Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1320067 > unrolled thread

[PATCH 4.4 00/67] 4.4.1-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.4 00/67] 4.4.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 23:20 +0100
    [PATCH 4.4 02/67] x86/xen: dont reset vcpu_info on a cancelled suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 23:20 +0100
    [PATCH 4.4 04/67] KVM: x86: correctly print #AC in traces Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 23:20 +0100
    [PATCH 4.4 19/67] ALSA: timer: Fix race among timer ioctls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 23:20 +0100
    [PATCH 4.4 17/67] ALSA: timer: Harden slave timer list handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 23:20 +0100
    [PATCH 4.4 22/67] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 23:20 +0100
    [PATCH 4.4 24/67] ALSA: hrtimer: Fix stall by hrtimer_cancel() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 23:20 +0100
    Re: [PATCH 4.4 00/67] 4.4.1-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-01-28 00:30 +0100
    Re: [PATCH 4.4 00/67] 4.4.1-stable review Guenter Roeck <linux@roeck-us.net> - 2016-01-28 03:30 +0100
      Re: [PATCH 4.4 00/67] 4.4.1-stable review Guenter Roeck <linux@roeck-us.net> - 2016-01-28 04:30 +0100
        Re: [PATCH 4.4 00/67] 4.4.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-31 20:20 +0100
          Re: [PATCH 4.4 00/67] 4.4.1-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-01 03:50 +0100

#1320067 — [PATCH 4.4 00/67] 4.4.1-stable review

-------------------------
NOTE:
  There are still a lot of pending stable patches in the queue, well
  over 400 of them to be specific, so some of your favorite/pet patches
  might not be included in these releases.  Please be patient as I dig
  out from this backlog over the next few weeks.  If there are specific
  patches that you just _must_ have included in a stable release soon,
  please let me know.
-------------------------

This is the start of the stable review cycle for the 4.4.1 release.
There are 67 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Fri Jan 29 18:08:16 UTC 2016.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.1-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.4.1-rc1

Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
    arm64: kernel: enforce pmuserenr_el0 initialization and restore

Will Deacon <will.deacon@arm.com>
    arm64: mm: ensure that the zero page is visible to the page table walker

John Blackwood <john.blackwood@ccur.com>
    arm64: Clear out any singlestep state on a ptrace detach operation

Ulrich Weigand <ulrich.weigand@de.ibm.com>
    powerpc/module: Handle R_PPC64_ENTRY relocations

Ulrich Weigand <ulrich.weigand@de.ibm.com>
    scripts/recordmcount.pl: support data in text section on powerpc

Boqun Feng <boqun.feng@gmail.com>
    powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered

Boqun Feng <boqun.feng@gmail.com>
    powerpc: Make value-returning atomics fully ordered

Michael Neuling <mikey@neuling.org>
    powerpc/tm: Check for already reclaimed tasks

Sven Eckelmann <sven@narfation.org>
    batman-adv: Drop immediate orig_node free function

Sven Eckelmann <sven@narfation.org>
    batman-adv: Drop immediate batadv_hard_iface free function

Sven Eckelmann <sven@narfation.org>
    batman-adv: Drop immediate neigh_ifinfo free function

Sven Eckelmann <sven@narfation.org>
    batman-adv: Drop immediate batadv_neigh_node free function

Sven Eckelmann <sven@narfation.org>
    batman-adv: Drop immediate batadv_orig_ifinfo free function

Sven Eckelmann <sven@narfation.org>
    batman-adv: Avoid recursive call_rcu for batadv_nc_node

Sven Eckelmann <sven@narfation.org>
    batman-adv: Avoid recursive call_rcu for batadv_bla_claim

Ido Schimmel <idosch@mellanox.com>
    team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid

Doron Tsur <doront@mellanox.com>
    net/mlx5_core: Fix trimming down IRQ number

Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    bridge: fix lockdep addr_list_lock false positive splat

Eric Dumazet <edumazet@google.com>
    ipv6: update skb->csum when CE mark is propagated

Rabin Vincent <rabin@rab.in>
    net: bpf: reject invalid shifts

Eric Dumazet <edumazet@google.com>
    phonet: properly unshare skbs in phonet_rcv()

Lars Persson <lars.persson@axis.com>
    dwc_eth_qos: Fix dma address for multi-fragment skbs

Karl Heiss <kheiss@gmail.com>
    bonding: Prevent IPv6 link local address on enslaved devices

Konstantin Khlebnikov <koct9i@gmail.com>
    net: preserve IP control block during GSO segmentation

Michal Kubeček <mkubecek@suse.cz>
    udp: disallow UFO for sockets with SO_NO_CHECK option

John Fastabend <john.fastabend@gmail.com>
    net: pktgen: fix null ptr deref in skb allocation

Jamal Hadi Salim <jhs@mojatatu.com>
    sched,cls_flower: set key address type when present

Neal Cardwell <ncardwell@google.com>
    tcp_yeah: don't set ssthresh below 2

Eric Dumazet <edumazet@google.com>
    ipv6: tcp: add rcu locking in tcp_v6_send_synack()

Sasha Levin <sasha.levin@oracle.com>
    net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    vxlan: fix test which detect duplicate vxlan iface

willy tarreau <w@1wt.eu>
    unix: properly account for FDs passed over unix sockets

Oliver Neukum <oneukum@suse.com>
    xhci: refuse loading if nousb is used

Lu Baolu <baolu.lu@linux.intel.com>
    usb: core: lpm: fix usb3_hardware_lpm sysfs node

Oliver Freyermuth <o.freyermuth@googlemail.com>
    USB: cp210x: add ID for ELV Marble Sound Board 1

Peter Wu <peter@lekensteyn.nl>
    rtlwifi: fix memory leak for USB device

Vinod Koul <vinod.koul@intel.com>
    ASoC: compress: Fix compress device direction check

Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    ASoC: wm5110: Fix PGA clear when disabling DRE

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Handle disconnection more safely

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Flush the pending probe work at remove

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix missing module loading with model=generic option

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix bass pin fixup for ASUS N550JX

Takashi Iwai <tiwai@suse.de>
    ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0

Takashi Iwai <tiwai@suse.de>
    ALSA: hrtimer: Fix stall by hrtimer_cancel()

Nicolas Boichat <drinkcat@chromium.org>
    ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode

Nicolas Boichat <drinkcat@chromium.org>
    ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Add fixup for Dell Latitidue E6540

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Fix double unlink of active_list

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Fix race among timer ioctls

Hui Wang <hui.wang@canonical.com>
    ALSA: hda - fix the headset mic detection problem for a Dell laptop

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Harden slave timer list handling

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Fix mixer ctl regression of Native Instrument devices

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix white noise on Dell Latitude E5550

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Fix race at timer setup and close

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Avoid calling usb_autopm_put_interface() at disconnect

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Fix missing NULL check at remove_events ioctl

David Henningsson <david.henningsson@canonical.com>
    ALSA: hda - Fixup inverted internal mic for Lenovo E50-80

Jurgen Kramer <gtmkramer@xs4all.nl>
    ALSA: usb: Add native DSD support for Oppo HA-1

Andy Lutomirski <luto@kernel.org>
    x86/mm: Improve switch_mm() barrier comments

Andy Lutomirski <luto@kernel.org>
    x86/mm: Add barriers and document switch_mm()-vs-flush synchronization

H.J. Lu <hjl.tools@gmail.com>
    x86/boot: Double BOOT_HEAP_SIZE to 64KB

Mario Kleiner <mario.kleiner.de@gmail.com>
    x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]

Huaitong Han <huaitong.han@intel.com>
    kvm: x86: Fix vmwrite to SECONDARY_VM_EXEC_CONTROL

Paolo Bonzini <pbonzini@redhat.com>
    KVM: x86: correctly print #AC in traces

Paolo Bonzini <pbonzini@redhat.com>
    KVM: x86: expose MSR_TSC_AUX to userspace

Ouyang Zhaowei (Charles) <ouyangzhaowei@huawei.com>
    x86/xen: don't reset vcpu_info on a cancelled suspend

Yevgeny Pats <yevgeny@perception-point.io>
    KEYS: Fix keyring ref leak in join_session_keyring()


-------------

Diffstat:

 Documentation/ABI/testing/sysfs-bus-usb           |  16 ++-
 Documentation/usb/power-management.txt            |  11 +-
 Makefile                                          |   4 +-
 arch/arm64/kernel/perf_event.c                    |   3 -
 arch/arm64/kernel/ptrace.c                        |   6 +
 arch/arm64/mm/mmu.c                               |   3 +
 arch/arm64/mm/proc.S                              |   2 +
 arch/powerpc/include/asm/cmpxchg.h                |  16 +--
 arch/powerpc/include/asm/synch.h                  |   2 +-
 arch/powerpc/include/uapi/asm/elf.h               |   2 +
 arch/powerpc/kernel/module_64.c                   |  27 ++++
 arch/powerpc/kernel/process.c                     |  18 +++
 arch/x86/include/asm/boot.h                       |   2 +-
 arch/x86/include/asm/mmu_context.h                |  34 ++++-
 arch/x86/kernel/reboot.c                          |   8 ++
 arch/x86/kvm/trace.h                              |   2 +-
 arch/x86/kvm/vmx.c                                |   3 +-
 arch/x86/kvm/x86.c                                |  11 +-
 arch/x86/mm/tlb.c                                 |  29 ++++-
 arch/x86/xen/suspend.c                            |   3 +-
 drivers/infiniband/hw/mlx5/cq.c                   |   2 +-
 drivers/net/bonding/bond_main.c                   |   5 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c |   6 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c    |   3 +-
 drivers/net/ethernet/synopsys/dwc_eth_qos.c       |   2 +-
 drivers/net/team/team.c                           |   6 +-
 drivers/net/vxlan.c                               |  12 +-
 drivers/net/wireless/realtek/rtlwifi/usb.c        |   2 +
 drivers/usb/core/hub.c                            |  39 ++++--
 drivers/usb/core/sysfs.c                          |  31 ++++-
 drivers/usb/host/xhci.c                           |   4 +
 drivers/usb/serial/cp210x.c                       |   1 +
 include/linux/mlx5/cq.h                           |   2 +-
 include/linux/mlx5/driver.h                       |   5 +-
 include/linux/sched.h                             |   1 +
 include/linux/skbuff.h                            |   3 +-
 include/linux/usb.h                               |   4 +
 include/net/inet_ecn.h                            |  19 ++-
 kernel/bpf/verifier.c                             |  10 ++
 net/batman-adv/bridge_loop_avoidance.c            |  10 +-
 net/batman-adv/hard-interface.h                   |  12 --
 net/batman-adv/network-coding.c                   |  19 ++-
 net/batman-adv/originator.c                       | 149 +++++++++-------------
 net/batman-adv/originator.h                       |   1 -
 net/batman-adv/translation-table.c                |  28 ++--
 net/bridge/br_device.c                            |   8 ++
 net/core/dev.c                                    |   5 +
 net/core/filter.c                                 |   5 +
 net/core/pktgen.c                                 |   4 +-
 net/ipv4/ip_output.c                              |   3 +-
 net/ipv4/tcp_yeah.c                               |   2 +-
 net/ipv6/ip6_output.c                             |   2 +-
 net/ipv6/tcp_ipv6.c                               |   2 +
 net/ipv6/xfrm6_mode_tunnel.c                      |   2 +-
 net/openvswitch/datapath.c                        |   5 +-
 net/phonet/af_phonet.c                            |   4 +
 net/sched/cls_flower.c                            |  10 +-
 net/sctp/sysctl.c                                 |   2 +-
 net/unix/af_unix.c                                |  24 +++-
 net/unix/garbage.c                                |  13 +-
 net/xfrm/xfrm_output.c                            |   2 +
 scripts/recordmcount.pl                           |   3 +-
 security/keys/process_keys.c                      |   1 +
 sound/core/control.c                              |   2 +
 sound/core/hrtimer.c                              |   3 +-
 sound/core/pcm_compat.c                           |  13 +-
 sound/core/seq/seq_clientmgr.c                    |   2 +-
 sound/core/seq/seq_compat.c                       |   9 +-
 sound/core/seq/seq_queue.c                        |   2 +
 sound/core/timer.c                                | 100 ++++++++++++---
 sound/pci/hda/hda_bind.c                          |  42 ++++--
 sound/pci/hda/hda_intel.c                         |  10 +-
 sound/pci/hda/patch_realtek.c                     |  15 +++
 sound/soc/codecs/wm5110.c                         |   8 +-
 sound/soc/soc-compress.c                          |  23 +++-
 sound/usb/card.c                                  |   2 +
 sound/usb/mixer_quirks.c                          |   2 +-
 sound/usb/quirks.c                                |   1 +
 78 files changed, 628 insertions(+), 281 deletions(-)

[toc] | [next] | [standalone]

#1320068 — [PATCH 4.4 02/67] x86/xen: dont reset vcpu_info on a cancelled suspend

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Ouyang Zhaowei (Charles)" <ouyangzhaowei@huawei.com>

commit 6a1f513776b78c994045287073e55bae44ed9f8c upstream.

On a cancelled suspend the vcpu_info location does not change (it's
still in the per-cpu area registered by xen_vcpu_setup()).  So do not
call xen_hvm_init_shared_info() which would make the kernel think its
back in the shared info.  With the wrong vcpu_info, events cannot be
received and the domain will hang after a cancelled suspend.

Signed-off-by: Charles Ouyang <ouyangzhaowei@huawei.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/xen/suspend.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/arch/x86/xen/suspend.c
+++ b/arch/x86/xen/suspend.c
@@ -34,7 +34,8 @@ static void xen_hvm_post_suspend(int sus
 {
 #ifdef CONFIG_XEN_PVHVM
 	int cpu;
-	xen_hvm_init_shared_info();
+	if (!suspend_cancelled)
+	    xen_hvm_init_shared_info();
 	xen_callback_vector();
 	xen_unplug_emulated_devices();
 	if (xen_feature(XENFEAT_hvm_safe_pvclock)) {

[toc] | [prev] | [next] | [standalone]

#1320069 — [PATCH 4.4 04/67] KVM: x86: correctly print #AC in traces

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paolo Bonzini <pbonzini@redhat.com>

commit aba2f06c070f604e388cf77b1dcc7f4cf4577eb0 upstream.

Poor #AC was so unimportant until a few days ago that we were
not even tracing its name correctly.  But now it's all over
the place.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/trace.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -268,7 +268,7 @@ TRACE_EVENT(kvm_inj_virq,
 #define kvm_trace_sym_exc						\
 	EXS(DE), EXS(DB), EXS(BP), EXS(OF), EXS(BR), EXS(UD), EXS(NM),	\
 	EXS(DF), EXS(TS), EXS(NP), EXS(SS), EXS(GP), EXS(PF),		\
-	EXS(MF), EXS(MC)
+	EXS(MF), EXS(AC), EXS(MC)
 
 /*
  * Tracepoint for kvm interrupt injection:

[toc] | [prev] | [next] | [standalone]

#1320071 — [PATCH 4.4 19/67] ALSA: timer: Fix race among timer ioctls

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit af368027a49a751d6ff4ee9e3f9961f35bb4fede upstream.

ALSA timer ioctls have an open race and this may lead to a
use-after-free of timer instance object.  A simplistic fix is to make
each ioctl exclusive.  We have already tread_sem for controlling the
tread, and extend this as a global mutex to be applied to each ioctl.

The downside is, of course, the worse concurrency.  But these ioctls
aren't to be parallel accessible, in anyway, so it should be fine to
serialize there.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/timer.c |   32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -73,7 +73,7 @@ struct snd_timer_user {
 	struct timespec tstamp;		/* trigger tstamp */
 	wait_queue_head_t qchange_sleep;
 	struct fasync_struct *fasync;
-	struct mutex tread_sem;
+	struct mutex ioctl_lock;
 };
 
 /* list of timers */
@@ -1263,7 +1263,7 @@ static int snd_timer_user_open(struct in
 		return -ENOMEM;
 	spin_lock_init(&tu->qlock);
 	init_waitqueue_head(&tu->qchange_sleep);
-	mutex_init(&tu->tread_sem);
+	mutex_init(&tu->ioctl_lock);
 	tu->ticks = 1;
 	tu->queue_size = 128;
 	tu->queue = kmalloc(tu->queue_size * sizeof(struct snd_timer_read),
@@ -1283,8 +1283,10 @@ static int snd_timer_user_release(struct
 	if (file->private_data) {
 		tu = file->private_data;
 		file->private_data = NULL;
+		mutex_lock(&tu->ioctl_lock);
 		if (tu->timeri)
 			snd_timer_close(tu->timeri);
+		mutex_unlock(&tu->ioctl_lock);
 		kfree(tu->queue);
 		kfree(tu->tqueue);
 		kfree(tu);
@@ -1522,7 +1524,6 @@ static int snd_timer_user_tselect(struct
 	int err = 0;
 
 	tu = file->private_data;
-	mutex_lock(&tu->tread_sem);
 	if (tu->timeri) {
 		snd_timer_close(tu->timeri);
 		tu->timeri = NULL;
@@ -1566,7 +1567,6 @@ static int snd_timer_user_tselect(struct
 	}
 
       __err:
-      	mutex_unlock(&tu->tread_sem);
 	return err;
 }
 
@@ -1779,7 +1779,7 @@ enum {
 	SNDRV_TIMER_IOCTL_PAUSE_OLD = _IO('T', 0x23),
 };
 
-static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
+static long __snd_timer_user_ioctl(struct file *file, unsigned int cmd,
 				 unsigned long arg)
 {
 	struct snd_timer_user *tu;
@@ -1796,17 +1796,11 @@ static long snd_timer_user_ioctl(struct
 	{
 		int xarg;
 
-		mutex_lock(&tu->tread_sem);
-		if (tu->timeri)	{	/* too late */
-			mutex_unlock(&tu->tread_sem);
+		if (tu->timeri)	/* too late */
 			return -EBUSY;
-		}
-		if (get_user(xarg, p)) {
-			mutex_unlock(&tu->tread_sem);
+		if (get_user(xarg, p))
 			return -EFAULT;
-		}
 		tu->tread = xarg ? 1 : 0;
-		mutex_unlock(&tu->tread_sem);
 		return 0;
 	}
 	case SNDRV_TIMER_IOCTL_GINFO:
@@ -1839,6 +1833,18 @@ static long snd_timer_user_ioctl(struct
 	return -ENOTTY;
 }
 
+static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
+				 unsigned long arg)
+{
+	struct snd_timer_user *tu = file->private_data;
+	long ret;
+
+	mutex_lock(&tu->ioctl_lock);
+	ret = __snd_timer_user_ioctl(file, cmd, arg);
+	mutex_unlock(&tu->ioctl_lock);
+	return ret;
+}
+
 static int snd_timer_user_fasync(int fd, struct file * file, int on)
 {
 	struct snd_timer_user *tu;

[toc] | [prev] | [next] | [standalone]

#1320072 — [PATCH 4.4 17/67] ALSA: timer: Harden slave timer list handling

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit b5a663aa426f4884c71cd8580adae73f33570f0d upstream.

A slave timer instance might be still accessible in a racy way while
operating the master instance as it lacks of locking.  Since the
master operation is mostly protected with timer->lock, we should cope
with it while changing the slave instance, too.  Also, some linked
lists (active_list and ack_list) of slave instances aren't unlinked
immediately at stopping or closing, and this may lead to unexpected
accesses.

This patch tries to address these issues.  It adds spin lock of
timer->lock (either from master or slave, which is equivalent) in a
few places.  For avoiding a deadlock, we ensure that the global
slave_active_lock is always locked at first before each timer lock.

Also, ack and active_list of slave instances are properly unlinked at
snd_timer_stop() and snd_timer_close().

Last but not least, remove the superfluous call of _snd_timer_stop()
at removing slave links.  This is a noop, and calling it may confuse
readers wrt locking.  Further cleanup will follow in a later patch.

Actually we've got reports of use-after-free by syzkaller fuzzer, and
this hopefully fixes these issues.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/timer.c |   18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -215,11 +215,13 @@ static void snd_timer_check_master(struc
 		    slave->slave_id == master->slave_id) {
 			list_move_tail(&slave->open_list, &master->slave_list_head);
 			spin_lock_irq(&slave_active_lock);
+			spin_lock(&master->timer->lock);
 			slave->master = master;
 			slave->timer = master->timer;
 			if (slave->flags & SNDRV_TIMER_IFLG_RUNNING)
 				list_add_tail(&slave->active_list,
 					      &master->slave_active_head);
+			spin_unlock(&master->timer->lock);
 			spin_unlock_irq(&slave_active_lock);
 		}
 	}
@@ -346,15 +348,18 @@ int snd_timer_close(struct snd_timer_ins
 		    timer->hw.close)
 			timer->hw.close(timer);
 		/* remove slave links */
+		spin_lock_irq(&slave_active_lock);
+		spin_lock(&timer->lock);
 		list_for_each_entry_safe(slave, tmp, &timeri->slave_list_head,
 					 open_list) {
-			spin_lock_irq(&slave_active_lock);
-			_snd_timer_stop(slave, 1, SNDRV_TIMER_EVENT_RESOLUTION);
 			list_move_tail(&slave->open_list, &snd_timer_slave_list);
 			slave->master = NULL;
 			slave->timer = NULL;
-			spin_unlock_irq(&slave_active_lock);
+			list_del_init(&slave->ack_list);
+			list_del_init(&slave->active_list);
 		}
+		spin_unlock(&timer->lock);
+		spin_unlock_irq(&slave_active_lock);
 		mutex_unlock(&register_mutex);
 	}
  out:
@@ -441,9 +446,12 @@ static int snd_timer_start_slave(struct
 
 	spin_lock_irqsave(&slave_active_lock, flags);
 	timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
-	if (timeri->master)
+	if (timeri->master && timeri->timer) {
+		spin_lock(&timeri->timer->lock);
 		list_add_tail(&timeri->active_list,
 			      &timeri->master->slave_active_head);
+		spin_unlock(&timeri->timer->lock);
+	}
 	spin_unlock_irqrestore(&slave_active_lock, flags);
 	return 1; /* delayed start */
 }
@@ -489,6 +497,8 @@ static int _snd_timer_stop(struct snd_ti
 		if (!keep_flag) {
 			spin_lock_irqsave(&slave_active_lock, flags);
 			timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
+			list_del_init(&timeri->ack_list);
+			list_del_init(&timeri->active_list);
 			spin_unlock_irqrestore(&slave_active_lock, flags);
 		}
 		goto __end;

[toc] | [prev] | [next] | [standalone]

#1320078 — [PATCH 4.4 22/67] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Boichat <drinkcat@chromium.org>

commit 9586495dc3011a80602329094e746dbce16cb1f1 upstream.

This reverts one hunk of
commit ef44a1ec6eee ("ALSA: sound/core: use memdup_user()"), which
replaced a number of kmalloc followed by memcpy with memdup calls.

In this case, we are copying from a struct snd_seq_port_info32 to a
struct snd_seq_port_info, but the latter is 4 bytes longer than the
32-bit version, so we need to separate kmalloc and copy calls.

Fixes: ef44a1ec6eee ('ALSA: sound/core: use memdup_user()')
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/seq/seq_compat.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/sound/core/seq/seq_compat.c
+++ b/sound/core/seq/seq_compat.c
@@ -49,11 +49,12 @@ static int snd_seq_call_port_info_ioctl(
 	struct snd_seq_port_info *data;
 	mm_segment_t fs;
 
-	data = memdup_user(data32, sizeof(*data32));
-	if (IS_ERR(data))
-		return PTR_ERR(data);
+	data = kmalloc(sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
 
-	if (get_user(data->flags, &data32->flags) ||
+	if (copy_from_user(data, data32, sizeof(*data32)) ||
+	    get_user(data->flags, &data32->flags) ||
 	    get_user(data->time_queue, &data32->time_queue))
 		goto error;
 	data->kernel = NULL;

[toc] | [prev] | [next] | [standalone]

#1320080 — [PATCH 4.4 24/67] ALSA: hrtimer: Fix stall by hrtimer_cancel()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 2ba1fe7a06d3624f9a7586d672b55f08f7c670f3 upstream.

hrtimer_cancel() waits for the completion from the callback, thus it
must not be called inside the callback itself.  This was already a
problem in the past with ALSA hrtimer driver, and the early commit
[fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it.

However, the previous fix is still insufficient: it may still cause a
lockup when the ALSA timer instance reprograms itself in its callback.
Then it invokes the start function even in snd_timer_interrupt() that
is called in hrtimer callback itself, results in a CPU stall.  This is
no hypothetical problem but actually triggered by syzkaller fuzzer.

This patch tries to fix the issue again.  Now we call
hrtimer_try_to_cancel() at both start and stop functions so that it
won't fall into a deadlock, yet giving some chance to cancel the queue
if the functions have been called outside the callback.  The proper
hrtimer_cancel() is called in anyway at closing, so this should be
enough.

Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/hrtimer.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/sound/core/hrtimer.c
+++ b/sound/core/hrtimer.c
@@ -90,7 +90,7 @@ static int snd_hrtimer_start(struct snd_
 	struct snd_hrtimer *stime = t->private_data;
 
 	atomic_set(&stime->running, 0);
-	hrtimer_cancel(&stime->hrt);
+	hrtimer_try_to_cancel(&stime->hrt);
 	hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution),
 		      HRTIMER_MODE_REL);
 	atomic_set(&stime->running, 1);
@@ -101,6 +101,7 @@ static int snd_hrtimer_stop(struct snd_t
 {
 	struct snd_hrtimer *stime = t->private_data;
 	atomic_set(&stime->running, 0);
+	hrtimer_try_to_cancel(&stime->hrt);
 	return 0;
 }
 

[toc] | [prev] | [next] | [standalone]

#1320132

On 01/27/2016 11:11 AM, Greg Kroah-Hartman wrote:
> -------------------------
> NOTE:
>   There are still a lot of pending stable patches in the queue, well
>   over 400 of them to be specific, so some of your favorite/pet patches
>   might not be included in these releases.  Please be patient as I dig
>   out from this backlog over the next few weeks.  If there are specific
>   patches that you just _must_ have included in a stable release soon,
>   please let me know.
> -------------------------
> 
> This is the start of the stable review cycle for the 4.4.1 release.
> There are 67 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Fri Jan 29 18:08:16 UTC 2016.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.1-rc1.gz
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions,

thanks,
-- Shuah


-- 
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978

[toc] | [prev] | [next] | [standalone]

#1320228

On 01/27/2016 10:11 AM, Greg Kroah-Hartman wrote:
> -------------------------
> NOTE:
>    There are still a lot of pending stable patches in the queue, well
>    over 400 of them to be specific, so some of your favorite/pet patches
>    might not be included in these releases.  Please be patient as I dig
>    out from this backlog over the next few weeks.  If there are specific
>    patches that you just _must_ have included in a stable release soon,
>    please let me know.
> -------------------------
>
> This is the start of the stable review cycle for the 4.4.1 release.
> There are 67 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri Jan 29 18:08:16 UTC 2016.
> Anything received after that time might be too late.
>
Build results:
	total: 145 pass: 145 fail: 0

Qemu test results:
	total: 96 pass: 94 fail: 2
Failed tests:
	arm64:smp:defconfig
	arm64:nosmp:defconfig

arm64 qemu test failures are the same as in v4.1.y, v4.3.y, and mainline.

Details are available at http://kerneltests.org/builders.

Guenter

[toc] | [prev] | [next] | [standalone]

#1320269

On 01/27/2016 06:23 PM, Guenter Roeck wrote:
> On 01/27/2016 10:11 AM, Greg Kroah-Hartman wrote:
>> -------------------------
>> NOTE:
>>    There are still a lot of pending stable patches in the queue, well
>>    over 400 of them to be specific, so some of your favorite/pet patches
>>    might not be included in these releases.  Please be patient as I dig
>>    out from this backlog over the next few weeks.  If there are specific
>>    patches that you just _must_ have included in a stable release soon,
>>    please let me know.
>> -------------------------
>>
>> This is the start of the stable review cycle for the 4.4.1 release.
>> There are 67 patches in this series, all will be posted as a response
>> to this one.  If anyone has any issues with these being applied, please
>> let me know.
>>
>> Responses should be made by Fri Jan 29 18:08:16 UTC 2016.
>> Anything received after that time might be too late.
>>
> Build results:
>      total: 145 pass: 145 fail: 0
>
> Qemu test results:
>      total: 96 pass: 94 fail: 2
> Failed tests:
>      arm64:smp:defconfig
>      arm64:nosmp:defconfig
>
> arm64 qemu test failures are the same as in v4.1.y, v4.3.y, and mainline.
>

Fix is now upstream, in case you want to apply it to v4.1 / v4.3 / v4.4.
Commit f436b2ac90a0 ("arm64: kernel: fix architected PMU registers
unconditional access").

Guenter

[toc] | [prev] | [next] | [standalone]

#1322718

On Wed, Jan 27, 2016 at 07:21:27PM -0800, Guenter Roeck wrote:
> On 01/27/2016 06:23 PM, Guenter Roeck wrote:
> >On 01/27/2016 10:11 AM, Greg Kroah-Hartman wrote:
> >>-------------------------
> >>NOTE:
> >>   There are still a lot of pending stable patches in the queue, well
> >>   over 400 of them to be specific, so some of your favorite/pet patches
> >>   might not be included in these releases.  Please be patient as I dig
> >>   out from this backlog over the next few weeks.  If there are specific
> >>   patches that you just _must_ have included in a stable release soon,
> >>   please let me know.
> >>-------------------------
> >>
> >>This is the start of the stable review cycle for the 4.4.1 release.
> >>There are 67 patches in this series, all will be posted as a response
> >>to this one.  If anyone has any issues with these being applied, please
> >>let me know.
> >>
> >>Responses should be made by Fri Jan 29 18:08:16 UTC 2016.
> >>Anything received after that time might be too late.
> >>
> >Build results:
> >     total: 145 pass: 145 fail: 0
> >
> >Qemu test results:
> >     total: 96 pass: 94 fail: 2
> >Failed tests:
> >     arm64:smp:defconfig
> >     arm64:nosmp:defconfig
> >
> >arm64 qemu test failures are the same as in v4.1.y, v4.3.y, and mainline.
> >
> 
> Fix is now upstream, in case you want to apply it to v4.1 / v4.3 / v4.4.
> Commit f436b2ac90a0 ("arm64: kernel: fix architected PMU registers
> unconditional access").

I've applied it to 4.3 and 4.4, but it doesn't apply to 4.1 at all :(

thanks,

greg k-h

[toc] | [prev] | [next] | [standalone]

#1322794

On 01/31/2016 11:17 AM, Greg Kroah-Hartman wrote:
> On Wed, Jan 27, 2016 at 07:21:27PM -0800, Guenter Roeck wrote:
>> On 01/27/2016 06:23 PM, Guenter Roeck wrote:
>>> On 01/27/2016 10:11 AM, Greg Kroah-Hartman wrote:
>>>> -------------------------
>>>> NOTE:
>>>>    There are still a lot of pending stable patches in the queue, well
>>>>    over 400 of them to be specific, so some of your favorite/pet patches
>>>>    might not be included in these releases.  Please be patient as I dig
>>>>    out from this backlog over the next few weeks.  If there are specific
>>>>    patches that you just _must_ have included in a stable release soon,
>>>>    please let me know.
>>>> -------------------------
>>>>
>>>> This is the start of the stable review cycle for the 4.4.1 release.
>>>> There are 67 patches in this series, all will be posted as a response
>>>> to this one.  If anyone has any issues with these being applied, please
>>>> let me know.
>>>>
>>>> Responses should be made by Fri Jan 29 18:08:16 UTC 2016.
>>>> Anything received after that time might be too late.
>>>>
>>> Build results:
>>>      total: 145 pass: 145 fail: 0
>>>
>>> Qemu test results:
>>>      total: 96 pass: 94 fail: 2
>>> Failed tests:
>>>      arm64:smp:defconfig
>>>      arm64:nosmp:defconfig
>>>
>>> arm64 qemu test failures are the same as in v4.1.y, v4.3.y, and mainline.
>>>
>>
>> Fix is now upstream, in case you want to apply it to v4.1 / v4.3 / v4.4.
>> Commit f436b2ac90a0 ("arm64: kernel: fix architected PMU registers
>> unconditional access").
>
> I've applied it to 4.3 and 4.4, but it doesn't apply to 4.1 at all :(
>

Turns out f436b2ac90a0 wasn't needed in 4.1 after all since you did not
apply 60792ad349f3 ("arm64: kernel: enforce pmuserenr_el0 initialization
and restore"). All (my) final builds and qemu tests for 4.1.17, 4.3.5,
and 4.4.1 are good.

Thanks,
Guenter

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web