- Linux-stable-mirror - lists.linaro.org

FAILED: patch "[PATCH] kthread, tracing: Don't expose half-written comm when" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 3e536e222f2930534c252c1cc7ae799c725c5ff9 Mon Sep 17 00:00:00 2001 From: Snild Dolkow <snild(a)sony.com> Date: Thu, 26 Jul 2018 09:15:39 +0200 Subject: [PATCH] kthread, tracing: Don't expose half-written comm when creating kthreads There is a window for racing when printing directly to task->comm, allowing other threads to see a non-terminated string. The vsnprintf function fills the buffer, counts the truncated chars, then finally writes the \0 at the end. creator other vsnprintf: fill (not terminated) count the rest trace_sched_waking(p): ... memcpy(comm, p->comm, TASK_COMM_LEN) write \0 The consequences depend on how 'other' uses the string. In our case, it was copied into the tracing system's saved cmdlines, a buffer of adjacent TASK_COMM_LEN-byte buffers (note the 'n' where 0 should be): crash-arm64> x/1024s savedcmd->saved_cmdlines | grep 'evenk' 0xffffffd5b3818640: "irq/497-pwr_evenkworker/u16:12" ...and a strcpy out of there would cause stack corruption: [224761.522292] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffff9bf9783c78 crash-arm64> kbt | grep 'comm\|trace_print_context' #6 0xffffff9bf9783c78 in trace_print_context+0x18c(+396) comm (char [16]) = "irq/497-pwr_even" crash-arm64> rd 0xffffffd4d0e17d14 8 ffffffd4d0e17d14: 2f71726900000000 5f7277702d373934 ....irq/497-pwr_ ffffffd4d0e17d24: 726f776b6e657665 3a3631752f72656b evenkworker/u16: ffffffd4d0e17d34: f9780248ff003231 cede60e0ffffff9b 12..H.x......`.. ffffffd4d0e17d44: cede60c8ffffffd4 00000fffffffffd4 .....`.......... The workaround in e09e28671 (use strlcpy in __trace_find_cmdline) was likely needed because of this same bug. Solved by vsnprintf:ing to a local buffer, then using set_task_comm(). This way, there won't be a window where comm is not terminated. Link: http://lkml.kernel.org/r/20180726071539.188015-1-snild@sony.com Cc: stable(a)vger.kernel.org Fixes: bc0c38d139ec7 ("ftrace: latency tracer infrastructure") Reviewed-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Signed-off-by: Snild Dolkow <snild(a)sony.com> Signed-off-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> diff --git a/kernel/kthread.c b/kernel/kthread.c index 750cb8082694..486dedbd9af5 100644 --- a/kernel/kthread.c +++ b/kernel/kthread.c @@ -325,8 +325,14 @@ struct task_struct *__kthread_create_on_node(int (*threadfn)(void *data), task = create->result; if (!IS_ERR(task)) { static const struct sched_param param = { .sched_priority = 0 }; + char name[TASK_COMM_LEN]; - vsnprintf(task->comm, sizeof(task->comm), namefmt, args); + /* + * task is already visible to other tasks, so updating + * COMM must be protected. + */ + vsnprintf(name, sizeof(name), namefmt, args); + set_task_comm(task, name); /* * root may have changed our (kthreadd's) priority or CPU mask. * The kernel thread should not inherit these properties.

7 years, 3 months

1
0
0 0

FAILED: patch "[PATCH] mm: fix vma_is_anonymous() false-positives" failed to apply to 4.17-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.17-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From bfd40eaff5abb9f62c8ef94ca13ed0d94a560f10 Mon Sep 17 00:00:00 2001 From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> Date: Thu, 26 Jul 2018 16:37:35 -0700 Subject: [PATCH] mm: fix vma_is_anonymous() false-positives vma_is_anonymous() relies on ->vm_ops being NULL to detect anonymous VMA. This is unreliable as ->mmap may not set ->vm_ops. False-positive vma_is_anonymous() may lead to crashes: next ffff8801ce5e7040 prev ffff8801d20eca50 mm ffff88019c1e13c0 prot 27 anon_vma ffff88019680cdd8 vm_ops 0000000000000000 pgoff 0 file ffff8801b2ec2d00 private_data 0000000000000000 flags: 0xff(read|write|exec|shared|mayread|maywrite|mayexec|mayshare) ------------[ cut here ]------------ kernel BUG at mm/memory.c:1422! invalid opcode: 0000 [#1] SMP KASAN CPU: 0 PID: 18486 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #136 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:zap_pmd_range mm/memory.c:1421 [inline] RIP: 0010:zap_pud_range mm/memory.c:1466 [inline] RIP: 0010:zap_p4d_range mm/memory.c:1487 [inline] RIP: 0010:unmap_page_range+0x1c18/0x2220 mm/memory.c:1508 Call Trace: unmap_single_vma+0x1a0/0x310 mm/memory.c:1553 zap_page_range_single+0x3cc/0x580 mm/memory.c:1644 unmap_mapping_range_vma mm/memory.c:2792 [inline] unmap_mapping_range_tree mm/memory.c:2813 [inline] unmap_mapping_pages+0x3a7/0x5b0 mm/memory.c:2845 unmap_mapping_range+0x48/0x60 mm/memory.c:2880 truncate_pagecache+0x54/0x90 mm/truncate.c:800 truncate_setsize+0x70/0xb0 mm/truncate.c:826 simple_setattr+0xe9/0x110 fs/libfs.c:409 notify_change+0xf13/0x10f0 fs/attr.c:335 do_truncate+0x1ac/0x2b0 fs/open.c:63 do_sys_ftruncate+0x492/0x560 fs/open.c:205 __do_sys_ftruncate fs/open.c:215 [inline] __se_sys_ftruncate fs/open.c:213 [inline] __x64_sys_ftruncate+0x59/0x80 fs/open.c:213 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Reproducer: #include <stdio.h> #include <stddef.h> #include <stdint.h> #include <stdlib.h> #include <string.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/ioctl.h> #include <sys/mman.h> #include <unistd.h> #include <fcntl.h> #define KCOV_INIT_TRACE _IOR('c', 1, unsigned long) #define KCOV_ENABLE _IO('c', 100) #define KCOV_DISABLE _IO('c', 101) #define COVER_SIZE (1024<<10) #define KCOV_TRACE_PC 0 #define KCOV_TRACE_CMP 1 int main(int argc, char **argv) { int fd; unsigned long *cover; system("mount -t debugfs none /sys/kernel/debug"); fd = open("/sys/kernel/debug/kcov", O_RDWR); ioctl(fd, KCOV_INIT_TRACE, COVER_SIZE); cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long), PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); munmap(cover, COVER_SIZE * sizeof(unsigned long)); cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long), PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); memset(cover, 0, COVER_SIZE * sizeof(unsigned long)); ftruncate(fd, 3UL << 20); return 0; } This can be fixed by assigning anonymous VMAs own vm_ops and not relying on it being NULL. If ->mmap() failed to set ->vm_ops, mmap_region() will set it to dummy_vm_ops. This way we will have non-NULL ->vm_ops for all VMAs. Link: http://lkml.kernel.org/r/20180724121139.62570-4-kirill.shutemov@linux.intel… Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Reported-by: syzbot+3f84280d52be9b7083cc(a)syzkaller.appspotmail.com Acked-by: Linus Torvalds <torvalds(a)linux-foundation.org> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Cc: Dmitry Vyukov <dvyukov(a)google.com> Cc: Oleg Nesterov <oleg(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> diff --git a/drivers/char/mem.c b/drivers/char/mem.c index ffeb60d3434c..df66a9dd0aae 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -708,6 +708,7 @@ static int mmap_zero(struct file *file, struct vm_area_struct *vma) #endif if (vma->vm_flags & VM_SHARED) return shmem_zero_setup(vma); + vma_set_anonymous(vma); return 0; } diff --git a/fs/exec.c b/fs/exec.c index 72e961a62adb..bdd0eacefdf5 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -293,6 +293,7 @@ static int __bprm_mm_init(struct linux_binprm *bprm) bprm->vma = vma = vm_area_alloc(mm); if (!vma) return -ENOMEM; + vma_set_anonymous(vma); if (down_write_killable(&mm->mmap_sem)) { err = -EINTR; diff --git a/include/linux/mm.h b/include/linux/mm.h index 31540f166987..7ba6d356d18f 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -454,10 +454,18 @@ struct vm_operations_struct { static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm) { + static const struct vm_operations_struct dummy_vm_ops = {}; + vma->vm_mm = mm; + vma->vm_ops = &dummy_vm_ops; INIT_LIST_HEAD(&vma->anon_vma_chain); } +static inline void vma_set_anonymous(struct vm_area_struct *vma) +{ + vma->vm_ops = NULL; +} + struct mmu_gather; struct inode; diff --git a/mm/mmap.c b/mm/mmap.c index ff1944d8d458..17bbf4d3e24f 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1778,6 +1778,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr, error = shmem_zero_setup(vma); if (error) goto free_vma; + } else { + vma_set_anonymous(vma); } vma_link(mm, vma, prev, rb_link, rb_parent); @@ -2983,6 +2985,7 @@ static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long fla return -ENOMEM; } + vma_set_anonymous(vma); vma->vm_start = addr; vma->vm_end = addr + len; vma->vm_pgoff = pgoff; diff --git a/mm/nommu.c b/mm/nommu.c index 1d22fdbf7d7c..9fc9e43335b6 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1145,6 +1145,8 @@ static int do_mmap_private(struct vm_area_struct *vma, if (ret < len) memset(base + ret, 0, len - ret); + } else { + vma_set_anonymous(vma); } return 0;

7 years, 3 months

1
0
0 0

FAILED: patch "[PATCH] mm: introduce vma_init()" failed to apply to 4.17-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.17-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 027232da7c7c1c7f04383f93bd798e475dde5285 Mon Sep 17 00:00:00 2001 From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> Date: Thu, 26 Jul 2018 16:37:25 -0700 Subject: [PATCH] mm: introduce vma_init() Not all VMAs allocated with vm_area_alloc(). Some of them allocated on stack or in data segment. The new helper can be use to initialize VMA properly regardless where it was allocated. Link: http://lkml.kernel.org/r/20180724121139.62570-2-kirill.shutemov@linux.intel… Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Acked-by: Linus Torvalds <torvalds(a)linux-foundation.org> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Cc: Dmitry Vyukov <dvyukov(a)google.com> Cc: Oleg Nesterov <oleg(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> diff --git a/include/linux/mm.h b/include/linux/mm.h index d3a3842316b8..31540f166987 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -452,6 +452,12 @@ struct vm_operations_struct { unsigned long addr); }; +static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm) +{ + vma->vm_mm = mm; + INIT_LIST_HEAD(&vma->anon_vma_chain); +} + struct mmu_gather; struct inode; diff --git a/kernel/fork.c b/kernel/fork.c index a191c05e757d..1b27babc4c78 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -312,10 +312,8 @@ struct vm_area_struct *vm_area_alloc(struct mm_struct *mm) { struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); - if (vma) { - vma->vm_mm = mm; - INIT_LIST_HEAD(&vma->anon_vma_chain); - } + if (vma) + vma_init(vma, mm); return vma; }

7 years, 3 months

1
0
0 0

[PATCH 4.4 00/23] 4.4.145-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.4.145 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Jul 29 10:08:37 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.145-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.4.145-rc1 Arnd Bergmann <arnd(a)arndb.de> ARM: fix put_user() for gcc-8 Arnd Bergmann <arnd(a)arndb.de> turn off -Wattribute-alias Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix RX overflow interrupt not being enabled Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix incorrect clear of non-processed interrupts Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: keep only 1-2 frames in TX FIFO to fix TX accounting Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix device dropping off bus on RX overrun Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix recovery from error states not being propagated Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix RX loop if RXNEMP is asserted without RXOK Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> driver core: Partially revert "driver core: correct device's shutdown order" Jerry Zhang <zhangjerry(a)google.com> usb: gadget: f_fs: Only return delayed status when len is 0 Bin Liu <b-liu(a)ti.com> usb: core: handle hub C_PORT_OVER_CURRENT condition Lubomir Rintel <lkundrak(a)v3.sk> usb: cdc_acm: Add quirk for Castles VEGA3000 Willem de Bruijn <willemb(a)google.com> ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull Eric Dumazet <edumazet(a)google.com> tcp: detect malicious patterns in tcp_collapse_ofo_queue() Eric Dumazet <edumazet(a)google.com> tcp: avoid collapses in tcp_prune_queue() if possible Yuchung Cheng <ycheng(a)google.com> tcp: do not delay ACK in DCTCP upon CE status change Yuchung Cheng <ycheng(a)google.com> tcp: do not cancel delay-AcK on DCTCP special ACK Yuchung Cheng <ycheng(a)google.com> tcp: helpers to send special DCTCP ack Yuchung Cheng <ycheng(a)google.com> tcp: fix dctcp delayed ACK schedule Roopa Prabhu <roopa(a)cumulusnetworks.com> rtnetlink: add rtnl_link_state check in rtnl_configure_link Jack Morgenstein <jackm(a)dev.mellanox.co.il> net/mlx4_core: Save the qpn from the input modifier in RST2INIT wrapper Paolo Abeni <pabeni(a)redhat.com> ip: hash fragments consistently Felix Fietkau <nbd(a)nbd.name> MIPS: ath79: fix register address in ath79_ddr_wb_flush() ------------- Diffstat: Makefile | 5 +- arch/arm/include/asm/uaccess.h | 2 +- arch/mips/ath79/common.c | 2 +- drivers/base/dd.c | 8 - drivers/net/can/xilinx_can.c | 323 +++++++++++++++++---- .../net/ethernet/mellanox/mlx4/resource_tracker.c | 2 +- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/hub.c | 8 +- drivers/usb/gadget/function/f_fs.c | 2 +- include/net/tcp.h | 2 + net/core/rtnetlink.c | 9 +- net/ipv4/ip_output.c | 2 + net/ipv4/ip_sockglue.c | 7 +- net/ipv4/tcp_dctcp.c | 50 +--- net/ipv4/tcp_input.c | 21 +- net/ipv4/tcp_output.c | 33 ++- net/ipv6/datagram.c | 7 +- net/ipv6/ip6_output.c | 2 + 18 files changed, 357 insertions(+), 131 deletions(-)

7 years, 3 months

5
27
0 0

[PATCH 4.9 00/33] 4.9.116-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.116 release. There are 33 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Jul 29 10:08:17 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.116-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.116-rc1 Arnd Bergmann <arnd(a)arndb.de> exec: avoid gcc-8 warning for get_task_comm Arnd Bergmann <arnd(a)arndb.de> turn off -Wattribute-alias Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix RX overflow interrupt not being enabled Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix incorrect clear of non-processed interrupts Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: keep only 1-2 frames in TX FIFO to fix TX accounting Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix device dropping off bus on RX overrun Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix recovery from error states not being propagated Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix power management handling Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix RX loop if RXNEMP is asserted without RXOK Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> driver core: Partially revert "driver core: correct device's shutdown order" Jerry Zhang <zhangjerry(a)google.com> usb: gadget: f_fs: Only return delayed status when len is 0 Bin Liu <b-liu(a)ti.com> usb: core: handle hub C_PORT_OVER_CURRENT condition Lubomir Rintel <lkundrak(a)v3.sk> usb: cdc_acm: Add quirk for Castles VEGA3000 Eric Dumazet <edumazet(a)google.com> tcp: call tcp_drop() from tcp_data_queue_ofo() Eric Dumazet <edumazet(a)google.com> tcp: detect malicious patterns in tcp_collapse_ofo_queue() Eric Dumazet <edumazet(a)google.com> tcp: avoid collapses in tcp_prune_queue() if possible Eric Dumazet <edumazet(a)google.com> tcp: free batches of packets in tcp_prune_ofo_queue() Yuchung Cheng <ycheng(a)google.com> tcp: do not delay ACK in DCTCP upon CE status change Yuchung Cheng <ycheng(a)google.com> tcp: do not cancel delay-AcK on DCTCP special ACK Yuchung Cheng <ycheng(a)google.com> tcp: helpers to send special DCTCP ack Yuchung Cheng <ycheng(a)google.com> tcp: fix dctcp delayed ACK schedule Roopa Prabhu <roopa(a)cumulusnetworks.com> rtnetlink: add rtnl_link_state check in rtnl_configure_link Heiner Kallweit <hkallweit1(a)gmail.com> net: phy: consider PHY_IGNORE_INTERRUPT in phy_start_aneg_priv Hangbin Liu <liuhangbin(a)gmail.com> multicast: do not restore deleted record source filter mode to new one Eran Ben Elisha <eranbe(a)mellanox.com> net/mlx5e: Fix quota counting in aRFS expire flow Eran Ben Elisha <eranbe(a)mellanox.com> net/mlx5e: Don't allow aRFS for encapsulated packets Ariel Levkovich <lariel(a)mellanox.com> net/mlx5: Adjust clock overflow work period Eric Dumazet <edumazet(a)google.com> net: skb_segment() should not return NULL Jack Morgenstein <jackm(a)dev.mellanox.co.il> net/mlx4_core: Save the qpn from the input modifier in RST2INIT wrapper Willem de Bruijn <willemb(a)google.com> ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull Paolo Abeni <pabeni(a)redhat.com> ip: hash fragments consistently Paul Burton <paul.burton(a)mips.com> MIPS: Fix off-by-one in pci_resource_to_user() Felix Fietkau <nbd(a)nbd.name> MIPS: ath79: fix register address in ath79_ddr_wb_flush() ------------- Diffstat: Makefile | 5 +- arch/mips/ath79/common.c | 2 +- arch/mips/pci/pci.c | 2 +- drivers/base/dd.c | 8 - drivers/net/can/xilinx_can.c | 392 +++++++++++++++------ .../net/ethernet/mellanox/mlx4/resource_tracker.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c | 7 +- drivers/net/ethernet/mellanox/mlx5/core/en_clock.c | 12 +- drivers/net/phy/phy.c | 2 +- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/hub.c | 8 +- drivers/usb/gadget/function/f_fs.c | 2 +- fs/exec.c | 7 +- include/linux/sched.h | 6 +- include/linux/skbuff.h | 2 + include/net/tcp.h | 2 + net/core/rtnetlink.c | 9 +- net/core/skbuff.c | 10 +- net/ipv4/igmp.c | 3 +- net/ipv4/ip_output.c | 2 + net/ipv4/ip_sockglue.c | 7 +- net/ipv4/tcp_dctcp.c | 50 +-- net/ipv4/tcp_input.c | 40 ++- net/ipv4/tcp_output.c | 33 +- net/ipv6/datagram.c | 7 +- net/ipv6/ip6_output.c | 2 + net/ipv6/mcast.c | 3 +- 27 files changed, 431 insertions(+), 197 deletions(-)

7 years, 3 months

5
37
0 0

[PATCH 4.14 00/48] 4.14.59-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.59 release. There are 48 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun Jul 29 09:58:59 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.59-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.59-rc1 Arnd Bergmann <arnd(a)arndb.de> turn off -Wattribute-alias Roman Fietze <roman.fietze(a)telemotive.de> can: m_can.c: fix setup of CCCR register: clear CCCR NISO bit before checking can.ctrlmode Stephane Grosjean <s.grosjean(a)peak-system.com> can: peak_canfd: fix firmware < v3.3.0: limit allocation to 32-bit DMA addr only Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix RX overflow interrupt not being enabled Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix incorrect clear of non-processed interrupts Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: keep only 1-2 frames in TX FIFO to fix TX accounting Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix device dropping off bus on RX overrun Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix recovery from error states not being propagated Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix power management handling Anssi Hannula <anssi.hannula(a)bitwise.fi> can: xilinx_can: fix RX loop if RXNEMP is asserted without RXOK Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> driver core: Partially revert "driver core: correct device's shutdown order" Jerry Zhang <zhangjerry(a)google.com> usb: gadget: f_fs: Only return delayed status when len is 0 Antti Seppälä <a.seppala(a)gmail.com> usb: dwc2: Fix DMA alignment to start at allocated boundary Bin Liu <b-liu(a)ti.com> usb: core: handle hub C_PORT_OVER_CURRENT condition Lubomir Rintel <lkundrak(a)v3.sk> usb: cdc_acm: Add quirk for Castles VEGA3000 Samuel Thibault <samuel.thibault(a)ens-lyon.org> staging: speakup: fix wraparound in uaccess length check Eric Dumazet <edumazet(a)google.com> tcp: add tcp_ooo_try_coalesce() helper Eric Dumazet <edumazet(a)google.com> tcp: call tcp_drop() from tcp_data_queue_ofo() Eric Dumazet <edumazet(a)google.com> tcp: detect malicious patterns in tcp_collapse_ofo_queue() Eric Dumazet <edumazet(a)google.com> tcp: avoid collapses in tcp_prune_queue() if possible Eric Dumazet <edumazet(a)google.com> tcp: free batches of packets in tcp_prune_ofo_queue() Yuchung Cheng <ycheng(a)google.com> tcp: do not delay ACK in DCTCP upon CE status change Yuchung Cheng <ycheng(a)google.com> tcp: do not cancel delay-AcK on DCTCP special ACK Yuchung Cheng <ycheng(a)google.com> tcp: helpers to send special DCTCP ack Yuchung Cheng <ycheng(a)google.com> tcp: fix dctcp delayed ACK schedule Roopa Prabhu <roopa(a)cumulusnetworks.com> vxlan: fix default fdb entry netlink notify ordering during netdev create Roopa Prabhu <roopa(a)cumulusnetworks.com> vxlan: make netlink notify in vxlan_fdb_destroy optional Roopa Prabhu <roopa(a)cumulusnetworks.com> vxlan: add new fdb alloc and create helpers Roopa Prabhu <roopa(a)cumulusnetworks.com> rtnetlink: add rtnl_link_state check in rtnl_configure_link Daniel Borkmann <daniel(a)iogearbox.net> sock: fix sg page frag coalescing in sk_alloc_sg Heiner Kallweit <hkallweit1(a)gmail.com> net: phy: consider PHY_IGNORE_INTERRUPT in phy_start_aneg_priv Hangbin Liu <liuhangbin(a)gmail.com> multicast: do not restore deleted record source filter mode to new one David Ahern <dsahern(a)gmail.com> net/ipv6: Fix linklocal to global address with VRF Eran Ben Elisha <eranbe(a)mellanox.com> net/mlx5e: Fix quota counting in aRFS expire flow Eran Ben Elisha <eranbe(a)mellanox.com> net/mlx5e: Don't allow aRFS for encapsulated packets Ariel Levkovich <lariel(a)mellanox.com> net/mlx5: Adjust clock overflow work period Eric Dumazet <edumazet(a)google.com> net: skb_segment() should not return NULL Jack Morgenstein <jackm(a)dev.mellanox.co.il> net/mlx4_core: Save the qpn from the input modifier in RST2INIT wrapper Willem de Bruijn <willemb(a)google.com> ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull Paolo Abeni <pabeni(a)redhat.com> ip: hash fragments consistently Jarod Wilson <jarod(a)redhat.com> bonding: set default miimon value for non-arp modes if not set Lyude Paul <lyude(a)redhat.com> drm/nouveau: Set DRIVER_ATOMIC cap earlier to fix debugfs Lyude Paul <lyude(a)redhat.com> drm/nouveau/drm/nouveau: Fix runtime PM leak in nv50_disp_atomic_commit() Alexey Kardashevskiy <aik(a)ozlabs.ru> KVM: PPC: Check if IOMMU page is contained in the pinned physical page Boris Ostrovsky <boris.ostrovsky(a)oracle.com> xen/PVH: Set up GS segment for stack canary Paul Burton <paul.burton(a)mips.com> MIPS: Fix off-by-one in pci_resource_to_user() Felix Fietkau <nbd(a)nbd.name> MIPS: ath79: fix register address in ath79_ddr_wb_flush() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting" ------------- Diffstat: Makefile | 5 +- arch/mips/ath79/common.c | 2 +- arch/mips/pci/pci.c | 2 +- arch/powerpc/include/asm/mmu_context.h | 4 +- arch/powerpc/kvm/book3s_64_vio.c | 2 +- arch/powerpc/kvm/book3s_64_vio_hv.c | 6 +- arch/powerpc/mm/mmu_context_iommu.c | 37 +- arch/x86/xen/xen-pvh.S | 26 +- drivers/base/dd.c | 8 - drivers/gpu/drm/nouveau/dispnv04/disp.c | 3 + drivers/gpu/drm/nouveau/nouveau_drm.c | 7 + drivers/gpu/drm/nouveau/nv50_display.c | 8 +- drivers/net/bonding/bond_options.c | 23 +- drivers/net/can/m_can/m_can.c | 3 +- drivers/net/can/peak_canfd/peak_pciefd_main.c | 19 + drivers/net/can/xilinx_can.c | 392 +++++++++++++++------ .../net/ethernet/mellanox/mlx4/resource_tracker.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c | 7 +- drivers/net/ethernet/mellanox/mlx5/core/en_clock.c | 12 +- drivers/net/phy/phy.c | 2 +- drivers/net/vxlan.c | 126 +++++-- drivers/staging/speakup/speakup_soft.c | 6 +- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/hub.c | 8 +- drivers/usb/dwc2/hcd.c | 44 +-- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/vfio/vfio_iommu_spapr_tce.c | 2 +- fs/cifs/smb2pdu.c | 7 +- include/linux/skbuff.h | 2 + include/net/tcp.h | 7 + net/core/rtnetlink.c | 9 +- net/core/skbuff.c | 10 +- net/ipv4/igmp.c | 3 +- net/ipv4/ip_output.c | 2 + net/ipv4/ip_sockglue.c | 7 +- net/ipv4/tcp_dctcp.c | 50 +-- net/ipv4/tcp_input.c | 65 +++- net/ipv4/tcp_output.c | 33 +- net/ipv6/datagram.c | 7 +- net/ipv6/icmp.c | 5 +- net/ipv6/ip6_output.c | 2 + net/ipv6/mcast.c | 3 +- net/ipv6/tcp_ipv6.c | 6 +- net/tls/tls_sw.c | 7 +- 44 files changed, 691 insertions(+), 295 deletions(-)

7 years, 3 months

4
49
0 0

FAILED: patch "[PATCH] spi: spi-s3c64xx: Fix system resume support" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From e935dba111621bd6a0c5d48e6511a4d9885103b4 Mon Sep 17 00:00:00 2001 From: Marek Szyprowski <m.szyprowski(a)samsung.com> Date: Wed, 16 May 2018 10:42:39 +0200 Subject: [PATCH] spi: spi-s3c64xx: Fix system resume support Since Linux v4.10 release (commit 1d9174fbc55e "PM / Runtime: Defer resuming of the device in pm_runtime_force_resume()"), pm_runtime_force_resume() function doesn't runtime resume device if it was not runtime active before system suspend. Thus, driver should not do any register access after pm_runtime_force_resume() without checking the runtime status of the device. To fix this issue, simply move s3c64xx_spi_hwinit() call to s3c64xx_spi_runtime_resume() to ensure that hardware is always properly initialized. This fixes Synchronous external abort issue on system suspend/resume cycle on newer Exynos SoCs. Signed-off-by: Marek Szyprowski <m.szyprowski(a)samsung.com> Reviewed-by: Krzysztof Kozlowski <krzk(a)kernel.org> Signed-off-by: Mark Brown <broonie(a)kernel.org> Cc: stable(a)vger.kernel.org diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c index f55dc78957ad..7b7151ec14c8 100644 --- a/drivers/spi/spi-s3c64xx.c +++ b/drivers/spi/spi-s3c64xx.c @@ -1292,8 +1292,6 @@ static int s3c64xx_spi_resume(struct device *dev) if (ret < 0) return ret; - s3c64xx_spi_hwinit(sdd); - return spi_master_resume(master); } #endif /* CONFIG_PM_SLEEP */ @@ -1331,6 +1329,8 @@ static int s3c64xx_spi_runtime_resume(struct device *dev) if (ret != 0) goto err_disable_src_clk; + s3c64xx_spi_hwinit(sdd); + return 0; err_disable_src_clk:

7 years, 3 months

3
2
0 0

request for 4.14-stable: 2a78cb4db487 ("IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write()")

by Sudip Mukherjee

Hi Greg, These were missing in 4.14-stable. Sending them together as the second commit fixes the first. Please apply to your queue. -- Regards Sudip

7 years, 3 months

2
1
0 0

request for 4.14-stable: a1ae7d0345ed ("RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access")

by Sudip Mukherjee

Hi Greg, These were missing in 4.14-stable. Sending them together as the second commit fixes the first. Please apply them to your queue. -- Regards Sudip

7 years, 3 months

2
1
0 0

Linux 4.14.59

by Greg KH

I'm announcing the release of the 4.14.59 kernel. All users of the 4.14 kernel series must upgrade. The updated 4.14.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y and can be browsed at the normal kernel.org git web browser: http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 3 arch/mips/ath79/common.c | 2 arch/mips/pci/pci.c | 2 arch/powerpc/include/asm/mmu_context.h | 4 arch/powerpc/kvm/book3s_64_vio.c | 2 arch/powerpc/kvm/book3s_64_vio_hv.c | 6 arch/powerpc/mm/mmu_context_iommu.c | 37 + arch/x86/xen/xen-pvh.S | 26 + drivers/base/dd.c | 8 drivers/gpu/drm/nouveau/dispnv04/disp.c | 3 drivers/gpu/drm/nouveau/nouveau_drm.c | 7 drivers/gpu/drm/nouveau/nv50_display.c | 8 drivers/net/bonding/bond_options.c | 23 - drivers/net/can/m_can/m_can.c | 3 drivers/net/can/peak_canfd/peak_pciefd_main.c | 19 drivers/net/can/xilinx_can.c | 392 +++++++++++++----- drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c | 7 drivers/net/ethernet/mellanox/mlx5/core/en_clock.c | 12 drivers/net/phy/phy.c | 2 drivers/net/vxlan.c | 126 +++-- drivers/staging/speakup/speakup_soft.c | 6 drivers/usb/class/cdc-acm.c | 3 drivers/usb/core/hub.c | 8 drivers/usb/dwc2/hcd.c | 44 +- drivers/usb/gadget/function/f_fs.c | 2 drivers/vfio/vfio_iommu_spapr_tce.c | 2 fs/cifs/smb2pdu.c | 7 include/linux/skbuff.h | 2 include/net/tcp.h | 7 net/core/rtnetlink.c | 9 net/core/skbuff.c | 10 net/ipv4/igmp.c | 3 net/ipv4/ip_output.c | 2 net/ipv4/ip_sockglue.c | 7 net/ipv4/tcp_dctcp.c | 50 -- net/ipv4/tcp_input.c | 65 ++ net/ipv4/tcp_output.c | 33 + net/ipv6/datagram.c | 7 net/ipv6/icmp.c | 5 net/ipv6/ip6_output.c | 2 net/ipv6/mcast.c | 3 net/ipv6/tcp_ipv6.c | 6 net/tls/tls_sw.c | 7 44 files changed, 690 insertions(+), 294 deletions(-) Alexey Kardashevskiy (1): KVM: PPC: Check if IOMMU page is contained in the pinned physical page Anssi Hannula (7): can: xilinx_can: fix RX loop if RXNEMP is asserted without RXOK can: xilinx_can: fix power management handling can: xilinx_can: fix recovery from error states not being propagated can: xilinx_can: fix device dropping off bus on RX overrun can: xilinx_can: keep only 1-2 frames in TX FIFO to fix TX accounting can: xilinx_can: fix incorrect clear of non-processed interrupts can: xilinx_can: fix RX overflow interrupt not being enabled Antti Seppälä (1): usb: dwc2: Fix DMA alignment to start at allocated boundary Ariel Levkovich (1): net/mlx5: Adjust clock overflow work period Arnd Bergmann (1): turn off -Wattribute-alias Bin Liu (1): usb: core: handle hub C_PORT_OVER_CURRENT condition Boris Ostrovsky (1): xen/PVH: Set up GS segment for stack canary Daniel Borkmann (1): sock: fix sg page frag coalescing in sk_alloc_sg David Ahern (1): net/ipv6: Fix linklocal to global address with VRF Eran Ben Elisha (2): net/mlx5e: Don't allow aRFS for encapsulated packets net/mlx5e: Fix quota counting in aRFS expire flow Eric Dumazet (6): net: skb_segment() should not return NULL tcp: free batches of packets in tcp_prune_ofo_queue() tcp: avoid collapses in tcp_prune_queue() if possible tcp: detect malicious patterns in tcp_collapse_ofo_queue() tcp: call tcp_drop() from tcp_data_queue_ofo() tcp: add tcp_ooo_try_coalesce() helper Felix Fietkau (1): MIPS: ath79: fix register address in ath79_ddr_wb_flush() Greg Kroah-Hartman (2): Revert "cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting" Linux 4.14.59 Hangbin Liu (1): multicast: do not restore deleted record source filter mode to new one Heiner Kallweit (1): net: phy: consider PHY_IGNORE_INTERRUPT in phy_start_aneg_priv Jack Morgenstein (1): net/mlx4_core: Save the qpn from the input modifier in RST2INIT wrapper Jarod Wilson (1): bonding: set default miimon value for non-arp modes if not set Jerry Zhang (1): usb: gadget: f_fs: Only return delayed status when len is 0 Lubomir Rintel (1): usb: cdc_acm: Add quirk for Castles VEGA3000 Lyude Paul (2): drm/nouveau/drm/nouveau: Fix runtime PM leak in nv50_disp_atomic_commit() drm/nouveau: Set DRIVER_ATOMIC cap earlier to fix debugfs Paolo Abeni (1): ip: hash fragments consistently Paul Burton (1): MIPS: Fix off-by-one in pci_resource_to_user() Rafael J. Wysocki (1): driver core: Partially revert "driver core: correct device's shutdown order" Roman Fietze (1): can: m_can.c: fix setup of CCCR register: clear CCCR NISO bit before checking can.ctrlmode Roopa Prabhu (4): rtnetlink: add rtnl_link_state check in rtnl_configure_link vxlan: add new fdb alloc and create helpers vxlan: make netlink notify in vxlan_fdb_destroy optional vxlan: fix default fdb entry netlink notify ordering during netdev create Samuel Thibault (1): staging: speakup: fix wraparound in uaccess length check Stephane Grosjean (1): can: peak_canfd: fix firmware < v3.3.0: limit allocation to 32-bit DMA addr only Willem de Bruijn (1): ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull Yuchung Cheng (4): tcp: fix dctcp delayed ACK schedule tcp: helpers to send special DCTCP ack tcp: do not cancel delay-AcK on DCTCP special ACK tcp: do not delay ACK in DCTCP upon CE status change

7 years, 3 months

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror