- Linux-stable-mirror - lists.linaro.org

[PATCH v2] drm/sun4i: Fix an ulong overflow in the dotclock driver

by Boris Brezillon

The calculated ideal rate can easily overflow an unsigned long, thus making the best div selection buggy as soon as no ideal match is found before the overflow occurs. Fixes: 4731a72df273 ("drm/sun4i: request exact rates to our parents") Cc: <stable(a)vger.kernel.org> Signed-off-by: Boris Brezillon <boris.brezillon(a)bootlin.com> Acked-by: Maxime Ripard <maxime.ripard(a)bootlin.com> --- Changes in v2: - Add a comment to explain why we bail out after an overflow - Add Maxime ack - Use a goto instead of a break --- drivers/gpu/drm/sun4i/sun4i_dotclock.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/sun4i/sun4i_dotclock.c b/drivers/gpu/drm/sun4i/sun4i_dotclock.c index e36004fbe453..2a15f2f9271e 100644 --- a/drivers/gpu/drm/sun4i/sun4i_dotclock.c +++ b/drivers/gpu/drm/sun4i/sun4i_dotclock.c @@ -81,9 +81,19 @@ static long sun4i_dclk_round_rate(struct clk_hw *hw, unsigned long rate, int i; for (i = tcon->dclk_min_div; i <= tcon->dclk_max_div; i++) { - unsigned long ideal = rate * i; + u64 ideal = (u64)rate * i; unsigned long rounded; + /* + * ideal has overflowed the max value that can be stored in an + * unsigned long, and every clk operation we might do on a + * truncated u64 value will give us incorrect results. + * Let's just stop there since bigger dividers will result in + * the same overflow issue. + */ + if (ideal > ULONG_MAX) + goto out; + rounded = clk_hw_round_rate(clk_hw_get_parent(hw), ideal); -- 2.14.1

7 years, 2 months

2
1
0 0

patch "usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten" added to usb-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From e28fd56ad5273be67d0fae5bedc7e1680e729952 Mon Sep 17 00:00:00 2001 From: "Shuah Khan (Samsung OSG)" <shuah(a)kernel.org> Date: Thu, 18 Oct 2018 10:19:29 -0600 Subject: usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten In rmmod path, usbip_vudc does platform_device_put() twice once from platform_device_unregister() and then from put_vudc_device(). The second put results in: BUG kmalloc-2048 (Not tainted): Poison overwritten error or BUG: KASAN: use-after-free in kobject_put+0x1e/0x230 if KASAN is enabled. [ 169.042156] calling init+0x0/0x1000 [usbip_vudc] @ 1697 [ 169.042396] ============================================================================= [ 169.043678] probe of usbip-vudc.0 returned 1 after 350 usecs [ 169.044508] BUG kmalloc-2048 (Not tainted): Poison overwritten [ 169.044509] ----------------------------------------------------------------------------- ... [ 169.057849] INFO: Freed in device_release+0x2b/0x80 age=4223 cpu=3 pid=1693 [ 169.057852] kobject_put+0x86/0x1b0 [ 169.057853] 0xffffffffc0c30a96 [ 169.057855] __x64_sys_delete_module+0x157/0x240 Fix it to call platform_device_del() instead and let put_vudc_device() do the platform_device_put(). Reported-by: Randy Dunlap <rdunlap(a)infradead.org> Signed-off-by: Shuah Khan (Samsung OSG) <shuah(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/usbip/vudc_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/usb/usbip/vudc_main.c b/drivers/usb/usbip/vudc_main.c index 3fc22037a82f..390733e6937e 100644 --- a/drivers/usb/usbip/vudc_main.c +++ b/drivers/usb/usbip/vudc_main.c @@ -73,6 +73,10 @@ static int __init init(void) cleanup: list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) { list_del(&udc_dev->dev_entry); + /* + * Just do platform_device_del() here, put_vudc_device() + * calls the platform_device_put() + */ platform_device_del(udc_dev->pdev); put_vudc_device(udc_dev); } @@ -89,7 +93,11 @@ static void __exit cleanup(void) list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) { list_del(&udc_dev->dev_entry); - platform_device_unregister(udc_dev->pdev); + /* + * Just do platform_device_del() here, put_vudc_device() + * calls the platform_device_put() + */ + platform_device_del(udc_dev->pdev); put_vudc_device(udc_dev); } platform_driver_unregister(&vudc_driver); -- 2.19.1

7 years, 2 months

1
0
0 0

[PATCH] usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten

by Shuah Khan (Samsung OSG)

In rmmod path, usbip_vudc does platform_device_put() twice once from platform_device_unregister() and then from put_vudc_device(). The second put results in: BUG kmalloc-2048 (Not tainted): Poison overwritten error or BUG: KASAN: use-after-free in kobject_put+0x1e/0x230 if KASAN is enabled. [ 169.042156] calling init+0x0/0x1000 [usbip_vudc] @ 1697 [ 169.042396] ============================================================================= [ 169.043678] probe of usbip-vudc.0 returned 1 after 350 usecs [ 169.044508] BUG kmalloc-2048 (Not tainted): Poison overwritten [ 169.044509] ----------------------------------------------------------------------------- ... [ 169.057849] INFO: Freed in device_release+0x2b/0x80 age=4223 cpu=3 pid=1693 [ 169.057852] kobject_put+0x86/0x1b0 [ 169.057853] 0xffffffffc0c30a96 [ 169.057855] __x64_sys_delete_module+0x157/0x240 Fix it to call platform_device_del() instead and let put_vudc_device() do the platform_device_put(). Reported-by: Randy Dunlap <rdunlap(a)infradead.org> Signed-off-by: Shuah Khan (Samsung OSG) <shuah(a)kernel.org> Cc: <stable(a)vger.kernel.org> --- drivers/usb/usbip/vudc_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/usb/usbip/vudc_main.c b/drivers/usb/usbip/vudc_main.c index 3fc22037a82f..390733e6937e 100644 --- a/drivers/usb/usbip/vudc_main.c +++ b/drivers/usb/usbip/vudc_main.c @@ -73,6 +73,10 @@ static int __init init(void) cleanup: list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) { list_del(&udc_dev->dev_entry); + /* + * Just do platform_device_del() here, put_vudc_device() + * calls the platform_device_put() + */ platform_device_del(udc_dev->pdev); put_vudc_device(udc_dev); } @@ -89,7 +93,11 @@ static void __exit cleanup(void) list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) { list_del(&udc_dev->dev_entry); - platform_device_unregister(udc_dev->pdev); + /* + * Just do platform_device_del() here, put_vudc_device() + * calls the platform_device_put() + */ + platform_device_del(udc_dev->pdev); put_vudc_device(udc_dev); } platform_driver_unregister(&vudc_driver); -- 2.17.0

7 years, 2 months

2
1
0 0

+ hugetlbfs-dirty-pages-as-they-are-added-to-pagecache.patch tentatively added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: hugetlbfs: dirty pages as they are added to pagecache has been added to the -mm tree. Its filename is hugetlbfs-dirty-pages-as-they-are-added-to-pagecache.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/hugetlbfs-dirty-pages-as-they-are-… and later at http://ozlabs.org/~akpm/mmotm/broken-out/hugetlbfs-dirty-pages-as-they-are-… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Mike Kravetz <mike.kravetz(a)oracle.com> Subject: hugetlbfs: dirty pages as they are added to pagecache Some test systems were experiencing negative huge page reserve counts and incorrect file block counts. This was traced to /proc/sys/vm/drop_caches removing clean pages from hugetlbfs file pagecaches. When non-hugetlbfs explicit code removes the pages, the appropriate accounting is not performed. This can be recreated as follows: fallocate -l 2M /dev/hugepages/foo echo 1 > /proc/sys/vm/drop_caches fallocate -l 2M /dev/hugepages/foo grep -i huge /proc/meminfo AnonHugePages: 0 kB ShmemHugePages: 0 kB HugePages_Total: 2048 HugePages_Free: 2047 HugePages_Rsvd: 18446744073709551615 HugePages_Surp: 0 Hugepagesize: 2048 kB Hugetlb: 4194304 kB ls -lsh /dev/hugepages/foo 4.0M -rw-r--r--. 1 root root 2.0M Oct 17 20:05 /dev/hugepages/foo To address this issue, dirty pages as they are added to pagecache. This can easily be reproduced with fallocate as shown above. Read faulted pages will eventually end up being marked dirty. But there is a window where they are clean and could be impacted by code such as drop_caches. So, just dirty them all as they are added to the pagecache. In addition, it makes little sense to even try to drop hugetlbfs pagecache pages, so disable calls to these filesystems in drop_caches code. Link: http://lkml.kernel.org/r/20181018041022.4529-1-mike.kravetz@oracle.com Fixes: 70c3547e36f5 ("hugetlbfs: add hugetlbfs_fallocate()") Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> Cc: "Aneesh Kumar K.V" <aneesh.kumar(a)linux.vnet.ibm.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: "Kirill A . Shutemov" <kirill.shutemov(a)linux.intel.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Alexander Viro <viro(a)zeniv.linux.org.uk> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- --- a/fs/drop_caches.c~hugetlbfs-dirty-pages-as-they-are-added-to-pagecache +++ a/fs/drop_caches.c @@ -9,6 +9,7 @@ #include <linux/writeback.h> #include <linux/sysctl.h> #include <linux/gfp.h> +#include <linux/magic.h> #include "internal.h" /* A global variable is a bit ugly, but it keeps the code simple */ @@ -18,6 +19,12 @@ static void drop_pagecache_sb(struct sup { struct inode *inode, *toput_inode = NULL; + /* + * It makes no sense to try and drop hugetlbfs page cache pages. + */ + if (sb->s_magic == HUGETLBFS_MAGIC) + return; + spin_lock(&sb->s_inode_list_lock); list_for_each_entry(inode, &sb->s_inodes, i_sb_list) { spin_lock(&inode->i_lock); --- a/mm/hugetlb.c~hugetlbfs-dirty-pages-as-they-are-added-to-pagecache +++ a/mm/hugetlb.c @@ -3690,6 +3690,12 @@ int huge_add_to_page_cache(struct page * return err; ClearPagePrivate(page); + /* + * set page dirty so that it will not be removed from cache/file + * by non-hugetlbfs specific code paths. + */ + set_page_dirty(page); + spin_lock(&inode->i_lock); inode->i_blocks += blocks_per_huge_page(h); spin_unlock(&inode->i_lock); _ Patches currently in -mm which might be from mike.kravetz(a)oracle.com are hugetlbfs-dirty-pages-as-they-are-added-to-pagecache.patch

7 years, 2 months

1
0
0 0

Re: Patch "RISC-V: include linux/ftrace.h in asm-prototypes.h" has been added to the 4.4-stable tree

by Palmer Dabbelt

On Thu, 18 Oct 2018 11:23:12 PDT (-0700), merker(a)debian.org wrote: > On Thu, Oct 18, 2018 at 11:13:02AM +0200, gregkh(a)linuxfoundation.org wrote: >> >> This is a note to let you know that I've just added the patch titled >> >> RISC-V: include linux/ftrace.h in asm-prototypes.h >> >> to the 4.4-stable tree which can be found at: >> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… >> >> The filename of the patch is: >> risc-v-include-linux-ftrace.h-in-asm-prototypes.h.patch >> and it can be found in the queue-4.4 subdirectory. >> >> If you, or anyone else, feels it should not be added to the stable tree, >> please let <stable(a)vger.kernel.org> know about it. > [...] >> From: James Cowgill <jcowgill(a)debian.org> >> Date: Thu, 6 Sep 2018 22:57:56 +0100 >> Subject: RISC-V: include linux/ftrace.h in asm-prototypes.h >> >> From: James Cowgill <jcowgill(a)debian.org> >> >> [ Upstream commit 57a489786de9ec37d6e25ef1305dc337047f0236 ] > > I guess it doesn't make much sense to add this patch to the 4.4 > and 3.18 stable trees. The patch creates an arch-specific header > (arch/riscv/include/asm/asm-prototypes.h), but the first mainline > kernel with support for the RISC-V architecture has been kernel > 4.15. I agree.

7 years, 2 months

1
0
0 0

[4.4.y v2] ext4: avoid running out of journal credits when appending to an inline file

by Chenbo Feng

From: Theodore Ts'o <tytso(a)mit.edu> commit 8bc1379b82b8e809eef77a9fedbb75c6c297be19 upstream. Use a separate journal transaction if it turns out that we need to convert an inline file to use an data block. Otherwise we could end up failing due to not having journal credits. This addresses CVE-2018-10883. https://bugzilla.kernel.org/show_bug.cgi?id=200071 Change-Id: Ifbe92e379f7a25fb252a2584356ccb91f902ea8f Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org [fengc(a)google.com: 4.4 and 4.9 backport: adjust context] Signed-off-by: Chenbo Feng <fengc(a)google.com> --- fs/ext4/ext4.h | 3 --- fs/ext4/inline.c | 38 +------------------------------------- fs/ext4/xattr.c | 18 ++---------------- 3 files changed, 3 insertions(+), 56 deletions(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index f5d9f82b173a..b6e25d771eea 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -3039,9 +3039,6 @@ extern struct buffer_head *ext4_get_first_inline_block(struct inode *inode, extern int ext4_inline_data_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, int *has_inline, __u64 start, __u64 len); -extern int ext4_try_to_evict_inline_data(handle_t *handle, - struct inode *inode, - int needed); extern void ext4_inline_data_truncate(struct inode *inode, int *has_inline); extern int ext4_convert_inline_data(struct inode *inode); diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index 1e7a9774119c..5ead3b0f3d34 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -888,11 +888,11 @@ retry_journal: flags |= AOP_FLAG_NOFS; if (ret == -ENOSPC) { + ext4_journal_stop(handle); ret = ext4_da_convert_inline_data_to_extent(mapping, inode, flags, fsdata); - ext4_journal_stop(handle); if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries)) goto retry_journal; @@ -1867,42 +1867,6 @@ out: return (error < 0 ? error : 0); } -/* - * Called during xattr set, and if we can sparse space 'needed', - * just create the extent tree evict the data to the outer block. - * - * We use jbd2 instead of page cache to move data to the 1st block - * so that the whole transaction can be committed as a whole and - * the data isn't lost because of the delayed page cache write. - */ -int ext4_try_to_evict_inline_data(handle_t *handle, - struct inode *inode, - int needed) -{ - int error; - struct ext4_xattr_entry *entry; - struct ext4_inode *raw_inode; - struct ext4_iloc iloc; - - error = ext4_get_inode_loc(inode, &iloc); - if (error) - return error; - - raw_inode = ext4_raw_inode(&iloc); - entry = (struct ext4_xattr_entry *)((void *)raw_inode + - EXT4_I(inode)->i_inline_off); - if (EXT4_XATTR_LEN(entry->e_name_len) + - EXT4_XATTR_SIZE(le32_to_cpu(entry->e_value_size)) < needed) { - error = -ENOSPC; - goto out; - } - - error = ext4_convert_inline_data_nolock(handle, inode, &iloc); -out: - brelse(iloc.bh); - return error; -} - void ext4_inline_data_truncate(struct inode *inode, int *has_inline) { handle_t *handle; diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index b51bb73b06a6..b555b5ee0839 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1038,22 +1038,8 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode, if (EXT4_I(inode)->i_extra_isize == 0) return -ENOSPC; error = ext4_xattr_set_entry(i, s); - if (error) { - if (error == -ENOSPC && - ext4_has_inline_data(inode)) { - error = ext4_try_to_evict_inline_data(handle, inode, - EXT4_XATTR_LEN(strlen(i->name) + - EXT4_XATTR_SIZE(i->value_len))); - if (error) - return error; - error = ext4_xattr_ibody_find(inode, i, is); - if (error) - return error; - error = ext4_xattr_set_entry(i, s); - } - if (error) - return error; - } + if (error) + return error; header = IHDR(inode, ext4_raw_inode(&is->iloc)); if (!IS_LAST_ENTRY(s->first)) { header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC); -- 2.19.0.605.g01d371f741-goog

7 years, 2 months

2
5
0 0

[PATCH 0/4] [for linux-4.4.y only] Hyper-V: backport 4 KVP fixes

by Dexuan Cui

Recently Wang Jian reported some KVP issues on the v4.4 kernel: https://github.com/LIS/lis-next/issues/593: e.g. the /var/lib/hyperv/.kvp_pool_* files can not be updated, and sometimes if the hv_kvp_daemon doesn't timely start, the host may not be able to query the VM's IP address via KVP. I identified these 4 mainline patches to fix the issues. The patches can be applied cleanly to the latest 4.4.y branch (currently it's v4.4.161). The first 3 are simply cherry-picked from the mainline, and the 4th has to be reworked for the v4.4 kernel. Wang Jian tested the 4 patches, and the issues can be fixed. I also did some tests and found no regression. Thanks! -- Dexuan K. Y. Srinivasan (2): Drivers: hv: utils: Invoke the poll function after handshake Drivers: hv: util: Pass the channel information during the init call Long Li (1): -- Reworked by Dexuan HV: properly delay KVP packets when negotiation is in progress Vitaly Kuznetsov (1): Drivers: hv: kvp: fix IP Failover drivers/hv/hv_fcopy.c | 2 +- drivers/hv/hv_kvp.c | 40 +++++++++++++++++++++++++++++++++++++--- drivers/hv/hv_snapshot.c | 4 ++-- drivers/hv/hv_util.c | 1 + drivers/hv/hyperv_vmbus.h | 5 +++++ include/linux/hyperv.h | 1 + 6 files changed, 47 insertions(+), 6 deletions(-) -- 2.7.4

7 years, 2 months

2
2
0 0

[PATCH 4/4] [for linux-4.4.y only] HV: properly delay KVP packets when negotiation is in progress

by Dexuan Cui

The host may send multiple negotiation packets (due to timeout) before the KVP user-mode daemon is connected. KVP user-mode daemon is connected. We need to defer processing those packets until the daemon is negotiated and connected. It's okay for guest to respond to all negotiation packets. In addition, the host may send multiple staged KVP requests as soon as negotiation is done. We need to properly process those packets using one tasklet for exclusive access to ring buffer. This patch is based on the work of Nick Meier <Nick.Meier(a)microsoft.com>. Signed-off-by: Long Li <longli(a)microsoft.com> Signed-off-by: K. Y. Srinivasan <kys(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> The above is the original changelog of a3ade8cc474d ("HV: properly delay KVP packets when negotiation is in progress" Here I re-worked the original patch because the mainline version can't work for the linux-4.4.y branch, on which channel->callback_event doesn't exist yet. In the mainline, channel->callback_event was added by: 631e63a9f346 ("vmbus: change to per channel tasklet"). Here we don't want to backport it to v4.4, as it requires extra supporting changes and fixes, which are unnecessary as to the KVP bug we're trying to resolve. NOTE: before this patch is used, we should cherry-pick the other related 3 patches from the mainline first: The background of this backport request is that: recently Wang Jian reported some KVP issues: https://github.com/LIS/lis-next/issues/593: e.g. the /var/lib/hyperv/.kvp_pool_* files can not be updated, and sometimes if the hv_kvp_daemon doesn't timely start, the host may not be able to query the VM's IP address via KVP. Reported-by: Wang Jian <jianjian.wang1(a)gmail.com> Tested-by: Wang Jian <jianjian.wang1(a)gmail.com> Signed-off-by: Dexuan Cui <decui(a)microsoft.com> --- This is re-worked by me from the mainline: a3ade8cc474d ("HV: properly delay KVP packets when negotiation is in progress" I added my Signed-off-by as I identified and tested the patches. If this is unnecessary, please feel free to remove it. drivers/hv/hv_kvp.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c index ff0a426..1771a96 100644 --- a/drivers/hv/hv_kvp.c +++ b/drivers/hv/hv_kvp.c @@ -612,21 +612,22 @@ void hv_kvp_onchannelcallback(void *context) NEGO_IN_PROGRESS, NEGO_FINISHED} host_negotiatied = NEGO_NOT_STARTED; - if (host_negotiatied == NEGO_NOT_STARTED && - kvp_transaction.state < HVUTIL_READY) { + if (kvp_transaction.state < HVUTIL_READY) { /* * If userspace daemon is not connected and host is asking * us to negotiate we need to delay to not lose messages. * This is important for Failover IP setting. */ - host_negotiatied = NEGO_IN_PROGRESS; - schedule_delayed_work(&kvp_host_handshake_work, + if (host_negotiatied == NEGO_NOT_STARTED) { + host_negotiatied = NEGO_IN_PROGRESS; + schedule_delayed_work(&kvp_host_handshake_work, HV_UTIL_NEGO_TIMEOUT * HZ); + } return; } if (kvp_transaction.state > HVUTIL_READY) return; - +recheck: vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 4, &recvlen, &requestid); @@ -703,6 +704,8 @@ void hv_kvp_onchannelcallback(void *context) VM_PKT_DATA_INBAND, 0); host_negotiatied = NEGO_FINISHED; + + goto recheck; } } -- 2.7.4

7 years, 2 months

2
2
0 0

[4.9.y v3] ext4: avoid running out of journal credits when appending to an inline file

by Chenbo Feng

From: Theodore Ts'o <tytso(a)mit.edu> commit 8bc1379b82b8e809eef77a9fedbb75c6c297be19 upstream. Use a separate journal transaction if it turns out that we need to convert an inline file to use an data block. Otherwise we could end up failing due to not having journal credits. This addresses CVE-2018-10883. https://bugzilla.kernel.org/show_bug.cgi?id=200071 Change-Id: Ifbe92e379f7a25fb252a2584356ccb91f902ea8f Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org [fengc(a)google.com: 4.4 and 4.9 backport: adjust context] Signed-off-by: Chenbo Feng <fengc(a)google.com> --- fs/ext4/ext4.h | 3 --- fs/ext4/inline.c | 38 +------------------------------------- fs/ext4/xattr.c | 18 ++---------------- 3 files changed, 3 insertions(+), 56 deletions(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 43e27d8ec770..567a6c7af677 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -3038,9 +3038,6 @@ extern struct buffer_head *ext4_get_first_inline_block(struct inode *inode, extern int ext4_inline_data_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, int *has_inline, __u64 start, __u64 len); -extern int ext4_try_to_evict_inline_data(handle_t *handle, - struct inode *inode, - int needed); extern void ext4_inline_data_truncate(struct inode *inode, int *has_inline); extern int ext4_convert_inline_data(struct inode *inode); diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index 211539a7adfc..6779a9f1de3b 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -889,11 +889,11 @@ int ext4_da_write_inline_data_begin(struct address_space *mapping, flags |= AOP_FLAG_NOFS; if (ret == -ENOSPC) { + ext4_journal_stop(handle); ret = ext4_da_convert_inline_data_to_extent(mapping, inode, flags, fsdata); - ext4_journal_stop(handle); if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries)) goto retry_journal; @@ -1865,42 +1865,6 @@ int ext4_inline_data_fiemap(struct inode *inode, return (error < 0 ? error : 0); } -/* - * Called during xattr set, and if we can sparse space 'needed', - * just create the extent tree evict the data to the outer block. - * - * We use jbd2 instead of page cache to move data to the 1st block - * so that the whole transaction can be committed as a whole and - * the data isn't lost because of the delayed page cache write. - */ -int ext4_try_to_evict_inline_data(handle_t *handle, - struct inode *inode, - int needed) -{ - int error; - struct ext4_xattr_entry *entry; - struct ext4_inode *raw_inode; - struct ext4_iloc iloc; - - error = ext4_get_inode_loc(inode, &iloc); - if (error) - return error; - - raw_inode = ext4_raw_inode(&iloc); - entry = (struct ext4_xattr_entry *)((void *)raw_inode + - EXT4_I(inode)->i_inline_off); - if (EXT4_XATTR_LEN(entry->e_name_len) + - EXT4_XATTR_SIZE(le32_to_cpu(entry->e_value_size)) < needed) { - error = -ENOSPC; - goto out; - } - - error = ext4_convert_inline_data_nolock(handle, inode, &iloc); -out: - brelse(iloc.bh); - return error; -} - void ext4_inline_data_truncate(struct inode *inode, int *has_inline) { handle_t *handle; diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index c10180d0b018..d6d59b92da6d 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1086,22 +1086,8 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode, if (EXT4_I(inode)->i_extra_isize == 0) return -ENOSPC; error = ext4_xattr_set_entry(i, s, inode); - if (error) { - if (error == -ENOSPC && - ext4_has_inline_data(inode)) { - error = ext4_try_to_evict_inline_data(handle, inode, - EXT4_XATTR_LEN(strlen(i->name) + - EXT4_XATTR_SIZE(i->value_len))); - if (error) - return error; - error = ext4_xattr_ibody_find(inode, i, is); - if (error) - return error; - error = ext4_xattr_set_entry(i, s, inode); - } - if (error) - return error; - } + if (error) + return error; header = IHDR(inode, ext4_raw_inode(&is->iloc)); if (!IS_LAST_ENTRY(s->first)) { header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC); -- 2.19.1.331.ge82ca0e54c-goog

7 years, 2 months

2
1
0 0

[PATCH 4.9 v2 0/4] Fix softirq time accounting issues on 4.9

by Ivan Delalande

Hi Greg, This series fixes issues we've seen with softirq time accounting in 4.9: - when ksoftirqd is running at 100% on a CPU, none of the values reported by /proc/stat for that CPU will change, sometimes for dozens of seconds, - large deviations in the total number of ticks accumulated over a fixed time for a CPU, probably because of the first issue hitting for shorter periods. We found out that something pretty similar had been reported 9 months ago, see the reference link below. In that discussion, Rabin Vincent had made a 4.9 specific patch which fixes our first issue, but we were still seeing some deviation from the total number of ticks (up to 1.7% from expected, where we had only 0.2% on older kernels), and you had also asked for a direct backport from the mainline series, if possible. As mentioned in that thread, a lot of changes (probably 50+) went into 4.11 to remove cputime, but we could get something working with only the 4 attached patches to fix these two issues. Three of these patches apply without change, and the second one in the series ("sched/cputime: Convert kcpustat to nsecs") needed a minor change as a cast had been added in 527b0a76f41d ("sched/cpuacct: Avoid %lld seq_printf warning") to fix a build warning on s390. I guess we could also include that patch in this series, let me know if this is the preferred way to handle this. We ran our tests on 3.18, 4.4 and 4.9 and confirmed that only 4.9 would need this series, and that this series indeed restores the behavior we were seeing on those older kernels. Thanks! Reference: http://lkml.kernel.org/r/%3C1513159876-5125-1-git-send-email-rabin.vincent@… v2: - drop "time: Introduce jiffies64_to_nsecs()" as it has already been merged into v4.9.132, - include backport of commit 564b733c899f ("macintosh/rack-meter: Convert cputime64_t use to u64") to avoid introducing a build failure on powerpc. Frederic Weisbecker (4): sched/cputime: Convert kcpustat to nsecs macintosh/rack-meter: Convert cputime64_t use to u64 sched/cputime: Increment kcpustat directly on irqtime account sched/cputime: Fix ksoftirqd cputime accounting regression arch/s390/appldata/appldata_os.c | 16 +++---- drivers/cpufreq/cpufreq.c | 6 +-- drivers/cpufreq/cpufreq_governor.c | 2 +- drivers/cpufreq/cpufreq_stats.c | 1 - drivers/macintosh/rack-meter.c | 28 +++++------ fs/proc/stat.c | 68 +++++++++++++-------------- fs/proc/uptime.c | 7 +-- kernel/sched/cpuacct.c | 2 +- kernel/sched/cputime.c | 75 +++++++++++++----------------- kernel/sched/sched.h | 12 +++-- 10 files changed, 104 insertions(+), 113 deletions(-) -- 2.19.1

7 years, 2 months

2
5
0 0

request for 4.14-stable: 2b16fd63059a ("i2c: rcar: handle RXDMA HW behaviour on Gen3")

by Sudip Mukherjee

Hi Greg, This was missing in 4.14-stable. Please apply to your queue. -- Regards Sudip

7 years, 2 months

2
1
0 0

request for 4.14-stable: 0ca9488193e6 ("drm/i915/glk: Add Quirk for GLK NUC HDMI port issues.")

by Sudip Mukherjee

Hi Greg, This was missing in 4.14-stable. Please apply to your queue. -- Regards Sudip

7 years, 2 months

2
1
0 0

request for 4.14-stable: 15d36fecd0bd ("mm: disallow mappings that conflict for devm_memremap_pages()")

by Sudip Mukherjee

Hi Greg, This was missing in 4.14-stable. Please apply to your queue. -- Regards Sudip

7 years, 2 months

2
1
0 0

request for 4.14-stable: 2f7caf6b0214 ("staging: ccree: check DMA pool buf !NULL before free")

by Sudip Mukherjee

Hi Greg, This was missing in 4.14-stable. Please apply to your queue. -- Regards Sudip

7 years, 2 months

2
1
0 0

FAILED: patch "[PATCH] drm/i915: Nuke the LVDS lid notifier" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 05c72e77ccda89ff624108b1b59a0fc43843f343 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala(a)linux.intel.com> Date: Tue, 17 Jul 2018 20:42:14 +0300 Subject: [PATCH] drm/i915: Nuke the LVDS lid notifier MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We broke the LVDS notifier resume thing in (presumably) commit e2c8b8701e2d ("drm/i915: Use atomic helpers for suspend, v2.") as we no longer duplicate the current state in the LVDS notifier and thus we never resume it properly either. Instead of trying to fix it again let's just kill off the lid notifier entirely. None of the machines tested thus far have apparently needed it. Originally the lid notifier was added to work around cases where the VBIOS was clobbering some of the hardware state behind the driver's back, mostly on Thinkpads. We now have a few report of Thinkpads working just fine without the notifier. So maybe it was misdiagnosed originally, or something else has changed (ACPI video stuff perhaps?). If we do end up finding a machine where the VBIOS is still causing problems I would suggest that we first try setting various bits in the VBIOS scratch registers. There are several to choose from that may instruct the VBIOS to steer clear. With the notifier gone we'll also stop looking at the panel status in ->detect(). v2: Nuke enum modeset_restore (Rodrigo) Cc: stable(a)vger.kernel.org Cc: Wolfgang Draxinger <wdraxinger.maillist(a)draxit.de> Cc: Vito Caputo <vcaputo(a)pengaru.com> Cc: kitsunyan <kitsunyan(a)airmail.cc> Cc: Joonas Saarinen <jza(a)saunalahti.fi> Tested-by: Vito Caputo <vcaputo(a)pengaru.com> # Thinkapd X61s Tested-by: kitsunyan <kitsunyan(a)airmail.cc> # ThinkPad X200 Tested-by: Joonas Saarinen <jza(a)saunalahti.fi> # Fujitsu Siemens U9210 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105902 References: https://lists.freedesktop.org/archives/intel-gfx/2018-June/169315.html References: https://bugs.freedesktop.org/show_bug.cgi?id=21230 Fixes: e2c8b8701e2d ("drm/i915: Use atomic helpers for suspend, v2.") Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20180717174216.22252-1-ville.… Reviewed-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c index 337b1aad5212..343e79a44abd 100644 --- a/drivers/gpu/drm/i915/i915_drv.c +++ b/drivers/gpu/drm/i915/i915_drv.c @@ -900,7 +900,6 @@ static int i915_driver_init_early(struct drm_i915_private *dev_priv, spin_lock_init(&dev_priv->uncore.lock); mutex_init(&dev_priv->sb_lock); - mutex_init(&dev_priv->modeset_restore_lock); mutex_init(&dev_priv->av_mutex); mutex_init(&dev_priv->wm.wm_mutex); mutex_init(&dev_priv->pps_mutex); @@ -1570,11 +1569,6 @@ static int i915_drm_suspend(struct drm_device *dev) struct pci_dev *pdev = dev_priv->drm.pdev; pci_power_t opregion_target_state; - /* ignore lid events during suspend */ - mutex_lock(&dev_priv->modeset_restore_lock); - dev_priv->modeset_restore = MODESET_SUSPENDED; - mutex_unlock(&dev_priv->modeset_restore_lock); - disable_rpm_wakeref_asserts(dev_priv); /* We do a lot of poking in a lot of registers, make sure they work @@ -1770,10 +1764,6 @@ static int i915_drm_resume(struct drm_device *dev) intel_fbdev_set_suspend(dev, FBINFO_STATE_RUNNING, false); - mutex_lock(&dev_priv->modeset_restore_lock); - dev_priv->modeset_restore = MODESET_DONE; - mutex_unlock(&dev_priv->modeset_restore_lock); - intel_opregion_notify_adapter(dev_priv, PCI_D0); enable_rpm_wakeref_asserts(dev_priv); diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h index 08d4303abb14..995656f51b57 100644 --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h @@ -1002,12 +1002,6 @@ struct i915_gem_mm { #define I915_ENGINE_WEDGED_TIMEOUT (60 * HZ) /* Reset but no recovery? */ -enum modeset_restore { - MODESET_ON_LID_OPEN, - MODESET_DONE, - MODESET_SUSPENDED, -}; - #define DP_AUX_A 0x40 #define DP_AUX_B 0x10 #define DP_AUX_C 0x20 @@ -1730,8 +1724,6 @@ struct drm_i915_private { unsigned long quirks; - enum modeset_restore modeset_restore; - struct mutex modeset_restore_lock; struct drm_atomic_state *modeset_restore_state; struct drm_modeset_acquire_ctx reset_ctx; diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c index bb06744d28a4..a35404119257 100644 --- a/drivers/gpu/drm/i915/intel_lvds.c +++ b/drivers/gpu/drm/i915/intel_lvds.c @@ -44,8 +44,6 @@ /* Private structure for the integrated LVDS support */ struct intel_lvds_connector { struct intel_connector base; - - struct notifier_block lid_notifier; }; struct intel_lvds_pps { @@ -452,26 +450,9 @@ static bool intel_lvds_compute_config(struct intel_encoder *intel_encoder, return true; } -/* - * Detect the LVDS connection. - * - * Since LVDS doesn't have hotlug, we use the lid as a proxy. Open means - * connected and closed means disconnected. We also send hotplug events as - * needed, using lid status notification from the input layer. - */ static enum drm_connector_status intel_lvds_detect(struct drm_connector *connector, bool force) { - struct drm_i915_private *dev_priv = to_i915(connector->dev); - enum drm_connector_status status; - - DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", - connector->base.id, connector->name); - - status = intel_panel_detect(dev_priv); - if (status != connector_status_unknown) - return status; - return connector_status_connected; } @@ -496,117 +477,6 @@ static int intel_lvds_get_modes(struct drm_connector *connector) return 1; } -static int intel_no_modeset_on_lid_dmi_callback(const struct dmi_system_id *id) -{ - DRM_INFO("Skipping forced modeset for %s\n", id->ident); - return 1; -} - -/* The GPU hangs up on these systems if modeset is performed on LID open */ -static const struct dmi_system_id intel_no_modeset_on_lid[] = { - { - .callback = intel_no_modeset_on_lid_dmi_callback, - .ident = "Toshiba Tecra A11", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), - DMI_MATCH(DMI_PRODUCT_NAME, "TECRA A11"), - }, - }, - - { } /* terminating entry */ -}; - -/* - * Lid events. Note the use of 'modeset': - * - we set it to MODESET_ON_LID_OPEN on lid close, - * and set it to MODESET_DONE on open - * - we use it as a "only once" bit (ie we ignore - * duplicate events where it was already properly set) - * - the suspend/resume paths will set it to - * MODESET_SUSPENDED and ignore the lid open event, - * because they restore the mode ("lid open"). - */ -static int intel_lid_notify(struct notifier_block *nb, unsigned long val, - void *unused) -{ - struct intel_lvds_connector *lvds_connector = - container_of(nb, struct intel_lvds_connector, lid_notifier); - struct drm_connector *connector = &lvds_connector->base.base; - struct drm_device *dev = connector->dev; - struct drm_i915_private *dev_priv = to_i915(dev); - - if (dev->switch_power_state != DRM_SWITCH_POWER_ON) - return NOTIFY_OK; - - mutex_lock(&dev_priv->modeset_restore_lock); - if (dev_priv->modeset_restore == MODESET_SUSPENDED) - goto exit; - /* - * check and update the status of LVDS connector after receiving - * the LID nofication event. - */ - connector->status = connector->funcs->detect(connector, false); - - /* Don't force modeset on machines where it causes a GPU lockup */ - if (dmi_check_system(intel_no_modeset_on_lid)) - goto exit; - if (!acpi_lid_open()) { - /* do modeset on next lid open event */ - dev_priv->modeset_restore = MODESET_ON_LID_OPEN; - goto exit; - } - - if (dev_priv->modeset_restore == MODESET_DONE) - goto exit; - - /* - * Some old platform's BIOS love to wreak havoc while the lid is closed. - * We try to detect this here and undo any damage. The split for PCH - * platforms is rather conservative and a bit arbitrary expect that on - * those platforms VGA disabling requires actual legacy VGA I/O access, - * and as part of the cleanup in the hw state restore we also redisable - * the vga plane. - */ - if (!HAS_PCH_SPLIT(dev_priv)) - intel_display_resume(dev); - - dev_priv->modeset_restore = MODESET_DONE; - -exit: - mutex_unlock(&dev_priv->modeset_restore_lock); - return NOTIFY_OK; -} - -static int -intel_lvds_connector_register(struct drm_connector *connector) -{ - struct intel_lvds_connector *lvds = to_lvds_connector(connector); - int ret; - - ret = intel_connector_register(connector); - if (ret) - return ret; - - lvds->lid_notifier.notifier_call = intel_lid_notify; - if (acpi_lid_notifier_register(&lvds->lid_notifier)) { - DRM_DEBUG_KMS("lid notifier registration failed\n"); - lvds->lid_notifier.notifier_call = NULL; - } - - return 0; -} - -static void -intel_lvds_connector_unregister(struct drm_connector *connector) -{ - struct intel_lvds_connector *lvds = to_lvds_connector(connector); - - if (lvds->lid_notifier.notifier_call) - acpi_lid_notifier_unregister(&lvds->lid_notifier); - - intel_connector_unregister(connector); -} - /** * intel_lvds_destroy - unregister and free LVDS structures * @connector: connector to free @@ -639,8 +509,8 @@ static const struct drm_connector_funcs intel_lvds_connector_funcs = { .fill_modes = drm_helper_probe_single_connector_modes, .atomic_get_property = intel_digital_connector_atomic_get_property, .atomic_set_property = intel_digital_connector_atomic_set_property, - .late_register = intel_lvds_connector_register, - .early_unregister = intel_lvds_connector_unregister, + .late_register = intel_connector_register, + .early_unregister = intel_connector_unregister, .destroy = intel_lvds_destroy, .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, .atomic_duplicate_state = intel_digital_connector_duplicate_state, @@ -1114,8 +984,6 @@ void intel_lvds_init(struct drm_i915_private *dev_priv) * 2) check for VBT data * 3) check to see if LVDS is already on * if none of the above, no panel - * 4) make sure lid is open - * if closed, act like it's not there for now */ /*

7 years, 2 months

3
2
0 0

patch "usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten" added to usb-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the usb-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 55a9300cea58007741f7d6b4b132e37d84a4329e Mon Sep 17 00:00:00 2001 From: "Shuah Khan (Samsung OSG)" <shuah(a)kernel.org> Date: Thu, 18 Oct 2018 10:19:29 -0600 Subject: usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten In rmmod path, usbip_vudc does platform_device_put() twice once from platform_device_unregister() and then from put_vudc_device(). The second put results in: BUG kmalloc-2048 (Not tainted): Poison overwritten error or BUG: KASAN: use-after-free in kobject_put+0x1e/0x230 if KASAN is enabled. [ 169.042156] calling init+0x0/0x1000 [usbip_vudc] @ 1697 [ 169.042396] ============================================================================= [ 169.043678] probe of usbip-vudc.0 returned 1 after 350 usecs [ 169.044508] BUG kmalloc-2048 (Not tainted): Poison overwritten [ 169.044509] ----------------------------------------------------------------------------- ... [ 169.057849] INFO: Freed in device_release+0x2b/0x80 age=4223 cpu=3 pid=1693 [ 169.057852] kobject_put+0x86/0x1b0 [ 169.057853] 0xffffffffc0c30a96 [ 169.057855] __x64_sys_delete_module+0x157/0x240 Fix it to call platform_device_del() instead and let put_vudc_device() do the platform_device_put(). Reported-by: Randy Dunlap <rdunlap(a)infradead.org> Signed-off-by: Shuah Khan (Samsung OSG) <shuah(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/usbip/vudc_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/usb/usbip/vudc_main.c b/drivers/usb/usbip/vudc_main.c index 3fc22037a82f..390733e6937e 100644 --- a/drivers/usb/usbip/vudc_main.c +++ b/drivers/usb/usbip/vudc_main.c @@ -73,6 +73,10 @@ static int __init init(void) cleanup: list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) { list_del(&udc_dev->dev_entry); + /* + * Just do platform_device_del() here, put_vudc_device() + * calls the platform_device_put() + */ platform_device_del(udc_dev->pdev); put_vudc_device(udc_dev); } @@ -89,7 +93,11 @@ static void __exit cleanup(void) list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) { list_del(&udc_dev->dev_entry); - platform_device_unregister(udc_dev->pdev); + /* + * Just do platform_device_del() here, put_vudc_device() + * calls the platform_device_put() + */ + platform_device_del(udc_dev->pdev); put_vudc_device(udc_dev); } platform_driver_unregister(&vudc_driver); -- 2.19.1

7 years, 2 months

1
0
0 0

[PATCH v3 00/30] backport of IP fragmentation fixes

by Stephen Hemminger

Took the set of patches from 4.19 to handle IP fragmentation DoS and applied them against 4.14.69. Most of these are from Eric. In a couple case, it required some manual merge conflict resolution. Tested normal IP fragmentation with iperf3 and malicious IP fragments with fragmentsmack. Under fragmentation attack (700Kpps) the original 4.14.69 consumes 97% CPU; with this patch it drops to 5%. v3 - send to wider audience v2 - added patch from 4.19 linux-next to fix ip fragmentation crash Dan Carpenter (1): ipv4: frags: precedence bug in ip_expire() Eric Dumazet (22): inet: frags: change inet_frags_init_net() return value inet: frags: add a pointer to struct netns_frags inet: frags: refactor ipfrag_init() inet: frags: refactor ipv6_frag_init() inet: frags: refactor lowpan_net_frag_init() ipv6: export ip6 fragments sysctl to unprivileged users rhashtable: add schedule points inet: frags: use rhashtables for reassembly units inet: frags: remove some helpers inet: frags: get rif of inet_frag_evicting() inet: frags: remove inet_frag_maybe_warn_overflow() inet: frags: break the 2GB limit for frags storage inet: frags: do not clone skb in ip_expire() ipv6: frags: rewrite ip6_expire_frag_queue() rhashtable: reorganize struct rhashtable layout inet: frags: reorganize struct netns_frags inet: frags: get rid of ipfrag_skb_cb/FRAG_CB inet: frags: fix ip6frag_low_thresh boundary net: speed up skb_rbtree_purge() net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends net: add rb_to_skb() and other rb tree helpers net: sk_buff rbnode reorg Florian Westphal (1): ipv6: defrag: drop non-last frags smaller than min mtu Kees Cook (1): inet: frags: Convert timers to use timer_setup() Peter Oskolkov (4): ip: discard IPv4 datagrams with overlapping segments. net: modify skb_rbtree_purge to return the truesize of all purged skbs. ip: add helpers to process in-order fragments faster. ip: process in-order fragments efficiently Taehee Yoo (1): ip: frags: fix crash in ip_do_fragment() Documentation/networking/ip-sysctl.txt | 13 +- include/linux/rhashtable.h | 8 +- include/linux/skbuff.h | 50 +- include/net/inet_frag.h | 135 +++--- include/net/ip.h | 1 - include/net/ipv6.h | 26 +- include/uapi/linux/snmp.h | 1 + lib/rhashtable.c | 2 + net/core/skbuff.c | 31 +- net/ieee802154/6lowpan/6lowpan_i.h | 26 +- net/ieee802154/6lowpan/reassembly.c | 153 ++++--- net/ipv4/inet_fragment.c | 378 ++++------------ net/ipv4/ip_fragment.c | 578 +++++++++++++----------- net/ipv4/proc.c | 7 +- net/ipv4/tcp_fastopen.c | 8 +- net/ipv4/tcp_input.c | 33 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 105 ++--- net/ipv6/proc.c | 5 +- net/ipv6/reassembly.c | 217 ++++----- net/sched/sch_netem.c | 14 +- 20 files changed, 802 insertions(+), 989 deletions(-) -- 2.18.0

7 years, 2 months

3
32
0 0

[GIT PULL] commits for Linux 4.18

by Sasha Levin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Greg, Pleae pull commits for Linux 4.18 . I've sent a review request for all commits over a week ago and all comments were addressed. Thanks, Sasha ===== The following changes since commit e7d199e92956587695510d147c8de795f944cec9: Linux 4.18.14 (2018-10-13 09:33:17 +0200) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git tags/for-greg-4.18-16102018 for you to fetch changes up to c8e6deb507081660532500fb97cf8901a582d8f5: x86/boot: Fix kexec booting failure in the SEV bit detection code (2018-10-15 18:01:55 -0400) - ---------------------------------------------------------------- for-greg-4.18-16102018 - ---------------------------------------------------------------- Alaa Hleihel (1): net/mlx5: Check for SQ and not RQ state when modifying hairpin SQ Alexander Shishkin (1): intel_th: pci: Add Ice Lake PCH support Alexandru Gheorghe (1): drm: mali-dp: Call drm_crtc_vblank_reset on device init Andreas Schwab (1): Input: atakbd - fix Atari keymap Antoine Tenart (2): net: mvpp2: fix a txq_done race condition net: mscc: fix the frame extraction into the skb Arindam Nath (1): iommu/amd: Return devid as alias for ACPI HID devices Christian Lamparter (1): net: emac: fix fixed-link setup for the RTL8363SB switch Daniel Kurtz (1): pinctrl/amd: poll InterruptEnable bits in amd_gpio_irq_set_type Davide Caratti (1): bnxt_en: don't try to offload VLAN 'modify' action Friedemann Gerold (1): net: aquantia: memory corruption on jumbo frames Heiko Stuebner (1): iommu/rockchip: Free irqs in shutdown handler James Cowgill (1): RISC-V: include linux/ftrace.h in asm-prototypes.h James Smart (1): scsi: lpfc: Synchronize access to remoteport via rport Jisheng Zhang (1): PCI: dwc: Fix scheduling while atomic issues Johannes Thumshirn (1): scsi: sd: don't crash the host on invalid commands John Fastabend (3): bpf: sockmap only allow ESTABLISHED sock state bpf: sockmap, fix transition through disconnect without close bpf: test_maps, only support ESTABLISHED socks Jose Abreu (2): net: stmmac: Rework coalesce timer and fix multi-queue races net: stmmac: Fixup the tail addr setting in xmit path Jozef Balga (1): media: af9035: prevent buffer overflow on write Kairui Song (1): x86/boot: Fix kexec booting failure in the SEV bit detection code Kazuya Mizuguchi (1): ravb: do not write 1 to reserved bits Keerthy (1): clocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag for non-am43 SoCs Laura Abbott (2): scsi: ibmvscsis: Fix a stringop-overflow warning scsi: ibmvscsis: Ensure partition name is properly NUL terminated Linus Walleij (1): spi: gpio: Fix copy-and-paste error Majd Dibbiny (1): RDMA/uverbs: Fix validity check for modify QP Marek Lindner (2): batman-adv: fix backbone_gw refcount on queue_work() failure batman-adv: fix hardif_neigh refcount on queue_work() failure Michael Neuling (2): powerpc/tm: Fix userspace r13 corruption powerpc/tm: Avoid possible userspace r1 corruption on reclaim Michael Schmitz (1): Input: atakbd - fix Atari CapsLock behaviour Nathan Chancellor (1): net/mlx4: Use cpumask_available for eq->affinity_mask Russell King (1): sfp: fix oops with ethtool -m Sabrina Dubroca (1): selftests: pmtu: properly redirect stderr to /dev/null Sanyog Kale (1): soundwire: Fix acquiring bus lock twice during master release Selvin Xavier (1): RDMA/bnxt_re: Fix system crash during RDMA resource initialization Shreyas NC (2): soundwire: Fix duplicate stream state assignment soundwire: Fix incorrect exit after configuring stream Srikar Dronamraju (1): powerpc/numa: Use associativity if VPHN hcall is successful Steve Wise (1): cxgb4: fix abort_req_rss6 struct Sudarsana Reddy Kalluru (2): qed: Fix populating the invalid stag value in multi function mode. qed: Do not add VLAN 0 tag to untagged frames in multi-function mode. Sven Eckelmann (8): batman-adv: Avoid probe ELP information leak batman-adv: Fix segfault when writing to throughput_override batman-adv: Fix segfault when writing to sysfs elp_interval batman-adv: Prevent duplicated gateway_node entry batman-adv: Prevent duplicated nc_node entry batman-adv: Prevent duplicated softif_vlan entry batman-adv: Prevent duplicated global TT entry batman-adv: Prevent duplicated tvlv handler Tao Ren (1): clocksource/drivers/fttmr010: Fix set_next_event handler Ursula Braun (1): net/smc: fix non-blocking connect problem Wen Xiong (1): scsi: ipr: System hung while dlpar adding primary ipr adapter back YueHaibing (1): net/smc: fix sizeof to int comparison arch/powerpc/kernel/tm.S | 20 +- arch/powerpc/mm/numa.c | 4 +- arch/riscv/include/asm/asm-prototypes.h | 7 + arch/x86/boot/compressed/mem_encrypt.S | 19 -- drivers/clocksource/timer-fttmr010.c | 18 +- drivers/clocksource/timer-ti-32k.c | 3 + drivers/gpu/drm/arm/malidp_drv.c | 1 + drivers/hwtracing/intel_th/pci.c | 5 + drivers/infiniband/core/uverbs_cmd.c | 68 ++++-- drivers/infiniband/hw/bnxt_re/main.c | 93 ++++---- drivers/input/keyboard/atakbd.c | 74 +++---- drivers/iommu/amd_iommu.c | 6 + drivers/iommu/rockchip-iommu.c | 6 + drivers/media/usb/dvb-usb-v2/af9035.c | 6 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 32 +-- drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 20 +- drivers/net/ethernet/chelsio/cxgb4/t4_msg.h | 1 - drivers/net/ethernet/ibm/emac/core.c | 15 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 10 +- drivers/net/ethernet/mellanox/mlx4/eq.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/transobj.c | 2 +- drivers/net/ethernet/mscc/ocelot_board.c | 12 +- drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 9 +- drivers/net/ethernet/qlogic/qed/qed_dcbx.h | 1 + drivers/net/ethernet/qlogic/qed/qed_dev.c | 15 +- drivers/net/ethernet/qlogic/qed/qed_hsi.h | 4 + drivers/net/ethernet/renesas/ravb.h | 5 + drivers/net/ethernet/renesas/ravb_main.c | 11 +- drivers/net/ethernet/renesas/ravb_ptp.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 4 +- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 238 ++++++++++++--------- drivers/net/phy/sfp-bus.c | 4 +- drivers/pci/controller/dwc/pcie-designware.c | 8 +- drivers/pci/controller/dwc/pcie-designware.h | 3 +- drivers/pinctrl/pinctrl-amd.c | 33 ++- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 5 +- drivers/scsi/ipr.c | 106 +++++---- drivers/scsi/ipr.h | 1 + drivers/scsi/lpfc/lpfc_attr.c | 15 +- drivers/scsi/lpfc/lpfc_debugfs.c | 10 +- drivers/scsi/lpfc/lpfc_nvme.c | 11 +- drivers/scsi/sd.c | 3 +- drivers/soundwire/stream.c | 23 +- drivers/spi/spi-gpio.c | 4 +- include/linux/stmmac.h | 1 + kernel/bpf/sockmap.c | 91 ++++++-- net/batman-adv/bat_v_elp.c | 10 +- net/batman-adv/bridge_loop_avoidance.c | 10 +- net/batman-adv/gateway_client.c | 11 +- net/batman-adv/network-coding.c | 27 +-- net/batman-adv/soft-interface.c | 25 ++- net/batman-adv/sysfs.c | 30 ++- net/batman-adv/translation-table.c | 6 +- net/batman-adv/tvlv.c | 8 +- net/smc/af_smc.c | 7 +- net/smc/smc_clc.c | 14 +- tools/testing/selftests/bpf/test_maps.c | 10 +- tools/testing/selftests/net/pmtu.sh | 4 +- 59 files changed, 738 insertions(+), 470 deletions(-) create mode 100644 arch/riscv/include/asm/asm-prototypes.h -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAlvGFGoACgkQ3qZv95d3 LNxF8A/+KAEtzAlffVw0aUCqQa2Y87cjAQC9xXM6SkW27j8+trsBRoyZY+DmWPB3 Pud7sy55U5ETnmqfX1VHOs9S4KSICEiPrRkkfnE8BTq7N/hSOeNYTXeEwHppBVhZ pal4eWgjHdypbFCiJaiEbppH+14CgxYElfIPm0frPlsjfdPgTe5hS7j8/bRdtrxF JtG4IY0sLyFtD1piP31AglYetv3ETqe+uLXyqDSfTgNC6kfiSgtqLDoVKHUKH5ec wP8Aen+QN3YAJnaWq9JUlse74wPvLriysqvbgzL57KM9GDgUl1RECsN2koSh6fph MLzD9WrwdmSpiH37MVodjmriT8iSUp+a78eHT9FC7GKVhigTK4dnXLAkqXYBdJxU OwZCEzJwqmNsdJP6qXaFjHMv6t3dJUtvPls90/zshyEl/krxue+loYiKoHEn9vUS 8E4FPBqbsGih3cwZlloZMF5yqjnTdcKYWQ8Olwjs6/bIbtkINl9b3LQavHdzvdy3 KKBhWyW8ciIaL7Gr+HmrCGnqA4WsbXBIE9A3eXXALN2wWtNae6o03Czdw6EOpEdZ jRndNGsq93lfqdE7Zk8gJzUFoVGo/Ani5v+2ULBdMvlUgo8Xw1ZpuU/D63v/zMWp ZyOXvK/dkLm5bRtQf90nJln0z6Hf6q4ww6IFaEKSc5wn2zt+EW0= =jgQ+ -----END PGP SIGNATURE-----

7 years, 2 months

2
1
0 0

[PATCH stable v4.4+] usb: gadget: serial: fix oops when data rx'd after close

by Krzysztof Kozlowski

From: Stephen Warren <swarren(a)nvidia.com> commit daa35bd95634a2a2d72d1049c93576a02711cb1a upstream When the gadget serial device has no associated TTY, do not pass any received data into the TTY layer for processing; simply drop it instead. This prevents the TTY layer from calling back into the gadget serial driver, which will then crash in e.g. gs_write_room() due to lack of gadget serial device to TTY association (i.e. a NULL pointer dereference). Signed-off-by: Stephen Warren <swarren(a)nvidia.com> Signed-off-by: Felipe Balbi <felipe.balbi(a)linux.intel.com> Signed-off-by: Krzysztof Kozlowski <krzk(a)kernel.org> --- This is necessary for v4.4+ to fix: [ 134.015750] Unable to handle kernel NULL pointer dereference at virtual address 000000a8 [ 134.023988] pgd = 80004000 [ 134.026749] [000000a8] *pgd=00000000 [ 134.030417] Internal error: Oops: 17 [#1] ARM [ 134.034826] Modules linked in: ctr ccm usb_f_acm u_serial ath9k_htc ath9k_common ath9k_hw ath mac80211 cfg80211 libcomposite configfs [ 134.047166] CPU: 0 PID: 51 Comm: kworker/u2:1 Not tainted 4.9.133 #60 [ 134.053664] Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree) [ 134.060195] Workqueue: events_unbound flush_to_ldisc [ 134.065244] task: 86a42140 task.stack: 86a9a000 [ 134.069872] PC is at gs_flush_chars+0x18/0x30 [u_serial] [ 134.075261] LR is at n_tty_receive_buf_common+0x648/0xa54 [ 134.080726] pc : [<7f169d4c>] lr : [<803cce74>] psr: 200f0093 [ 134.080726] sp : 86a9be08 ip : 86a9be20 fp : 86a9be1c [ 134.092310] r10: 86bff600 r9 : 862240cc r8 : 00000000 [ 134.097589] r7 : 862240cc r6 : 00000000 r5 : 00000000 r4 : 200f0013 [ 134.104177] r3 : 7f169d34 r2 : 0000000a r1 : 0000003c r0 : 00000000 [ 134.110763] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none [ 134.118081] Control: 10c5387d Table: 85fb8059 DAC: 00000051 [ 134.123882] Process kworker/u2:1 (pid: 51, stack limit = 0x86a9a208) [ 134.130293] Stack: (0x86a9be08 to 0x86a9c000) [ 134.134717] be00: 89f0b000 00000000 86a9be8c 86a9be20 803cce74 7f169d40 [ 134.143000] be20: 86bff658 00020001 86bff73c 86a9be38 55555556 89f0b000 86a9be6c 8061f090 [ 134.151282] be40: 89f0b018 89f0d000 89f0b000 00000000 86224090 0000003c 00000000 0000003c [ 134.159567] be60: 86a9be94 0000003c 803cd280 86be5e00 8604ea40 86be5e14 00000000 86802014 [ 134.167852] be80: 86a9bea4 86a9be90 803cd29c 803cc838 00000001 80101438 86a9bebc 86a9bea8 [ 134.176135] bea0: 803d00c4 803cd28c 86224000 86be5e04 86a9bee4 86a9bec0 803d05fc 803d00a8 [ 134.184419] bec0: 86be5e04 86acf980 00000000 86808700 86802000 00000000 86a9bf1c 86a9bee8 [ 134.192703] bee0: 8012ef38 803d054c 00000088 8090cac0 86a9a000 86acf980 86802000 86acf998 [ 134.200988] bf00: 00000088 8090cac0 86a9a000 86802014 86a9bf5c 86a9bf20 8012f260 8012ee20 [ 134.209270] bf20: 86ad1dc0 8070ee70 8092c91c 86802000 00000000 00000000 86ad1dc0 86a9a000 [ 134.217554] bf40: 86acf980 8012f1f4 00000000 00000000 86a9bfac 86a9bf60 80134a78 8012f200 [ 134.225838] bf60: 00000000 00000000 86ad1dc0 86acf980 00000000 86a9bf74 86a9bf74 00000000 [ 134.234122] bf80: 86a9bf80 86a9bf80 8013b048 86ad1dc0 80134980 00000000 00000000 00000000 [ 134.242406] bfa0: 00000000 86a9bfb0 80107990 8013498c 00000000 00000000 00000000 00000000 [ 134.250688] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 134.258970] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [ 134.267228] Backtrace: [ 134.269785] [<7f169d34>] (gs_flush_chars [u_serial]) from [<803cce74>] (n_tty_receive_buf_common+0x648/0xa54) [ 134.279800] r5:00000000 r4:89f0b000 [ 134.283449] [<803cc82c>] (n_tty_receive_buf_common) from [<803cd29c>] (n_tty_receive_buf2+0x1c/0x24) [ 134.292695] r10:86802014 r9:00000000 r8:86be5e14 r7:8604ea40 r6:86be5e00 r5:803cd280 [ 134.300610] r4:0000003c [ 134.303216] [<803cd280>] (n_tty_receive_buf2) from [<803d00c4>] (tty_ldisc_receive_buf+0x28/0x64) [ 134.312201] [<803d009c>] (tty_ldisc_receive_buf) from [<803d05fc>] (flush_to_ldisc+0xbc/0xd4) [ 134.320822] r5:86be5e04 r4:86224000 [ 134.324476] [<803d0540>] (flush_to_ldisc) from [<8012ef38>] (process_one_work+0x124/0x3e0) [ 134.332851] r9:00000000 r8:86802000 r7:86808700 r6:00000000 r5:86acf980 r4:86be5e04 [ 134.340706] [<8012ee14>] (process_one_work) from [<8012f260>] (worker_thread+0x6c/0x5a8) [ 134.348905] r10:86802014 r9:86a9a000 r8:8090cac0 r7:00000088 r6:86acf998 r5:86802000 [ 134.356828] r4:86acf980 [ 134.359431] [<8012f1f4>] (worker_thread) from [<80134a78>] (kthread+0xf8/0x110) [ 134.366847] r10:00000000 r9:00000000 r8:8012f1f4 r7:86acf980 r6:86a9a000 r5:86ad1dc0 [ 134.374765] r4:00000000 [ 134.377375] [<80134980>] (kthread) from [<80107990>] (ret_from_fork+0x14/0x24) [ 134.384708] r8:00000000 r7:00000000 r6:00000000 r5:80134980 r4:86ad1dc0 [ 134.391483] Code: e24cb004 e5900168 e10f4000 f10c0080 (e59030a8) [ 134.397643] ---[ end trace 6d6c0a94eccf9fda ]--- Reproduction: 1. Set up USB serial gadget and connect to device. 2. On device: while true; do echo "abcdefgh01234567890" > /dev/ttyGS0; done 3. On PC, execute simultaneously: while true; do cat /dev/ttyACM0 >> /tmp/tmp-dl; done for i in `seq 10000` ; do echo "XXXXXXXXXXXXXX" > /dev/ttyACM0 ; done --- drivers/usb/gadget/function/u_serial.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index f7771d86ad6c..4ea44f7122ee 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -518,7 +518,7 @@ static void gs_rx_push(unsigned long _port) } /* push data to (open) tty */ - if (req->actual) { + if (req->actual && tty) { char *packet = req->buf; unsigned size = req->actual; unsigned n; -- 2.7.4

7 years, 2 months

2
1
0 0

Re: [PATCH] HID: quirks: fix support for Apple Magic Keyboards

by Benjamin Tissoires

On Wed, Oct 17, 2018 at 5:55 PM Natanael Copa <ncopa(a)alpinelinux.org> wrote: > > On Wed, 17 Oct 2018 16:59:15 +0200 > Benjamin Tissoires <benjamin.tissoires(a)redhat.com> wrote: > > > Hi Natanael, > > > > On Wed, Oct 17, 2018 at 4:52 PM Natanael Copa <ncopa(a)alpinelinux.org> wrote: > > > > > > Commit ee3454924370 ("HID: add support for Apple Magic Keyboards") added > > > support for the Magic Keyboard over Bluetooth, but did not add the > > > BT_VENDOR_ID_APPLE to hid-quirks. Fix this so hid-apple driver is used > > > over hid-generic. > > > > > > This fixes the Fn key, which does not work at all with hid-generic. > > > > > > Fixes: ee3454924370 ("HID: add support for Apple Magic Keyboards") > > > Bugzilla-id: https://bugzilla.kernel.org/show_bug.cgi?id=99881 > > > Signed-off-by: Natanael Copa <ncopa(a)alpinelinux.org> > > > --- > > > This should be backported to stable too. > > > > > > drivers/hid/hid-quirks.c | 3 +++ > > > 1 file changed, 3 insertions(+) > > > > > > diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c > > > index 249d49b6b16c..a3b3aecf8628 100644 > > > --- a/drivers/hid/hid-quirks.c > > > +++ b/drivers/hid/hid-quirks.c > > > @@ -270,6 +270,9 @@ static const struct hid_device_id hid_have_special_driver[] = { > > > { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO) }, > > > { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS) }, > > > { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI) }, > > > + { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI) }, > > > + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI) }, > > > + { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI) }, > > > > NACK, this should not be required with kernels v4.17+ IIRC. > > > > If it doesn't work on a recent kernel, please raise the issue, but I > > am actually chasing down the new inclusions of these when we add new > > device support. > > Fair enough. I think it may be needed for 4.14.y kernels though, to fix > commit b6cc0ba2cbf4 (HID: add support for Apple Magic Keyboards). > > Fn key did not work without this patch on 4.14.76 for me. Right, b6cc0ba2cbf4 has been added to 4.14.75 and is not working because tweaking hid_have_special_driver[] is not required in current kernels anymore. @stable folks, would it be possible to take this patch in the v4.9 and v4.14 trees? It can't go into Linus' tree, but I'd be glad to give my Acked-by for a stable backport. > > > There is even a high chance that we remove the list entirely as this > > would tremendously help the distributions to just have to ship > > hid-generic in the initramfs instead of a bunch of random hid drivers. > > I doubt that distros will want Bluetooth keyboards there though. (which > this is about) I was talking more generally, killing this list of devices, as some are keyboard and useful, and some are not needed as you say. But the point is that distro folks won't have to decide which module to ship: only hid-generic will be sufficient. Cheers, Benjamin > > > By the way, if the driver is not autoloaded by udev, it is a problem > > in udev likely. > > > > Cheers, > > Benjamin > > > > > { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, > > > USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) }, > > > { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, > > > USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) }, #endif -- > > > 2.19.1 > > > >

7 years, 2 months

3
4
0 0

[PATCH] block: don't deal with discard limit in blkdev_issue_discard()

by Ming Lei

blk_queue_split() does respect this limit via bio splitting, so no need to do that in blkdev_issue_discard(), then we can align to normal bio submit(bio_add_page() & submit_bio()). More importantly, this patch fixes one issue introduced in a22c4d7e34402cc ("block: re-add discard_granularity and alignment checks"), in which zero discard bio may be generated in case of zero alignment. Fixes: a22c4d7e34402ccdf3 ("block: re-add discard_granularity and alignment checks") Cc: stable(a)vger.kernel.org Cc: Mariusz Dabrowski <mariusz.dabrowski(a)intel.com> Cc: Ming Lin <ming.l(a)ssi.samsung.com> Cc: Mike Snitzer <snitzer(a)redhat.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: Xiao Ni <xni(a)redhat.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> --- block/blk-lib.c | 28 ++-------------------------- 1 file changed, 2 insertions(+), 26 deletions(-) diff --git a/block/blk-lib.c b/block/blk-lib.c index d1b9dd03da25..bbd44666f2b5 100644 --- a/block/blk-lib.c +++ b/block/blk-lib.c @@ -29,9 +29,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, { struct request_queue *q = bdev_get_queue(bdev); struct bio *bio = *biop; - unsigned int granularity; unsigned int op; - int alignment; sector_t bs_mask; if (!q) @@ -54,38 +52,16 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, if ((sector | nr_sects) & bs_mask) return -EINVAL; - /* Zero-sector (unknown) and one-sector granularities are the same. */ - granularity = max(q->limits.discard_granularity >> 9, 1U); - alignment = (bdev_discard_alignment(bdev) >> 9) % granularity; - while (nr_sects) { - unsigned int req_sects; - sector_t end_sect, tmp; + unsigned int req_sects = nr_sects; + sector_t end_sect; - /* - * Issue in chunks of the user defined max discard setting, - * ensuring that bi_size doesn't overflow - */ - req_sects = min_t(sector_t, nr_sects, - q->limits.max_discard_sectors); if (!req_sects) goto fail; if (req_sects > UINT_MAX >> 9) req_sects = UINT_MAX >> 9; - /* - * If splitting a request, and the next starting sector would be - * misaligned, stop the discard at the previous aligned sector. - */ end_sect = sector + req_sects; - tmp = end_sect; - if (req_sects < nr_sects && - sector_div(tmp, granularity) != alignment) { - end_sect = end_sect - alignment; - sector_div(end_sect, granularity); - end_sect = end_sect * granularity + alignment; - req_sects = end_sect - sector; - } bio = next_bio(bio, 0, gfp_mask); bio->bi_iter.bi_sector = sector; -- 2.9.5

7 years, 2 months

3
3
0 0

[PATCH v2 2/3] tracing: Fix synthetic event to allow semicolon at end

by Masami Hiramatsu

Fix synthetic event to allow independent semicolon at end. The synthetic_events interface accepts a semicolon after the last word if there is no space. # echo "myevent u64 var;" >> synthetic_events But if there is a space, it returns an error. # echo "myevent u64 var ;" > synthetic_events sh: write error: Invalid argument This behavior is difficult for users to understand. Let's allow the last independent semicolon too. Fixes: commit 4b147936fa50 ("tracing: Add support for 'synthetic' events") Signed-off-by: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: stable(a)vger.kernel.org Cc: Tom Zanussi <tom.zanussi(a)linux.intel.com> Cc: Steven Rostedt <rostedt(a)goodmis.org> --- kernel/trace/trace_events_hist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 6ff83941065a..d239004aaf29 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -1088,7 +1088,7 @@ static int create_synth_event(int argc, char **argv) i += consumed - 1; } - if (i < argc) { + if (i < argc && strcmp(argv[i], ";") != 0) { ret = -EINVAL; goto err; }

7 years, 2 months

1
0
0 0

[PATCH v2 1/3] tracing: Fix synthetic event to accept unsigned modifier

by Masami Hiramatsu

Fix synthetic event to accept unsigned modifier for its field type correctly. Currently, synthetic_events interface returns error for "unsigned" modifiers as below; # echo "myevent unsigned long var" >> synthetic_events sh: write error: Invalid argument This is because argv_split() breaks "unsigned long" into "unsigned" and "long", but parse_synth_field() doesn't expected it. With this fix, synthetic_events can handle the "unsigned long" correctly like as below; # echo "myevent unsigned long var" >> synthetic_events # cat synthetic_events myevent unsigned long var Fixes: commit 4b147936fa50 ("tracing: Add support for 'synthetic' events") Signed-off-by: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: stable(a)vger.kernel.org Cc: Tom Zanussi <tom.zanussi(a)linux.intel.com> Cc: Steven Rostedt <rostedt(a)goodmis.org> --- Changes in v2: - Fix a typo of stable ML. --- kernel/trace/trace_events_hist.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 85f6b01431c7..6ff83941065a 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -738,16 +738,30 @@ static void free_synth_field(struct synth_field *field) kfree(field); } -static struct synth_field *parse_synth_field(char *field_type, - char *field_name) +static struct synth_field *parse_synth_field(int argc, char **argv, + int *consumed) { struct synth_field *field; + const char *prefix = NULL; + char *field_type = argv[0], *field_name; int len, ret = 0; char *array; if (field_type[0] == ';') field_type++; + if (!strcmp(field_type, "unsigned")) { + if (argc < 3) + return ERR_PTR(-EINVAL); + prefix = "unsigned "; + field_type = argv[1]; + field_name = argv[2]; + *consumed = 3; + } else { + field_name = argv[1]; + *consumed = 2; + } + len = strlen(field_name); if (field_name[len - 1] == ';') field_name[len - 1] = '\0'; @@ -760,11 +774,15 @@ static struct synth_field *parse_synth_field(char *field_type, array = strchr(field_name, '['); if (array) len += strlen(array); + if (prefix) + len += strlen(prefix); field->type = kzalloc(len, GFP_KERNEL); if (!field->type) { ret = -ENOMEM; goto free; } + if (prefix) + strcat(field->type, prefix); strcat(field->type, field_type); if (array) { strcat(field->type, array); @@ -1009,7 +1027,7 @@ static int create_synth_event(int argc, char **argv) struct synth_field *field, *fields[SYNTH_FIELDS_MAX]; struct synth_event *event = NULL; bool delete_event = false; - int i, n_fields = 0, ret = 0; + int i, consumed = 0, n_fields = 0, ret = 0; char *name; mutex_lock(&synth_event_mutex); @@ -1061,13 +1079,13 @@ static int create_synth_event(int argc, char **argv) goto err; } - field = parse_synth_field(argv[i], argv[i + 1]); + field = parse_synth_field(argc - i, &argv[i], &consumed); if (IS_ERR(field)) { ret = PTR_ERR(field); goto err; } - fields[n_fields] = field; - i++; n_fields++; + fields[n_fields++] = field; + i += consumed - 1; } if (i < argc) {

7 years, 2 months

1
0
0 0

RE: [PATCH] ARC: Get rid of toolchain check

by Alexey Brodkin

Hello, > -----Original Message----- > From: Rob Herring [mailto:robh@kernel.org] > Sent: Friday, September 14, 2018 12:04 AM > To: Alexey.Brodkin(a)synopsys.com > Cc: linux-snps-arc(a)lists.infradead.org; Linux Kernel Mailing List <linux-kernel(a)vger.kernel.org>; Vineet.Gupta1(a)synopsys.com > Subject: Re: [PATCH] ARC: Get rid of toolchain check > > On Thu, Sep 13, 2018 at 3:24 PM Alexey Brodkin > <Alexey.Brodkin(a)synopsys.com> wrote: > > > > This check is very naive: we simply test if GCC invoked without > > "-mcpu=XXX" has ARC700 define set. In that case we think that GCC > > was built with "--with-cpu=arc700" and has libgcc built for ARC700. > > > > Otherwise if ARC700 is not defined we think that everythng was built > > for ARCv2. > > > > But in reality our life is much more interesting. > > > > 1. Regardless of GCC configuration (i.e. what we pass in "--with-cpu" > > it may generate code for any ARC core). > > > > 2. libgcc might be built with explicitly specified "--mcpu=YYY" > > > > That's exactly what happens in case of multilibbed toolchains: > > - GCC is configured with default settings > > - All the libs built for many different CPU flavors > > > > I.e. that check gets in the way of usage of multilibbed > > toolchains. And even non-multilibbed toolchains are affected. > > OpenEmbedded also builds GCC without "--with-cpu" because > > each and every target component later is compiled with explicitly > > set "-mcpu=ZZZ". > > > > Signed-off-by: Alexey Brodkin <abrodkin(a)synopsys.com> > > --- > > arch/arc/Makefile | 14 -------------- > > 1 file changed, 14 deletions(-) > > +1 for this. Removing it also helps with my work to be able to build > all the .dts files with only a host compiler. That also needs the hunk > setting CROSS_COMPILE removed and not having a built-in dtb by > default, but this is a step in the right direction. > > Acked-by: Rob Herring <robh(a)kernel.org> May we get this one back-ported to stable trees? Upstream commit in Linus' tree is 615f64458ad8 ("ARC: build: Get rid of toolchain check"). This fixes kernel configuration for ARC in case of missing ARC cross-tools in current PATH. -Alexey

7 years, 2 months

2
1
0 0

RE: [PATCH] ARC: Don't set CROSS_COMPILE in arch's Makefile

by Alexey Brodkin

Hello, > -----Original Message----- > From: Alexey Brodkin [mailto:abrodkin@synopsys.com] > Sent: Sunday, September 16, 2018 11:48 PM > To: linux-snps-arc(a)lists.infradead.org > Cc: linux-kernel(a)vger.kernel.org; Vineet Gupta <vgupta(a)synopsys.com>; Alexey Brodkin <abrodkin(a)synopsys.com>; Masahiro > Yamada <yamada.masahiro(a)socionext.com>; Rob Herring <robh(a)kernel.org> > Subject: [PATCH] ARC: Don't set CROSS_COMPILE in arch's Makefile > > There's not much sense in doing that because if user or > his build-system didn't set CROSS_COMPILE we still may > very well make incorrect guess. > > But as it turned out setting CROSS_COMPILE is not as harmless > as one may think: with recent changes that implemented automatic > discovery of __host__ gcc features unconditional setup of > CROSS_COMPILE leads to failures on execution of "make xxx_defconfig" > with absent cross-compiler, for more info see [1]. > > Set CROSS_COMPILE as well gets in the way if we want only to build > .dtb's (again with absent cross-compiler which is not really needed > for building .dtb's), see [2]. > > Note, we had to change LIBGCC assignment type from ":=" to "=" > so that is is resolved on its usage, otherwise if it is resolved > at declaration time with missing CROSS_COMPILE we're getting this > error message from host GCC: > ------------------------->8------------------------- > gcc: error: unrecognized command line option ‘-mmedium-calls’ > gcc: error: unrecognized command line option ‘-mno-sdata’; did you mean ‘-fno-stats’? > ------------------------->8------------------------- > > [1] http://lists.infradead.org/pipermail/linux-snps-arc/2018-September/004308.h… > [2] http://lists.infradead.org/pipermail/linux-snps-arc/2018-September/004320.h… > > Signed-off-by: Alexey Brodkin <abrodkin(a)synopsys.com> > Cc: Masahiro Yamada <yamada.masahiro(a)socionext.com> > Cc: Rob Herring <robh(a)kernel.org> > --- > arch/arc/Makefile | 10 +--------- > 1 file changed, 1 insertion(+), 9 deletions(-) > > diff --git a/arch/arc/Makefile b/arch/arc/Makefile > index 99cce77ab98f..5f6b67917dc2 100644 > --- a/arch/arc/Makefile > +++ b/arch/arc/Makefile > @@ -6,14 +6,6 @@ > # published by the Free Software Foundation. > # > > -ifeq ($(CROSS_COMPILE),) > -ifndef CONFIG_CPU_BIG_ENDIAN > -CROSS_COMPILE := arc-linux- > -else > -CROSS_COMPILE := arceb-linux- > -endif > -endif > - > KBUILD_DEFCONFIG := nsim_700_defconfig > > cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__ > @@ -79,7 +71,7 @@ cflags-$(disable_small_data) += -mno-sdata -fcall-used-gp > cflags-$(CONFIG_CPU_BIG_ENDIAN) += -mbig-endian > ldflags-$(CONFIG_CPU_BIG_ENDIAN) += -EB > > -LIBGCC := $(shell $(CC) $(cflags-y) --print-libgcc-file-name) > +LIBGCC = $(shell $(CC) $(cflags-y) --print-libgcc-file-name) > > # Modules with short calls might break for calls into builtin-kernel > KBUILD_CFLAGS_MODULE += -mlong-calls -mno-millicode > -- > 2.17.1 May we have this one back-ported to stable branches? Upstream commit in Linus' tree is: 40660f1fcee8 ("ARC: build: Don't set CROSS_COMPILE in arch's Makefile"). Regards, Alexey

7 years, 2 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror