- Linux-stable-mirror - lists.linaro.org

[PATCH 1/2] mm: Fix vma_is_anonymous() false-positives

by Kirill A. Shutemov

vma_is_anonymous() relies on ->vm_ops being NULL to detect anonymous VMA. This is unreliable as ->mmap may not set ->vm_ops. False-positive vma_is_anonymous() may lead to crashes: next ffff8801ce5e7040 prev ffff8801d20eca50 mm ffff88019c1e13c0 prot 27 anon_vma ffff88019680cdd8 vm_ops 0000000000000000 pgoff 0 file ffff8801b2ec2d00 private_data 0000000000000000 flags: 0xff(read|write|exec|shared|mayread|maywrite|mayexec|mayshare) ------------[ cut here ]------------ kernel BUG at mm/memory.c:1422! invalid opcode: 0000 [#1] SMP KASAN CPU: 0 PID: 18486 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #136 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:zap_pmd_range mm/memory.c:1421 [inline] RIP: 0010:zap_pud_range mm/memory.c:1466 [inline] RIP: 0010:zap_p4d_range mm/memory.c:1487 [inline] RIP: 0010:unmap_page_range+0x1c18/0x2220 mm/memory.c:1508 Code: ff 31 ff 4c 89 e6 42 c6 04 33 f8 e8 92 dd d0 ff 4d 85 e4 0f 85 4a eb ff ff e8 54 dc d0 ff 48 8b bd 10 fc ff ff e8 82 95 fe ff <0f> 0b e8 41 dc d0 ff 0f 0b 4c 89 ad 18 fc ff ff c7 85 7c fb ff ff RSP: 0018:ffff8801b0587330 EFLAGS: 00010286 RAX: 000000000000013c RBX: 1ffff100360b0e9c RCX: ffffc90002620000 RDX: 0000000000000000 RSI: ffffffff81631851 RDI: 0000000000000001 RBP: ffff8801b05877c8 R08: ffff880199d40300 R09: ffffed003b5c4fc0 R10: ffffed003b5c4fc0 R11: ffff8801dae27e07 R12: 0000000000000000 R13: ffff88019c1e13c0 R14: dffffc0000000000 R15: 0000000020e01000 FS: 00007fca32251700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f04c540d000 CR3: 00000001ac1f0000 CR4: 00000000001426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: unmap_single_vma+0x1a0/0x310 mm/memory.c:1553 zap_page_range_single+0x3cc/0x580 mm/memory.c:1644 unmap_mapping_range_vma mm/memory.c:2792 [inline] unmap_mapping_range_tree mm/memory.c:2813 [inline] unmap_mapping_pages+0x3a7/0x5b0 mm/memory.c:2845 unmap_mapping_range+0x48/0x60 mm/memory.c:2880 truncate_pagecache+0x54/0x90 mm/truncate.c:800 truncate_setsize+0x70/0xb0 mm/truncate.c:826 simple_setattr+0xe9/0x110 fs/libfs.c:409 notify_change+0xf13/0x10f0 fs/attr.c:335 do_truncate+0x1ac/0x2b0 fs/open.c:63 do_sys_ftruncate+0x492/0x560 fs/open.c:205 __do_sys_ftruncate fs/open.c:215 [inline] __se_sys_ftruncate fs/open.c:213 [inline] __x64_sys_ftruncate+0x59/0x80 fs/open.c:213 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Reproducer: #include <stdio.h> #include <stddef.h> #include <stdint.h> #include <stdlib.h> #include <string.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/ioctl.h> #include <sys/mman.h> #include <unistd.h> #include <fcntl.h> #define KCOV_INIT_TRACE _IOR('c', 1, unsigned long) #define KCOV_ENABLE _IO('c', 100) #define KCOV_DISABLE _IO('c', 101) #define COVER_SIZE (1024<<10) #define KCOV_TRACE_PC 0 #define KCOV_TRACE_CMP 1 int main(int argc, char **argv) { int fd; unsigned long *cover; system("mount -t debugfs none /sys/kernel/debug"); fd = open("/sys/kernel/debug/kcov", O_RDWR); ioctl(fd, KCOV_INIT_TRACE, COVER_SIZE); cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long), PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); munmap(cover, COVER_SIZE * sizeof(unsigned long)); cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long), PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); memset(cover, 0, COVER_SIZE * sizeof(unsigned long)); ftruncate(fd, 3UL << 20); return 0; } This can be fixed by assigning anonymous VMAs own vm_ops and not relying on it being NULL. If ->mmap() failed to set ->vm_ops, mmap_region() will set it to dummy_vm_ops. This way we will have non-NULL ->vm_ops for all VMAs. Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Reported-by: syzbot+3f84280d52be9b7083cc(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Cc: Dmitry Vyukov <dvyukov(a)google.com> Cc: Oleg Nesterov <oleg(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> --- drivers/char/mem.c | 1 + fs/exec.c | 1 + fs/hugetlbfs/inode.c | 1 + include/linux/mm.h | 5 ++++- mm/khugepaged.c | 4 ++-- mm/mmap.c | 13 +++++++++++++ mm/shmem.c | 1 + 7 files changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/char/mem.c b/drivers/char/mem.c index ffeb60d3434c..f0a8b0b1768b 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -708,6 +708,7 @@ static int mmap_zero(struct file *file, struct vm_area_struct *vma) #endif if (vma->vm_flags & VM_SHARED) return shmem_zero_setup(vma); + vma->vm_ops = &anon_vm_ops; return 0; } diff --git a/fs/exec.c b/fs/exec.c index 2d4e0075bd24..a1a246062561 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -307,6 +307,7 @@ static int __bprm_mm_init(struct linux_binprm *bprm) * configured yet. */ BUILD_BUG_ON(VM_STACK_FLAGS & VM_STACK_INCOMPLETE_SETUP); + vma->vm_ops = &anon_vm_ops; vma->vm_end = STACK_TOP_MAX; vma->vm_start = vma->vm_end - PAGE_SIZE; vma->vm_flags = VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP; diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index d508c7844681..5ff73b1398ad 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -597,6 +597,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset, memset(&pseudo_vma, 0, sizeof(struct vm_area_struct)); pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED); pseudo_vma.vm_file = file; + pseudo_vma.vm_ops = &dummy_vm_ops; for (index = start; index < end; index++) { /* diff --git a/include/linux/mm.h b/include/linux/mm.h index a0fbb9ffe380..9a35362bbc92 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1536,9 +1536,12 @@ int clear_page_dirty_for_io(struct page *page); int get_cmdline(struct task_struct *task, char *buffer, int buflen); +extern const struct vm_operations_struct anon_vm_ops; +extern const struct vm_operations_struct dummy_vm_ops; + static inline bool vma_is_anonymous(struct vm_area_struct *vma) { - return !vma->vm_ops; + return vma->vm_ops == &anon_vm_ops; } #ifdef CONFIG_SHMEM diff --git a/mm/khugepaged.c b/mm/khugepaged.c index d7b2a4bf8671..5ae34097aed1 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -440,7 +440,7 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma, * page fault if needed. */ return 0; - if (vma->vm_ops || (vm_flags & VM_NO_KHUGEPAGED)) + if (!vma_is_anonymous(vma) || (vm_flags & VM_NO_KHUGEPAGED)) /* khugepaged not yet working on file or special mappings */ return 0; hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK; @@ -831,7 +831,7 @@ static bool hugepage_vma_check(struct vm_area_struct *vma) return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff, HPAGE_PMD_NR); } - if (!vma->anon_vma || vma->vm_ops) + if (!vma->anon_vma || !vma_is_anonymous(vma)) return false; if (is_vma_temporary_stack(vma)) return false; diff --git a/mm/mmap.c b/mm/mmap.c index d1eb87ef4b1a..0729ed06b01c 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -71,6 +71,9 @@ int mmap_rnd_compat_bits __read_mostly = CONFIG_ARCH_MMAP_RND_COMPAT_BITS; static bool ignore_rlimit_data; core_param(ignore_rlimit_data, ignore_rlimit_data, bool, 0644); +const struct vm_operations_struct anon_vm_ops = {}; +const struct vm_operations_struct dummy_vm_ops = {}; + static void unmap_region(struct mm_struct *mm, struct vm_area_struct *vma, struct vm_area_struct *prev, unsigned long start, unsigned long end); @@ -561,6 +564,8 @@ static unsigned long count_vma_pages_range(struct mm_struct *mm, void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma, struct rb_node **rb_link, struct rb_node *rb_parent) { + WARN_ONCE(!vma->vm_ops, "missing vma->vm_ops"); + /* Update tracking information for the gap following the new vma. */ if (vma->vm_next) vma_gap_update(vma->vm_next); @@ -1774,12 +1779,19 @@ unsigned long mmap_region(struct file *file, unsigned long addr, */ WARN_ON_ONCE(addr != vma->vm_start); + /* All mappings must have ->vm_ops set */ + if (!vma->vm_ops) + vma->vm_ops = &dummy_vm_ops; + addr = vma->vm_start; vm_flags = vma->vm_flags; } else if (vm_flags & VM_SHARED) { error = shmem_zero_setup(vma); if (error) goto free_vma; + } else { + /* vma_is_anonymous() relies on this. */ + vma->vm_ops = &anon_vm_ops; } vma_link(mm, vma, prev, rb_link, rb_parent); @@ -2999,6 +3011,7 @@ static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long INIT_LIST_HEAD(&vma->anon_vma_chain); vma->vm_mm = mm; + vma->vm_ops = &anon_vm_ops; vma->vm_start = addr; vma->vm_end = addr + len; vma->vm_pgoff = pgoff; diff --git a/mm/shmem.c b/mm/shmem.c index 2cab84403055..db5c319161ca 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -1424,6 +1424,7 @@ static void shmem_pseudo_vma_init(struct vm_area_struct *vma, /* Bias interleave by inode number to distribute better across nodes */ vma->vm_pgoff = index + info->vfs_inode.i_ino; vma->vm_policy = mpol_shared_policy_lookup(&info->policy, index); + vma->vm_ops = &dummy_vm_ops; } static void shmem_pseudo_vma_destroy(struct vm_area_struct *vma) -- 2.18.0

