From: Eric Biggers <ebiggers(a)google.com>
Hash algorithms with an alignmask set, e.g. "xcbc(aes-aesni)" and
"michael_mic", fail the improved hash tests because they sometimes
produce the wrong digest. The bug is that in the case where a
scatterlist element crosses pages, not all the data is actually hashed
because the scatterlist walk terminates too early. This happens because
the 'nbytes' variable in crypto_hash_walk_done() is assigned the number
of bytes remaining in the page, then later interpreted as the number of
bytes remaining in the scatterlist element. Fix it.
Fixes: 900a081f6912 ("crypto: ahash - Fix early termination in hash walk")
Cc: stable(a)vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
crypto/ahash.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/crypto/ahash.c b/crypto/ahash.c
index ca0d3e281fef..81e2767e2164 100644
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -86,17 +86,17 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk)
int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err)
{
unsigned int alignmask = walk->alignmask;
- unsigned int nbytes = walk->entrylen;
walk->data -= walk->offset;
- if (nbytes && walk->offset & alignmask && !err) {
- walk->offset = ALIGN(walk->offset, alignmask + 1);
- nbytes = min(nbytes,
- ((unsigned int)(PAGE_SIZE)) - walk->offset);
- walk->entrylen -= nbytes;
+ if (walk->entrylen && (walk->offset & alignmask) && !err) {
+ unsigned int nbytes;
+ walk->offset = ALIGN(walk->offset, alignmask + 1);
+ nbytes = min(walk->entrylen,
+ (unsigned int)(PAGE_SIZE - walk->offset));
if (nbytes) {
+ walk->entrylen -= nbytes;
walk->data += walk->offset;
return nbytes;
}
@@ -116,7 +116,7 @@ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err)
if (err)
return err;
- if (nbytes) {
+ if (walk->entrylen) {
walk->offset = 0;
walk->pg++;
return hash_walk_next(walk);
--
2.20.1.321.g9e740568ce-goog
From: Eric Biggers <ebiggers(a)google.com>
gcmaes_crypt_by_sg() dereferences the NULL pointer returned by
scatterwalk_ffwd() when encrypting an empty plaintext and the source
scatterlist ends immediately after the associated data.
Fix it by only fast-forwarding to the src/dst data scatterlists if the
data length is nonzero.
This bug is reproduced by the "rfc4543(gcm(aes))" test vectors when run
with the new AEAD test manager.
Fixes: e845520707f8 ("crypto: aesni - Update aesni-intel_glue to use scatter/gather")
Cc: <stable(a)vger.kernel.org> # v4.17+
Cc: Dave Watson <davejwatson(a)fb.com>
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
arch/x86/crypto/aesni-intel_glue.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index 9b5ccde3ef31..1e3d2102033a 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -813,11 +813,14 @@ static int gcmaes_crypt_by_sg(bool enc, struct aead_request *req,
scatterwalk_map_and_copy(assoc, req->src, 0, assoclen, 0);
}
- src_sg = scatterwalk_ffwd(src_start, req->src, req->assoclen);
- scatterwalk_start(&src_sg_walk, src_sg);
- if (req->src != req->dst) {
- dst_sg = scatterwalk_ffwd(dst_start, req->dst, req->assoclen);
- scatterwalk_start(&dst_sg_walk, dst_sg);
+ if (left) {
+ src_sg = scatterwalk_ffwd(src_start, req->src, req->assoclen);
+ scatterwalk_start(&src_sg_walk, src_sg);
+ if (req->src != req->dst) {
+ dst_sg = scatterwalk_ffwd(dst_start, req->dst,
+ req->assoclen);
+ scatterwalk_start(&dst_sg_walk, dst_sg);
+ }
}
kernel_fpu_begin();
--
2.20.1.321.g9e740568ce-goog
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 3d4332cd8258 Linux 4.20.4
The results of these automated tests are provided below.
Overall result: PASSED
Patch merge: OK
Compile: OK
Kernel tests: OK
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out a ref:
Repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Ref: 3d4332cd8258 Linux 4.20.4
We then merged the following patches with `git am`:
ipv6-consider-sk_bound_dev_if-when-binding-a-socket-to-a-v4-mapped-address.patch
mlxsw-spectrum-disable-lag-port-tx-before-removing-it.patch
mlxsw-spectrum_switchdev-set-pvid-correctly-during-vlan-deletion.patch
net-dsa-mv88x6xxx-mv88e6390-errata.patch
net-skbuff-do-not-prefer-skb-allocation-fails-early.patch
qmi_wwan-add-mtu-default-to-qmap-network-interface.patch
r8169-add-support-for-new-realtek-ethernet.patch
ipv6-take-rcu_read_lock-in-__inet6_bind-for-mapped-addresses.patch
ipv6-fix-dump-of-specific-table-with-strict-checking.patch
netlink-fixup-regression-in-rtm_getaddr.patch
octeontx2-af-fix-a-resource-leak-in-an-error-handling-path-in-cgx_probe.patch
openvswitch-fix-ipv6-later-frags-parsing.patch
net-clear-skb-tstamp-in-bridge-forwarding-path.patch
netfilter-ipset-allow-matching-on-destination-mac-ad.patch
gpio-pl061-move-irq_chip-definition-inside-struct-pl.patch
asoc-wm97xx-fix-uninitialized-regmap-pointer-problem.patch
drm-amd-display-guard-against-null-stream_state-in-s.patch
drm-amdkfd-fix-interrupt-spin-lock.patch
qtnfmac-fix-error-handling-in-control-path.patch
ixgbe-allow-ipsec-tx-offload-in-vepa-mode.patch
platform-x86-asus-wmi-tell-the-ec-the-os-will-handle.patch
e1000e-allow-non-monotonic-systim-readings.patch
usb-typec-tcpm-do-not-disconnect-link-for-self-power.patch
selftests-bpf-enable-uncomment-all-tests-in-test_lib.patch
of-overlay-add-missing-of_node_put-after-add-new-nod.patch
writeback-don-t-decrement-wb-refcnt-if-wb-bdi.patch
serial-set-suppress_bind_attrs-flag-only-if-builtin.patch
bpf-allow-narrow-loads-with-offset-0.patch
alsa-oxfw-add-support-for-apogee-duet-firewire.patch
x86-mce-fix-wmissing-prototypes-warnings.patch
mips-sibyte-enable-swiotlb-for-swarm-littlesur-and-b.patch
crypto-ecc-regularize-scalar-for-scalar-multiplicati.patch
drm-scheduler-fix-bad-job-be-re-processed-in-tdr.patch
arm64-perf-set-suppress_bind_attrs-flag-to-true.patch
mips-loongson-add-loongson-3a-r2.1-basic-support.patch
x86-fault-don-t-try-to-recover-from-an-implicit-supe.patch
drm-atomic-helper-complete-fake_commit-flip_done-pot.patch
clk-meson-meson8b-add-support-for-more-m-n-values-in.patch
clk-meson-meson8b-fix-incorrect-divider-mapping-in-c.patch
samples-bpf-fix-error-handling-regarding-kprobe_even.patch
usb-gadget-udc-renesas_usb3-add-a-safety-connection-.patch
fpga-altera-cvp-fix-probing-for-multiple-fpgas-on-th.patch
selinux-always-allow-mounting-submounts.patch
arm64-use-a-raw-spinlock-in-__install_bp_hardening_c.patch
asoc-pcm3168a-don-t-disable-pcm3168a-when-config_pm-.patch
scsi-qedi-check-for-session-online-before-getting-is.patch
net-ethernet-ave-set-initial-wol-state-to-disabled.patch
drm-amdgpu-reorder-uvd-ring-init-before-uvd-resume.patch
rxe-ib_wr_reg_mr-does-not-capture-mr-s-iova-field.patch
efi-libstub-disable-some-warnings-for-x86-_64.patch
jffs2-fix-use-of-uninitialized-delayed_work-lockdep-.patch
kbuild-let-fixdep-directly-write-to-.-.cmd-files.patch
clk-imx-make-mux-parent-strings-const.patch
pstore-ram-do-not-treat-empty-buffers-as-valid.patch
media-uvcvideo-refactor-teardown-of-uvc-on-usb-disco.patch
powerpc-xmon-fix-invocation-inside-lock-region.patch
powerpc-pseries-cpuidle-fix-preempt-warning.patch
arm64-relocatable-fix-inconsistencies-in-linker-scri.patch
media-firewire-fix-app_info-parameter-type-in-avc_ca.patch
asoc-use-dma_ops-of-parent-device-for-acp_audio_dma.patch
coresight-tmc-fix-bad-register-address-for-claim.patch
media-venus-core-set-dma-maximum-segment-size.patch
staging-erofs-fix-use-after-free-of-on-stack-z_erofs.patch
net-call-sk_dst_reset-when-set-so_dontroute.patch
scsi-target-use-consistent-left-aligned-ascii-inquir.patch
scsi-target-core-make-sure-that-target_wait_for_sess.patch
selftests-do-not-macro-expand-failed-assertion-expre.patch
arm64-kasan-increase-stack-size-for-kasan_extra.patch
clk-imx6q-reset-exclusive-gates-on-init.patch
arm64-fix-minor-issues-with-the-dcache_by_line_op-ma.patch
bpf-relax-verifier-restriction-on-bpf_mov-bpf_alu.patch
usb-dwc2-fix-disable-all-ep-s-on-disconnect.patch
x86-resctrl-fix-rdt_find_domain-return-value-and-che.patch
kconfig-fix-file-name-and-line-number-of-warn_ignore.patch
kconfig-fix-memory-leak-when-eof-is-encountered-in-q.patch
mmc-atmel-mci-do-not-assume-idle-after-atmci_request.patch
btrfs-volumes-make-sure-there-is-no-overlap-of-dev-e.patch
btrfs-alloc_chunk-fix-more-dup-stripe-size-handling.patch
btrfs-fix-use-after-free-due-to-race-between-replace.patch
btrfs-improve-error-handling-of-btrfs_add_link.patch
tty-serial-do-not-free-trasnmit-buffer-page-under-po.patch
tools-lib-traceevent-fix-compile-warnings-in-tools-l.patch
perf-intel-pt-fix-error-with-config-term-pt-0.patch
perf-tests-arm-disable-breakpoint-tests-32-bit.patch
perf-svghelper-fix-unchecked-usage-of-strncpy.patch
perf-parse-events-fix-unchecked-usage-of-strncpy.patch
perf-vendor-events-intel-fix-load_miss_real_latency-.patch
netfilter-ipt_clusterip-check-mac-address-when-dupli.patch
netfilter-ipt_clusterip-remove-wrong-warn_on_once-in.patch
netfilter-ipt_clusterip-fix-deadlock-in-netns-exit-r.patch
x86-topology-use-total_cpus-for-max-logical-packages.patch
dm-crypt-use-u64-instead-of-sector_t-to-store-iv_off.patch
dm-kcopyd-fix-bug-causing-workqueue-stalls.patch
perf-stat-avoid-segfaults-caused-by-negated-options.patch
tools-lib-subcmd-don-t-add-the-kernel-sources-to-the.patch
dm-snapshot-fix-excessive-memory-usage-and-workqueue.patch
perf-cs-etm-correct-packets-swapping-in-cs_etm__flus.patch
perf-tools-add-missing-sigqueue-prototype-for-system.patch
perf-tools-add-missing-open_memstream-prototype-for-.patch
quota-lock-s_umount-in-exclusive-mode-for-q_xquota-o.patch
clocksource-drivers-integrator-ap-add-missing-of_nod.patch
dm-check-for-device-sector-overflow-if-config_lbdaf-.patch
bluetooth-btusb-add-support-for-intel-bluetooth-devi.patch
alsa-bebob-fix-model-id-of-unit-for-apogee-ensemble.patch
sysfs-disable-lockdep-for-driver-bind-unbind-files.patch
ib-usnic-fix-potential-deadlock.patch
scsi-mpt3sas-fix-memory-ordering-on-64bit-writes.patch
scsi-smartpqi-correct-lun-reset-issues.patch
ath10k-fix-peer-stats-null-pointer-dereference.patch
scsi-smartpqi-call-pqi_free_interrupts-in-pqi_shutdo.patch
kvm-ppc-book3s-hv-align-gfn-to-l1-page-size-when-ins.patch
kvm-ppc-book3s-hv-apply-combination-of-host-and-l1-p.patch
scsi-megaraid-fix-out-of-bound-array-accesses.patch
iomap-don-t-search-past-page-end-in-iomap_is_partial.patch
ocfs2-fix-panic-due-to-unrecovered-local-alloc.patch
mm-page-writeback.c-don-t-break-integrity-writeback-.patch
mm-swap-use-nr_node_ids-for-avail_lists-in-swap_info.patch
userfaultfd-clear-flag-if-remap-event-not-enabled.patch
mm-proc-be-more-verbose-about-unstable-vma-flags-in-.patch
mm-memblock.c-skip-kmemleak-for-kasan_init.patch
Compile testing
---------------
We compiled the kernel for 4 architectures:
s390x:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration: https://artifacts.cki-project.org/builds/s390x/873ea5d697070570b63f001ce6cb…
powerpc64le:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration: https://artifacts.cki-project.org/builds/ppc64le/a8b31b98d3ab8809a00574c3d6…
aarch64:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration: https://artifacts.cki-project.org/builds/aarch64/08f2f4e731cf3053866d349015…
x86_64:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration: https://artifacts.cki-project.org/builds/x86_64/ee4ca360d8bf2fc0e74e17ce0bb…
Hardware testing
----------------
We booted each kernel and ran the following tests:
s390:
Boot test
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
/distribution/command
LTP lite - release 20180926
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
AMTU (Abstract Machine Test Utility)
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
powerpc:
Boot test
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
/distribution/command
LTP lite - release 20180926
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
xfstests: xfs
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
AMTU (Abstract Machine Test Utility)
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
Usex - version 1.9-29
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
arm64:
Boot test
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
/distribution/command
LTP lite - release 20180926
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
xfstests: xfs
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
AMTU (Abstract Machine Test Utility)
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
Usex - version 1.9-29
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
x86_64:
Boot test
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
/distribution/command
LTP lite - release 20180926
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
xfstests: xfs
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
AMTU (Abstract Machine Test Utility)
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
Usex - version 1.9-29
- URL: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
Even if we don't have the correct clock and get a warning, we should not
skip the return.
Fixes: 1fa11ee2d9d0 ("drm/i915/icl: start adding the TBT pll")
Cc: Paulo Zanoni <paulo.r.zanoni(a)intel.com>
Cc: <stable(a)vger.kernel.org> # v4.19+
Signed-off-by: Lucas De Marchi <lucas.demarchi(a)intel.com>
---
drivers/gpu/drm/i915/intel_ddi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 8dbf6c9e22fb..4dc03e8c6c10 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1021,7 +1021,7 @@ static uint32_t icl_pll_to_ddi_pll_sel(struct intel_encoder *encoder,
return DDI_CLK_SEL_TBT_810;
default:
MISSING_CASE(clock);
- break;
+ return DDI_CLK_SEL_NONE;
}
case DPLL_ID_ICL_MGPLL1:
case DPLL_ID_ICL_MGPLL2:
--
2.20.0
commit c156618e15101a9cc8c815108fec0300a0ec6637 upstream.
The following deadlock can occur between a process waiting for a client
to initialize in while walking the client list during nfsv4 server trunking
detection and another process waiting for the nfs_clid_init_mutex so it
can initialize that client:
Process 1 Process 2
--------- ---------
spin_lock(&nn->nfs_client_lock);
list_add_tail(&CLIENTA->cl_share_link,
&nn->nfs_client_list);
spin_unlock(&nn->nfs_client_lock);
spin_lock(&nn->nfs_client_lock);
list_add_tail(&CLIENTB->cl_share_link,
&nn->nfs_client_list);
spin_unlock(&nn->nfs_client_lock);
mutex_lock(&nfs_clid_init_mutex);
nfs41_walk_client_list(clp, result, cred);
nfs_wait_client_init_complete(CLIENTA);
(waiting for nfs_clid_init_mutex)
Make sure nfs_match_client() only evaluates clients that have completed
initialization in order to prevent that deadlock.
This patch also fixes v4.0 trunking behavior by not marking the client
NFS_CS_READY until the clientid has been confirmed.
Signed-off-by: Scott Mayhew <smayhew(a)redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker(a)Netapp.com>
Signed-off-by: Qian Lu <luqia(a)amazon.com>
---
fs/nfs/client.c | 11 +++++++++++
fs/nfs/nfs4client.c | 17 +++++++++++++----
2 files changed, 24 insertions(+), 4 deletions(-)
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 22880ef6d8dd..7d6ddfd60271 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -291,12 +291,23 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat
const struct sockaddr *sap = data->addr;
struct nfs_net *nn = net_generic(data->net, nfs_net_id);
+again:
list_for_each_entry(clp, &nn->nfs_client_list, cl_share_link) {
const struct sockaddr *clap = (struct sockaddr *)&clp->cl_addr;
/* Don't match clients that failed to initialise properly */
if (clp->cl_cons_state < 0)
continue;
+ /* If a client is still initializing then we need to wait */
+ if (clp->cl_cons_state > NFS_CS_READY) {
+ atomic_inc(&clp->cl_count);
+ spin_unlock(&nn->nfs_client_lock);
+ nfs_wait_client_init_complete(clp);
+ nfs_put_client(clp);
+ spin_lock(&nn->nfs_client_lock);
+ goto again;
+ }
+
/* Different NFS versions cannot share the same nfs_client */
if (clp->rpc_ops != data->nfs_mod->rpc_ops)
continue;
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index fed9c8005c17..8f96f6548dc8 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -404,15 +404,19 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
if (error < 0)
goto error;
- if (!nfs4_has_session(clp))
- nfs_mark_client_ready(clp, NFS_CS_READY);
-
error = nfs4_discover_server_trunking(clp, &old);
if (error < 0)
goto error;
- if (clp != old)
+ if (clp != old) {
clp->cl_preserve_clid = true;
+ /*
+ * Mark the client as having failed initialization so other
+ * processes walking the nfs_client_list in nfs_match_client()
+ * won't try to use it.
+ */
+ nfs_mark_client_ready(clp, -EPERM);
+ }
nfs_put_client(clp);
clear_bit(NFS_CS_TSM_POSSIBLE, &clp->cl_flags);
return old;
@@ -539,6 +543,9 @@ int nfs40_walk_client_list(struct nfs_client *new,
spin_lock(&nn->nfs_client_lock);
list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
+ if (pos == new)
+ goto found;
+
status = nfs4_match_client(pos, new, &prev, nn);
if (status < 0)
goto out_unlock;
@@ -559,6 +566,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
* way that a SETCLIENTID_CONFIRM to pos can succeed is
* if new and pos point to the same server:
*/
+found:
atomic_inc(&pos->cl_count);
spin_unlock(&nn->nfs_client_lock);
@@ -572,6 +580,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
case 0:
nfs4_swap_callback_idents(pos, new);
pos->cl_confirm = new->cl_confirm;
+ nfs_mark_client_ready(pos, NFS_CS_READY);
prev = NULL;
*result = pos;
--
2.14.4
Request to include the following patch into stable for linux-4.19 and
linux-4.20:
scsi: mpt3sas: fix memory ordering on 64bit writes
commit: 23c3828aa2f8
Commit 09c2f95ad404 introduced a bug apparent on powerpc64 systems
causing SAS HBAs relying on mpt3sas to drop from the PCIe bus under
load, rendering those devices virtually useless.
As linux-4.19 is a longterm kernel, the bug would affect those systems
for a long time otherwise.