- Linux-stable-mirror - lists.linaro.org

[PATCH] MIPS: CPU_LOONGSON2EF need software to maintain cache consistency

by Lichao Liu

CPU_LOONGSON2EF need software to maintain cache consistency, so modify the 'cpu_needs_post_dma_flush' function to return true when the cpu type is CPU_LOONGSON2EF. Cc: stable(a)vger.kernel.org Signed-off-by: Lichao Liu <liulichao(a)loongson.cn> --- arch/mips/mm/dma-noncoherent.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/mips/mm/dma-noncoherent.c b/arch/mips/mm/dma-noncoherent.c index fcea92d95d86..563c2c0d0c81 100644 --- a/arch/mips/mm/dma-noncoherent.c +++ b/arch/mips/mm/dma-noncoherent.c @@ -33,6 +33,7 @@ static inline bool cpu_needs_post_dma_flush(void) case CPU_R10000: case CPU_R12000: case CPU_BMIPS5000: + case CPU_LOONGSON2EF: return true; default: /* -- 2.17.1

5 years, 7 months

3
2
0 0

patch "staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK" added to staging-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 15ea976a1f12b5fd76b1bd6ff3eb5132fd28047f Mon Sep 17 00:00:00 2001 From: Pascal Terjan <pterjan(a)google.com> Date: Sat, 23 May 2020 22:12:47 +0100 Subject: staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK The value in shared headers was fixed 9 years ago in commit 8d661f1e462d ("ieee80211: correct IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK macro") and while looking at using shared headers for other duplicated constants I noticed this driver uses the old value. The macros are also defined twice in this file so I am deleting the second definition. Signed-off-by: Pascal Terjan <pterjan(a)google.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20200523211247.23262-1-pterjan@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/rtl8712/wifi.h | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/staging/rtl8712/wifi.h b/drivers/staging/rtl8712/wifi.h index be731f1a2209..91b65731fcaa 100644 --- a/drivers/staging/rtl8712/wifi.h +++ b/drivers/staging/rtl8712/wifi.h @@ -440,7 +440,7 @@ static inline unsigned char *get_hdr_bssid(unsigned char *pframe) /* block-ack parameters */ #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0 +#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800 @@ -532,13 +532,6 @@ struct ieee80211_ht_addt_info { #define IEEE80211_HT_IE_NON_GF_STA_PRSNT 0x0004 #define IEEE80211_HT_IE_NON_HT_STA_PRSNT 0x0010 -/* block-ack parameters */ -#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002 -#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0 -#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000 -#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800 - /* * A-PMDU buffer sizes * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2) -- 2.26.2

5 years, 7 months

1
0
0 0

patch "vt: keyboard: avoid signed integer overflow in k_ascii" added to tty-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled vt: keyboard: avoid signed integer overflow in k_ascii to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From b86dab054059b970111b5516ae548efaae5b3aae Mon Sep 17 00:00:00 2001 From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Date: Mon, 25 May 2020 16:27:40 -0700 Subject: vt: keyboard: avoid signed integer overflow in k_ascii When k_ascii is invoked several times in a row there is a potential for signed integer overflow: UBSAN: Undefined behaviour in drivers/tty/vt/keyboard.c:888:19 signed integer overflow: 10 * 1111111111 cannot be represented in type 'int' CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.11 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 ubsan_epilogue+0xe/0x30 lib/ubsan.c:154 handle_overflow+0xdc/0xf0 lib/ubsan.c:184 __ubsan_handle_mul_overflow+0x2a/0x40 lib/ubsan.c:205 k_ascii+0xbf/0xd0 drivers/tty/vt/keyboard.c:888 kbd_keycode drivers/tty/vt/keyboard.c:1477 [inline] kbd_event+0x888/0x3be0 drivers/tty/vt/keyboard.c:1495 While it can be worked around by using check_mul_overflow()/ check_add_overflow(), it is better to introduce a separate flag to signal that number pad is being used to compose a symbol, and change type of the accumulator from signed to unsigned, thus avoiding undefined behavior when it overflows. Reported-by: Kyungtae Kim <kt0755(a)gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Cc: stable <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20200525232740.GA262061@dtor-ws Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/vt/keyboard.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 15d33fa0c925..568b2171f335 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -127,7 +127,11 @@ static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf' and friends */ static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */ static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */ static bool dead_key_next; -static int npadch = -1; /* -1 or number assembled on pad */ + +/* Handles a number being assembled on the number pad */ +static bool npadch_active; +static unsigned int npadch_value; + static unsigned int diacr; static char rep; /* flag telling character repeat */ @@ -845,12 +849,12 @@ static void k_shift(struct vc_data *vc, unsigned char value, char up_flag) shift_state &= ~(1 << value); /* kludge */ - if (up_flag && shift_state != old_state && npadch != -1) { + if (up_flag && shift_state != old_state && npadch_active) { if (kbd->kbdmode == VC_UNICODE) - to_utf8(vc, npadch); + to_utf8(vc, npadch_value); else - put_queue(vc, npadch & 0xff); - npadch = -1; + put_queue(vc, npadch_value & 0xff); + npadch_active = false; } } @@ -868,7 +872,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag) static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag) { - int base; + unsigned int base; if (up_flag) return; @@ -882,10 +886,12 @@ static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag) base = 16; } - if (npadch == -1) - npadch = value; - else - npadch = npadch * base + value; + if (!npadch_active) { + npadch_value = 0; + npadch_active = true; + } + + npadch_value = npadch_value * base + value; } static void k_lock(struct vc_data *vc, unsigned char value, char up_flag) -- 2.26.2

5 years, 7 months

1
0
0 0

patch "tty: hvc_console, fix crashes on parallel open/close" added to tty-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled tty: hvc_console, fix crashes on parallel open/close to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 24eb2377f977fe06d84fca558f891f95bc28a449 Mon Sep 17 00:00:00 2001 From: Jiri Slaby <jslaby(a)suse.cz> Date: Tue, 26 May 2020 16:56:32 +0200 Subject: tty: hvc_console, fix crashes on parallel open/close hvc_open sets tty->driver_data to NULL when open fails at some point. Typically, the failure happens in hp->ops->notifier_add(). If there is a racing process which tries to open such mangled tty, which was not closed yet, the process will crash in hvc_open as tty->driver_data is NULL. All this happens because close wants to know whether open failed or not. But ->open should not NULL this and other tty fields for ->close to be happy. ->open should call tty_port_set_initialized(true) and close should check by tty_port_initialized() instead. So do this properly in this driver. So this patch removes these from ->open: * tty_port_tty_set(&hp->port, NULL). This happens on last close. * tty->driver_data = NULL. Dtto. * tty_port_put(&hp->port). This happens in shutdown and until now, this must have been causing a reference underflow, if I am not missing something. Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Cc: stable <stable(a)vger.kernel.org> Reported-and-tested-by: Raghavendra <rananta(a)codeaurora.org> Link: https://lore.kernel.org/r/20200526145632.13879-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/hvc/hvc_console.c | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-) diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c index 436cc51c92c3..cdcc64ea2554 100644 --- a/drivers/tty/hvc/hvc_console.c +++ b/drivers/tty/hvc/hvc_console.c @@ -371,15 +371,14 @@ static int hvc_open(struct tty_struct *tty, struct file * filp) * tty fields and return the kref reference. */ if (rc) { - tty_port_tty_set(&hp->port, NULL); - tty->driver_data = NULL; - tty_port_put(&hp->port); printk(KERN_ERR "hvc_open: request_irq failed with rc %d.\n", rc); - } else + } else { /* We are ready... raise DTR/RTS */ if (C_BAUD(tty)) if (hp->ops->dtr_rts) hp->ops->dtr_rts(hp, 1); + tty_port_set_initialized(&hp->port, true); + } /* Force wakeup of the polling thread */ hvc_kick(); @@ -389,22 +388,12 @@ static int hvc_open(struct tty_struct *tty, struct file * filp) static void hvc_close(struct tty_struct *tty, struct file * filp) { - struct hvc_struct *hp; + struct hvc_struct *hp = tty->driver_data; unsigned long flags; if (tty_hung_up_p(filp)) return; - /* - * No driver_data means that this close was issued after a failed - * hvc_open by the tty layer's release_dev() function and we can just - * exit cleanly because the kref reference wasn't made. - */ - if (!tty->driver_data) - return; - - hp = tty->driver_data; - spin_lock_irqsave(&hp->port.lock, flags); if (--hp->port.count == 0) { @@ -412,6 +401,9 @@ static void hvc_close(struct tty_struct *tty, struct file * filp) /* We are done with the tty pointer now. */ tty_port_tty_set(&hp->port, NULL); + if (!tty_port_initialized(&hp->port)) + return; + if (C_HUPCL(tty)) if (hp->ops->dtr_rts) hp->ops->dtr_rts(hp, 0); @@ -428,6 +420,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp) * waking periodically to check chars_in_buffer(). */ tty_wait_until_sent(tty, HVC_CLOSE_WAIT); + tty_port_set_initialized(&hp->port, false); } else { if (hp->port.count < 0) printk(KERN_ERR "hvc_close %X: oops, count is %d\n", -- 2.26.2

5 years, 7 months

1
0
0 0

patch "serial: 8250: Enable 16550A variants by default on non-x86" added to tty-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled serial: 8250: Enable 16550A variants by default on non-x86 to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 15a3f03d5ec0118f1e5db3fc1018686e72744e37 Mon Sep 17 00:00:00 2001 From: Josh Triplett <josh(a)joshtriplett.org> Date: Tue, 26 May 2020 09:13:57 -0700 Subject: serial: 8250: Enable 16550A variants by default on non-x86 Some embedded devices still use these serial ports; make sure they're still enabled by default on architectures more likely to have them, to avoid rendering someone's console unavailable. Reported-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Reported-by: Maxim Kochetkov <fido_max(a)inbox.ru> Fixes: dc56ecb81a0a ("serial: 8250: Support disabling mdelay-filled probes of 16550A variants") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Josh Triplett <josh(a)joshtriplett.org> Link: https://lore.kernel.org/r/a20b5fb7dd295cfb48160eecf4bdebd76332d67d.15905094… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/8250/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig index af0688156dd0..8195a31519ea 100644 --- a/drivers/tty/serial/8250/Kconfig +++ b/drivers/tty/serial/8250/Kconfig @@ -63,6 +63,7 @@ config SERIAL_8250_PNP config SERIAL_8250_16550A_VARIANTS bool "Support for variants of the 16550A serial port" depends on SERIAL_8250 + default !X86 help The 8250 driver can probe for many variants of the venerable 16550A serial port. Doing so takes additional time at boot. -- 2.26.2

5 years, 7 months

1
0
0 0

[patch 3/5] mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()

by Andrew Morton

From: Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru> Subject: mm: remove VM_BUG_ON(PageSlab()) from page_mapcount() Replace superfluous VM_BUG_ON() with comment about correct usage. Technically reverts commit 1d148e218a0d0566b1c06f2f45f1436d53b049b2 ("mm: add VM_BUG_ON_PAGE() to page_mapcount()"), but context have changed. Function isolate_migratepages_block() runs some checks out of lru_lock when choose pages for migration. After checking PageLRU() it checks extra page references by comparing page_count() and page_mapcount(). Between these two checks page could be removed from lru, freed and taken by slab. As a result this race triggers VM_BUG_ON(PageSlab()) in page_mapcount(). Race window is tiny. For certain workload this happens around once a year. page:ffffea0105ca9380 count:1 mapcount:0 mapping:ffff88ff7712c180 index:0x0 compound_mapcount: 0 flags: 0x500000000008100(slab|head) raw: 0500000000008100 dead000000000100 dead000000000200 ffff88ff7712c180 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(PageSlab(page)) ------------[ cut here ]------------ kernel BUG at ./include/linux/mm.h:628! invalid opcode: 0000 [#1] SMP NOPTI CPU: 77 PID: 504 Comm: kcompactd1 Tainted: G W 4.19.109-27 #1 Hardware name: Yandex T175-N41-Y3N/MY81-EX0-Y3N, BIOS R05 06/20/2019 RIP: 0010:isolate_migratepages_block+0x986/0x9b0 Code in isolate_migratepages_block() was added in commit 119d6d59dcc0 ("mm, compaction: avoid isolating pinned pages") before adding VM_BUG_ON into page_mapcount(). This race has been predicted in 2015 by Vlastimil Babka (see link below). [akpm(a)linux-foundation.org: comment tweaks, per Hugh] Link: http://lkml.kernel.org/r/159032779896.957378.7852761411265662220.stgit@buzz Link: https://lore.kernel.org/lkml/557710E1.6060103@suse.cz/ Link: https://lore.kernel.org/linux-mm/158937872515.474360.5066096871639561424.st… (v1) Fixes: 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to page_mapcount()") Signed-off-by: Konstantin Khlebnikov <khlebnikov(a)yandex-team.ru> Acked-by: Hugh Dickins <hughd(a)google.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: David Rientjes <rientjes(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mm.h | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) --- a/include/linux/mm.h~mm-remove-vm_bug_onpageslab-from-page_mapcount +++ a/include/linux/mm.h @@ -782,6 +782,11 @@ static inline void *kvcalloc(size_t n, s extern void kvfree(const void *addr); +/* + * Mapcount of compound page as a whole, does not include mapped sub-pages. + * + * Must be called only for compound pages or any their tail sub-pages. + */ static inline int compound_mapcount(struct page *page) { VM_BUG_ON_PAGE(!PageCompound(page), page); @@ -801,10 +806,16 @@ static inline void page_mapcount_reset(s int __page_mapcount(struct page *page); +/* + * Mapcount of 0-order page; when compound sub-page, includes + * compound_mapcount(). + * + * Result is undefined for pages which cannot be mapped into userspace. + * For example SLAB or special types of pages. See function page_has_type(). + * They use this place in struct page differently. + */ static inline int page_mapcount(struct page *page) { - VM_BUG_ON_PAGE(PageSlab(page), page); - if (unlikely(PageCompound(page))) return __page_mapcount(page); return atomic_read(&page->_mapcount) + 1; _

5 years, 7 months

1
0
0 0

[patch 2/5] mm,thp: stop leaking unreleased file pages

by Andrew Morton

From: Hugh Dickins <hughd(a)google.com> Subject: mm,thp: stop leaking unreleased file pages When collapse_file() calls try_to_release_page(), it has already isolated the page: so if releasing buffers happens to fail (as it sometimes does), remember to putback_lru_page(): otherwise that page is left unreclaimable and unfreeable, and the file extent uncollapsible. Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2005231837500.1766@eggly.anvils Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS") Signed-off-by: Hugh Dickins <hughd(a)google.com> Acked-by: Song Liu <songliubraving(a)fb.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Rik van Riel <riel(a)surriel.com> Cc: <stable(a)vger.kernel.org> [5.4+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/khugepaged.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/khugepaged.c~mmthp-stop-leaking-unreleased-file-pages +++ a/mm/khugepaged.c @@ -1692,6 +1692,7 @@ static void collapse_file(struct mm_stru if (page_has_private(page) && !try_to_release_page(page, GFP_KERNEL)) { result = SCAN_PAGE_HAS_PRIVATE; + putback_lru_page(page); goto out_unlock; } _

5 years, 7 months

1
0
0 0

+ relay-handle-alloc_percpu-returning-null-in-relay_open.patch added to -mm tree

by Andrew Morton

The patch titled Subject: kernel/relay.c: handle alloc_percpu returning NULL in relay_open has been added to the -mm tree. Its filename is relay-handle-alloc_percpu-returning-null-in-relay_open.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/relay-handle-alloc_percpu-returnin… and later at http://ozlabs.org/~akpm/mmotm/broken-out/relay-handle-alloc_percpu-returnin… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Daniel Axtens <dja(a)axtens.net> Subject: kernel/relay.c: handle alloc_percpu returning NULL in relay_open alloc_percpu() may return NULL, which means chan->buf may be set to NULL. In that case, when we do *per_cpu_ptr(chan->buf, ...), we dereference an invalid pointer: BUG: Unable to handle kernel data access at 0x7dae0000 Faulting instruction address: 0xc0000000003f3fec ... NIP [c0000000003f3fec] relay_open+0x29c/0x600 LR [c0000000003f3fc0] relay_open+0x270/0x600 Call Trace: [c000000054353a70] [c0000000003f3fb4] relay_open+0x264/0x600 (unreliable) [c000000054353b00] [c000000000451764] __blk_trace_setup+0x254/0x600 [c000000054353bb0] [c000000000451b78] blk_trace_setup+0x68/0xa0 [c000000054353c10] [c0000000010da77c] sg_ioctl+0x7bc/0x2e80 [c000000054353cd0] [c000000000758cbc] do_vfs_ioctl+0x13c/0x1300 [c000000054353d90] [c000000000759f14] ksys_ioctl+0x94/0x130 [c000000054353de0] [c000000000759ff8] sys_ioctl+0x48/0xb0 [c000000054353e20] [c00000000000bcd0] system_call+0x5c/0x68 Check if alloc_percpu returns NULL. This was found by syzkaller both on x86 and powerpc, and the reproducer it found on powerpc is capable of hitting the issue as an unprivileged user. Link: http://lkml.kernel.org/r/20191219121256.26480-1-dja@axtens.net Fixes: 017c59c042d0 ("relay: Use per CPU constructs for the relay channel buffer pointers") Signed-off-by: Daniel Axtens <dja(a)axtens.net> Reviewed-by: Michael Ellerman <mpe(a)ellerman.id.au> Reviewed-by: Andrew Donnellan <ajd(a)linux.ibm.com> Acked-by: David Rientjes <rientjes(a)google.com> Reported-by: syzbot+1e925b4b836afe85a1c6(a)syzkaller-ppc64.appspotmail.com Reported-by: syzbot+587b2421926808309d21(a)syzkaller-ppc64.appspotmail.com Reported-by: syzbot+58320b7171734bf79d26(a)syzkaller.appspotmail.com Reported-by: syzbot+d6074fb08bdb2e010520(a)syzkaller.appspotmail.com Cc: Akash Goel <akash.goel(a)intel.com> Cc: Andrew Donnellan <ajd(a)linux.ibm.com> Cc: Guenter Roeck <linux(a)roeck-us.net> Cc: Salvatore Bonaccorso <carnil(a)debian.org> Cc: <stable(a)vger.kernel.org> [4.10+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/relay.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/kernel/relay.c~relay-handle-alloc_percpu-returning-null-in-relay_open +++ a/kernel/relay.c @@ -581,6 +581,11 @@ struct rchan *relay_open(const char *bas return NULL; chan->buf = alloc_percpu(struct rchan_buf *); + if (!chan->buf) { + kfree(chan); + return NULL; + } + chan->version = RELAYFS_CHANNEL_VERSION; chan->n_subbufs = n_subbufs; chan->subbuf_size = subbuf_size; _ Patches currently in -mm which might be from dja(a)axtens.net are kasan-stop-tests-being-eliminated-as-dead-code-with-fortify_source.patch kasan-stop-tests-being-eliminated-as-dead-code-with-fortify_source-v4.patch stringh-fix-incompatibility-between-fortify_source-and-kasan.patch relay-handle-alloc_percpu-returning-null-in-relay_open.patch

5 years, 7 months

1
0
0 0

[PATCH 4.19 00/54] 4.19.115-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.115 release. There are 54 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 13 Apr 2020 11:51:28 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.115-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.115-rc1 Hans Verkuil <hans.verkuil(a)cisco.com> drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read() Roger Quadros <rogerq(a)ti.com> usb: dwc3: don't set gadget->is_otg flag Chris Lew <clew(a)codeaurora.org> rpmsg: glink: Remove chunk size word align warning Arun KS <arunks(a)codeaurora.org> arm64: Fix size of __early_cpu_boot_status Rob Clark <robdclark(a)chromium.org> drm/msm: stop abusing dma_map/unmap for cache Taniya Das <tdas(a)codeaurora.org> clk: qcom: rcg: Return failure for RCG update Qiujun Huang <hqjagain(a)gmail.com> fbcon: fix null-ptr-deref in fbcon_switch Avihai Horon <avihaih(a)mellanox.com> RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow Qiujun Huang <hqjagain(a)gmail.com> Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/cma: Teach lockdep about the order of rtnl and lock Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ucma: Put a lock around every call to the rdma_cm layer Ilya Dryomov <idryomov(a)gmail.com> ceph: canonicalize server path in place Xiubo Li <xiubli(a)redhat.com> ceph: remove the extra slashes in the server path Kaike Wan <kaike.wan(a)intel.com> IB/hfi1: Fix memory leaks in sysfs registration and unregistration Kaike Wan <kaike.wan(a)intel.com> IB/hfi1: Call kobject_put() when kobject_init_and_add() fails Paul Cercueil <paul(a)crapouillou.net> ASoC: jz4740-i2s: Fix divider written at incorrect offset in register Martin Kaiser <martin(a)kaiser.cx> hwrng: imx-rngc - fix an error path David Ahern <dsahern(a)kernel.org> tools/accounting/getdelays.c: fix netlink attribute length Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Wrap around when skip TRBs Jason A. Donenfeld <Jason(a)zx2c4.com> random: always use batched entropy for get_random_u{32,64} Petr Machata <petrm(a)mellanox.com> mlxsw: spectrum_flower: Do not stop at FLOW_ACTION_VLAN_MANGLE Richard Palethorpe <rpalethorpe(a)suse.com> slcan: Don't transmit uninitialized stack data in padding Jisheng Zhang <Jisheng.Zhang(a)synaptics.com> net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting Oleksij Rempel <o.rempel(a)pengutronix.de> net: phy: micrel: kszphy_resume(): add delay after genphy_resume() before accessing PHY registers Florian Fainelli <f.fainelli(a)gmail.com> net: dsa: bcm_sf2: Ensure correct sub-node is parsed Florian Fainelli <f.fainelli(a)gmail.com> net: dsa: bcm_sf2: Do not register slave MDIO bus with OF Jarod Wilson <jarod(a)redhat.com> ipv6: don't auto-add link-local address to lag ports Randy Dunlap <rdunlap(a)infradead.org> mm: mempolicy: require at least one nodeid for MPOL_PREFERRED Sam Protsenko <semen.protsenko(a)linaro.org> include/linux/notifier.h: SRCU: fix ctags Miklos Szeredi <mszeredi(a)redhat.com> bitops: protect variables in set_mask_bits() macro Daniel Jordan <daniel.m.jordan(a)oracle.com> padata: always acquire cpu_hotplug_lock before pinst->lock Amritha Nambiar <amritha.nambiar(a)intel.com> net: Fix Tx hash bound checking David Howells <dhowells(a)redhat.com> rxrpc: Fix sendmsg(MSG_WAITALL) handling Geoffrey Allott <geoffrey(a)allott.email> ALSA: hda/ca0132 - Add Recon3Di quirk to handle integrated sound on EVGA X99 Classified motherboard Hans de Goede <hdegoede(a)redhat.com> power: supply: axp288_charger: Add special handling for HP Pavilion x2 10 Hans de Goede <hdegoede(a)redhat.com> extcon: axp288: Add wakeup support Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: add cedar fork device ids Eugene Syromiatnikov <esyr(a)redhat.com> coresight: do not use the BIT() macro in the UAPI header Kishon Vijay Abraham I <kishon(a)ti.com> misc: pci_endpoint_test: Avoid using module parameter to determine irqtype Kishon Vijay Abraham I <kishon(a)ti.com> misc: pci_endpoint_test: Fix to support > 10 pci-endpoint-test devices YueHaibing <yuehaibing(a)huawei.com> misc: rtsx: set correct pcr_ops for rts522A Sean Young <sean(a)mess.org> media: rc: IR signal for Panasonic air conditioner too long Lucas Stach <l.stach(a)pengutronix.de> drm/etnaviv: replace MMU flush marker with flush sequence Len Brown <len.brown(a)intel.com> tools/power turbostat: Fix missing SYS_LPI counter on some Chromebooks Len Brown <len.brown(a)intel.com> tools/power turbostat: Fix gcc build warnings James Zhu <James.Zhu(a)amd.com> drm/amdgpu: fix typo for vcn1 idle check Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com> initramfs: restore default compression behavior Gerd Hoffmann <kraxel(a)redhat.com> drm/bochs: downgrade pci_request_region failure from error to warning Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017 Prabhath Sajeepa <psajeepa(a)purestorage.com> nvme-rdma: Avoid double freeing of async event data Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> sctp: fix possibly using a bad saddr with a given dst Qiujun Huang <hqjagain(a)gmail.com> sctp: fix refcount bug in sctp_wfree William Dauchy <w.dauchy(a)criteo.com> net, ip_tunnel: fix interface lookup with no key Qian Cai <cai(a)lca.pw> ipv4: fix a RCU-list lock in fib_triestat_seq_show ------------- Diffstat: Makefile | 4 +- arch/arm64/kernel/head.S | 2 +- drivers/char/hw_random/imx-rngc.c | 4 +- drivers/char/random.c | 20 ++------ drivers/clk/qcom/clk-rcg2.c | 2 +- drivers/extcon/extcon-axp288.c | 32 ++++++++++++ drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 11 +++++ drivers/gpu/drm/bochs/bochs_hw.c | 6 +-- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 10 ++-- drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 1 + drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 6 +-- drivers/gpu/drm/etnaviv/etnaviv_mmu.h | 2 +- drivers/gpu/drm/msm/msm_gem.c | 4 +- drivers/infiniband/core/cma.c | 14 ++++++ drivers/infiniband/core/ucma.c | 49 ++++++++++++++++++- drivers/infiniband/hw/hfi1/sysfs.c | 26 +++++++--- drivers/media/rc/lirc_dev.c | 2 +- drivers/misc/cardreader/rts5227.c | 1 + drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/misc/pci_endpoint_test.c | 14 ++++-- drivers/net/can/slcan.c | 4 +- drivers/net/dsa/bcm_sf2.c | 9 +++- .../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 8 +-- .../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 2 +- drivers/net/phy/micrel.c | 7 +++ drivers/nvme/host/rdma.c | 8 +-- drivers/power/supply/axp288_charger.c | 57 +++++++++++++++++++++- drivers/rpmsg/qcom_glink_native.c | 3 -- drivers/usb/dwc3/gadget.c | 3 +- drivers/video/fbdev/core/fbcon.c | 3 ++ fs/ceph/super.c | 56 +++++++++++++-------- fs/ceph/super.h | 2 +- include/linux/bitops.h | 14 +++--- include/linux/notifier.h | 3 +- include/uapi/linux/coresight-stm.h | 6 ++- kernel/padata.c | 4 +- mm/mempolicy.c | 6 ++- net/bluetooth/rfcomm/tty.c | 4 +- net/core/dev.c | 2 + net/ipv4/fib_trie.c | 3 ++ net/ipv4/ip_tunnel.c | 6 +-- net/ipv6/addrconf.c | 4 ++ net/rxrpc/sendmsg.c | 4 +- net/sctp/ipv6.c | 20 +++++--- net/sctp/protocol.c | 28 +++++++---- net/sctp/socket.c | 31 +++++++++--- sound/pci/hda/patch_ca0132.c | 1 + sound/soc/jz4740/jz4740-i2s.c | 2 +- tools/accounting/getdelays.c | 2 +- tools/power/x86/turbostat/turbostat.c | 27 +++++----- usr/Kconfig | 22 ++++----- 54 files changed, 409 insertions(+), 159 deletions(-)

5 years, 7 months

10
69
0 0

[PATCH] arm64: fix clang integrated assembler build

by Arnd Bergmann

clang and gas seem to interpret the symbols in memmove.S and memset.S differently, such that clang does not make them 'weak' as expected, which leads to a linker error, with both ld.bfd and ld.lld: ld.lld: error: duplicate symbol: memmove >>> defined at common.c >>> kasan/common.o:(memmove) in archive mm/built-in.a >>> defined at memmove.o:(__memmove) in archive arch/arm64/lib/lib.a ld.lld: error: duplicate symbol: memset >>> defined at common.c >>> kasan/common.o:(memset) in archive mm/built-in.a >>> defined at memset.o:(__memset) in archive arch/arm64/lib/lib.a Copy the exact way these are written in memcpy_64.S, which does not have the same problem. I don't know why this makes a difference, and it would be good to have someone with a better understanding of assembler internals review it. It might be either a bug in the kernel or a bug in the assembler, no idea which one. My patch makes it work with all versions of clang and gcc, which is probably helpful even if it's a workaround for a clang bug. Cc: stable(a)vger.kernel.org Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> --- --- arch/arm64/lib/memcpy.S | 3 +-- arch/arm64/lib/memmove.S | 3 +-- arch/arm64/lib/memset.S | 3 +-- 3 files changed, 3 insertions(+), 6 deletions(-) diff --git a/arch/arm64/lib/memcpy.S b/arch/arm64/lib/memcpy.S index e0bf83d556f2..dc8d2a216a6e 100644 --- a/arch/arm64/lib/memcpy.S +++ b/arch/arm64/lib/memcpy.S @@ -56,9 +56,8 @@ stp \reg1, \reg2, [\ptr], \val .endm - .weak memcpy SYM_FUNC_START_ALIAS(__memcpy) -SYM_FUNC_START_PI(memcpy) +SYM_FUNC_START_WEAK_PI(memcpy) #include "copy_template.S" ret SYM_FUNC_END_PI(memcpy) diff --git a/arch/arm64/lib/memmove.S b/arch/arm64/lib/memmove.S index 02cda2e33bde..1035dce4bdaf 100644 --- a/arch/arm64/lib/memmove.S +++ b/arch/arm64/lib/memmove.S @@ -45,9 +45,8 @@ C_h .req x12 D_l .req x13 D_h .req x14 - .weak memmove SYM_FUNC_START_ALIAS(__memmove) -SYM_FUNC_START_PI(memmove) +SYM_FUNC_START_WEAK_PI(memmove) cmp dstin, src b.lo __memcpy add tmp1, src, count diff --git a/arch/arm64/lib/memset.S b/arch/arm64/lib/memset.S index 77c3c7ba0084..a9c1c9a01ea9 100644 --- a/arch/arm64/lib/memset.S +++ b/arch/arm64/lib/memset.S @@ -42,9 +42,8 @@ dst .req x8 tmp3w .req w9 tmp3 .req x9 - .weak memset SYM_FUNC_START_ALIAS(__memset) -SYM_FUNC_START_PI(memset) +SYM_FUNC_START_WEAK_PI(memset) mov dst, dstin /* Preserve return value. */ and A_lw, val, #255 orr A_lw, A_lw, A_lw, lsl #8 -- 2.26.2

5 years, 7 months

3
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror