- Linux-stable-mirror - lists.linaro.org

[merged] mm-thp-handle-page-cache-thp-correctly-in-pagetranscompoundmap.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm: thp: handle page cache THP correctly in PageTransCompoundMap has been removed from the -mm tree. Its filename was mm-thp-handle-page-cache-thp-correctly-in-pagetranscompoundmap.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Yang Shi <yang.shi(a)linux.alibaba.com> Subject: mm: thp: handle page cache THP correctly in PageTransCompoundMap We have a usecase to use tmpfs as QEMU memory backend and we would like to take the advantage of THP as well. But, our test shows the EPT is not PMD mapped even though the underlying THP are PMD mapped on host. The number showed by /sys/kernel/debug/kvm/largepage is much less than the number of PMD mapped shmem pages as the below: 7f2778200000-7f2878200000 rw-s 00000000 00:14 262232 /dev/shm/qemu_back_mem.mem.Hz2hSf (deleted) Size: 4194304 kB [snip] AnonHugePages: 0 kB ShmemPmdMapped: 579584 kB [snip] Locked: 0 kB cat /sys/kernel/debug/kvm/largepages 12 And some benchmarks do worse than with anonymous THPs. By digging into the code we figured out that commit 127393fbe597 ("mm: thp: kvm: fix memory corruption in KVM with THP enabled") checks if there is a single PTE mapping on the page for anonymous THP when setting up EPT map. But, the _mapcount < 0 check doesn't fit to page cache THP since every subpage of page cache THP would get _mapcount inc'ed once it is PMD mapped, so PageTransCompoundMap() always returns false for page cache THP. This would prevent KVM from setting up PMD mapped EPT entry. So we need handle page cache THP correctly. However, when page cache THP's PMD gets split, kernel just remove the map instead of setting up PTE map like what anonymous THP does. Before KVM calls get_user_pages() the subpages may get PTE mapped even though it is still a THP since the page cache THP may be mapped by other processes at the mean time. Checking its _mapcount and whether the THP has PTE mapped or not. Although this may report some false negative cases (PTE mapped by other processes), it looks not trivial to make this accurate. With this fix /sys/kernel/debug/kvm/largepage would show reasonable pages are PMD mapped by EPT as the below: 7fbeaee00000-7fbfaee00000 rw-s 00000000 00:14 275464 /dev/shm/qemu_back_mem.mem.SKUvat (deleted) Size: 4194304 kB [snip] AnonHugePages: 0 kB ShmemPmdMapped: 557056 kB [snip] Locked: 0 kB cat /sys/kernel/debug/kvm/largepages 271 And the benchmarks are as same as anonymous THPs. [yang.shi(a)linux.alibaba.com: v4] Link: http://lkml.kernel.org/r/1571865575-42913-1-git-send-email-yang.shi@linux.a… Link: http://lkml.kernel.org/r/1571769577-89735-1-git-send-email-yang.shi@linux.a… Fixes: dd78fedde4b9 ("rmap: support file thp") Signed-off-by: Yang Shi <yang.shi(a)linux.alibaba.com> Reported-by: Gang Deng <gavin.dg(a)linux.alibaba.com> Tested-by: Gang Deng <gavin.dg(a)linux.alibaba.com> Suggested-by: Hugh Dickins <hughd(a)google.com> Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> [4.8+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mm.h | 5 ----- include/linux/mm_types.h | 5 +++++ include/linux/page-flags.h | 20 ++++++++++++++++++-- 3 files changed, 23 insertions(+), 7 deletions(-) --- a/include/linux/mm.h~mm-thp-handle-page-cache-thp-correctly-in-pagetranscompoundmap +++ a/include/linux/mm.h @@ -695,11 +695,6 @@ static inline void *kvcalloc(size_t n, s extern void kvfree(const void *addr); -static inline atomic_t *compound_mapcount_ptr(struct page *page) -{ - return &page[1].compound_mapcount; -} - static inline int compound_mapcount(struct page *page) { VM_BUG_ON_PAGE(!PageCompound(page), page); --- a/include/linux/mm_types.h~mm-thp-handle-page-cache-thp-correctly-in-pagetranscompoundmap +++ a/include/linux/mm_types.h @@ -221,6 +221,11 @@ struct page { #endif } _struct_page_alignment; +static inline atomic_t *compound_mapcount_ptr(struct page *page) +{ + return &page[1].compound_mapcount; +} + /* * Used for sizing the vmemmap region on some architectures */ --- a/include/linux/page-flags.h~mm-thp-handle-page-cache-thp-correctly-in-pagetranscompoundmap +++ a/include/linux/page-flags.h @@ -622,12 +622,28 @@ static inline int PageTransCompound(stru * * Unlike PageTransCompound, this is safe to be called only while * split_huge_pmd() cannot run from under us, like if protected by the - * MMU notifier, otherwise it may result in page->_mapcount < 0 false + * MMU notifier, otherwise it may result in page->_mapcount check false * positives. + * + * We have to treat page cache THP differently since every subpage of it + * would get _mapcount inc'ed once it is PMD mapped. But, it may be PTE + * mapped in the current process so comparing subpage's _mapcount to + * compound_mapcount to filter out PTE mapped case. */ static inline int PageTransCompoundMap(struct page *page) { - return PageTransCompound(page) && atomic_read(&page->_mapcount) < 0; + struct page *head; + + if (!PageTransCompound(page)) + return 0; + + if (PageAnon(page)) + return atomic_read(&page->_mapcount) < 0; + + head = compound_head(page); + /* File THP is PMD mapped and not PTE mapped */ + return atomic_read(&page->_mapcount) == + atomic_read(compound_mapcount_ptr(head)); } /* _ Patches currently in -mm which might be from yang.shi(a)linux.alibaba.com are mm-mempolicy-fix-the-wrong-return-value-and-potential-pages-leak-of-mbind.patch mm-rmap-use-vm_bug_on-in-__page_check_anon_rmap.patch mm-vmscan-remove-unused-scan_control-parameter-from-pageout.patch

6 years

1
0
0 0

[merged] mm-meminit-recalculate-pcpu-batch-and-high-limits-after-init-completes.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm, meminit: recalculate pcpu batch and high limits after init completes has been removed from the -mm tree. Its filename was mm-meminit-recalculate-pcpu-batch-and-high-limits-after-init-completes.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Mel Gorman <mgorman(a)techsingularity.net> Subject: mm, meminit: recalculate pcpu batch and high limits after init completes Deferred memory initialisation updates zone->managed_pages during the initialisation phase but before that finishes, the per-cpu page allocator (pcpu) calculates the number of pages allocated/freed in batches as well as the maximum number of pages allowed on a per-cpu list. As zone->managed_pages is not up to date yet, the pcpu initialisation calculates inappropriately low batch and high values. This increases zone lock contention quite severely in some cases with the degree of severity depending on how many CPUs share a local zone and the size of the zone. A private report indicated that kernel build times were excessive with extremely high system CPU usage. A perf profile indicated that a large chunk of time was lost on zone->lock contention. This patch recalculates the pcpu batch and high values after deferred initialisation completes for every populated zone in the system. It was tested on a 2-socket AMD EPYC 2 machine using a kernel compilation workload -- allmodconfig and all available CPUs. mmtests configuration: config-workload-kernbench-max Configuration was modified to build on a fresh XFS partition. kernbench 5.4.0-rc3 5.4.0-rc3 vanilla resetpcpu-v2 Amean user-256 13249.50 ( 0.00%) 16401.31 * -23.79%* Amean syst-256 14760.30 ( 0.00%) 4448.39 * 69.86%* Amean elsp-256 162.42 ( 0.00%) 119.13 * 26.65%* Stddev user-256 42.97 ( 0.00%) 19.15 ( 55.43%) Stddev syst-256 336.87 ( 0.00%) 6.71 ( 98.01%) Stddev elsp-256 2.46 ( 0.00%) 0.39 ( 84.03%) 5.4.0-rc3 5.4.0-rc3 vanilla resetpcpu-v2 Duration User 39766.24 49221.79 Duration System 44298.10 13361.67 Duration Elapsed 519.11 388.87 The patch reduces system CPU usage by 69.86% and total build time by 26.65%. The variance of system CPU usage is also much reduced. Before, this was the breakdown of batch and high values over all zones was. 256 batch: 1 256 batch: 63 512 batch: 7 256 high: 0 256 high: 378 512 high: 42 512 pcpu pagesets had a batch limit of 7 and a high limit of 42. After the patch: 256 batch: 1 768 batch: 63 256 high: 0 768 high: 378 [mgorman(a)techsingularity.net: fix merge/linkage snafu] Link: http://lkml.kernel.org/r/20191023084705.GD3016@techsingularity.netLink: http://lkml.kernel.org/r/20191021094808.28824-2-mgorman@techsingularity.net Signed-off-by: Mel Gorman <mgorman(a)techsingularity.net> Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Matt Fleming <matt(a)codeblueprint.co.uk> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Borislav Petkov <bp(a)alien8.de> Cc: Qian Cai <cai(a)lca.pw> Cc: <stable(a)vger.kernel.org> [4.1+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/page_alloc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/mm/page_alloc.c~mm-meminit-recalculate-pcpu-batch-and-high-limits-after-init-completes +++ a/mm/page_alloc.c @@ -1948,6 +1948,14 @@ void __init page_alloc_init_late(void) wait_for_completion(&pgdat_init_all_done_comp); /* + * The number of managed pages has changed due to the initialisation + * so the pcpu batch and high limits needs to be updated or the limits + * will be artificially small. + */ + for_each_populated_zone(zone) + zone_pcp_update(zone); + + /* * We initialized the rest of the deferred pages. Permanently disable * on-demand struct page initialization. */ @@ -8514,7 +8522,6 @@ void free_contig_range(unsigned long pfn WARN(count != 0, "%d pages are still in use!\n", count); } -#ifdef CONFIG_MEMORY_HOTPLUG /* * The zone indicated has a new number of managed_pages; batch sizes and percpu * page high values need to be recalulated. @@ -8528,7 +8535,6 @@ void __meminit zone_pcp_update(struct zo per_cpu_ptr(zone->pageset, cpu)); mutex_unlock(&pcp_batch_high_lock); } -#endif void zone_pcp_reset(struct zone *zone) { _ Patches currently in -mm which might be from mgorman(a)techsingularity.net are mm-pcp-share-common-code-between-memory-hotplug-and-percpu-sysctl-handler.patch mm-pcpu-make-zone-pcp-updates-and-reset-internal-to-the-mm.patch

6 years

1
0
0 0

[merged] mm-memcontrol-fix-null-ptr-deref-in-percpu-stats-flush.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm: memcontrol: fix NULL-ptr deref in percpu stats flush has been removed from the -mm tree. Its filename was mm-memcontrol-fix-null-ptr-deref-in-percpu-stats-flush.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Shakeel Butt <shakeelb(a)google.com> Subject: mm: memcontrol: fix NULL-ptr deref in percpu stats flush __mem_cgroup_free() can be called on the failure path in mem_cgroup_alloc(). However memcg_flush_percpu_vmstats() and memcg_flush_percpu_vmevents() which are called from __mem_cgroup_free() access the fields of memcg which can potentially be null if called from failure path from mem_cgroup_alloc(). Indeed syzbot has reported the following crash: R13: 00000000004bf27d R14: 00000000004db028 R15: 0000000000000003 kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 30393 Comm: syz-executor.1 Not tainted 5.4.0-rc2+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:memcg_flush_percpu_vmstats+0x4ae/0x930 mm/memcontrol.c:3436 Code: 05 41 89 c0 41 0f b6 04 24 41 38 c7 7c 08 84 c0 0f 85 5d 03 00 00 44 3b 05 33 d5 12 08 0f 83 e2 00 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 0f 85 91 03 00 00 48 8b 85 10 fe ff ff 48 8b b0 90 RSP: 0018:ffff888095c27980 EFLAGS: 00010206 RAX: 0000000000000012 RBX: ffff888095c27b28 RCX: ffffc90008192000 RDX: 0000000000040000 RSI: ffffffff8340fae7 RDI: 0000000000000007 RBP: ffff888095c27be0 R08: 0000000000000000 R09: ffffed1013f0da33 R10: ffffed1013f0da32 R11: ffff88809f86d197 R12: fffffbfff138b760 R13: dffffc0000000000 R14: 0000000000000090 R15: 0000000000000007 FS: 00007f5027170700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000710158 CR3: 00000000a7b18000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __mem_cgroup_free+0x1a/0x190 mm/memcontrol.c:5021 mem_cgroup_free mm/memcontrol.c:5033 [inline] mem_cgroup_css_alloc+0x3a1/0x1ae0 mm/memcontrol.c:5160 css_create kernel/cgroup/cgroup.c:5156 [inline] cgroup_apply_control_enable+0x44d/0xc40 kernel/cgroup/cgroup.c:3119 cgroup_mkdir+0x899/0x11b0 kernel/cgroup/cgroup.c:5401 kernfs_iop_mkdir+0x14d/0x1d0 fs/kernfs/dir.c:1124 vfs_mkdir+0x42e/0x670 fs/namei.c:3807 do_mkdirat+0x234/0x2a0 fs/namei.c:3830 __do_sys_mkdir fs/namei.c:3846 [inline] __se_sys_mkdir fs/namei.c:3844 [inline] __x64_sys_mkdir+0x5c/0x80 fs/namei.c:3844 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459a59 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f502716fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 00007f502716fc90 RCX: 0000000000459a59 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000180 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f50271706d4 R13: 00000000004bf27d R14: 00000000004db028 R15: 0000000000000003 Fixing this by moving the flush to mem_cgroup_free as there is no need to flush anything if we see failure in mem_cgroup_alloc(). Link: http://lkml.kernel.org/r/20191018165231.249872-1-shakeelb@google.com Fixes: bb65f89b7d3d ("mm: memcontrol: flush percpu vmevents before releasing memcg") Fixes: c350a99ea2b1 ("mm: memcontrol: flush percpu vmstats before releasing memcg") Signed-off-by: Shakeel Butt <shakeelb(a)google.com> Reported-by: syzbot+515d5bcfe179cdf049b2(a)syzkaller.appspotmail.com Reviewed-by: Roman Gushchin <guro(a)fb.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memcontrol.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) --- a/mm/memcontrol.c~mm-memcontrol-fix-null-ptr-deref-in-percpu-stats-flush +++ a/mm/memcontrol.c @@ -5014,12 +5014,6 @@ static void __mem_cgroup_free(struct mem { int node; - /* - * Flush percpu vmstats and vmevents to guarantee the value correctness - * on parent's and all ancestor levels. - */ - memcg_flush_percpu_vmstats(memcg, false); - memcg_flush_percpu_vmevents(memcg); for_each_node(node) free_mem_cgroup_per_node_info(memcg, node); free_percpu(memcg->vmstats_percpu); @@ -5030,6 +5024,12 @@ static void __mem_cgroup_free(struct mem static void mem_cgroup_free(struct mem_cgroup *memcg) { memcg_wb_domain_exit(memcg); + /* + * Flush percpu vmstats and vmevents to guarantee the value correctness + * on parent's and all ancestor levels. + */ + memcg_flush_percpu_vmstats(memcg, false); + memcg_flush_percpu_vmevents(memcg); __mem_cgroup_free(memcg); } _ Patches currently in -mm which might be from shakeelb(a)google.com are mm-vmscan-memcontrol-remove-mem_cgroup_select_victim_node.patch mm-vmscan-memcontrol-remove-mem_cgroup_select_victim_node-v2.patch

6 years

1
0
0 0

[FOR STABLE] wireless: Skip directory when generating certificates

by Brian Norris

Hello stable! I'd like to see the following commit included in -stable trees: commit 32b5a2c9950b9284000059d752f7afa164deb15e Author: Maxim Mikityanskiy <maxtram95(a)gmail.com> Date: Tue May 7 20:28:15 2019 +0300 wireless: Skip directory when generating certificates As it is, CONFIG_CFG80211_EXTRA_REGDB_KEYDIR is broken between v4.15 and v5.2. Thanks, Brian P.S. I've take the "Option 2" in Documentation/process/stable-kernel-rules.rst. Let me know if I should do differently.

6 years

2
1
0 0

[PATCH] net: usb: qmi_wwan: add support for DW5821e with eSIM support

by Aleksander Morgado

Exactly same layout as the default DW5821e module, just a different vid/pid. The QMI interface is exposed in USB configuration #1: P: Vendor=413c ProdID=81e0 Rev=03.18 S: Manufacturer=Dell Inc. S: Product=DW5821e-eSIM Snapdragon X20 LTE S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#=0x1 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option Signed-off-by: Aleksander Morgado <aleksander(a)aleksander.es> Cc: stable <stable(a)vger.kernel.org> --- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c index 596428ec71df..56d334b9ad45 100644 --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c @@ -1362,6 +1362,7 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x413c, 0x81b6, 8)}, /* Dell Wireless 5811e */ {QMI_FIXED_INTF(0x413c, 0x81b6, 10)}, /* Dell Wireless 5811e */ {QMI_FIXED_INTF(0x413c, 0x81d7, 0)}, /* Dell Wireless 5821e */ + {QMI_FIXED_INTF(0x413c, 0x81e0, 0)}, /* Dell Wireless 5821e with eSIM support*/ {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */ {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */ -- 2.24.0

6 years

2
1
0 0

[PATCH 1/2] docs: admin-guide: Fix min value of threads-max in kernel.rst

by Masanari Iida

Since following patch was merged 5.4-rc3, minimum value for threads-max changed to 1. kernel/sysctl.c: do not override max_threads provided by userspace b0f53dbc4bc4c371f38b14c391095a3bb8a0bb40 Signed-off-by: Masanari Iida <standby24x7(a)gmail.com> --- Documentation/admin-guide/sysctl/kernel.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst index 032c7cd3cede..38e0f10d7d9f 100644 --- a/Documentation/admin-guide/sysctl/kernel.rst +++ b/Documentation/admin-guide/sysctl/kernel.rst @@ -1101,7 +1101,7 @@ During initialization the kernel sets this value such that even if the maximum number of threads is created, the thread structures occupy only a part (1/8th) of the available RAM pages. -The minimum value that can be written to threads-max is 20. +The minimum value that can be written to threads-max is 1. The maximum value that can be written to threads-max is given by the constant FUTEX_TID_MASK (0x3fffffff). -- 2.24.0.rc1

6 years

3
4
0 0

Re: KASAN: use-after-free Read in vhci_hub_control

by syzbot

syzbot suspects this bug was fixed by commit: commit 81f7567c51ad97668d1c3a48e8ecc482e64d4161 Author: Shuah Khan (Samsung OSG) <shuah(a)kernel.org> Date: Fri Oct 5 22:17:44 2018 +0000 usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control() bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14046c2c600000 start commit: 420f51f4 Merge tag 'arm64-fixes' of git://git.kernel.org/p.. git tree: upstream kernel config: https://syzkaller.appspot.com/x/.config?x=531a917630d2a492 dashboard link: https://syzkaller.appspot.com/bug?extid=600b03e0cf1b73bb23c4 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1116710a400000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=119be4ea400000 If the result looks correct, please mark the bug fixed by replying with: #syz fix: usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control() For information about bisection process see: https://goo.gl/tpsmEJ#bisection

6 years

2
1
0 0

[PATCH] staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param()

by Ajay.Kathat＠microchip.com

From: Ajay Singh <ajay.kathat(a)microchip.com> Do not copy the extended supported rates in 'param->supp_rates' if the array is already full with basic rates values. The array size check helped to avoid possible illegal memory access [1] while copying to 'param->supp_rates' array. 1. https://marc.info/?l=linux-next&m=157301720517456&w=2 Reported-by: coverity-bot <keescook+coverity-bot(a)chromium.org> Addresses-Coverity-ID: 1487400 ("Memory - illegal accesses") Fixes: 4e0b0f42c9c7 ("staging: wilc1000: use struct to pack join parameters for FW") Cc: stable(a)vger.kernel.org Signed-off-by: Ajay Singh <ajay.kathat(a)microchip.com> --- drivers/staging/wilc1000/hif.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/drivers/staging/wilc1000/hif.c b/drivers/staging/wilc1000/hif.c index 5f6706bcedf6..349e45d58ec9 100644 --- a/drivers/staging/wilc1000/hif.c +++ b/drivers/staging/wilc1000/hif.c @@ -485,16 +485,21 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, memcpy(&param->supp_rates[1], rates_ie + 2, rates_len); } - supp_rates_ie = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies->data, - ies->len); - if (supp_rates_ie) { - if (supp_rates_ie[1] > (WILC_MAX_RATES_SUPPORTED - rates_len)) - param->supp_rates[0] = WILC_MAX_RATES_SUPPORTED; - else - param->supp_rates[0] += supp_rates_ie[1]; - - memcpy(&param->supp_rates[rates_len + 1], supp_rates_ie + 2, - (param->supp_rates[0] - rates_len)); + if (rates_len < WILC_MAX_RATES_SUPPORTED) { + supp_rates_ie = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, + ies->data, ies->len); + if (supp_rates_ie) { + u8 ext_rates = supp_rates_ie[1]; + + if (ext_rates > (WILC_MAX_RATES_SUPPORTED - rates_len)) + param->supp_rates[0] = WILC_MAX_RATES_SUPPORTED; + else + param->supp_rates[0] += ext_rates; + + memcpy(&param->supp_rates[rates_len + 1], + supp_rates_ie + 2, + (param->supp_rates[0] - rates_len)); + } } ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies->data, ies->len); -- 2.22.0

6 years

1
0
0 0

✅ PASS: Stable queue: queue-5.3

by CKI Project

Hello, We ran automated tests on a patchset that was proposed for merging into this kernel tree. The patches were applied to: Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: 37b4d0c37c0b - Linux 5.3.9 The results of these automated tests are provided below. Overall result: PASSED Merge: OK Compile: OK Tests: OK All kernel binaries, config files, and logs are available for download here: https://artifacts.cki-project.org/pipelines/269865 Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Merge testing ------------- We cloned this repository and checked out the following commit: Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: 37b4d0c37c0b - Linux 5.3.9 We grabbed the 53b52b123f7b commit of the stable queue repository. We then merged the patchset with `git am`: regulator-of-fix-suspend-min-max-voltage-parsing.patch asoc-samsung-arndale-add-missing-of-node-dereferenci.patch asoc-wm8994-do-not-register-inapplicable-controls-fo.patch regulator-da9062-fix-suspend_enable-disable-preparat.patch asoc-topology-fix-a-signedness-bug-in-soc_tplg_dapm_.patch arm64-dts-allwinner-a64-pine64-plus-add-phy-regulato.patch arm64-dts-allwinner-a64-drop-pmu-node.patch arm64-dts-allwinner-a64-sopine-baseboard-add-phy-reg.patch arm64-dts-fix-gpio-to-pinmux-mapping.patch regulator-ti-abb-fix-timeout-in-ti_abb_wait_txdone-t.patch pinctrl-intel-allocate-irq-chip-dynamic.patch asoc-sof-loader-fix-kernel-oops-on-firmware-boot-fai.patch asoc-sof-topology-fix-parse-fail-issue-for-byte-bool.patch asoc-sof-intel-hda-fix-warnings-during-fw-load.patch asoc-sof-intel-initialise-and-verify-fw-crash-dump-d.patch asoc-sof-intel-hda-disable-dmi-l1-entry-during-captu.patch asoc-rt5682-add-null-handler-to-set_jack-function.patch asoc-intel-sof_rt5682-add-remove-function-to-disable.patch asoc-intel-bytcr_rt5651-add-null-check-to-support_bu.patch regulator-pfuze100-regulator-variable-val-in-pfuze10.patch asoc-wm_adsp-don-t-generate-kcontrols-without-read-f.patch asoc-rockchip-i2s-fix-rpm-imbalance.patch arm64-dts-rockchip-fix-rockpro64-rk808-interrupt-lin.patch arm-dts-logicpd-torpedo-som-remove-twl_keypad.patch arm64-dts-rockchip-fix-rockpro64-vdd-log-regulator-s.patch arm64-dts-rockchip-fix-rockpro64-sdhci-settings.patch pinctrl-ns2-fix-off-by-one-bugs-in-ns2_pinmux_enable.patch pinctrl-stmfx-fix-null-pointer-on-remove.patch arm64-dts-zii-ultra-fix-arm-regulator-states.patch arm-dts-am3874-iceboard-fix-i2c-mux-idle-disconnect-.patch asoc-msm8916-wcd-digital-add-missing-mix2-path-for-r.patch asoc-simple_card_utils.h-fix-potential-multiple-rede.patch arm-dts-use-level-interrupt-for-omap4-5-wlcore.patch arm-mm-fix-alignment-handler-faults-under-memory-pre.patch scsi-qla2xxx-fix-a-potential-null-pointer-dereferenc.patch scsi-scsi_dh_alua-handle-rtpg-sense-code-correctly-d.patch scsi-sni_53c710-fix-compilation-error.patch scsi-fix-kconfig-dependency-warning-related-to-53c70.patch arm-8908-1-add-__always_inline-to-functions-called-f.patch arm-8914-1-nommu-fix-exc_ret-for-xip.patch arm64-dts-rockchip-fix-rockpro64-sdmmc-settings.patch arm64-dts-rockchip-fix-usb-c-on-hugsun-x99-tv-box.patch arm64-dts-lx2160a-correct-cpu-core-idle-state-name.patch arm-dts-imx6q-logicpd-re-enable-snvs-power-key.patch arm-dts-vf610-zii-scu4-aib-specify-i2c-mux-idle-disc.patch arm-dts-imx7s-correct-gpt-s-ipg-clock-source.patch arm64-dts-imx8mq-use-correct-clock-for-usdhc-s-ipg-c.patch arm64-dts-imx8mm-use-correct-clock-for-usdhc-s-ipg-c.patch perf-tools-fix-resource-leak-of-closedir-on-the-erro.patch perf-c2c-fix-memory-leak-in-build_cl_output.patch 8250-men-mcb-fix-error-checking-when-get_num_ports-r.patch perf-kmem-fix-memory-leak-in-compact_gfp_flags.patch arm-davinci-dm365-fix-mcbsp-dma_slave_map-entry.patch drm-amdgpu-fix-potential-vm-faults.patch drm-amdgpu-fix-error-handling-in-amdgpu_bo_list_crea.patch scsi-target-core-do-not-overwrite-cdb-byte-1.patch scsi-hpsa-add-missing-hunks-in-reset-patch.patch asoc-intel-sof-rt5682-add-a-check-for-devm_clk_get.patch asoc-sof-control-return-true-when-kcontrol-values-ch.patch tracing-fix-gfp_t-format-for-synthetic-events.patch arm-dts-bcm2837-rpi-cm3-avoid-leds-gpio-probing-issu.patch i2c-aspeed-fix-master-pending-state-handling.patch drm-komeda-don-t-flush-inactive-pipes.patch arm-8926-1-v7m-remove-register-save-to-stack-before-.patch selftests-kvm-vmx_set_nested_state_test-don-t-check-.patch selftests-kvm-fix-sync_regs_test-with-newer-gccs.patch alsa-hda-add-tigerlake-jasperlake-pci-id.patch of-unittest-fix-memory-leak-in-unittest_data_add.patch mips-bmips-mark-exception-vectors-as-char-arrays.patch irqchip-gic-v3-its-use-the-exact-itslist-for-vmovp.patch i2c-mt65xx-fix-null-ptr-dereference.patch i2c-stm32f7-fix-first-byte-to-send-in-slave-mode.patch i2c-stm32f7-fix-a-race-in-slave-mode-with-arbitratio.patch i2c-stm32f7-remove-warning-when-compiling-with-w-1.patch cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconn.patch irqchip-sifive-plic-skip-contexts-except-supervisor-.patch nbd-protect-cmd-status-with-cmd-lock.patch nbd-handle-racing-with-error-ed-out-commands.patch ata-libahci_platform-fix-regulator_get_optional-misu.patch cxgb4-fix-panic-when-attaching-to-uld-fail.patch cxgb4-request-the-tx-cidx-updates-to-status-page.patch dccp-do-not-leak-jiffies-on-the-wire.patch erspan-fix-the-tun_info-options_len-check-for-erspan.patch inet-stop-leaking-jiffies-on-the-wire.patch net-annotate-accesses-to-sk-sk_incoming_cpu.patch net-annotate-lockless-accesses-to-sk-sk_napi_id.patch net-dsa-bcm_sf2-fix-imp-setup-for-port-different-than-8.patch net-ethernet-ftgmac100-fix-dma-coherency-issue-with-sw-checksum.patch net-fix-sk_page_frag-recursion-from-memory-reclaim.patch net-hisilicon-fix-ping-latency-when-deal-with-high-throughput.patch net-mlx4_core-dynamically-set-guaranteed-amount-of-counters-per-vf.patch netns-fix-gfp-flags-in-rtnl_net_notifyid.patch net-rtnetlink-fix-a-typo-fbd-fdb.patch net-usb-lan78xx-disable-interrupts-before-calling-generic_handle_irq.patch net-zeroing-the-structure-ethtool_wolinfo-in-ethtool_get_wol.patch selftests-net-reuseport_dualstack-fix-uninitalized-parameter.patch udp-fix-data-race-in-udp_set_dev_scratch.patch vxlan-check-tun_info-options_len-properly.patch net-add-skb_queue_empty_lockless.patch udp-use-skb_queue_empty_lockless.patch net-use-skb_queue_empty_lockless-in-poll-handlers.patch net-use-skb_queue_empty_lockless-in-busy-poll-contexts.patch net-add-read_once-annotation-in-__skb_wait_for_more_packets.patch ipv4-fix-route-update-on-metric-change.patch selftests-fib_tests-add-more-tests-for-metric-update.patch net-smc-fix-closing-of-fallback-smc-sockets.patch net-smc-keep-vlan_id-for-smc-r-in-smc_listen_work.patch keys-fix-memory-leak-in-copy_net_ns.patch net-phylink-fix-phylink_dbg-macro.patch rxrpc-fix-handling-of-last-subpacket-of-jumbo-packet.patch net-mlx5e-determine-source-port-properly-for-vlan-push-action.patch net-mlx5e-remove-incorrect-match-criteria-assignment-line.patch net-mlx5e-initialize-on-stack-link-modes-bitmap.patch net-mlx5-fix-flow-counter-list-auto-bits-struct.patch net-smc-fix-refcounting-for-non-blocking-connect.patch net-mlx5-fix-rtable-reference-leak.patch mlxsw-core-unpublish-devlink-parameters-during-reload.patch r8169-fix-wrong-phy-id-issue-with-rtl8168dp.patch net-mlx5e-fix-ethtool-self-test-link-speed.patch net-mlx5e-fix-handling-of-compressed-cqes-in-case-of-low-napi-budget.patch ipv4-fix-ipskb_frag_pmtu-handling-with-fragmentation.patch net-bcmgenet-don-t-set-phydev-link-from-mac.patch net-dsa-b53-do-not-clear-existing-mirrored-port-mask.patch net-dsa-fix-switch-tree-list.patch net-ensure-correct-skb-tstamp-in-various-fragmenters.patch net-hns3-fix-mis-counting-irq-vector-numbers-issue.patch net-netem-fix-error-path-for-corrupted-gso-frames.patch net-reorder-struct-net-fields-to-avoid-false-sharing.patch net-usb-lan78xx-connect-phy-before-registering-mac.patch r8152-add-device-id-for-lenovo-thinkpad-usb-c-dock-gen-2.patch net-netem-correct-the-parent-s-backlog-when-corrupted-packet-was-dropped.patch net-phy-bcm7xxx-define-soft_reset-for-40nm-ephy.patch net-bcmgenet-reset-40nm-ephy-on-energy-detect.patch net-flow_dissector-switch-to-siphash.patch Compile testing --------------- We compiled the kernel for 3 architectures: aarch64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg ppc64le: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg x86_64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg Hardware testing ---------------- We booted each kernel and ran the following tests: aarch64: Host 1: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ LTP lite ✅ Loopdev Sanity ✅ jvm test suite ✅ AMTU (Abstract Machine Test Utility) ✅ LTP: openposix test suite ✅ Networking bridge: sanity ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking route_func: local ✅ Networking route_func: forward ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: gre basic ✅ Networking tunnel: vxlan basic ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ ALSA PCM loopback test ✅ ALSA Control (mixer) Userspace Element test ✅ Usex - version 1.9-29 ✅ storage: SCSI VPD ✅ stress: stress-ng ✅ trace: ftrace/tracer 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites Host 2: ✅ Boot test ✅ selinux-policy: serge-testsuite 🚧 ✅ Storage blktests ppc64le: Host 1: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ LTP lite ✅ Loopdev Sanity ✅ jvm test suite ✅ AMTU (Abstract Machine Test Utility) ✅ LTP: openposix test suite ✅ Networking bridge: sanity ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking route_func: local ✅ Networking route_func: forward ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: gre basic ✅ Networking tunnel: vxlan basic ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ ALSA PCM loopback test ✅ ALSA Control (mixer) Userspace Element test ✅ Usex - version 1.9-29 ✅ trace: ftrace/tracer 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites Host 2: ✅ Boot test ✅ selinux-policy: serge-testsuite 🚧 ✅ Storage blktests x86_64: Host 1: ✅ Boot test ✅ selinux-policy: serge-testsuite 🚧 ✅ Storage blktests Host 2: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ LTP lite ✅ Loopdev Sanity ✅ jvm test suite ✅ AMTU (Abstract Machine Test Utility) ✅ LTP: openposix test suite ✅ Networking bridge: sanity ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking route_func: local ✅ Networking route_func: forward ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: gre basic ✅ Networking tunnel: vxlan basic ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ pciutils: sanity smoke test ✅ ALSA PCM loopback test ✅ ALSA Control (mixer) Userspace Element test ✅ Usex - version 1.9-29 ✅ storage: SCSI VPD ✅ stress: stress-ng ✅ trace: ftrace/tracer 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites Test sources: https://github.com/CKI-project/tests-beaker 💚 Pull requests are welcome for new tests or improvements to existing tests! Waived tests ------------ If the test run included waived tests, they are marked with 🚧. Such tests are executed but their results are not taken into account. Tests are waived when their results are not reliable enough, e.g. when they're just introduced or are being fixed. Testing timeout --------------- We aim to provide a report within reasonable timeframe. Tests that haven't finished running are marked with ⏱. Reports for non-upstream kernels have a Beaker recipe linked to next to each host.

6 years

1
0
0 0

[PATCH] USB: serial: option: add support for DW5821e with eSIM support

by Aleksander Morgado

The device exposes AT, NMEA and DIAG ports in both USB configurations. Exactly same layout as the default DW5821e module, just a different vid/pid. P: Vendor=413c ProdID=81e0 Rev=03.18 S: Manufacturer=Dell Inc. S: Product=DW5821e-eSIM Snapdragon X20 LTE S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#=0x1 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option P: Vendor=413c ProdID=81e0 Rev=03.18 S: Manufacturer=Dell Inc. S: Product=DW5821e-eSIM Snapdragon X20 LTE S: SerialNumber=0123456789ABCDEF C: #Ifs= 7 Cfg#= 2 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) Signed-off-by: Aleksander Morgado <aleksander(a)aleksander.es> Cc: stable <stable(a)vger.kernel.org> --- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c index 06ab016be0b6..2023f1f4edaf 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -197,6 +197,7 @@ static void option_instat_callback(struct urb *urb); #define DELL_PRODUCT_5804_MINICARD_ATT 0x819b /* Novatel E371 */ #define DELL_PRODUCT_5821E 0x81d7 +#define DELL_PRODUCT_5821E_ESIM 0x81e0 #define KYOCERA_VENDOR_ID 0x0c88 #define KYOCERA_PRODUCT_KPC650 0x17da @@ -1044,6 +1045,8 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5804_MINICARD_ATT, 0xff, 0xff, 0xff) }, { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E), .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E_ESIM), + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) }, { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) }, -- 2.24.0

6 years

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror