This is the start of the stable review cycle for the 4.4.174 release.
There are 34 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Feb 9 11:30:10 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.174-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.174-rc1
Paul E. McKenney <paulmck(a)linux.vnet.ibm.com>
rcu: Force boolean subscript for expedited stall warnings
Michal Kubecek <mkubecek(a)suse.cz>
net: ipv4: do not handle duplicate fragments as overlapping
Dimitris Michailidis <dmichail(a)google.com>
net: fix pskb_trim_rcsum_slow() with odd trim offset
Eric Dumazet <edumazet(a)google.com>
inet: frags: better deal with smp races
Dan Carpenter <dan.carpenter(a)oracle.com>
ipv4: frags: precedence bug in ip_expire()
Taehee Yoo <ap420073(a)gmail.com>
ip: frags: fix crash in ip_do_fragment()
Peter Oskolkov <posk(a)google.com>
ip: process in-order fragments efficiently
Peter Oskolkov <posk(a)google.com>
ip: add helpers to process in-order fragments faster.
Peter Oskolkov <posk(a)google.com>
ip: use rb trees for IP frag queue.
Eric Dumazet <edumazet(a)google.com>
net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends
Florian Westphal <fw(a)strlen.de>
ipv6: defrag: drop non-last frags smaller than min mtu
Peter Oskolkov <posk(a)google.com>
net: modify skb_rbtree_purge to return the truesize of all purged skbs.
Peter Oskolkov <posk(a)google.com>
ip: discard IPv4 datagrams with overlapping segments.
Eric Dumazet <edumazet(a)google.com>
inet: frags: fix ip6frag_low_thresh boundary
Eric Dumazet <edumazet(a)google.com>
inet: frags: get rid of ipfrag_skb_cb/FRAG_CB
Eric Dumazet <edumazet(a)google.com>
inet: frags: reorganize struct netns_frags
Eric Dumazet <edumazet(a)google.com>
rhashtable: reorganize struct rhashtable layout
Eric Dumazet <edumazet(a)google.com>
ipv6: frags: rewrite ip6_expire_frag_queue()
Eric Dumazet <edumazet(a)google.com>
inet: frags: do not clone skb in ip_expire()
Eric Dumazet <edumazet(a)google.com>
inet: frags: break the 2GB limit for frags storage
Eric Dumazet <edumazet(a)google.com>
inet: frags: remove inet_frag_maybe_warn_overflow()
Eric Dumazet <edumazet(a)google.com>
inet: frags: get rif of inet_frag_evicting()
Eric Dumazet <edumazet(a)google.com>
inet: frags: remove some helpers
Paolo Abeni <pabeni(a)redhat.com>
ipfrag: really prevent allocation on netns exit
Alexander Aring <aring(a)mojatatu.com>
net: ieee802154: 6lowpan: fix frag reassembly
Eric Dumazet <edumazet(a)google.com>
inet: frags: use rhashtables for reassembly units
Eric Dumazet <edumazet(a)google.com>
rhashtable: add schedule points
Ben Hutchings <ben.hutchings(a)codethink.co.uk>
rhashtable: Add rhashtable_lookup()
Pablo Neira Ayuso <pablo(a)netfilter.org>
rhashtable: add rhashtable_lookup_get_insert_key()
Eric Dumazet <edumazet(a)google.com>
inet: frags: refactor lowpan_net_frag_init()
Eric Dumazet <edumazet(a)google.com>
inet: frags: refactor ipv6_frag_init()
Eric Dumazet <edumazet(a)google.com>
inet: frags: refactor ipfrag_init()
Eric Dumazet <edumazet(a)google.com>
inet: frags: add a pointer to struct netns_frags
Eric Dumazet <edumazet(a)google.com>
inet: frags: change inet_frags_init_net() return value
-------------
Diffstat:
Documentation/networking/ip-sysctl.txt | 13 +-
Makefile | 4 +-
include/linux/rhashtable.h | 143 ++++++--
include/linux/skbuff.h | 16 +-
include/net/inet_frag.h | 133 ++++----
include/net/ip.h | 1 -
include/net/ipv6.h | 26 +-
include/uapi/linux/snmp.h | 1 +
kernel/rcu/tree.c | 2 +-
lib/rhashtable.c | 15 +-
net/core/skbuff.c | 21 +-
net/ieee802154/6lowpan/6lowpan_i.h | 26 +-
net/ieee802154/6lowpan/reassembly.c | 148 ++++-----
net/ipv4/inet_fragment.c | 389 +++++-----------------
net/ipv4/ip_fragment.c | 571 ++++++++++++++++++--------------
net/ipv4/proc.c | 7 +-
net/ipv6/netfilter/nf_conntrack_reasm.c | 100 +++---
net/ipv6/proc.c | 5 +-
net/ipv6/reassembly.c | 209 ++++++------
19 files changed, 868 insertions(+), 962 deletions(-)
Hi,
On Thu, Feb 07, 2019 at 04:32:13PM +0000, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: 3f0c82066448 drivers: of: add initialization code for dynamic reserved memory.
>
> The bot has tested the following trees: v4.20.6, v4.19.19, v4.14.97, v4.9.154, v4.4.172, v3.18.133.
...
> How should we proceed with this patch?
Below is the backport of the patch to 4.19.19 and below. I've build-tested
for 4.19 and verified it applies cleanly to the older versions.
>From 2052bf06134fd8feae3e621acea6421f916bbbae Mon Sep 17 00:00:00 2001
From: Mike Rapoport <rppt(a)linux.ibm.com>
Date: Mon, 4 Feb 2019 15:37:21 +0100
Subject: [PATCH] of: fix kmemleak crash caused by imbalance in early memory
reservation
Marc Gonzalez reported the following kmemleak crash:
Unable to handle kernel paging request at virtual address ffffffc021e00000
Mem abort info:
ESR = 0x96000006
Exception class = DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
swapper pgtable: 4k pages, 39-bit VAs, pgdp = (____ptrval____)
[ffffffc021e00000] pgd=000000017e3ba803, pud=000000017e3ba803,
pmd=0000000000000000
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 6 PID: 523 Comm: kmemleak Tainted: G S W 5.0.0-rc1 #13
Hardware name: Qualcomm Technologies, Inc. MSM8998 v1 MTP (DT)
pstate: 80000085 (Nzcv daIf -PAN -UAO)
pc : scan_block+0x70/0x190
lr : scan_block+0x6c/0x190
sp : ffffff8012e8bd20
x29: ffffff8012e8bd20 x28: ffffffc0fdbaf018
x27: ffffffc022000000 x26: 0000000000000080
x25: ffffff8011aadf70 x24: ffffffc0f8cc8000
x23: ffffff8010dc8000 x22: ffffff8010dc8830
x21: ffffffc021e00ff9 x20: ffffffc0f8cc8050
x19: ffffffc021e00000 x18: 0000000000002409
x17: 0000000000000200 x16: 0000000000000000
x15: ffffff8010e14dd8 x14: 0000000000002406
x13: 000000004c4dd0c6 x12: ffffffc0f77dad58
x11: 0000000000000001 x10: ffffff8010d9e688
x9 : ffffff8010d9f000 x8 : ffffff8010d9e688
x7 : 0000000000000002 x6 : 0000000000000000
x5 : ffffff8011511c20 x4 : 00000000000026d1
x3 : ffffff8010e14d88 x2 : 5b36396f4e7d4000
x1 : 0000000000208040 x0 : 0000000000000000
Process kmemleak (pid: 523, stack limit = 0x(____ptrval____))
Call trace:
scan_block+0x70/0x190
scan_gray_list+0x108/0x1c0
kmemleak_scan+0x33c/0x7c0
kmemleak_scan_thread+0x98/0xf0
kthread+0x11c/0x120
ret_from_fork+0x10/0x1c
Code: f9000fb4 d503201f 97ffffd2 35000580 (f9400260)
---[ end trace 176d6ed9d86a0c33 ]---
note: kmemleak[523] exited with preempt_count 2
The crash happens when a no-map area is allocated in
early_init_dt_alloc_reserved_memory_arch(). The allocated region is
registered with kmemleak, but it is then removed from memblock using
memblock_remove() that is not kmemleak-aware.
Replacing __memblock_alloc_base() with memblock_find_in_range() makes sure
that the allocated memory is not added to kmemleak and then
memblock_remove()'ing this memory is safe.
As a bonus, since memblock_find_in_range() ensures the allocation in the
specified range, the bounds check can be removed.
Cc: stable(a)vger.kernel.org # 3.15+
Fixes: 3f0c820664483 ("drivers: of: add initialization code for dynamic reserved memory")
Acked-by: Marek Szyprowski <m.szyprowski(a)samsung.com>
Acked-by: Prateek Patel <prpatel(a)nvidia.com>
Tested-by: Marc Gonzalez <marc.w.gonzalez(a)free.fr>
Signed-off-by: Mike Rapoport <rppt(a)linux.ibm.com>
---
drivers/of/of_reserved_mem.c | 18 +++++-------------
1 file changed, 5 insertions(+), 13 deletions(-)
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 895c83e..240763b 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -32,26 +32,18 @@ int __init __weak early_init_dt_alloc_reserved_memory_arch(phys_addr_t size,
phys_addr_t *res_base)
{
phys_addr_t base;
- /*
- * We use __memblock_alloc_base() because memblock_alloc_base()
- * panic()s on allocation failure.
- */
+
end = !end ? MEMBLOCK_ALLOC_ANYWHERE : end;
- base = __memblock_alloc_base(size, align, end);
+ base = memblock_find_in_range(size, align, start, end);
if (!base)
return -ENOMEM;
- /*
- * Check if the allocated region fits in to start..end window
- */
- if (base < start) {
- memblock_free(base, size);
- return -ENOMEM;
- }
-
*res_base = base;
if (nomap)
return memblock_remove(base, size);
+ else
+ return memblock_reserve(base, size);
+
return 0;
}
#else
--
2.7.4
> --
> Thanks,
> Sasha
>
--
Sincerely yours,
Mike.
This is a note to let you know that I've just added the patch titled
devres: Align data[] to ARCH_KMALLOC_MINALIGN
to my driver-core git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
in the driver-core-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From a66d972465d15b1d89281258805eb8b47d66bd36 Mon Sep 17 00:00:00 2001
From: Alexey Brodkin <alexey.brodkin(a)synopsys.com>
Date: Wed, 31 Oct 2018 18:25:47 +0300
Subject: devres: Align data[] to ARCH_KMALLOC_MINALIGN
Initially we bumped into problem with 32-bit aligned atomic64_t
on ARC, see [1]. And then during quite lengthly discussion Peter Z.
mentioned ARCH_KMALLOC_MINALIGN which IMHO makes perfect sense.
If allocation is done by plain kmalloc() obtained buffer will be
ARCH_KMALLOC_MINALIGN aligned and then why buffer obtained via
devm_kmalloc() should have any other alignment?
This way we at least get the same behavior for both types of
allocation.
[1] http://lists.infradead.org/pipermail/linux-snps-arc/2018-July/004009.html
[2] http://lists.infradead.org/pipermail/linux-snps-arc/2018-July/004036.html
Signed-off-by: Alexey Brodkin <abrodkin(a)synopsys.com>
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: David Laight <David.Laight(a)ACULAB.COM>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Vineet Gupta <vgupta(a)synopsys.com>
Cc: Will Deacon <will.deacon(a)arm.com>
Cc: Greg KH <greg(a)kroah.com>
Cc: <stable(a)vger.kernel.org> # 4.8+
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/base/devres.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/base/devres.c b/drivers/base/devres.c
index 4aaf00d2098b..e038e2b3b7ea 100644
--- a/drivers/base/devres.c
+++ b/drivers/base/devres.c
@@ -26,8 +26,14 @@ struct devres_node {
struct devres {
struct devres_node node;
- /* -- 3 pointers */
- unsigned long long data[]; /* guarantee ull alignment */
+ /*
+ * Some archs want to perform DMA into kmalloc caches
+ * and need a guaranteed alignment larger than
+ * the alignment of a 64-bit integer.
+ * Thus we use ARCH_KMALLOC_MINALIGN here and get exactly the same
+ * buffer alignment as if it was allocated by plain kmalloc().
+ */
+ u8 __aligned(ARCH_KMALLOC_MINALIGN) data[];
};
struct devres_group {
--
2.19.1
The patch titled
Subject: kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
has been added to the -mm tree. Its filename is
kernel-sysctlc-add-missing-range-check-in-do_proc_dointvec_minmax_conv.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/kernel-sysctlc-add-missing-range-c…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/kernel-sysctlc-add-missing-range-c…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Zev Weiss <zev(a)bewilderbeest.net>
Subject: kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
This bug has apparently existed since the introduction of this function in
the pre-git era (4500e91754d3 in Thomas Gleixner's history.git, "[NET]:
Add proc_dointvec_userhz_jiffies, use it for proper handling of neighbour
sysctls."). As a minimal fix we can simply duplicate the corresponding
check in do_proc_dointvec_conv().
Link: http://lkml.kernel.org/r/20190207123426.9202-3-zev@bewilderbeest.net
Signed-off-by: Zev Weiss <zev(a)bewilderbeest.net>
Cc: Brendan Higgins <brendanhiggins(a)google.com>
Cc: Iurii Zaikin <yzaikin(a)google.com>
Cc: Kees Cook <keescook(a)chromium.org>
Cc: Luis Chamberlain <mcgrof(a)kernel.org>
Cc: <stable(a)vger.kernel.org> [2.6.2+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/kernel/sysctl.c~kernel-sysctlc-add-missing-range-check-in-do_proc_dointvec_minmax_conv
+++ a/kernel/sysctl.c
@@ -2579,7 +2579,16 @@ static int do_proc_dointvec_minmax_conv(
{
struct do_proc_dointvec_minmax_conv_param *param = data;
if (write) {
- int val = *negp ? -*lvalp : *lvalp;
+ int val;
+ if (*negp) {
+ if (*lvalp > (unsigned long) INT_MAX + 1)
+ return -EINVAL;
+ val = -*lvalp;
+ } else {
+ if (*lvalp > (unsigned long) INT_MAX)
+ return -EINVAL;
+ val = *lvalp;
+ }
if ((param->min && *param->min > val) ||
(param->max && *param->max < val))
return -EINVAL;
_
Patches currently in -mm which might be from zev(a)bewilderbeest.net are
test_sysctl-add-tests-for-32-bit-values-written-to-32-bit-integers.patch
kernel-sysctlc-add-missing-range-check-in-do_proc_dointvec_minmax_conv.patch
kernel-sysctlc-define-minmax-conv-functions-in-terms-of-non-minmax-versions.patch
Make sure the underlying VMA in the process address space is the
same as it was during vm_mmap to avoid applying WC to wrong VMA.
A more long-term solution would be to have vm_mmap_locked variant
in linux/mmap.h for when caller wants to hold mmap_sem for an
extended duration.
Fixes: 1816f9236303 ("drm/i915: Support creation of unbound wc user mappings for objects")
Reported-by: Adam Zabrocki <adamza(a)microsoft.com>
Suggested-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Signed-off-by: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
Cc: <stable(a)vger.kernel.org> # v4.0+
Cc: Akash Goel <akash.goel(a)intel.com>
Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin(a)linux.intel.com>
Cc: Adam Zabrocki <adamza(a)microsoft.com>
---
drivers/gpu/drm/i915/i915_gem.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 062c8395557c..f1d594a53978 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1680,6 +1680,15 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
return 0;
}
+static inline bool
+match_gem_vma(struct vm_area_struct *vma, struct file *filp,
+ unsigned long addr, unsigned long size)
+{
+ return vma && vma->vm_file == filp &&
+ vma->vm_start == addr &&
+ (vma->vm_end - vma->vm_start) == size;
+}
+
/**
* i915_gem_mmap_ioctl - Maps the contents of an object, returning the address
* it is mapped to.
@@ -1738,7 +1747,7 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
return -EINTR;
}
vma = find_vma(mm, addr);
- if (vma)
+ if (match_gem_vma(vma, obj->base.filp, addr, args->size))
vma->vm_page_prot =
pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
else
--
2.17.2
On Thu, Feb 07, 2019 at 04:31:58PM +0000, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: bf38b8710892 tpm/tpm_i2c_stm_st33: Split tpm_i2c_tpm_st33 in 2 layers (core + phy).
>
> The bot has tested the following trees: v4.20.6, v4.19.19, v4.14.97, v4.9.154, v4.4.172.
>
> v4.20.6: Build OK!
> v4.19.19: Build OK!
> v4.14.97: Build OK!
> v4.9.154: Build OK!
> v4.4.172: Failed to apply! Possible dependencies:
> 036bb38ffb3e ("tpm_tis: Ensure interrupts are disabled when the driver starts")
> 23d06ff700f5 ("tpm: drop tpm_atmel specific fields from tpm_vendor_specific")
> 25112048cd59 ("tpm: rework tpm_get_timeouts()")
> 4d627e672bd0 ("tpm_tis: Do not fall back to a hardcoded address for TPM2")
> 4eea703caaac ("tpm: drop 'iobase' from struct tpm_vendor_specific")
> 51dd43dff74b ("tpm_tis: Use devm_ioremap_resource")
> 55a889c2cb13 ("tpm_crb: Use the common ACPI definition of struct acpi_tpm2")
> 56671c893e0e ("tpm: drop 'locality' from struct tpm_vendor_specific")
> 570a36097f30 ("tpm: drop 'irq' from struct tpm_vendor_specific")
> 7ab4032fa579 ("tpm_tis: Get rid of the duplicate IRQ probing code")
> d30b8e4f68ef ("tpm: cleanup tpm_tis_remove()")
> d4956524f1b0 ("tpm: drop manufacturer_id from struct tpm_vendor_specific")
> e3837e74a06d ("tpm_tis: Refactor the interrupt setup")
> ee1779840d09 ("tpm: drop 'base' from struct tpm_vendor_specific")
> ef7b81dc7864 ("tpm_tis: Disable interrupt auto probing on a per-device basis")
>
>
> How should we proceed with this patch?
I'll look into this next week.
/Jarkko