> >> only defined through the devicetree and not only via commandline
>> >> arguments.
>> >>
>> >> Reported-by: Mathieu Malaterre <mathieu.malaterre(a)gmail.com>
>> >> Signed-off-by: Marcin Nowakowski <marcin.nowakowski(a)mips.com>
>> >> Fixes: 73fbc1eba7ff ("MIPS: fix mem=X@Y commandline processing")
>> >> Cc: <stable(a)vger.kernel.org> # v4.11+
>> >> ---
>> >> v3: Update stable version, code cleanup as suggested by James Hogan
>> >> v2: Use updated email adress, add tag for stable.
>> >> ---
>> >> arch/mips/kernel/setup.c | 16 ++++++++++++----
>> >> 1 file changed, 12 insertions(+), 4 deletions(-)
>> >>
>> >> diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
>> >> index 702c678de116..e4a1581ce822 100644
>> >> --- a/arch/mips/kernel/setup.c
>> >> +++ b/arch/mips/kernel/setup.c
>> >> @@ -375,6 +375,7 @@ static void __init bootmem_init(void)
>> >> unsigned long reserved_end;
>> >> unsigned long mapstart = ~0UL;
>> >> unsigned long bootmap_size;
>> >> + phys_addr_t ramstart = (phys_addr_t)ULLONG_MAX;
>> >> bool bootmap_valid = false;
>> >> int i;
>> >>
>> >> @@ -395,7 +396,8 @@ static void __init bootmem_init(void)
>> >> max_low_pfn = 0;
>> >>
>> >> /*
>> >> - * Find the highest page frame number we have available.
>> >> + * Find the highest page frame number we have available
>> >> + * and the lowest used RAM address
>> >> */
>> >> for (i = 0; i < boot_mem_map.nr_map; i++) {
>> >> unsigned long start, end;
>> >> @@ -407,6 +409,8 @@ static void __init bootmem_init(void)
>> >> end = PFN_DOWN(boot_mem_map.map[i].addr
>> >> + boot_mem_map.map[i].size);
>> >>
>> >> + ramstart = min(ramstart, boot_mem_map.map[i].addr);
>> >> +
>> >> #ifndef CONFIG_HIGHMEM
>> >> /*
>> >> * Skip highmem here so we get an accurate max_low_pfn if low
>> >> @@ -436,6 +440,13 @@ static void __init bootmem_init(void)
>> >> mapstart = max(reserved_end, start);
>> >> }
>> >>
>> >> + /*
>> >> + * Reserve any memory between the start of RAM and PHYS_OFFSET
>> >> + */
>> >> + if (ramstart > PHYS_OFFSET)
>> >> + add_memory_region(PHYS_OFFSET, ramstart - PHYS_OFFSET,
>> >> + BOOT_MEM_RESERVED);
>> >> +
>> >> if (min_low_pfn >= max_low_pfn)
>> >> panic("Incorrect memory mapping !!!");
>> >> if (min_low_pfn > ARCH_PFN_OFFSET) {
>> >> @@ -664,9 +675,6 @@ static int __init early_parse_mem(char *p)
>> >>
>> >> add_memory_region(start, size, BOOT_MEM_RAM);
>> >>
>> >> - if (start && start > PHYS_OFFSET)
>> >> - add_memory_region(PHYS_OFFSET, start - PHYS_OFFSET,
>> >> - BOOT_MEM_RESERVED);
>> >> return 0;
>> >> }
>> >> early_param("mem", early_parse_mem);
>> >> --
>> >> 2.14.1
>> >>
>> >
>> > Looks good to me:
>> >
>> > $ cat /proc/cpuinfo
>> > system type : JZ4780
>> > machine : Creator CI20
>> > processor : 0
>> > cpu model : Ingenic JZRISC V4.15 FPU V0.0
>> > BogoMIPS : 956.00
>> > wait instruction : yes
>> > microsecond timers : no
>> > tlb_entries : 32
>> > extra interrupt vector : yes
>> > hardware watchpoint : yes, count: 1, address/irw mask: [0x0fff]
>> > isa : mips1 mips2 mips32r1 mips32r2
>> > ASEs implemented :
>> > shadow register sets : 1
>> > kscratch registers : 0
>> > package : 0
>> > core : 0
>> > VCED exceptions : not available
>> > VCEI exceptions : not available
>> > $ uname -a
>> > Linux ci20 4.15.0+ #323 PREEMPT Thu Feb 1 13:08:11 CET 2018 mips GNU/Linux
>> >
>> > Tested-by: Mathieu Malaterre <malat(a)debian.org>
>> >
>> > Thanks
>>
>> Could you please review the patch v3 ?
>
> Yes, looks good to me, and Ralf had applied to his test branch so I
> presume he's happy with it too. I'll apply for 4.16.
Hum, just to be sure I understand the process. Which branch are you
talking about:
https://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git
> Commit 73fbc1eba7ff ("MIPS: fix mem=X@Y commandline processing") which
> this fixes was evidently requested to be backported to stable (unsure
> who by) and added to the 4.9 queue, but then this arose and it was
> removed until this fix is merged (see
> https://patchwork.linux-mips.org/patch/17268/).
>
> Anybody know how far back before 4.11 both of these patches should be
> applied to stable? If not I'll just leave it at 4.11 and if its
> important before then for kexec or whatever they can be requested again.