7 years, 3 months

4
11
0 0

[PATCH 4.17 00/67] 4.17.7-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.17.7 release. There are 67 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Jul 18 07:34:11 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.17.7-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.17.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.17.7-rc1 Baruch Siach <baruch(a)tkos.co.il> ARM: dts: armada-38x: use the new thermal binding Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: sanity check for total valid node blocks Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: sanity check on sit entry Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: avoid bug_on on corrupted inode Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: give message and set need_fsck given broken node id Marc Orr <marcorr(a)google.com> kvm: vmx: Nested VM-entry prereqs for event inj. Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> loop: remember whether sysfs_create_group() was done Leon Romanovsky <leon(a)kernel.org> RDMA/ucm: Mark UCM interface as BROKEN Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> PM / hibernate: Fix oops at snapshot_write() Darrick J. Wong <darrick.wong(a)oracle.com> xfs: fix inobt magic number check Theodore Ts'o <tytso(a)mit.edu> loop: add recursion validation to LOOP_CHANGE_FD Florian Westphal <fw(a)strlen.de> netfilter: x_tables: initialise match/target check parameter struct Dmitry Vyukov <dvyukov(a)google.com> crypto: don't optimize keccakf() Eric Dumazet <edumazet(a)google.com> netfilter: nf_queue: augment nfqa_cfg_policy Oleg Nesterov <oleg(a)redhat.com> uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn() Eric Biggers <ebiggers(a)google.com> crypto: x86/salsa20 - remove x86 salsa20 implementations Tony Battersby <tonyb(a)cybernetics.com> bsg: fix bogus EINVAL on non-data commands Juergen Gross <jgross(a)suse.com> xen: setup pv irq ops vector earlier Juergen Gross <jgross(a)suse.com> xen: remove global bit from __default_kernel_pte_mask for pv guests Steve Wise <swise(a)opengridcomputing.com> iw_cxgb4: correctly enforce the max reg_mr depth Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: recovery: if possible send STOP with recovery pulses Jon Hunter <jonathanh(a)nvidia.com> i2c: tegra: Fix NACK error handling Michael J. Ruhl <michael.j.ruhl(a)intel.com> IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return values Paul Menzel <pmenzel(a)molgen.mpg.de> tools build: fix # escaping in .cmd files for future Make Yandong Zhao <yandong77520(a)gmail.com> arm64: neon: Fix function may_use_simd() return error status Dan Williams <dan.j.williams(a)intel.com> acpi, nfit: Fix scrub idle detection Randy Dunlap <rdunlap(a)infradead.org> kbuild: delete INSTALL_FW_PATH from kbuild documentation Joel Fernandes (Google) <joel(a)joelfernandes.org> tracing: Reorder display of TGID to be after PID Michal Hocko <mhocko(a)suse.com> mm: do not bug_on on incorrect length in __mm_populate() Oscar Salvador <osalvador(a)suse.de> fs, elf: make sure to page align bss in load_elf_library Philipp Rudo <prudo(a)linux.ibm.com> x86/purgatory: add missing FORCE to Makefile target Vlastimil Babka <vbabka(a)suse.cz> fs/proc/task_mmu.c: fix Locked field in /proc/pid/smaps* Christian Borntraeger <borntraeger(a)de.ibm.com> mm: do not drop unused pages when userfaultd is running Chris Wilson <chris(a)chris-wilson.co.uk> ALSA: hda - Handle pm failure during hotplug Hui Wang <hui.wang(a)canonical.com> ALSA: hda/realtek - two more lenovo models need fixup of MIC_LOCATION Pavel Tatashin <pasha.tatashin(a)oracle.com> mm: zero unavailable pages before memmap init Linus Torvalds <torvalds(a)linux-foundation.org> Fix up non-directory creation in SGID directories Dan Carpenter <dan.carpenter(a)oracle.com> xhci: xhci-mem: off by one in xhci_stream_id_to_ring() Nico Sneck <snecknico(a)gmail.com> usb: quirks: add delay quirks for Corsair Strafe Johan Hovold <johan(a)kernel.org> USB: serial: mos7840: fix status-register error handling Jann Horn <jannh(a)google.com> USB: yurex: fix out-of-bounds uaccess in read handler Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix modem-status error handling Olli Salonen <olli.salonen(a)iki.fi> USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick Dan Carpenter <dan.carpenter(a)oracle.com> USB: serial: ch341: fix type promotion bug in ch341_control_in() Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Notify userspace when boot_acl is changed Hans de Goede <hdegoede(a)redhat.com> ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS Mika Westerberg <mika.westerberg(a)linux.intel.com> ahci: Add Intel Ice Lake LP PCI ID Nadav Amit <namit(a)vmware.com> vmw_balloon: fix inflation with batching Jiri Olsa <jolsa(a)kernel.org> tracing/kprobe: Release kprobe print_fmt properly Vignesh R <vigneshr(a)ti.com> mtd: spi-nor: cadence-quadspi: Fix direct mode write timeouts Alexander Usyskin <alexander.usyskin(a)intel.com> mei: discard messages from not connected client during power down. Damien Le Moal <damien.lemoal(a)wdc.com> ata: Fix ZBC_OUT all bit handling Damien Le Moal <damien.lemoal(a)wdc.com> ata: Fix ZBC_OUT command block check Ping-Ke Shih <pkshih(a)realtek.com> staging: r8822be: Fix RTL8822be can't find any wireless AP Murray McAllister <murray.mcallister(a)insomniasec.com> staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data(). Jann Horn <jannh(a)google.com> ibmasm: don't write out of bounds in read handler Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> mmc: renesas_sdhi_internal_dmac: Cannot clear the RX_IN_USE in abort x00270170 <xiaqing17(a)hisilicon.com> mmc: dw_mmc: fix card threshold control configuration Stefan Agner <stefan(a)agner.ch> mmc: sdhci-esdhc-imx: allow 1.8V modes without 100/200MHz pinctrl states Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPICA: Clear status of all events when entering S5 Lucas Stach <l.stach(a)pengutronix.de> drm/etnaviv: bring back progress check in job timeout handler Fabio Estevam <fabio.estevam(a)nxp.com> drm/etnaviv: Fix driver unregistering Fabio Estevam <fabio.estevam(a)nxp.com> drm/etnaviv: Check for platform_device_register_simple() failure Paul Burton <paul.burton(a)mips.com> MIPS: Fix ioremap() RAM check Paul Burton <paul.burton(a)mips.com> MIPS: Use async IPIs for arch_trigger_cpumask_backtrace() Paul Burton <paul.burton(a)mips.com> MIPS: Call dump_stack() from show_regs() Daniel Borkmann <daniel(a)iogearbox.net> bpf: reject passing modified ctx to helper functions ------------- Diffstat: Documentation/kbuild/kbuild.txt | 9 - Makefile | 4 +- arch/arm/boot/dts/armada-38x.dtsi | 2 +- arch/arm64/include/asm/simd.h | 19 +- arch/mips/kernel/process.c | 43 +- arch/mips/kernel/traps.c | 1 + arch/mips/mm/ioremap.c | 37 +- arch/x86/crypto/Makefile | 4 - arch/x86/crypto/salsa20-i586-asm_32.S | 938 -------------------------- arch/x86/crypto/salsa20-x86_64-asm_64.S | 805 ---------------------- arch/x86/crypto/salsa20_glue.c | 91 --- arch/x86/include/asm/vmx.h | 3 + arch/x86/kernel/uprobes.c | 2 +- arch/x86/kvm/vmx.c | 67 ++ arch/x86/kvm/x86.h | 9 + arch/x86/purgatory/Makefile | 2 +- arch/x86/xen/enlighten_pv.c | 25 +- arch/x86/xen/irq.c | 4 +- block/bsg.c | 2 - crypto/Kconfig | 28 - crypto/sha3_generic.c | 2 +- drivers/acpi/acpica/hwsleep.c | 15 +- drivers/acpi/nfit/core.c | 44 +- drivers/acpi/nfit/nfit.h | 1 + drivers/ata/ahci.c | 60 ++ drivers/ata/libata-core.c | 3 + drivers/ata/libata-scsi.c | 18 +- drivers/block/loop.c | 79 ++- drivers/block/loop.h | 1 + drivers/gpu/drm/etnaviv/etnaviv_drv.c | 24 +- drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 3 + drivers/gpu/drm/etnaviv/etnaviv_sched.c | 24 + drivers/i2c/busses/i2c-tegra.c | 17 +- drivers/i2c/i2c-core-base.c | 11 +- drivers/infiniband/Kconfig | 11 + drivers/infiniband/core/Makefile | 4 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/hfi1/rc.c | 2 +- drivers/infiniband/hw/hfi1/uc.c | 4 +- drivers/infiniband/hw/hfi1/ud.c | 4 +- drivers/infiniband/hw/hfi1/verbs_txreq.c | 4 +- drivers/infiniband/hw/hfi1/verbs_txreq.h | 4 +- drivers/misc/ibmasm/ibmasmfs.c | 27 +- drivers/misc/mei/interrupt.c | 5 +- drivers/misc/vmw_balloon.c | 4 +- drivers/mmc/host/dw_mmc.c | 7 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 3 +- drivers/mmc/host/sdhci-esdhc-imx.c | 21 +- drivers/mtd/spi-nor/cadence-quadspi.c | 6 +- drivers/staging/rtl8723bs/core/rtw_ap.c | 2 +- drivers/staging/rtlwifi/rtl8822be/hw.c | 2 +- drivers/staging/rtlwifi/wifi.h | 1 + drivers/thunderbolt/domain.c | 4 + drivers/usb/core/quirks.c | 4 + drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/misc/yurex.c | 23 +- drivers/usb/serial/ch341.c | 2 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/keyspan_pda.c | 4 +- drivers/usb/serial/mos7840.c | 3 + fs/binfmt_elf.c | 5 +- fs/f2fs/f2fs.h | 13 +- fs/f2fs/inode.c | 33 +- fs/f2fs/node.c | 21 +- fs/f2fs/segment.c | 25 + fs/inode.c | 6 + fs/proc/task_mmu.c | 3 +- fs/xfs/libxfs/xfs_ialloc_btree.c | 2 +- include/linux/libata.h | 1 + kernel/bpf/verifier.c | 48 +- kernel/power/user.c | 5 + kernel/trace/trace.c | 8 +- kernel/trace/trace_kprobe.c | 6 +- kernel/trace/trace_output.c | 5 +- mm/gup.c | 2 - mm/mmap.c | 29 +- mm/page_alloc.c | 4 +- mm/rmap.c | 8 +- net/bridge/netfilter/ebtables.c | 2 + net/ipv4/netfilter/ip_tables.c | 1 + net/ipv6/netfilter/ip6_tables.c | 1 + net/netfilter/nfnetlink_queue.c | 3 + sound/pci/hda/patch_hdmi.c | 19 +- sound/pci/hda/patch_realtek.c | 6 +- tools/build/Build.include | 4 +- tools/testing/selftests/bpf/test_verifier.c | 58 +- 86 files changed, 702 insertions(+), 2169 deletions(-)

7 years, 3 months

6
73
0 0

the editing

by Ruby

We have got a team of professional to do image editing service for you. We have 20 image editors and on daily basis 2000 images can be processed. If you want to check our quality of work please send us a photo with instruction and we will work on it. Our Services: Photo cut out, masking, clipping path Color, brightness and contrast correction Beauty, Model retouching, skin retouching Image cropping and resizing Correcting the shape and size We do unlimited revisions until you are satisfied with the work. Thanks, Ruby Young

7 years, 3 months

1
0
0 0

patch "usb: dwc2: Fix DMA alignment to start at allocated boundary" added to usb-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: dwc2: Fix DMA alignment to start at allocated boundary to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From 56406e017a883b54b339207b230f85599f4d70ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Antti=20Sepp=C3=A4l=C3=A4?= <a.seppala(a)gmail.com> Date: Thu, 5 Jul 2018 17:31:53 +0300 Subject: usb: dwc2: Fix DMA alignment to start at allocated boundary MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The commit 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in a more supported way") introduced a common way to align DMA allocations. The code in the commit aligns the struct dma_aligned_buffer but the actual DMA address pointed by data[0] gets aligned to an offset from the allocated boundary by the kmalloc_ptr and the old_xfer_buffer pointers. This is against the recommendation in Documentation/DMA-API.txt which states: Therefore, it is recommended that driver writers who don't take special care to determine the cache line size at run time only map virtual regions that begin and end on page boundaries (which are guaranteed also to be cache line boundaries). The effect of this is that architectures with non-coherent DMA caches may run into memory corruption or kernel crashes with Unhandled kernel unaligned accesses exceptions. Fix the alignment by positioning the DMA area in front of the allocation and use memory at the end of the area for storing the orginal transfer_buffer pointer. This may have the added benefit of increased performance as the DMA area is now fully aligned on all architectures. Tested with Lantiq xRX200 (MIPS) and RPi Model B Rev 2 (ARM). Fixes: 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in a more supported way") Cc: <stable(a)vger.kernel.org> Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Signed-off-by: Antti Seppälä <a.seppala(a)gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi(a)linux.intel.com> --- drivers/usb/dwc2/hcd.c | 44 ++++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c index b1104be3429c..2ed0ac18e053 100644 --- a/drivers/usb/dwc2/hcd.c +++ b/drivers/usb/dwc2/hcd.c @@ -2665,34 +2665,29 @@ static int dwc2_alloc_split_dma_aligned_buf(struct dwc2_hsotg *hsotg, #define DWC2_USB_DMA_ALIGN 4 -struct dma_aligned_buffer { - void *kmalloc_ptr; - void *old_xfer_buffer; - u8 data[0]; -}; - static void dwc2_free_dma_aligned_buffer(struct urb *urb) { - struct dma_aligned_buffer *temp; + void *stored_xfer_buffer; if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER)) return; - temp = container_of(urb->transfer_buffer, - struct dma_aligned_buffer, data); + /* Restore urb->transfer_buffer from the end of the allocated area */ + memcpy(&stored_xfer_buffer, urb->transfer_buffer + + urb->transfer_buffer_length, sizeof(urb->transfer_buffer)); if (usb_urb_dir_in(urb)) - memcpy(temp->old_xfer_buffer, temp->data, + memcpy(stored_xfer_buffer, urb->transfer_buffer, urb->transfer_buffer_length); - urb->transfer_buffer = temp->old_xfer_buffer; - kfree(temp->kmalloc_ptr); + kfree(urb->transfer_buffer); + urb->transfer_buffer = stored_xfer_buffer; urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER; } static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags) { - struct dma_aligned_buffer *temp, *kmalloc_ptr; + void *kmalloc_ptr; size_t kmalloc_size; if (urb->num_sgs || urb->sg || @@ -2700,22 +2695,29 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags) !((uintptr_t)urb->transfer_buffer & (DWC2_USB_DMA_ALIGN - 1))) return 0; - /* Allocate a buffer with enough padding for alignment */ + /* + * Allocate a buffer with enough padding for original transfer_buffer + * pointer. This allocation is guaranteed to be aligned properly for + * DMA + */ kmalloc_size = urb->transfer_buffer_length + - sizeof(struct dma_aligned_buffer) + DWC2_USB_DMA_ALIGN - 1; + sizeof(urb->transfer_buffer); kmalloc_ptr = kmalloc(kmalloc_size, mem_flags); if (!kmalloc_ptr) return -ENOMEM; - /* Position our struct dma_aligned_buffer such that data is aligned */ - temp = PTR_ALIGN(kmalloc_ptr + 1, DWC2_USB_DMA_ALIGN) - 1; - temp->kmalloc_ptr = kmalloc_ptr; - temp->old_xfer_buffer = urb->transfer_buffer; + /* + * Position value of original urb->transfer_buffer pointer to the end + * of allocation for later referencing + */ + memcpy(kmalloc_ptr + urb->transfer_buffer_length, + &urb->transfer_buffer, sizeof(urb->transfer_buffer)); + if (usb_urb_dir_out(urb)) - memcpy(temp->data, urb->transfer_buffer, + memcpy(kmalloc_ptr, urb->transfer_buffer, urb->transfer_buffer_length); - urb->transfer_buffer = temp->data; + urb->transfer_buffer = kmalloc_ptr; urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER; -- 2.18.0

7 years, 3 months

1
0
0 0

patch "usb: gadget: Fix OS descriptors support" added to usb-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: gadget: Fix OS descriptors support to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From 50b9773c13bffbef32060e67c4483ea7b2eca7b5 Mon Sep 17 00:00:00 2001 From: Benjamin Herrenschmidt <benh(a)kernel.crashing.org> Date: Wed, 27 Jun 2018 12:33:56 +1000 Subject: usb: gadget: Fix OS descriptors support The current code is broken as it re-defines "req" inside the if block, then goto out of it. Thus the request that ends up being sent is not the one that was populated by the code in question. This fixes RNDIS driver autodetect by Windows 10 for me. The bug was introduced by Chris rework to remove the local queuing inside the if { } block of the redefined request. Fixes: 636ba13aec8a ("usb: gadget: composite: remove duplicated code in OS desc handling") Cc: <stable(a)vger.kernel.org> # v4.17 Signed-off-by: Benjamin Herrenschmidt <benh(a)kernel.crashing.org> Signed-off-by: Felipe Balbi <felipe.balbi(a)linux.intel.com> --- drivers/usb/gadget/composite.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index d2fa071c21b1..b8a15840b4ff 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1819,7 +1819,6 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) if (cdev->use_os_string && cdev->os_desc_config && (ctrl->bRequestType & USB_TYPE_VENDOR) && ctrl->bRequest == cdev->b_vendor_code) { - struct usb_request *req; struct usb_configuration *os_desc_cfg; u8 *buf; int interface; -- 2.18.0

7 years, 3 months

1
0
0 0

[PATCH Resend 4.9] MIPS: Use async IPIs for arch_trigger_cpumask_backtrace()

by Huacai Chen

From: Paul Burton <paul.burton(a)mips.com> The current MIPS implementation of arch_trigger_cpumask_backtrace() is broken because it attempts to use synchronous IPIs despite the fact that it may be run with interrupts disabled. This means that when arch_trigger_cpumask_backtrace() is invoked, for example by the RCU CPU stall watchdog, we may: - Deadlock due to use of synchronous IPIs with interrupts disabled, causing the CPU that's attempting to generate the backtrace output to hang itself. - Not succeed in generating the desired output from remote CPUs. - Produce warnings about this from smp_call_function_many(), for example: [42760.526910] INFO: rcu_sched detected stalls on CPUs/tasks: [42760.535755] 0-...!: (1 GPs behind) idle=ade/140000000000000/0 softirq=526944/526945 fqs=0 [42760.547874] 1-...!: (0 ticks this GP) idle=e4a/140000000000000/0 softirq=547885/547885 fqs=0 [42760.559869] (detected by 2, t=2162 jiffies, g=266689, c=266688, q=33) [42760.568927] ------------[ cut here ]------------ [42760.576146] WARNING: CPU: 2 PID: 1216 at kernel/smp.c:416 smp_call_function_many+0x88/0x20c [42760.587839] Modules linked in: [42760.593152] CPU: 2 PID: 1216 Comm: sh Not tainted 4.15.4-00373-gee058bb4d0c2 #2 [42760.603767] Stack : 8e09bd20 8e09bd20 8e09bd20 fffffff0 00000007 00000006 00000000 8e09bca8 [42760.616937] 95b2b379 95b2b379 807a0080 00000007 81944518 0000018a 00000032 00000000 [42760.630095] 00000000 00000030 80000000 00000000 806eca74 00000009 8017e2b8 000001a0 [42760.643169] 00000000 00000002 00000000 8e09baa4 00000008 808b8008 86d69080 8e09bca0 [42760.656282] 8e09ad50 805e20aa 00000000 00000000 00000000 8017e2b8 00000009 801070ca [42760.669424] ... [42760.673919] Call Trace: [42760.678672] [<27fde568>] show_stack+0x70/0xf0 [42760.685417] [<84751641>] dump_stack+0xaa/0xd0 [42760.692188] [<699d671c>] __warn+0x80/0x92 [42760.698549] [<68915d41>] warn_slowpath_null+0x28/0x36 [42760.705912] [<f7c76c1c>] smp_call_function_many+0x88/0x20c [42760.713696] [<6bbdfc2a>] arch_trigger_cpumask_backtrace+0x30/0x4a [42760.722216] [<f845bd33>] rcu_dump_cpu_stacks+0x6a/0x98 [42760.729580] [<796e7629>] rcu_check_callbacks+0x672/0x6ac [42760.737476] [<059b3b43>] update_process_times+0x18/0x34 [42760.744981] [<6eb94941>] tick_sched_handle.isra.5+0x26/0x38 [42760.752793] [<478d3d70>] tick_sched_timer+0x1c/0x50 [42760.759882] [<e56ea39f>] __hrtimer_run_queues+0xc6/0x226 [42760.767418] [<e88bbcae>] hrtimer_interrupt+0x88/0x19a [42760.775031] [<6765a19e>] gic_compare_interrupt+0x2e/0x3a [42760.782761] [<0558bf5f>] handle_percpu_devid_irq+0x78/0x168 [42760.790795] [<90c11ba2>] generic_handle_irq+0x1e/0x2c [42760.798117] [<1b6d462c>] gic_handle_local_int+0x38/0x86 [42760.805545] [<b2ada1c7>] gic_irq_dispatch+0xa/0x14 [42760.812534] [<90c11ba2>] generic_handle_irq+0x1e/0x2c [42760.820086] [<c7521934>] do_IRQ+0x16/0x20 [42760.826274] [<9aef3ce6>] plat_irq_dispatch+0x62/0x94 [42760.833458] [<6a94b53c>] except_vec_vi_end+0x70/0x78 [42760.840655] [<22284043>] smp_call_function_many+0x1ba/0x20c [42760.848501] [<54022b58>] smp_call_function+0x1e/0x2c [42760.855693] [<ab9fc705>] flush_tlb_mm+0x2a/0x98 [42760.862730] [<0844cdd0>] tlb_flush_mmu+0x1c/0x44 [42760.869628] [<cb259b74>] arch_tlb_finish_mmu+0x26/0x3e [42760.877021] [<1aeaaf74>] tlb_finish_mmu+0x18/0x66 [42760.883907] [<b3fce717>] exit_mmap+0x76/0xea [42760.890428] [<c4c8a2f6>] mmput+0x80/0x11a [42760.896632] [<a41a08f4>] do_exit+0x1f4/0x80c [42760.903158] [<ee01cef6>] do_group_exit+0x20/0x7e [42760.909990] [<13fa8d54>] __wake_up_parent+0x0/0x1e [42760.917045] [<46cf89d0>] smp_call_function_many+0x1a2/0x20c [42760.924893] [<8c21a93b>] syscall_common+0x14/0x1c [42760.931765] ---[ end trace 02aa09da9dc52a60 ]--- [42760.938342] ------------[ cut here ]------------ [42760.945311] WARNING: CPU: 2 PID: 1216 at kernel/smp.c:291 smp_call_function_single+0xee/0xf8 ... This patch switches MIPS' arch_trigger_cpumask_backtrace() to use async IPIs & smp_call_function_single_async() in order to resolve this problem. We ensure use of the pre-allocated call_single_data_t structures is serialized by maintaining a cpumask indicating that they're busy, and refusing to attempt to send an IPI when a CPU's bit is set in this mask. This should only happen if a CPU hasn't responded to a previous backtrace IPI - ie. if it's hung - and we print a warning to the console in this case. I've marked this for stable branches as far back as v4.9, to which it applies cleanly. Strictly speaking the faulty MIPS implementation can be traced further back to commit 856839b76836 ("MIPS: Add arch_trigger_all_cpu_backtrace() function") in v3.19, but kernel versions v3.19 through v4.8 will require further work to backport due to the rework performed in commit 9a01c3ed5cdb ("nmi_backtrace: add more trigger_*_cpu_backtrace() methods"). Signed-off-by: Paul Burton <paul.burton(a)mips.com> Patchwork: https://patchwork.linux-mips.org/patch/19597/ Cc: James Hogan <jhogan(a)kernel.org> Cc: Ralf Baechle <ralf(a)linux-mips.org> Cc: linux-mips(a)linux-mips.org Cc: stable(a)vger.kernel.org Fixes: 856839b76836 ("MIPS: Add arch_trigger_all_cpu_backtrace() function") Fixes: 9a01c3ed5cdb ("nmi_backtrace: add more trigger_*_cpu_backtrace() methods") [ Huacai: backported to 4.9: Replace "call_single_data_t" with "struct call_single_data" ] Signed-off-by: Huacai Chen <chenhc(a)lemote.com> --- arch/mips/kernel/process.c | 45 ++++++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 15 deletions(-) diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c index cb1e9c1..513a63b 100644 --- a/arch/mips/kernel/process.c +++ b/arch/mips/kernel/process.c @@ -26,6 +26,7 @@ #include <linux/kallsyms.h> #include <linux/random.h> #include <linux/prctl.h> +#include <linux/nmi.h> #include <asm/asm.h> #include <asm/bootinfo.h> @@ -633,28 +634,42 @@ unsigned long arch_align_stack(unsigned long sp) return sp & ALMASK; } -static void arch_dump_stack(void *info) -{ - struct pt_regs *regs; +static DEFINE_PER_CPU(struct call_single_data, backtrace_csd); +static struct cpumask backtrace_csd_busy; - regs = get_irq_regs(); - - if (regs) - show_regs(regs); - else - dump_stack(); +static void handle_backtrace(void *info) +{ + nmi_cpu_backtrace(get_irq_regs()); + cpumask_clear_cpu(smp_processor_id(), &backtrace_csd_busy); } -void arch_trigger_cpumask_backtrace(const cpumask_t *mask, bool exclude_self) +static void raise_backtrace(cpumask_t *mask) { - long this_cpu = get_cpu(); + struct call_single_data *csd; + int cpu; - if (cpumask_test_cpu(this_cpu, mask) && !exclude_self) - dump_stack(); + for_each_cpu(cpu, mask) { + /* + * If we previously sent an IPI to the target CPU & it hasn't + * cleared its bit in the busy cpumask then it didn't handle + * our previous IPI & it's not safe for us to reuse the + * call_single_data_t. + */ + if (cpumask_test_and_set_cpu(cpu, &backtrace_csd_busy)) { + pr_warn("Unable to send backtrace IPI to CPU%u - perhaps it hung?\n", + cpu); + continue; + } - smp_call_function_many(mask, arch_dump_stack, NULL, 1); + csd = &per_cpu(backtrace_csd, cpu); + csd->func = handle_backtrace; + smp_call_function_single_async(cpu, csd); + } +} - put_cpu(); +void arch_trigger_cpumask_backtrace(const cpumask_t *mask, bool exclude_self) +{ + nmi_trigger_cpumask_backtrace(mask, exclude_self, raise_backtrace); } int mips_get_process_fp_mode(struct task_struct *task) -- 2.7.0

7 years, 3 months

1
0
0 0

[PATCH 4.14 00/54] 4.14.56-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.56 release. There are 54 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed Jul 18 07:34:24 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.56-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.56-rc1 Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: give message and set need_fsck given broken node id Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> loop: remember whether sysfs_create_group() was done Leon Romanovsky <leonro(a)mellanox.com> RDMA/ucm: Mark UCM interface as BROKEN Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> PM / hibernate: Fix oops at snapshot_write() Theodore Ts'o <tytso(a)mit.edu> loop: add recursion validation to LOOP_CHANGE_FD Florian Westphal <fw(a)strlen.de> netfilter: x_tables: initialise match/target check parameter struct Eric Dumazet <edumazet(a)google.com> netfilter: nf_queue: augment nfqa_cfg_policy Oleg Nesterov <oleg(a)redhat.com> uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn() Eric Biggers <ebiggers(a)google.com> crypto: x86/salsa20 - remove x86 salsa20 implementations Keith Busch <keith.busch(a)intel.com> nvme-pci: Remap CMB SQ entries on every controller reset Juergen Gross <jgross(a)suse.com> xen: setup pv irq ops vector earlier Steve Wise <swise(a)opengridcomputing.com> iw_cxgb4: correctly enforce the max reg_mr depth Jon Hunter <jonathanh(a)nvidia.com> i2c: tegra: Fix NACK error handling Michael J. Ruhl <michael.j.ruhl(a)intel.com> IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return values Paul Menzel <pmenzel(a)molgen.mpg.de> tools build: fix # escaping in .cmd files for future Make Yandong Zhao <yandong77520(a)gmail.com> arm64: neon: Fix function may_use_simd() return error status Randy Dunlap <rdunlap(a)infradead.org> kbuild: delete INSTALL_FW_PATH from kbuild documentation Joel Fernandes (Google) <joel(a)joelfernandes.org> tracing: Reorder display of TGID to be after PID Michal Hocko <mhocko(a)suse.com> mm: do not bug_on on incorrect length in __mm_populate() Oscar Salvador <osalvador(a)suse.de> fs, elf: make sure to page align bss in load_elf_library Vlastimil Babka <vbabka(a)suse.cz> fs/proc/task_mmu.c: fix Locked field in /proc/pid/smaps* Christian Borntraeger <borntraeger(a)de.ibm.com> mm: do not drop unused pages when userfaultd is running Chris Wilson <chris(a)chris-wilson.co.uk> ALSA: hda - Handle pm failure during hotplug Hui Wang <hui.wang(a)canonical.com> ALSA: hda/realtek - two more lenovo models need fixup of MIC_LOCATION Ming Lei <ming.lei(a)redhat.com> scsi: megaraid_sas: fix selection of reply queue Shivasharan S <shivasharan.srikanteshwara(a)broadcom.com> scsi: megaraid_sas: Create separate functions to allocate ctrl memory Shivasharan S <shivasharan.srikanteshwara(a)broadcom.com> scsi: megaraid_sas: replace is_ventura with adapter_type checks Shivasharan S <shivasharan.srikanteshwara(a)broadcom.com> scsi: megaraid_sas: replace instance->ctrl_context checks with instance->adapter_type Shivasharan S <shivasharan.srikanteshwara(a)broadcom.com> scsi: megaraid_sas: use adapter_type for all gen controllers Christoph Hellwig <hch(a)lst.de> genirq/affinity: assign vectors to all possible CPUs Linus Torvalds <torvalds(a)linux-foundation.org> Fix up non-directory creation in SGID directories Christian Brauner <christian.brauner(a)ubuntu.com> devpts: resolve devpts bind-mounts Christian Brauner <christian.brauner(a)ubuntu.com> devpts: hoist out check for DEVPTS_SUPER_MAGIC Dan Carpenter <dan.carpenter(a)oracle.com> xhci: xhci-mem: off by one in xhci_stream_id_to_ring() Nico Sneck <snecknico(a)gmail.com> usb: quirks: add delay quirks for Corsair Strafe Johan Hovold <johan(a)kernel.org> USB: serial: mos7840: fix status-register error handling Jann Horn <jannh(a)google.com> USB: yurex: fix out-of-bounds uaccess in read handler Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix modem-status error handling Olli Salonen <olli.salonen(a)iki.fi> USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick Dan Carpenter <dan.carpenter(a)oracle.com> USB: serial: ch341: fix type promotion bug in ch341_control_in() Hans de Goede <hdegoede(a)redhat.com> ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS Nadav Amit <namit(a)vmware.com> vmw_balloon: fix inflation with batching Damien Le Moal <damien.lemoal(a)wdc.com> ata: Fix ZBC_OUT all bit handling Damien Le Moal <damien.lemoal(a)wdc.com> ata: Fix ZBC_OUT command block check Ping-Ke Shih <pkshih(a)realtek.com> staging: r8822be: Fix RTL8822be can't find any wireless AP Murray McAllister <murray.mcallister(a)insomniasec.com> staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data(). Jann Horn <jannh(a)google.com> ibmasm: don't write out of bounds in read handler x00270170 <xiaqing17(a)hisilicon.com> mmc: dw_mmc: fix card threshold control configuration Stefan Agner <stefan(a)agner.ch> mmc: sdhci-esdhc-imx: allow 1.8V modes without 100/200MHz pinctrl states Paul Burton <paul.burton(a)mips.com> MIPS: Fix ioremap() RAM check Paul Burton <paul.burton(a)mips.com> MIPS: Use async IPIs for arch_trigger_cpumask_backtrace() Paul Burton <paul.burton(a)mips.com> MIPS: Call dump_stack() from show_regs() Kai Chieh Chuang <kaichieh.chuang(a)mediatek.com> ASoC: mediatek: preallocate pages use platform device Sean Young <sean(a)mess.org> media: rc: mce_kbd decoder: fix stuck keys ------------- Diffstat: Documentation/kbuild/kbuild.txt | 9 - Makefile | 4 +- arch/arm64/include/asm/simd.h | 19 +- arch/mips/kernel/process.c | 43 +- arch/mips/kernel/traps.c | 1 + arch/mips/mm/ioremap.c | 37 +- arch/x86/crypto/Makefile | 4 - arch/x86/crypto/salsa20-i586-asm_32.S | 1114 -------------------- arch/x86/crypto/salsa20-x86_64-asm_64.S | 919 ---------------- arch/x86/crypto/salsa20_glue.c | 116 -- arch/x86/kernel/uprobes.c | 2 +- arch/x86/xen/enlighten_pv.c | 24 +- arch/x86/xen/irq.c | 4 +- crypto/Kconfig | 26 - drivers/ata/ahci.c | 59 ++ drivers/ata/libata-core.c | 3 + drivers/ata/libata-scsi.c | 18 +- drivers/block/loop.c | 79 +- drivers/block/loop.h | 1 + drivers/i2c/busses/i2c-tegra.c | 17 +- drivers/infiniband/Kconfig | 12 + drivers/infiniband/core/Makefile | 4 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/hfi1/rc.c | 2 +- drivers/infiniband/hw/hfi1/uc.c | 4 +- drivers/infiniband/hw/hfi1/ud.c | 4 +- drivers/infiniband/hw/hfi1/verbs_txreq.c | 4 +- drivers/infiniband/hw/hfi1/verbs_txreq.h | 4 +- drivers/media/rc/ir-mce_kbd-decoder.c | 2 + drivers/misc/ibmasm/ibmasmfs.c | 27 +- drivers/misc/vmw_balloon.c | 4 +- drivers/mmc/host/dw_mmc.c | 7 +- drivers/mmc/host/sdhci-esdhc-imx.c | 21 +- drivers/nvme/host/pci.c | 27 +- drivers/scsi/megaraid/megaraid_sas.h | 10 +- drivers/scsi/megaraid/megaraid_sas_base.c | 296 ++++-- drivers/scsi/megaraid/megaraid_sas_fp.c | 20 +- drivers/scsi/megaraid/megaraid_sas_fusion.c | 54 +- drivers/scsi/megaraid/megaraid_sas_fusion.h | 7 - drivers/staging/rtl8723bs/core/rtw_ap.c | 2 +- drivers/staging/rtlwifi/rtl8822be/hw.c | 2 +- drivers/staging/rtlwifi/wifi.h | 1 + drivers/usb/core/quirks.c | 4 + drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/misc/yurex.c | 23 +- drivers/usb/serial/ch341.c | 2 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/keyspan_pda.c | 4 +- drivers/usb/serial/mos7840.c | 3 + fs/binfmt_elf.c | 5 +- fs/devpts/inode.c | 48 +- fs/f2fs/f2fs.h | 13 +- fs/f2fs/inode.c | 13 +- fs/f2fs/node.c | 21 +- fs/inode.c | 6 + fs/proc/task_mmu.c | 2 +- include/linux/libata.h | 1 + kernel/irq/affinity.c | 30 +- kernel/power/user.c | 5 + kernel/trace/trace.c | 8 +- kernel/trace/trace_output.c | 5 +- mm/gup.c | 2 - mm/mmap.c | 29 +- mm/rmap.c | 8 +- net/bridge/netfilter/ebtables.c | 2 + net/ipv4/netfilter/ip_tables.c | 1 + net/ipv6/netfilter/ip6_tables.c | 1 + net/netfilter/nfnetlink_queue.c | 3 + sound/pci/hda/patch_hdmi.c | 19 +- sound/pci/hda/patch_realtek.c | 6 +- .../soc/mediatek/common/mtk-afe-platform-driver.c | 4 +- tools/build/Build.include | 4 +- 72 files changed, 665 insertions(+), 2625 deletions(-)

7 years, 3 months

3
56
0 0

[PATCH] x86/efi: Access EFI MMIO data as unencrypted when SEV is active

by Brijesh Singh

SEV guest fails to update the UEFI runtime variables stored in the flash. commit 1379edd59673 ("x86/efi: Access EFI data as encrypted when SEV is active") unconditionally maps all the UEFI runtime data as 'encrypted' (C=1). When SEV is active the UEFI runtime data marked as EFI_MEMORY_MAPPED_IO should be mapped as 'unencrypted' so that both guest and hypervisor can access the data. Fixes: 1379edd59673 (x86/efi: Access EFI data as encrypted ...) Cc: Tom Lendacky <thomas.lendacky(a)amd.com> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Borislav Petkov <bp(a)suse.de> Cc: linux-efi(a)vger.kernel.org Cc: kvm(a)vger.kernel.org Cc: Ard Biesheuvel <ard.biesheuvel(a)linaro.org> Cc: Matt Fleming <matt(a)codeblueprint.co.uk> Cc: Andy Lutomirski <luto(a)kernel.org> Cc: <stable(a)vger.kernel.org> # 4.15.x Signed-off-by: Brijesh Singh <brijesh.singh(a)amd.com> --- arch/x86/platform/efi/efi_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index 77873ce..5f2eb32 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -417,7 +417,7 @@ static void __init __map_region(efi_memory_desc_t *md, u64 va) if (!(md->attribute & EFI_MEMORY_WB)) flags |= _PAGE_PCD; - if (sev_active()) + if (sev_active() && md->type != EFI_MEMORY_MAPPED_IO) flags |= _PAGE_ENC; pfn = md->phys_addr >> PAGE_SHIFT; -- 2.7.4

7 years, 3 months

3
5
0 0

[PATCH] x86/pci: Some buggy virtual functions incorrectly report 1 for intx.

by Ashok Raj

PCI_INTERRUPT_PIN should always read 0 for SRIOV Virtual Functions. Some SRIOV devices have some bugs in RTL and VF's end up reading 1 instead of 0 for the PIN. We could enforce it by default in vfio_pci_nointx. Reported-by: Gage Eads <gage.eads(a)intel.com> Tested-by: Gage Eads <gage.eads(a)intel.com> Signed-off-by: Ashok Raj <ashok.raj(a)intel.com> Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org Cc: iommu(a)lists.linux-foundation.org Cc: Joerg Roedel <joro(a)8bytes.org> Cc: Bjorn Helgaas <helgaas(a)kernel.org> Cc: Gage Eads <gage.eads(a)intel.com> --- drivers/vfio/pci/vfio_pci.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index b423a30..bc3f4fa 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -192,6 +192,13 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev); */ static bool vfio_pci_nointx(struct pci_dev *pdev) { + /* + * Per PCI, no VF's should have INTx + * Simply disable it here + */ + if (pdev->is_virtfn) + return true; + switch (pdev->vendor) { case PCI_VENDOR_ID_INTEL: switch (pdev->device) { -- 2.7.4

7 years, 3 months

3
2
0 0

[PATCH] net: lan78xx: Fix race in tx pending skb size calculation

by Stefan Wahren

The skb size calculation in lan78xx_tx_bh is in race with the start_xmit, which could lead to rare kernel oopses. So protect the whole skb walk with a spin lock. As a benefit we can unlink the skb directly. This patch was tested on Raspberry Pi 3B+ Link: https://github.com/raspberrypi/linux/issues/2608 Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Floris Bos <bos(a)je-eigen-domein.nl> Signed-off-by: Stefan Wahren <stefan.wahren(a)i2se.com> --- drivers/net/usb/lan78xx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c index 2e41307..ed10d49 100644 --- a/drivers/net/usb/lan78xx.c +++ b/drivers/net/usb/lan78xx.c @@ -3344,6 +3344,7 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev) pkt_cnt = 0; count = 0; length = 0; + spin_lock_irqsave(&tqp->lock, flags); for (skb = tqp->next; pkt_cnt < tqp->qlen; skb = skb->next) { if (skb_is_gso(skb)) { if (pkt_cnt) { @@ -3352,7 +3353,8 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev) } count = 1; length = skb->len - TX_OVERHEAD; - skb2 = skb_dequeue(tqp); + __skb_unlink(skb, tqp); + spin_unlock_irqrestore(&tqp->lock, flags); goto gso_skb; } @@ -3361,6 +3363,7 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev) skb_totallen = skb->len + roundup(skb_totallen, sizeof(u32)); pkt_cnt++; } + spin_unlock_irqrestore(&tqp->lock, flags); /* copy to a single skb */ skb = alloc_skb(skb_totallen, GFP_ATOMIC); -- 2.7.4

7 years, 3 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror