Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1201166 > unrolled thread
| Started by | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| First post | 2015-08-05 23:50 +0200 |
| Last post | 2015-08-06 00:30 +0200 |
| Articles | 11 on this page of 111 — 2 participants |
Back to article view | Back to linux.kernel
[3.19.y-ckt stable] Linux 3.19.8-ckt5 stable review Kamal Mostafa <kamal@canonical.com> - 2015-08-05 23:50 +0200
[PATCH 3.19.y-ckt 086/107] staging: vt6656: check ieee80211_bss_conf bssid not NULL Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 098/107] net: call rcu_read_lock early in process_backlog Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 094/107] ARM: 8404/1: dma-mapping: fix off-by-one error in bitmap size check Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 091/107] drm/radeon: fix user ptr race condition Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 079/107] can: c_can: Fix default pinmux glitch at init Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 088/107] scsi: fix host max depth checking for the 'queue_depth' sysfs interface Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 103/107] net: graceful exit from netif_alloc_netdev_queues() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 077/107] Btrfs: fix list transaction->pending_ordered corruption Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 100/107] bridge: mdb: start delete timer for temp static entries Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 081/107] ARC: make sure instruction_pointer() returns unsigned value Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 080/107] ARM: dts: dra7x-evm: Prevent glitch on DCAN1 pinmux Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 104/107] net: dsa: Fix off-by-one in switch address parsing Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 092/107] drm/radeon/ci: silence a harmless PCC warning Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 085/107] staging: vt6655: check ieee80211_bss_conf bssid not NULL Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 089/107] drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 084/107] Btrfs: fix file corruption after cloning inline extents Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 096/107] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
Re: [PATCH 3.19.y-ckt 096/107] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() Jan Kara <jack@suse.cz> - 2015-08-06 17:20 +0200
Re: [PATCH 3.19.y-ckt 096/107] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 18:00 +0200
[PATCH 3.19.y-ckt 001/107] ieee802154: Fix sockaddr_ieee802154 implicit padding information leak. Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 011/107] KEYS: ensure we free the assoc array edit if edit is valid Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 083/107] Revert "drm/i915: Declare the swizzling unknown for L-shaped configurations" Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 063/107] USB: cp210x: add ID for Aruba Networks controllers Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 105/107] perf hists browser: Take the --comm, --dsos, etc filters into account Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 095/107] dma-debug: skip debug_dma_assert_idle() when disabled Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 087/107] st: null pointer dereference panic caused by use after kref_put by st_open Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 082/107] s390/process: fix sfpc inline assembly Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 090/107] drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 106/107] net: dsa: Test array index before use Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 066/107] usb: f_mass_storage: limit number of reported LUNs Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 073/107] drivers: net: cpsw: fix crash while accessing second slave ethernet interface Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 107/107] rds: rds_ib_device.refcount overflow Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 097/107] ipv6: Make MLD packets to only be processed locally Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 099/107] ip_tunnel: fix ipv4 pmtu check to honor inner ip header df Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 093/107] genirq: Prevent resend to interrupts marked IRQ_NESTED_THREAD Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 102/107] net: do not process device backlog during unregistration Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 101/107] bridge: mdb: zero out the local br_ip variable before use Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 004/107] x86/asm/entry/64: Remove a redundant jump Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 060/107] ARC: Override toplevel default -O2 with -O3 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 071/107] ARM: dts: mx23: fix iio-hwmon support Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 069/107] drm: add a check for x/y in drm_mode_setcrtc Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 064/107] dm btree: silence lockdep lock inversion in dm_btree_del() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 054/107] iio: light: tcs3414: Fix bug preventing to set integration time Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 068/107] drm/rockchip: use drm_gem_mmap helpers Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 062/107] USB: option: add 2020:4000 ID Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 076/107] Btrfs: fix memory leak in the extent_same ioctl Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 067/107] s390/sclp: clear upper register halves in _sclp_print_early Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 052/107] iio: DAC: ad5624r_spi: fix bit shift of output data value Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 070/107] bio integrity: do not assume bio_integrity_pool exists if bioset exists Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 051/107] iio: inv-mpu: Specify the expected format/precision for write channels Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 056/107] iio: tmp006: Check channel info on write Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 075/107] KVM: VMX: fix vmwrite to invalid VMCS Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 048/107] drivers: clk: st: Fix flexgen lock init Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 027/107] drm/i915: Declare the swizzling unknown for L-shaped configurations Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
Re: [PATCH 3.19.y-ckt 027/107] drm/i915: Declare the swizzling unknown for L-shaped configurations Kamal Mostafa <kamal@canonical.com> - 2015-08-06 19:00 +0200
[PATCH 3.19.y-ckt 061/107] crypto: omap-des - Fix unmapping of dma channels Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 072/107] tracing: Have branch tracer use recursive field of task struct Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 078/107] can: rcar_can: fix IRQ check Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 065/107] usb: musb: host: rely on port_mode to call musb_start() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 003/107] x86/asm/entry/64: Fold the 'test_in_nmi' macro into its only user Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 049/107] iio: adc: rockchip_saradc: add missing MODULE_* data Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 058/107] dm thin: allocate the cell_sort_array dynamically Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 059/107] kbuild: Allow arch Makefiles to override {cpp,ld,c}flags Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 047/107] ARM: 8393/1: smp: Fix suspicious RCU usage with ipi tracepoints Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 057/107] dm btree remove: fix bug in redistribute3 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 050/107] iio: twl4030-madc: Pass the IRQF_ONESHOT flag Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 053/107] iio: adc: at91_adc: allow to use full range of startup time Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 055/107] ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 074/107] USB: serial: Destroy serial_minors IDR on module exit Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 021/107] ext4: replace open coded nofail allocation in ext4_free_blocks() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 032/107] MIPS: kernel: cps-vec: Replace KSEG0 with CKSEG0 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 043/107] freeing unlinked file indefinitely delayed Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 023/107] ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 034/107] drm/radeon: Clean up reference counting and pinning of the cursor BOs Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 036/107] mm: avoid setting up anonymous pages into file mapping Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 020/107] ext4: correctly migrate a file with a hole at the beginning Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 042/107] 9p: don't leave a half-initialized inode sitting around Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 040/107] cxl: Check if afu is not null in cxl_slbia Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 022/107] ARM: dts: am57xx-beagle-x15: Provide supply for usb2_phy2 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 028/107] MIPS: kernel: smp-cps: Fix 64-bit compatibility errors due to pointer casting Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 039/107] hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 029/107] MIPS: kernel: cps-vec: Replace 'la' macro with PTR_LA Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 017/107] ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 037/107] selinux: don't waste ebitmap space when importing NetLabel categories Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 015/107] Btrfs: fix fsync data loss after append write Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 031/107] MIPS: kernel: cps-vec: Use ta0-ta3 pseudo-registers for 64-bit Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 044/107] clk: qcom: Use parent rate when set rate to pixel RCG clock Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 018/107] ext4: fix reservation release on invalidatepage for delalloc fs Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 019/107] ext4: be more strict when migrating to non-extent based file Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 035/107] drm/radeon: unpin cursor BOs on suspend and pin them again on resume (v2) Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 026/107] drm/radeon: fix HDP flushing Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 030/107] MIPS: kernel: cps-vec: Replace mips32r2 ISA level with mips64r2 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 033/107] MIPS: cps-vec: Use macros for various arithmetics and memory operations Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 045/107] drivers: clk: st: Incorrect register offset used for lock_status Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 046/107] drivers: clk: st: Fix mux bit-setting for Cortex A9 clocks Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 038/107] hpfs: kstrdup() out of memory handling Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 025/107] cxl: Fix off by one error allowing subsequent mmap page to be accessed Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 041/107] parisc: Fix some PTE/TLB race conditions and optimize __flush_tlb_range based on timing results Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 024/107] powerpc/powernv: Fix race in updating core_idle_state Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 016/107] bufferhead: Add _gfp version for sb_getblk() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 013/107] Btrfs: use kmem_cache_free when freeing entry in inode cache Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 006/107] x86/nmi/64: Remove asm code that saves cr2 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 008/107] x86/nmi/64: Improve nested NMI comments Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 012/107] sg_start_req(): make sure that there's not too many elements in iovec Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 005/107] x86/nmi: Enable nested do_nmi handling for 64-bit kernels Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 007/107] x86/nmi/64: Switch stacks on userspace NMI entry Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 002/107] evm: labeling pseudo filesystems exception Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 014/107] Btrfs: fix race between caching kthread and returning inode to inode cache Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 009/107] x86/nmi/64: Reorder nested NMI checks Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 010/107] x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
Page 6 of 6 — ← Prev page 1 2 3 4 5 [6]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 016/107] bufferhead: Add _gfp version for sb_getblk() |
| Message-ID | <pUfma-6lp-11@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Borisov <kernel@kyup.com>
commit bd7ade3cd9b0850264306f5c2b79024a417b6396 upstream.
sb_getblk() is used during ext4 (and possibly other FSes) writeback
paths. Sometimes such path require allocating memory and guaranteeing
that such allocation won't block. Currently, however, there is no way
to provide user flags for sb_getblk which could lead to deadlocks.
This patch implements a sb_getblk_gfp with the only difference it can
accept user-provided GFP flags.
Signed-off-by: Nikolay Borisov <kernel@kyup.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
include/linux/buffer_head.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
index 73b4522..e6797de 100644
--- a/include/linux/buffer_head.h
+++ b/include/linux/buffer_head.h
@@ -317,6 +317,13 @@ sb_getblk(struct super_block *sb, sector_t block)
return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
}
+
+static inline struct buffer_head *
+sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp)
+{
+ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp);
+}
+
static inline struct buffer_head *
sb_find_get_block(struct super_block *sb, sector_t block)
{
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 013/107] Btrfs: use kmem_cache_free when freeing entry in inode cache |
| Message-ID | <pUfma-6lp-17@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Filipe Manana <fdmanana@suse.com> commit c3f4a1685bb87e59c886ee68f7967eae07d4dffa upstream. The free space entries are allocated using kmem_cache_zalloc(), through __btrfs_add_free_space(), therefore we should use kmem_cache_free() and not kfree() to avoid any confusion and any potential problem. Looking at the kfree() definition at mm/slab.c it has the following comment: /* * (...) * * Don't free memory not originally allocated by kmalloc() * or you will run into trouble. */ So better be safe and use kmem_cache_free(). Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: David Sterba <dsterba@suse.cz> Signed-off-by: Chris Mason <clm@fb.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- fs/btrfs/inode-map.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c index 74faea3a..0e4e46e 100644 --- a/fs/btrfs/inode-map.c +++ b/fs/btrfs/inode-map.c @@ -271,7 +271,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) __btrfs_add_free_space(ctl, info->offset, count); free: rb_erase(&info->offset_index, rbroot); - kfree(info); + kmem_cache_free(btrfs_free_space_cachep, info); } } -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 006/107] x86/nmi/64: Remove asm code that saves cr2 |
| Message-ID | <pUfmb-6lp-31@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Andy Lutomirski <luto@kernel.org> commit 0e181bb58143cb4a2e8f01c281b0816cd0e4798e upstream. Now that do_nmi saves cr2, we don't need to save it in asm. This is a prerequisity for the fix for CVE-2015-3290. Reviewed-by: Steven Rostedt <rostedt@goodmis.org> Acked-by: Borislav Petkov <bp@suse.de> Signed-off-by: Andy Lutomirski <luto@kernel.org> [bwh: Backported to 4.0: adjust filename, context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Acked-by: John Johansen <john.johansen@canonical.com> Acked-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Luis Henriques <luis.henriques@canonical.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- arch/x86/kernel/entry_64.S | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S index 315f8e9..edffe680 100644 --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1651,29 +1651,11 @@ end_repeat_nmi: call save_paranoid DEFAULT_FRAME 0 - /* - * Save off the CR2 register. If we take a page fault in the NMI then - * it could corrupt the CR2 value. If the NMI preempts a page fault - * handler before it was able to read the CR2 register, and then the - * NMI itself takes a page fault, the page fault that was preempted - * will read the information from the NMI page fault and not the - * origin fault. Save it off and restore it if it changes. - * Use the r12 callee-saved register. - */ - movq %cr2, %r12 - /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */ movq %rsp,%rdi movq $-1,%rsi call do_nmi - /* Did the NMI take a page fault? Restore cr2 if it did */ - movq %cr2, %rcx - cmpq %rcx, %r12 - je 1f - movq %r12, %cr2 -1: - testl %ebx,%ebx /* swapgs needed? */ jnz nmi_restore nmi_swapgs: -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 008/107] x86/nmi/64: Improve nested NMI comments |
| Message-ID | <pUfma-6lp-15@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Andy Lutomirski <luto@kernel.org> commit 0b22930ebad563ae97ff3f8d7b9f12060b4c6e6b upstream. I found the nested NMI documentation to be difficult to follow. Improve the comments. Signed-off-by: Andy Lutomirski <luto@kernel.org> [bwh: Backported to 4.0: adjust filename, context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Acked-by: John Johansen <john.johansen@canonical.com> Acked-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Luis Henriques <luis.henriques@canonical.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- arch/x86/kernel/entry_64.S | 159 ++++++++++++++++++++++++++------------------- arch/x86/kernel/nmi.c | 4 +- 2 files changed, 93 insertions(+), 70 deletions(-) diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S index b889daf..21a8acf 100644 --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1459,11 +1459,12 @@ ENTRY(nmi) * If the variable is not set and the stack is not the NMI * stack then: * o Set the special variable on the stack - * o Copy the interrupt frame into a "saved" location on the stack - * o Copy the interrupt frame into a "copy" location on the stack + * o Copy the interrupt frame into an "outermost" location on the + * stack + * o Copy the interrupt frame into an "iret" location on the stack * o Continue processing the NMI * If the variable is set or the previous stack is the NMI stack: - * o Modify the "copy" location to jump to the repeate_nmi + * o Modify the "iret" location to jump to the repeat_nmi * o return back to the first NMI * * Now on exit of the first NMI, we first clear the stack variable @@ -1557,18 +1558,60 @@ ENTRY(nmi) .Lnmi_from_kernel: /* - * Check the special variable on the stack to see if NMIs are - * executing. + * Here's what our stack frame will look like: + * +---------------------------------------------------------+ + * | original SS | + * | original Return RSP | + * | original RFLAGS | + * | original CS | + * | original RIP | + * +---------------------------------------------------------+ + * | temp storage for rdx | + * +---------------------------------------------------------+ + * | "NMI executing" variable | + * +---------------------------------------------------------+ + * | iret SS } Copied from "outermost" frame | + * | iret Return RSP } on each loop iteration; overwritten | + * | iret RFLAGS } by a nested NMI to force another | + * | iret CS } iteration if needed. | + * | iret RIP } | + * +---------------------------------------------------------+ + * | outermost SS } initialized in first_nmi; | + * | outermost Return RSP } will not be changed before | + * | outermost RFLAGS } NMI processing is done. | + * | outermost CS } Copied to "iret" frame on each | + * | outermost RIP } iteration. | + * +---------------------------------------------------------+ + * | pt_regs | + * +---------------------------------------------------------+ + * + * The "original" frame is used by hardware. Before re-enabling + * NMIs, we need to be done with it, and we need to leave enough + * space for the asm code here. + * + * We return by executing IRET while RSP points to the "iret" frame. + * That will either return for real or it will loop back into NMI + * processing. + * + * The "outermost" frame is copied to the "iret" frame on each + * iteration of the loop, so each iteration starts with the "iret" + * frame pointing to the final return target. + */ + + /* + * Determine whether we're a nested NMI. + * + * First check "NMI executing". If it's set, then we're nested. + * This will not detect if we interrupted an outer NMI just + * before IRET. */ cmpl $1, -8(%rsp) je nested_nmi /* - * Now test if the previous stack was an NMI stack. - * We need the double check. We check the NMI stack to satisfy the - * race when the first NMI clears the variable before returning. - * We check the variable because the first NMI could be in a - * breakpoint routine using a breakpoint stack. + * Now test if the previous stack was an NMI stack. This covers + * the case where we interrupt an outer NMI after it clears + * "NMI executing" but before IRET. */ lea 6*8(%rsp), %rdx /* Compare the NMI stack (rdx) with the stack we came from (4*8(%rsp)) */ @@ -1585,9 +1628,11 @@ ENTRY(nmi) nested_nmi: /* - * Do nothing if we interrupted the fixup in repeat_nmi. - * It's about to repeat the NMI handler, so we are fine - * with ignoring this one. + * If we interrupted an NMI that is between repeat_nmi and + * end_repeat_nmi, then we must not modify the "iret" frame + * because it's being written by the outer NMI. That's okay: + * the outer NMI handler is about to call do_nmi anyway, + * so we can just resume the outer NMI. */ movq $repeat_nmi, %rdx cmpq 8(%rsp), %rdx @@ -1597,7 +1642,10 @@ nested_nmi: ja nested_nmi_out 1: - /* Set up the interrupted NMIs stack to jump to repeat_nmi */ + /* + * Modify the "iret" frame to point to repeat_nmi, forcing another + * iteration of NMI handling. + */ leaq -1*8(%rsp), %rdx movq %rdx, %rsp CFI_ADJUST_CFA_OFFSET 1*8 @@ -1616,60 +1664,23 @@ nested_nmi_out: popq_cfi %rdx CFI_RESTORE rdx - /* No need to check faults here */ + /* We are returning to kernel mode, so this cannot result in a fault. */ INTERRUPT_RETURN CFI_RESTORE_STATE first_nmi: - /* - * Because nested NMIs will use the pushed location that we - * stored in rdx, we must keep that space available. - * Here's what our stack frame will look like: - * +-------------------------+ - * | original SS | - * | original Return RSP | - * | original RFLAGS | - * | original CS | - * | original RIP | - * +-------------------------+ - * | temp storage for rdx | - * +-------------------------+ - * | NMI executing variable | - * +-------------------------+ - * | copied SS | - * | copied Return RSP | - * | copied RFLAGS | - * | copied CS | - * | copied RIP | - * +-------------------------+ - * | Saved SS | - * | Saved Return RSP | - * | Saved RFLAGS | - * | Saved CS | - * | Saved RIP | - * +-------------------------+ - * | pt_regs | - * +-------------------------+ - * - * The saved stack frame is used to fix up the copied stack frame - * that a nested NMI may change to make the interrupted NMI iret jump - * to the repeat_nmi. The original stack frame and the temp storage - * is also used by nested NMIs and can not be trusted on exit. - */ - /* Do not pop rdx, nested NMIs will corrupt that part of the stack */ + /* Restore rdx. */ movq (%rsp), %rdx CFI_RESTORE rdx - /* Set the NMI executing variable on the stack. */ + /* Set "NMI executing" on the stack. */ pushq_cfi $1 - /* - * Leave room for the "copied" frame - */ + /* Leave room for the "iret" frame */ subq $(5*8), %rsp CFI_ADJUST_CFA_OFFSET 5*8 - /* Copy the stack frame to the Saved frame */ + /* Copy the "original" frame to the "outermost" frame */ .rept 5 pushq_cfi 11*8(%rsp) .endr @@ -1677,6 +1688,7 @@ first_nmi: /* Everything up to here is safe from nested NMIs */ +repeat_nmi: /* * If there was a nested NMI, the first NMI's iret will return * here. But NMIs are still enabled and we can take another @@ -1685,16 +1697,21 @@ first_nmi: * it will just return, as we are about to repeat an NMI anyway. * This makes it safe to copy to the stack frame that a nested * NMI will update. - */ -repeat_nmi: - /* - * Update the stack variable to say we are still in NMI (the update - * is benign for the non-repeat case, where 1 was pushed just above - * to this very stack slot). + * + * RSP is pointing to "outermost RIP". gsbase is unknown, but, if + * we're repeating an NMI, gsbase has the same value that it had on + * the first iteration. paranoid_entry will load the kernel + * gsbase if needed before we call do_nmi. + * + * Set "NMI executing" in case we came back here via IRET. */ movq $1, 10*8(%rsp) - /* Make another copy, this one may be modified by nested NMIs */ + /* + * Copy the "outermost" frame to the "iret" frame. NMIs that nest + * here must not modify the "iret" frame while we're writing to + * it or it will end up containing garbage. + */ addq $(10*8), %rsp CFI_ADJUST_CFA_OFFSET -10*8 .rept 5 @@ -1705,9 +1722,9 @@ repeat_nmi: end_repeat_nmi: /* - * Everything below this point can be preempted by a nested - * NMI if the first NMI took an exception and reset our iret stack - * so that we repeat another NMI. + * Everything below this point can be preempted by a nested NMI. + * If this happens, then the inner NMI will change the "iret" + * frame to point back to repeat_nmi. */ pushq_cfi $-1 /* ORIG_RAX: no syscall to restart */ subq $ORIG_RAX-R15, %rsp @@ -1732,11 +1749,17 @@ end_repeat_nmi: nmi_swapgs: SWAPGS_UNSAFE_STACK nmi_restore: - /* Pop the extra iret frame at once */ + RESTORE_ALL 6*8 - /* Clear the NMI executing stack variable */ + /* Clear "NMI executing". */ movq $0, 5*8(%rsp) + + /* + * INTERRUPT_RETURN reads the "iret" frame and exits the NMI + * stack in a single instruction. We are returning to kernel + * mode, so this cannot result in a fault. + */ jmp irq_return CFI_ENDPROC END(nmi) diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c index d8766b1..d05bd2e 100644 --- a/arch/x86/kernel/nmi.c +++ b/arch/x86/kernel/nmi.c @@ -408,8 +408,8 @@ static void default_do_nmi(struct pt_regs *regs) NOKPROBE_SYMBOL(default_do_nmi); /* - * NMIs can hit breakpoints which will cause it to lose its NMI context - * with the CPU when the breakpoint or page fault does an IRET. + * NMIs can page fault or hit breakpoints which will cause it to lose + * its NMI context with the CPU when the breakpoint or page fault does an IRET. * * As a result, NMIs can nest if NMIs get unmasked due an IRET during * NMI processing. On x86_64, the asm glue protects us from nested NMIs -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 012/107] sg_start_req(): make sure that there's not too many elements in iovec |
| Message-ID | <pUfmb-6lp-29@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 451a2886b6bf90e2fb378f7c46c655450fb96e81 upstream.
unfortunately, allowing an arbitrary 16bit value means a possibility of
overflow in the calculation of total number of pages in bio_map_user_iov() -
we rely on there being no more than PAGE_SIZE members of sum in the
first loop there. If that sum wraps around, we end up allocating
too small array of pointers to pages and it's easy to overflow it in
the second loop.
X-Coverup: TINC (and there's no lumber cartel either)
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: s/MAX_UIOVEC/UIO_MAXIOV/. This was fixed upstream by commit
fdc81f45e9f5 ("sg_start_req(): use import_iovec()"), but we don't have
that function.]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Reference: CVE-2015-5707
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/scsi/sg.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index dbf8e77..9b6e7cb 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1759,6 +1759,9 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
md->from_user = 0;
}
+ if (unlikely(iov_count > UIO_MAXIOV))
+ return -EINVAL;
+
if (iov_count) {
int len, size = sizeof(struct sg_iovec) * iov_count;
struct iovec *iov;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 005/107] x86/nmi: Enable nested do_nmi handling for 64-bit kernels |
| Message-ID | <pUfma-6lp-25@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
commit 9d05041679904b12c12421cbcf9cb5f4860a8d7b upstream.
32-bit kernels handle nested NMIs in C. Enable the exact same
handling on 64-bit kernels as well. This isn't currently necessary,
but it will become necessary once the asm code starts allowing
limited nesting.
This is a prerequisite for the fix for CVE-2015-3290.
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/x86/kernel/nmi.c | 123 +++++++++++++++++++++-----------------------------
1 file changed, 52 insertions(+), 71 deletions(-)
diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index c3e985d..d8766b1 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -408,15 +408,15 @@ static void default_do_nmi(struct pt_regs *regs)
NOKPROBE_SYMBOL(default_do_nmi);
/*
- * NMIs can hit breakpoints which will cause it to lose its
- * NMI context with the CPU when the breakpoint does an iret.
- */
-#ifdef CONFIG_X86_32
-/*
- * For i386, NMIs use the same stack as the kernel, and we can
- * add a workaround to the iret problem in C (preventing nested
- * NMIs if an NMI takes a trap). Simply have 3 states the NMI
- * can be in:
+ * NMIs can hit breakpoints which will cause it to lose its NMI context
+ * with the CPU when the breakpoint or page fault does an IRET.
+ *
+ * As a result, NMIs can nest if NMIs get unmasked due an IRET during
+ * NMI processing. On x86_64, the asm glue protects us from nested NMIs
+ * if the outer NMI came from kernel mode, but we can still nest if the
+ * outer NMI came from user mode.
+ *
+ * To handle these nested NMIs, we have three states:
*
* 1) not running
* 2) executing
@@ -430,15 +430,14 @@ NOKPROBE_SYMBOL(default_do_nmi);
* (Note, the latch is binary, thus multiple NMIs triggering,
* when one is running, are ignored. Only one NMI is restarted.)
*
- * If an NMI hits a breakpoint that executes an iret, another
- * NMI can preempt it. We do not want to allow this new NMI
- * to run, but we want to execute it when the first one finishes.
- * We set the state to "latched", and the exit of the first NMI will
- * perform a dec_return, if the result is zero (NOT_RUNNING), then
- * it will simply exit the NMI handler. If not, the dec_return
- * would have set the state to NMI_EXECUTING (what we want it to
- * be when we are running). In this case, we simply jump back
- * to rerun the NMI handler again, and restart the 'latched' NMI.
+ * If an NMI executes an iret, another NMI can preempt it. We do not
+ * want to allow this new NMI to run, but we want to execute it when the
+ * first one finishes. We set the state to "latched", and the exit of
+ * the first NMI will perform a dec_return, if the result is zero
+ * (NOT_RUNNING), then it will simply exit the NMI handler. If not, the
+ * dec_return would have set the state to NMI_EXECUTING (what we want it
+ * to be when we are running). In this case, we simply jump back to
+ * rerun the NMI handler again, and restart the 'latched' NMI.
*
* No trap (breakpoint or page fault) should be hit before nmi_restart,
* thus there is no race between the first check of state for NOT_RUNNING
@@ -461,49 +460,36 @@ enum nmi_states {
static DEFINE_PER_CPU(enum nmi_states, nmi_state);
static DEFINE_PER_CPU(unsigned long, nmi_cr2);
-#define nmi_nesting_preprocess(regs) \
- do { \
- if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) { \
- this_cpu_write(nmi_state, NMI_LATCHED); \
- return; \
- } \
- this_cpu_write(nmi_state, NMI_EXECUTING); \
- this_cpu_write(nmi_cr2, read_cr2()); \
- } while (0); \
- nmi_restart:
-
-#define nmi_nesting_postprocess() \
- do { \
- if (unlikely(this_cpu_read(nmi_cr2) != read_cr2())) \
- write_cr2(this_cpu_read(nmi_cr2)); \
- if (this_cpu_dec_return(nmi_state)) \
- goto nmi_restart; \
- } while (0)
-#else /* x86_64 */
+#ifdef CONFIG_X86_64
/*
- * In x86_64 things are a bit more difficult. This has the same problem
- * where an NMI hitting a breakpoint that calls iret will remove the
- * NMI context, allowing a nested NMI to enter. What makes this more
- * difficult is that both NMIs and breakpoints have their own stack.
- * When a new NMI or breakpoint is executed, the stack is set to a fixed
- * point. If an NMI is nested, it will have its stack set at that same
- * fixed address that the first NMI had, and will start corrupting the
- * stack. This is handled in entry_64.S, but the same problem exists with
- * the breakpoint stack.
+ * In x86_64, we need to handle breakpoint -> NMI -> breakpoint. Without
+ * some care, the inner breakpoint will clobber the outer breakpoint's
+ * stack.
*
- * If a breakpoint is being processed, and the debug stack is being used,
- * if an NMI comes in and also hits a breakpoint, the stack pointer
- * will be set to the same fixed address as the breakpoint that was
- * interrupted, causing that stack to be corrupted. To handle this case,
- * check if the stack that was interrupted is the debug stack, and if
- * so, change the IDT so that new breakpoints will use the current stack
- * and not switch to the fixed address. On return of the NMI, switch back
- * to the original IDT.
+ * If a breakpoint is being processed, and the debug stack is being
+ * used, if an NMI comes in and also hits a breakpoint, the stack
+ * pointer will be set to the same fixed address as the breakpoint that
+ * was interrupted, causing that stack to be corrupted. To handle this
+ * case, check if the stack that was interrupted is the debug stack, and
+ * if so, change the IDT so that new breakpoints will use the current
+ * stack and not switch to the fixed address. On return of the NMI,
+ * switch back to the original IDT.
*/
static DEFINE_PER_CPU(int, update_debug_stack);
+#endif
-static inline void nmi_nesting_preprocess(struct pt_regs *regs)
+dotraplinkage notrace void
+do_nmi(struct pt_regs *regs, long error_code)
{
+ if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) {
+ this_cpu_write(nmi_state, NMI_LATCHED);
+ return;
+ }
+ this_cpu_write(nmi_state, NMI_EXECUTING);
+ this_cpu_write(nmi_cr2, read_cr2());
+nmi_restart:
+
+#ifdef CONFIG_X86_64
/*
* If we interrupted a breakpoint, it is possible that
* the nmi handler will have breakpoints too. We need to
@@ -514,22 +500,8 @@ static inline void nmi_nesting_preprocess(struct pt_regs *regs)
debug_stack_set_zero();
this_cpu_write(update_debug_stack, 1);
}
-}
-
-static inline void nmi_nesting_postprocess(void)
-{
- if (unlikely(this_cpu_read(update_debug_stack))) {
- debug_stack_reset();
- this_cpu_write(update_debug_stack, 0);
- }
-}
#endif
-dotraplinkage notrace void
-do_nmi(struct pt_regs *regs, long error_code)
-{
- nmi_nesting_preprocess(regs);
-
nmi_enter();
inc_irq_stat(__nmi_count);
@@ -539,8 +511,17 @@ do_nmi(struct pt_regs *regs, long error_code)
nmi_exit();
- /* On i386, may loop back to preprocess */
- nmi_nesting_postprocess();
+#ifdef CONFIG_X86_64
+ if (unlikely(this_cpu_read(update_debug_stack))) {
+ debug_stack_reset();
+ this_cpu_write(update_debug_stack, 0);
+ }
+#endif
+
+ if (unlikely(this_cpu_read(nmi_cr2) != read_cr2()))
+ write_cr2(this_cpu_read(nmi_cr2));
+ if (this_cpu_dec_return(nmi_state))
+ goto nmi_restart;
}
NOKPROBE_SYMBOL(do_nmi);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 007/107] x86/nmi/64: Switch stacks on userspace NMI entry |
| Message-ID | <pUfma-6lp-23@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Andy Lutomirski <luto@kernel.org> commit 9b6e6a8334d56354853f9c255d1395c2ba570e0a upstream. Returning to userspace is tricky: IRET can fail, and ESPFIX can rearrange the stack prior to IRET. The NMI nesting fixup relies on a precise stack layout and atomic IRET. Rather than trying to teach the NMI nesting fixup to handle ESPFIX and failed IRET, punt: run NMIs that came from user mode on the normal kernel stack. This will make some nested NMIs visible to C code, but the C code is okay with that. As a side effect, this should speed up perf: it eliminates an RDMSR when NMIs come from user mode. Fixes CVE-2015-3290. Reviewed-by: Steven Rostedt <rostedt@goodmis.org> Reviewed-by: Borislav Petkov <bp@suse.de> Signed-off-by: Andy Lutomirski <luto@kernel.org> [bwh: Backported to 4.0: - Adjust filename, context - s/restore_c_regs_and_iret/restore_args/ - Use kernel_stack + KERNEL_STACK_OFFSET instead of cpu_current_top_of_stack] [luto: Open-coded return path to avoid dependency on partial pt_regs details] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Andy Lutomirski <luto@kernel.org> Acked-by: John Johansen <john.johansen@canonical.com> Acked-by: Andy Whitcroft <apw@canonical.com> CVE-2015-3290, CVE-2015-5157 Signed-off-by: Luis Henriques <luis.henriques@canonical.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- arch/x86/kernel/entry_64.S | 79 +++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 75 insertions(+), 4 deletions(-) diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S index edffe680..b889daf 100644 --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1472,19 +1472,90 @@ ENTRY(nmi) * a nested NMI that updated the copy interrupt stack frame, a * jump will be made to the repeat_nmi code that will handle the second * NMI. + * + * However, espfix prevents us from directly returning to userspace + * with a single IRET instruction. Similarly, IRET to user mode + * can fault. We therefore handle NMIs from user space like + * other IST entries. */ /* Use %rdx as out temp variable throughout */ pushq_cfi %rdx CFI_REL_OFFSET rdx, 0 + testb $3, CS-RIP+8(%rsp) + jz .Lnmi_from_kernel + /* - * If %cs was not the kernel segment, then the NMI triggered in user - * space, which means it is definitely not nested. + * NMI from user mode. We need to run on the thread stack, but we + * can't go through the normal entry paths: NMIs are masked, and + * we don't want to enable interrupts, because then we'll end + * up in an awkward situation in which IRQs are on but NMIs + * are off. */ - cmpl $__KERNEL_CS, 16(%rsp) - jne first_nmi + SWAPGS + cld + movq %rsp, %rdx + movq PER_CPU_VAR(kernel_stack), %rsp + addq $KERNEL_STACK_OFFSET, %rsp + pushq 5*8(%rdx) /* pt_regs->ss */ + pushq 4*8(%rdx) /* pt_regs->rsp */ + pushq 3*8(%rdx) /* pt_regs->flags */ + pushq 2*8(%rdx) /* pt_regs->cs */ + pushq 1*8(%rdx) /* pt_regs->rip */ + pushq $-1 /* pt_regs->orig_ax */ + pushq %rdi /* pt_regs->di */ + pushq %rsi /* pt_regs->si */ + pushq (%rdx) /* pt_regs->dx */ + pushq %rcx /* pt_regs->cx */ + pushq %rax /* pt_regs->ax */ + pushq %r8 /* pt_regs->r8 */ + pushq %r9 /* pt_regs->r9 */ + pushq %r10 /* pt_regs->r10 */ + pushq %r11 /* pt_regs->r11 */ + pushq %rbx /* pt_regs->rbx */ + pushq %rbp /* pt_regs->rbp */ + pushq %r12 /* pt_regs->r12 */ + pushq %r13 /* pt_regs->r13 */ + pushq %r14 /* pt_regs->r14 */ + pushq %r15 /* pt_regs->r15 */ + + /* + * At this point we no longer need to worry about stack damage + * due to nesting -- we're on the normal thread stack and we're + * done with the NMI stack. + */ + + movq %rsp, %rdi + movq $-1, %rsi + call do_nmi + + /* + * Return back to user mode. We must *not* do the normal exit + * work, because we don't want to enable interrupts. Fortunately, + * do_nmi doesn't modify pt_regs. + */ + SWAPGS + + /* + * Open-code the entire return process for compatibility with varying + * register layouts across different kernel versions. + */ + addq $6*8, %rsp /* skip bx, bp, and r12-r15 */ + popq %r11 /* pt_regs->r11 */ + popq %r10 /* pt_regs->r10 */ + popq %r9 /* pt_regs->r9 */ + popq %r8 /* pt_regs->r8 */ + popq %rax /* pt_regs->ax */ + popq %rcx /* pt_regs->cx */ + popq %rdx /* pt_regs->dx */ + popq %rsi /* pt_regs->si */ + popq %rdi /* pt_regs->di */ + addq $8, %rsp /* skip orig_ax */ + INTERRUPT_RETURN + +.Lnmi_from_kernel: /* * Check the special variable on the stack to see if NMIs are * executing. -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 002/107] evm: labeling pseudo filesystems exception |
| Message-ID | <pUfmb-6lp-43@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Mimi Zohar <zohar@linux.vnet.ibm.com> commit 5101a1850bb7ccbf107929dee9af0cd2f400940f upstream. To prevent offline stripping of existing file xattrs and relabeling of them at runtime, EVM allows only newly created files to be labeled. As pseudo filesystems are not persistent, stripping of xattrs is not a concern. Some LSMs defer file labeling on pseudo filesystems. This patch permits the labeling of existing files on pseudo files systems. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- security/integrity/evm/evm_main.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index f589c9a0..02c6e4d 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -296,6 +296,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, iint = integrity_iint_find(dentry->d_inode); if (iint && (iint->flags & IMA_NEW_FILE)) return 0; + + /* exception for pseudo filesystems */ + if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC + || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC) + return 0; + + integrity_audit_msg(AUDIT_INTEGRITY_METADATA, + dentry->d_inode, dentry->d_name.name, + "update_metadata", + integrity_status_msg[evm_status], + -EPERM, 0); } out: if (evm_status != INTEGRITY_PASS) -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 014/107] Btrfs: fix race between caching kthread and returning inode to inode cache |
| Message-ID | <pUfmb-6lp-49@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit ae9d8f17118551bedd797406a6768b87c2146234 upstream.
While the inode cache caching kthread is calling btrfs_unpin_free_ino(),
we could have a concurrent call to btrfs_return_ino() that adds a new
entry to the root's free space cache of pinned inodes. This concurrent
call does not acquire the fs_info->commit_root_sem before adding a new
entry if the caching state is BTRFS_CACHE_FINISHED, which is a problem
because the caching kthread calls btrfs_unpin_free_ino() after setting
the caching state to BTRFS_CACHE_FINISHED and therefore races with
the task calling btrfs_return_ino(), which is adding a new entry, while
the former (caching kthread) is navigating the cache's rbtree, removing
and freeing nodes from the cache's rbtree without acquiring the spinlock
that protects the rbtree.
This race resulted in memory corruption due to double free of struct
btrfs_free_space objects because both tasks can end up doing freeing the
same objects. Note that adding a new entry can result in merging it with
other entries in the cache, in which case those entries are freed.
This is particularly important as btrfs_free_space structures are also
used for the block group free space caches.
This memory corruption can be detected by a debugging kernel, which
reports it with the following trace:
[132408.501148] slab error in verify_redzone_free(): cache `btrfs_free_space': double free detected
[132408.505075] CPU: 15 PID: 12248 Comm: btrfs-ino-cache Tainted: G W 4.1.0-rc5-btrfs-next-10+ #1
[132408.505075] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
[132408.505075] ffff880023e7d320 ffff880163d73cd8 ffffffff8145eec7 ffffffff81095dce
[132408.505075] ffff880009735d40 ffff880163d73ce8 ffffffff81154e1e ffff880163d73d68
[132408.505075] ffffffff81155733 ffffffffa054a95a ffff8801b6099f00 ffffffffa0505b5f
[132408.505075] Call Trace:
[132408.505075] [<ffffffff8145eec7>] dump_stack+0x4f/0x7b
[132408.505075] [<ffffffff81095dce>] ? console_unlock+0x356/0x3a2
[132408.505075] [<ffffffff81154e1e>] __slab_error.isra.28+0x25/0x36
[132408.505075] [<ffffffff81155733>] __cache_free+0xe2/0x4b6
[132408.505075] [<ffffffffa054a95a>] ? __btrfs_add_free_space+0x2f0/0x343 [btrfs]
[132408.505075] [<ffffffffa0505b5f>] ? btrfs_unpin_free_ino+0x8e/0x99 [btrfs]
[132408.505075] [<ffffffff810f3b30>] ? time_hardirqs_off+0x15/0x28
[132408.505075] [<ffffffff81084d42>] ? trace_hardirqs_off+0xd/0xf
[132408.505075] [<ffffffff811563a1>] ? kfree+0xb6/0x14e
[132408.505075] [<ffffffff811563d0>] kfree+0xe5/0x14e
[132408.505075] [<ffffffffa0505b5f>] btrfs_unpin_free_ino+0x8e/0x99 [btrfs]
[132408.505075] [<ffffffffa0505e08>] caching_kthread+0x29e/0x2d9 [btrfs]
[132408.505075] [<ffffffffa0505b6a>] ? btrfs_unpin_free_ino+0x99/0x99 [btrfs]
[132408.505075] [<ffffffff8106698f>] kthread+0xef/0xf7
[132408.505075] [<ffffffff810f3b08>] ? time_hardirqs_on+0x15/0x28
[132408.505075] [<ffffffff810668a0>] ? __kthread_parkme+0xad/0xad
[132408.505075] [<ffffffff814653d2>] ret_from_fork+0x42/0x70
[132408.505075] [<ffffffff810668a0>] ? __kthread_parkme+0xad/0xad
[132408.505075] ffff880023e7d320: redzone 1:0x9f911029d74e35b, redzone 2:0x9f911029d74e35b.
[132409.501654] slab: double free detected in cache 'btrfs_free_space', objp ffff880023e7d320
[132409.503355] ------------[ cut here ]------------
[132409.504241] kernel BUG at mm/slab.c:2571!
Therefore fix this by having btrfs_unpin_free_ino() acquire the lock
that protects the rbtree while doing the searches and removing entries.
Fixes: 1c70d8fb4dfa ("Btrfs: fix inode caching vs tree log")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/btrfs/inode-map.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index 0e4e46e..66fd3ec 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -246,6 +246,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
{
struct btrfs_free_space_ctl *ctl = root->free_ino_ctl;
struct rb_root *rbroot = &root->free_ino_pinned->free_space_offset;
+ spinlock_t *rbroot_lock = &root->free_ino_pinned->tree_lock;
struct btrfs_free_space *info;
struct rb_node *n;
u64 count;
@@ -254,23 +255,29 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
return;
while (1) {
+ bool add_to_ctl = true;
+
+ spin_lock(rbroot_lock);
n = rb_first(rbroot);
- if (!n)
+ if (!n) {
+ spin_unlock(rbroot_lock);
break;
+ }
info = rb_entry(n, struct btrfs_free_space, offset_index);
BUG_ON(info->bitmap); /* Logic error */
if (info->offset > root->ino_cache_progress)
- goto free;
+ add_to_ctl = false;
else if (info->offset + info->bytes > root->ino_cache_progress)
count = root->ino_cache_progress - info->offset + 1;
else
count = info->bytes;
- __btrfs_add_free_space(ctl, info->offset, count);
-free:
rb_erase(&info->offset_index, rbroot);
+ spin_unlock(rbroot_lock);
+ if (add_to_ctl)
+ __btrfs_add_free_space(ctl, info->offset, count);
kmem_cache_free(btrfs_free_space_cachep, info);
}
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 009/107] x86/nmi/64: Reorder nested NMI checks |
| Message-ID | <pUfmc-6lp-55@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Andy Lutomirski <luto@kernel.org> commit a27507ca2d796cfa8d907de31ad730359c8a6d06 upstream. Check the repeat_nmi .. end_repeat_nmi special case first. The next patch will rework the RSP check and, as a side effect, the RSP check will no longer detect repeat_nmi .. end_repeat_nmi, so we'll need this ordering of the checks. Note: this is more subtle than it appears. The check for repeat_nmi .. end_repeat_nmi jumps straight out of the NMI code instead of adjusting the "iret" frame to force a repeat. This is necessary, because the code between repeat_nmi and end_repeat_nmi sets "NMI executing" and then writes to the "iret" frame itself. If a nested NMI comes in and modifies the "iret" frame while repeat_nmi is also modifying it, we'll end up with garbage. The old code got this right, as does the new code, but the new code is a bit more explicit. If we were to move the check right after the "NMI executing" check, then we'd get it wrong and have random crashes. This is a prerequisite for the fix for CVE-2015-3291. Signed-off-by: Andy Lutomirski <luto@kernel.org> [bwh: Backported to 4.0: adjust filename, spacing] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Acked-by: John Johansen <john.johansen@canonical.com> Acked-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Luis Henriques <luis.henriques@canonical.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- arch/x86/kernel/entry_64.S | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S index 21a8acf..5dc89ed 100644 --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1601,7 +1601,24 @@ ENTRY(nmi) /* * Determine whether we're a nested NMI. * - * First check "NMI executing". If it's set, then we're nested. + * If we interrupted kernel code between repeat_nmi and + * end_repeat_nmi, then we are a nested NMI. We must not + * modify the "iret" frame because it's being written by + * the outer NMI. That's okay: the outer NMI handler is + * about to about to call do_nmi anyway, so we can just + * resume the outer NMI. + */ + + movq $repeat_nmi, %rdx + cmpq 8(%rsp), %rdx + ja 1f + movq $end_repeat_nmi, %rdx + cmpq 8(%rsp), %rdx + ja nested_nmi_out +1: + + /* + * Now check "NMI executing". If it's set, then we're nested. * This will not detect if we interrupted an outer NMI just * before IRET. */ @@ -1628,21 +1645,6 @@ ENTRY(nmi) nested_nmi: /* - * If we interrupted an NMI that is between repeat_nmi and - * end_repeat_nmi, then we must not modify the "iret" frame - * because it's being written by the outer NMI. That's okay: - * the outer NMI handler is about to call do_nmi anyway, - * so we can just resume the outer NMI. - */ - movq $repeat_nmi, %rdx - cmpq 8(%rsp), %rdx - ja 1f - movq $end_repeat_nmi, %rdx - cmpq 8(%rsp), %rdx - ja nested_nmi_out - -1: - /* * Modify the "iret" frame to point to repeat_nmi, forcing another * iteration of NMI handling. */ -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:30 +0200 |
| Subject | [PATCH 3.19.y-ckt 010/107] x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection |
| Message-ID | <pUfmc-6lp-57@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Andy Lutomirski <luto@kernel.org> commit 810bc075f78ff2c221536eb3008eac6a492dba2d upstream. We have a tricky bug in the nested NMI code: if we see RSP pointing to the NMI stack on NMI entry from kernel mode, we assume that we are executing a nested NMI. This isn't quite true. A malicious userspace program can point RSP at the NMI stack, issue SYSCALL, and arrange for an NMI to happen while RSP is still pointing at the NMI stack. Fix it with a sneaky trick. Set DF in the region of code that the RSP check is intended to detect. IRET will clear DF atomically. (Note: other than paravirt, there's little need for all this complexity. We could check RIP instead of RSP.) Fixes CVE-2015-3291. Reviewed-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Andy Lutomirski <luto@kernel.org> [bwh: Backported to 4.0: adjust filename, context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Acked-by: John Johansen <john.johansen@canonical.com> Acked-by: Andy Whitcroft <apw@canonical.com> CVE-2015-3291 Signed-off-by: Luis Henriques <luis.henriques@canonical.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- arch/x86/kernel/entry_64.S | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S index 5dc89ed..138e7af 100644 --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1628,7 +1628,14 @@ ENTRY(nmi) /* * Now test if the previous stack was an NMI stack. This covers * the case where we interrupt an outer NMI after it clears - * "NMI executing" but before IRET. + * "NMI executing" but before IRET. We need to be careful, though: + * there is one case in which RSP could point to the NMI stack + * despite there being no NMI active: naughty userspace controls + * RSP at the very beginning of the SYSCALL targets. We can + * pull a fast one on naughty userspace, though: we program + * SYSCALL to mask DF, so userspace cannot cause DF to be set + * if it controls the kernel's RSP. We set DF before we clear + * "NMI executing". */ lea 6*8(%rsp), %rdx /* Compare the NMI stack (rdx) with the stack we came from (4*8(%rsp)) */ @@ -1639,10 +1646,16 @@ ENTRY(nmi) cmpq %rdx, 4*8(%rsp) /* If it is below the NMI stack, it is a normal NMI */ jb first_nmi - /* Ah, it is within the NMI stack, treat it as nested */ + + /* Ah, it is within the NMI stack. */ + + testb $(X86_EFLAGS_DF >> 8), (3*8 + 1)(%rsp) + jz first_nmi /* RSP was user controlled. */ CFI_REMEMBER_STATE + /* This is a nested NMI. */ + nested_nmi: /* * Modify the "iret" frame to point to repeat_nmi, forcing another @@ -1754,8 +1767,16 @@ nmi_restore: RESTORE_ALL 6*8 - /* Clear "NMI executing". */ - movq $0, 5*8(%rsp) + /* + * Clear "NMI executing". Set DF first so that we can easily + * distinguish the remaining code between here and IRET from + * the SYSCALL entry and exit paths. On a native kernel, we + * could just inspect RIP, but, on paravirt kernels, + * INTERRUPT_RETURN can translate into a jump into a + * hypercall page. + */ + std + movq $0, 5*8(%rsp) /* clear "NMI executing" */ /* * INTERRUPT_RETURN reads the "iret" frame and exits the NMI -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Page 6 of 6 — ← Prev page 1 2 3 4 5 [6]
Back to top | Article view | linux.kernel
csiph-web