Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1680110 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-07-03 15:50 +0200 |
| Last post | 2017-07-04 10:00 +0200 |
| Articles | 20 on this page of 66 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH 4.11 00/84] 4.11.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.11 39/84] MIPS: Fix IRQ tracing & lockdep when rescheduling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.11 13/84] net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.11 61/84] ARM64: PCI: Fix struct acpi_pci_root_ops allocation failure path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 23/84] ipv6: fix calling in6_ifa_hold incorrectly for dad work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 64/84] ARM: davinci: PM: Free resources in error handling path in davinci_pm_init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 80/84] mtd: nand: fsmc: fix NAND width handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 50/84] dm thin: do not queue freed thin mapping for next stage processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 47/84] x86/intel_rdt: Fix memory leak on mount failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 76/84] iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 60/84] watchdog: bcm281xx: Fix use of uninitialized spinlock. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 67/84] Revert "x86/entry: Fix the end of the stack for newly forked tasks" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 78/84] infiniband: hns: avoid gcc-7.0.1 warning for uninitialized data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 36/84] MIPS: head: Reorder instructions missing a delay slot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 81/84] KVM: x86: fix emulation of RSM and IRET instructions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 58/84] xfrm: NULL dereference on allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 69/84] x86/boot/KASLR: Fix kexec crash due to virt_addr calculation bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 75/84] iommu/dma: Dont reserve PCI I/O windows Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 74/84] ocfs2: fix deadlock caused by recursive locking in xattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 33/84] netfilter: synproxy: fix conntrackd interaction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 72/84] x86/mm: Fix flush_tlb_page() on Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 55/84] xfrm6: Fix IPv6 payload_len in xfrm6_transport_finish Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 46/84] gpiolib: fix filtering out unwanted events Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 73/84] ocfs2: o2hb: revert hb threshold to keep compatible Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 66/84] tools arch: Sync arch/x86/lib/memcpy_64.S with the kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 79/84] mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 38/84] MIPS: pm-cps: Drop manual cache-line alignment of ready_count Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 65/84] ARM: davinci: PM: Do not free useful resources in normal path in davinci_pm_init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 34/84] NFSv4.x/callback: Create the callback service through svc_create_pooled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 62/84] ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 70/84] perf/x86: Fix spurious NMI with PEBS Load Latency event Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 31/84] ipv6: Do not leak throw route references Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 56/84] xfrm: move xfrm_garbage_collect out of xfrm_policy_flush Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 68/84] x86/mshyperv: Remove excess #includes from mshyperv.h Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 53/84] mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 37/84] MIPS: Avoid accidental raw backtrace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 40/84] ALSA: hda - Fix endless loop of codec configure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 71/84] x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 77/84] iommu/amd: Fix interrupt remapping when disable guest_mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 51/84] x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:00 +0200
[PATCH 4.11 25/84] net/mlx5e: Fix min inline value for VF rep SQs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 16/84] net/mlx5e: Fix wrong indications in DIM due to counter wraparound Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 45/84] ovl: copy-up: dont unlock between lookup and link Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 20/84] igmp: add a missing spin_lock_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 01/84] net: dont call strlen on non-terminated string in dev_set_alias() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 22/84] net: dont global ICMP rate limit packets originating from loopback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 06/84] net: Zero ifla_vf_info in rtnl_fill_vfinfo() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 05/84] decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 27/84] net/mlx5: Wait for FW readiness before initializing command interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 43/84] NFSv4.1: Fix a race in nfs4_proc_layoutget Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 17/84] net/mlx5: Enable 4K UAR only when page size is bigger than 4K Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 32/84] rtnetlink: add IFLA_GROUP to ifla_policy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 41/84] ALSA: hda - set input_path bitmap to zero after moving it to new place Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 08/84] net: vrf: Make add_fib_rules per network namespace flag Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 04/84] mac80211: free netdev on dev_alloc_name() error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 19/84] igmp: acquire pmc lock for ip_mc_clear_src() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 02/84] net: Fix inconsistent teardown and release of private netdev state. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 29/84] decnet: always not take dst->__refcnt when inserting dst into hash table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 44/84] Revert "NFS: nfs_rename() handle -ERESTARTSYS dentry left behind" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 14/84] net/mlx5: Remove several module events out of ethtool stats Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 09/84] af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 18/84] proc: snmp6: Use correct type in memset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 42/84] NFSv4.2: Dont send mode again in post-EXCLUSIVE4_1 SETATTR with umask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
[PATCH 4.11 07/84] net: ipv6: Release route when device is unregistering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:10 +0200
Re: [PATCH 4.11 00/84] 4.11.9-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-03 22:00 +0200
Re: [PATCH 4.11 00/84] 4.11.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-04 10:00 +0200
Page 1 of 4 [1] 2 3 4 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.11 00/84] 4.11.9-stable review |
| Message-ID | <tZ9TH-2c1-5@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.11.9 release.
There are 84 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Jul 5 13:33:30 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.11.9-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.11.9-rc1
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: nVMX: Fix exception injection
Radim Krčmář <rkrcmar@redhat.com>
KVM: x86: zero base3 of unusable segments
Radim Krčmář <rkrcmar@redhat.com>
KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh()
Ladi Prosek <lprosek@redhat.com>
KVM: x86: fix emulation of RSM and IRET instructions
Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
mtd: nand: fsmc: fix NAND width handling
Kamal Dasu <kdasu.kdev@gmail.com>
mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program
Arnd Bergmann <arnd@arndb.de>
infiniband: hns: avoid gcc-7.0.1 warning for uninitialized data
Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
iommu/amd: Fix interrupt remapping when disable guest_mode
Pan Bian <bianpan2016@163.com>
iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid()
Robin Murphy <robin.murphy@arm.com>
iommu/dma: Don't reserve PCI I/O windows
Eric Ren <zren@suse.com>
ocfs2: fix deadlock caused by recursive locking in xattr
Junxiao Bi <junxiao.bi@oracle.com>
ocfs2: o2hb: revert hb threshold to keep compatible
Andy Lutomirski <luto@kernel.org>
x86/mm: Fix flush_tlb_page() on Xen
Joerg Roedel <jroedel@suse.de>
x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space
Kan Liang <kan.liang@intel.com>
perf/x86: Fix spurious NMI with PEBS Load Latency event
Baoquan He <bhe@redhat.com>
x86/boot/KASLR: Fix kexec crash due to 'virt_addr' calculation bug
Thomas Gleixner <tglx@linutronix.de>
x86/mshyperv: Remove excess #includes from mshyperv.h
Josh Poimboeuf <jpoimboe@redhat.com>
Revert "x86/entry: Fix the end of the stack for newly forked tasks"
Arnaldo Carvalho de Melo <acme@redhat.com>
tools arch: Sync arch/x86/lib/memcpy_64.S with the kernel
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
ARM: davinci: PM: Do not free useful resources in normal path in 'davinci_pm_init'
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
ARM: davinci: PM: Free resources in error handling path in 'davinci_pm_init'
Doug Berger <opendmb@gmail.com>
ARM: 8685/1: ensure memblock-limit is pmd-aligned
Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation
Timmy Li <lixiaoping3@huawei.com>
ARM64: PCI: Fix struct acpi_pci_root_ops allocation failure path
Eric Anholt <eric@anholt.net>
watchdog: bcm281xx: Fix use of uninitialized spinlock.
Dan Carpenter <dan.carpenter@oracle.com>
xfrm: Oops on error in pfkey_msg2xfrm_state()
Dan Carpenter <dan.carpenter@oracle.com>
xfrm: NULL dereference on allocation failure
Sabrina Dubroca <sd@queasysnail.net>
xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
Hangbin Liu <liuhangbin@gmail.com>
xfrm: move xfrm_garbage_collect out of xfrm_policy_flush
Yossi Kuperman <yossiku@mellanox.com>
xfrm6: Fix IPv6 payload_len in xfrm6_transport_finish
Juergen Gross <jgross@suse.com>
xen/blkback: don't free be structure too early
Ard Biesheuvel <ard.biesheuvel@linaro.org>
mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings
Thomas Gleixner <tglx@linutronix.de>
pinctrl/amd: Use regular interrupt instead of chained
Baoquan He <bhe@redhat.com>
x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds()
Vallish Vaidyeshwara <vallish@amazon.com>
dm thin: do not queue freed thin mapping for next stage processing
Deepak Rawat <drawat@vmware.com>
drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
Kan Liang <kan.liang@intel.com>
perf/x86/intel/uncore: Fix wrong box pointer check
Vikas Shivappa <vikas.shivappa@linux.intel.com>
x86/intel_rdt: Fix memory leak on mount failure
Bartosz Golaszewski <brgl@bgdev.pl>
gpiolib: fix filtering out unwanted events
Miklos Szeredi <mszeredi@redhat.com>
ovl: copy-up: don't unlock between lookup and link
Benjamin Coddington <bcodding@redhat.com>
Revert "NFS: nfs_rename() handle -ERESTARTSYS dentry left behind"
Trond Myklebust <trond.myklebust@primarydata.com>
NFSv4.1: Fix a race in nfs4_proc_layoutget
Benjamin Coddington <bcodding@redhat.com>
NFSv4.2: Don't send mode again in post-EXCLUSIVE4_1 SETATTR with umask
Hui Wang <hui.wang@canonical.com>
ALSA: hda - set input_path bitmap to zero after moving it to new place
Takashi Iwai <tiwai@suse.de>
ALSA: hda - Fix endless loop of codec configure
Paul Burton <paul.burton@imgtec.com>
MIPS: Fix IRQ tracing & lockdep when rescheduling
Paul Burton <paul.burton@imgtec.com>
MIPS: pm-cps: Drop manual cache-line alignment of ready_count
James Hogan <james.hogan@imgtec.com>
MIPS: Avoid accidental raw backtrace
Karl Beldan <karl.beldan@gmail.com>
MIPS: head: Reorder instructions missing a delay slot
Juergen Gross <jgross@suse.com>
xen/blkback: don't use xen_blkif_get() in xen-blkback kthread
Kinglong Mee <kinglongmee@gmail.com>
NFSv4.x/callback: Create the callback service through svc_create_pooled
Eric Leblond <eric@regit.org>
netfilter: synproxy: fix conntrackd interaction
Serhey Popovych <serhe.popovych@gmail.com>
rtnetlink: add IFLA_GROUP to ifla_policy
Serhey Popovych <serhe.popovych@gmail.com>
ipv6: Do not leak throw route references
Gao Feng <gfree.wind@vip.163.com>
net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
Wei Wang <weiwan@google.com>
decnet: always not take dst->__refcnt when inserting dst into hash table
Maor Dickman <maord@mellanox.com>
net/mlx5e: Fix timestamping capabilities reporting
Eli Cohen <eli@mellanox.com>
net/mlx5: Wait for FW readiness before initializing command interface
Or Gerlitz <ogerlitz@mellanox.com>
net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it
Chris Mi <chrism@mellanox.com>
net/mlx5e: Fix min inline value for VF rep SQs
Xin Long <lucien.xin@gmail.com>
sctp: return next obj by passing pos + 1 into sctp_transport_get_idx
Xin Long <lucien.xin@gmail.com>
ipv6: fix calling in6_ifa_hold incorrectly for dad work
Jesper Dangaard Brouer <brouer@redhat.com>
net: don't global ICMP rate limit packets originating from loopback
Bjørn Mork <bjorn@mork.no>
qmi_wwan: new Telewell and Sierra device IDs
WANG Cong <xiyou.wangcong@gmail.com>
igmp: add a missing spin_lock_init()
WANG Cong <xiyou.wangcong@gmail.com>
igmp: acquire pmc lock for ip_mc_clear_src()
Christian Perle <christian.perle@secunet.com>
proc: snmp6: Use correct type in memset
Majd Dibbiny <majd@mellanox.com>
net/mlx5: Enable 4K UAR only when page size is bigger than 4K
Tal Gilboa <talgi@mellanox.com>
net/mlx5e: Fix wrong indications in DIM due to counter wraparound
Tal Gilboa <talgi@mellanox.com>
net/mlx5e: Added BW check for DIM decision mechanism
Huy Nguyen <huyn@mellanox.com>
net/mlx5: Remove several module events out of ethtool stats
Jia-Ju Bai <baijiaju1990@163.com>
net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse
Jia-Ju Bai <baijiaju1990@163.com>
net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
Xin Long <lucien.xin@gmail.com>
sctp: disable BH in sctp_for_each_endpoint
Krister Johansen <kjlx@templeofstupid.com>
Fix an intermittent pr_emerg warning about lo becoming free.
Mateusz Jurczyk <mjurczyk@google.com>
af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
David Ahern <dsahern@gmail.com>
net: vrf: Make add_fib_rules per network namespace flag
David Ahern <dsahern@gmail.com>
net: ipv6: Release route when device is unregistering
Mintz, Yuval <Yuval.Mintz@cavium.com>
net: Zero ifla_vf_info in rtnl_fill_vfinfo()
Mateusz Jurczyk <mjurczyk@google.com>
decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb
Johannes Berg <johannes.berg@intel.com>
mac80211: free netdev on dev_alloc_name() error
Stephen Rothwell <sfr@canb.auug.org.au>
net: s390: fix up for "Fix inconsistent teardown and release of private netdev state"
David S. Miller <davem@davemloft.net>
net: Fix inconsistent teardown and release of private netdev state.
Alexander Potapenko <glider@google.com>
net: don't call strlen on non-terminated string in dev_set_alias()
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-davinci/pm.c | 7 +-
arch/arm/mm/mmu.c | 8 +-
arch/arm64/include/asm/acpi.h | 6 +-
arch/arm64/kernel/pci.c | 4 +-
arch/mips/kernel/entry.S | 3 +
arch/mips/kernel/head.S | 2 +-
arch/mips/kernel/pm-cps.c | 9 +--
arch/mips/kernel/traps.c | 2 +
arch/x86/boot/compressed/kaslr.c | 3 -
arch/x86/boot/compressed/misc.c | 4 +-
arch/x86/boot/compressed/misc.h | 2 -
arch/x86/entry/entry_32.S | 30 ++++---
arch/x86/entry/entry_64.S | 11 +--
arch/x86/events/intel/core.c | 2 +-
arch/x86/events/intel/ds.c | 2 +-
arch/x86/events/intel/uncore.c | 2 +-
arch/x86/events/perf_event.h | 1 +
arch/x86/include/asm/kvm_emulate.h | 4 +-
arch/x86/include/asm/mshyperv.h | 3 +-
arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 4 +-
arch/x86/kvm/emulate.c | 16 ++--
arch/x86/kvm/pmu_intel.c | 2 +-
arch/x86/kvm/vmx.c | 2 +-
arch/x86/kvm/x86.c | 17 +++-
arch/x86/mm/init_64.c | 8 +-
arch/x86/mm/mpx.c | 10 +--
arch/x86/mm/tlb.c | 4 +-
drivers/block/xen-blkback/blkback.c | 3 -
drivers/block/xen-blkback/xenbus.c | 7 +-
drivers/gpio/gpiolib.c | 3 +-
drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 1 +
drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 1 +
drivers/iommu/amd_iommu.c | 6 +-
drivers/iommu/amd_iommu_v2.c | 2 +-
drivers/iommu/dma-iommu.c | 3 +-
drivers/md/dm-thin.c | 26 +++----
drivers/mtd/nand/brcmnand/brcmnand.c | 61 ++++++++++++++-
drivers/mtd/nand/fsmc_nand.c | 13 ++--
drivers/net/bonding/bond_main.c | 6 +-
drivers/net/caif/caif_hsi.c | 2 +-
drivers/net/caif/caif_serial.c | 2 +-
drivers/net/caif/caif_spi.c | 2 +-
drivers/net/caif/caif_virtio.c | 2 +-
drivers/net/can/slcan.c | 7 +-
drivers/net/can/vcan.c | 2 +-
drivers/net/dummy.c | 4 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en.h | 8 +-
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 +-
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +
drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c | 45 ++++++-----
drivers/net/ethernet/mellanox/mlx5/core/en_stats.h | 11 +--
drivers/net/ethernet/mellanox/mlx5/core/main.c | 20 ++++-
drivers/net/geneve.c | 2 +-
drivers/net/gtp.c | 2 +-
drivers/net/hamradio/6pack.c | 2 +-
drivers/net/hamradio/bpqether.c | 2 +-
drivers/net/ifb.c | 4 +-
drivers/net/ipvlan/ipvlan_main.c | 2 +-
drivers/net/loopback.c | 4 +-
drivers/net/macsec.c | 4 +-
drivers/net/macvlan.c | 2 +-
drivers/net/nlmon.c | 2 +-
drivers/net/slip/slip.c | 7 +-
drivers/net/team/team.c | 4 +-
drivers/net/tun.c | 4 +-
drivers/net/usb/cdc-phonet.c | 2 +-
drivers/net/usb/qmi_wwan.c | 4 +
drivers/net/veth.c | 4 +-
drivers/net/vrf.c | 38 +++++++--
drivers/net/vxlan.c | 2 +-
drivers/net/wan/dlci.c | 2 +-
drivers/net/wan/hdlc_fr.c | 2 +-
drivers/net/wan/lapbether.c | 2 +-
drivers/net/wireless/ath/ath6kl/main.c | 2 +-
.../broadcom/brcm80211/brcmfmac/cfg80211.c | 1 -
.../wireless/broadcom/brcm80211/brcmfmac/core.c | 3 +-
drivers/net/wireless/intersil/hostap/hostap_main.c | 2 +-
drivers/net/wireless/mac80211_hwsim.c | 2 +-
drivers/net/wireless/marvell/mwifiex/main.c | 2 +-
drivers/pinctrl/pinctrl-amd.c | 91 ++++++++++------------
drivers/s390/net/netiucv.c | 4 +-
drivers/staging/rtl8188eu/os_dep/mon.c | 2 +-
drivers/usb/gadget/function/f_phonet.c | 2 +-
drivers/watchdog/bcm_kona_wdt.c | 3 +-
fs/nfs/callback.c | 2 +-
fs/nfs/dir.c | 51 ++++++------
fs/nfs/nfs4proc.c | 5 +-
fs/ocfs2/cluster/heartbeat.c | 8 +-
fs/ocfs2/dlmglue.c | 4 +
fs/ocfs2/xattr.c | 23 +++---
fs/overlayfs/copy_up.c | 24 +++---
include/linux/netdevice.h | 12 ++-
include/net/xfrm.h | 10 ---
mm/vmalloc.c | 15 +++-
net/8021q/vlan.c | 3 +-
net/8021q/vlan_dev.c | 4 +-
net/batman-adv/soft-interface.c | 5 +-
net/bluetooth/6lowpan.c | 2 +-
net/bridge/br_device.c | 2 +-
net/caif/cfpkt_skbuff.c | 6 +-
net/caif/chnl_net.c | 4 +-
net/core/dev.c | 11 ++-
net/core/dst.c | 14 ++++
net/core/rtnetlink.c | 5 +-
net/decnet/dn_route.c | 14 +---
net/decnet/netfilter/dn_rtmsg.c | 4 +-
net/hsr/hsr_device.c | 4 +-
net/ieee802154/6lowpan/core.c | 2 +-
net/ipv4/icmp.c | 8 +-
net/ipv4/igmp.c | 22 ++++--
net/ipv4/ip_tunnel.c | 4 +-
net/ipv4/ipmr.c | 2 +-
net/ipv6/addrconf.c | 6 +-
net/ipv6/fib6_rules.c | 22 ++----
net/ipv6/icmp.c | 2 +-
net/ipv6/ip6_fib.c | 3 +-
net/ipv6/ip6_gre.c | 9 ++-
net/ipv6/ip6_tunnel.c | 8 +-
net/ipv6/ip6_vti.c | 8 +-
net/ipv6/ip6mr.c | 2 +-
net/ipv6/proc.c | 2 +-
net/ipv6/route.c | 1 +
net/ipv6/sit.c | 6 +-
net/ipv6/xfrm6_input.c | 2 +-
net/irda/irlan/irlan_eth.c | 2 +-
net/key/af_key.c | 19 ++++-
net/l2tp/l2tp_eth.c | 2 +-
net/mac80211/iface.c | 7 +-
net/mac802154/iface.c | 7 +-
net/netfilter/nf_conntrack_netlink.c | 4 +
net/openvswitch/vport-internal_dev.c | 4 +-
net/phonet/pep-gprs.c | 2 +-
net/sctp/socket.c | 9 +--
net/tipc/msg.c | 2 +-
net/unix/af_unix.c | 7 +-
net/xfrm/xfrm_policy.c | 51 ------------
net/xfrm/xfrm_user.c | 1 +
sound/pci/hda/hda_codec.h | 2 +
sound/pci/hda/hda_controller.c | 8 +-
sound/pci/hda/hda_generic.c | 1 +
tools/arch/x86/lib/memcpy_64.S | 2 +-
144 files changed, 604 insertions(+), 502 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.11 39/84] MIPS: Fix IRQ tracing & lockdep when rescheduling |
| Message-ID | <tZ9TN-2c1-145@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <paul.burton@imgtec.com>
commit d8550860d910c6b7b70f830f59003b33daaa52c9 upstream.
When the scheduler sets TIF_NEED_RESCHED & we call into the scheduler
from arch/mips/kernel/entry.S we disable interrupts. This is true
regardless of whether we reach work_resched from syscall_exit_work,
resume_userspace or by looping after calling schedule(). Although we
disable interrupts in these paths we don't call trace_hardirqs_off()
before calling into C code which may acquire locks, and we therefore
leave lockdep with an inconsistent view of whether interrupts are
disabled or not when CONFIG_PROVE_LOCKING & CONFIG_DEBUG_LOCKDEP are
both enabled.
Without tracing this interrupt state lockdep will print warnings such
as the following once a task returns from a syscall via
syscall_exit_partial with TIF_NEED_RESCHED set:
[ 49.927678] ------------[ cut here ]------------
[ 49.934445] WARNING: CPU: 0 PID: 1 at kernel/locking/lockdep.c:3687 check_flags.part.41+0x1dc/0x1e8
[ 49.946031] DEBUG_LOCKS_WARN_ON(current->hardirqs_enabled)
[ 49.946355] CPU: 0 PID: 1 Comm: init Not tainted 4.10.0-00439-gc9fd5d362289-dirty #197
[ 49.963505] Stack : 0000000000000000 ffffffff81bb5d6a 0000000000000006 ffffffff801ce9c4
[ 49.974431] 0000000000000000 0000000000000000 0000000000000000 000000000000004a
[ 49.985300] ffffffff80b7e487 ffffffff80a24498 a8000000ff160000 ffffffff80ede8b8
[ 49.996194] 0000000000000001 0000000000000000 0000000000000000 0000000077c8030c
[ 50.007063] 000000007fd8a510 ffffffff801cd45c 0000000000000000 a8000000ff127c88
[ 50.017945] 0000000000000000 ffffffff801cf928 0000000000000001 ffffffff80a24498
[ 50.028827] 0000000000000000 0000000000000001 0000000000000000 0000000000000000
[ 50.039688] 0000000000000000 a8000000ff127bd0 0000000000000000 ffffffff805509bc
[ 50.050575] 00000000140084e0 0000000000000000 0000000000000000 0000000000040a00
[ 50.061448] 0000000000000000 ffffffff8010e1b0 0000000000000000 ffffffff805509bc
[ 50.072327] ...
[ 50.076087] Call Trace:
[ 50.079869] [<ffffffff8010e1b0>] show_stack+0x80/0xa8
[ 50.086577] [<ffffffff805509bc>] dump_stack+0x10c/0x190
[ 50.093498] [<ffffffff8015dde0>] __warn+0xf0/0x108
[ 50.099889] [<ffffffff8015de34>] warn_slowpath_fmt+0x3c/0x48
[ 50.107241] [<ffffffff801c15b4>] check_flags.part.41+0x1dc/0x1e8
[ 50.114961] [<ffffffff801c239c>] lock_is_held_type+0x8c/0xb0
[ 50.122291] [<ffffffff809461b8>] __schedule+0x8c0/0x10f8
[ 50.129221] [<ffffffff80946a60>] schedule+0x30/0x98
[ 50.135659] [<ffffffff80106278>] work_resched+0x8/0x34
[ 50.142397] ---[ end trace 0cb4f6ef5b99fe21 ]---
[ 50.148405] possible reason: unannotated irqs-off.
[ 50.154600] irq event stamp: 400463
[ 50.159566] hardirqs last enabled at (400463): [<ffffffff8094edc8>] _raw_spin_unlock_irqrestore+0x40/0xa8
[ 50.171981] hardirqs last disabled at (400462): [<ffffffff8094eb98>] _raw_spin_lock_irqsave+0x30/0xb0
[ 50.183897] softirqs last enabled at (400450): [<ffffffff8016580c>] __do_softirq+0x4ac/0x6a8
[ 50.195015] softirqs last disabled at (400425): [<ffffffff80165e78>] irq_exit+0x110/0x128
Fix this by using the TRACE_IRQS_OFF macro to call trace_hardirqs_off()
when CONFIG_TRACE_IRQFLAGS is enabled. This is done before invoking
schedule() following the work_resched label because:
1) Interrupts are disabled regardless of the path we take to reach
work_resched() & schedule().
2) Performing the tracing here avoids the need to do it in paths which
disable interrupts but don't call out to C code before hitting a
path which uses the RESTORE_SOME macro that will call
trace_hardirqs_on() or trace_hardirqs_off() as appropriate.
We call trace_hardirqs_on() using the TRACE_IRQS_ON macro before calling
syscall_trace_leave() for similar reasons, ensuring that lockdep has a
consistent view of state after we re-enable interrupts.
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/15385/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/entry.S | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -11,6 +11,7 @@
#include <asm/asm.h>
#include <asm/asmmacro.h>
#include <asm/compiler.h>
+#include <asm/irqflags.h>
#include <asm/regdef.h>
#include <asm/mipsregs.h>
#include <asm/stackframe.h>
@@ -119,6 +120,7 @@ work_pending:
andi t0, a2, _TIF_NEED_RESCHED # a2 is preloaded with TI_FLAGS
beqz t0, work_notifysig
work_resched:
+ TRACE_IRQS_OFF
jal schedule
local_irq_disable # make sure need_resched and
@@ -155,6 +157,7 @@ syscall_exit_work:
beqz t0, work_pending # trace bit set?
local_irq_enable # could let syscall_trace_leave()
# call schedule() instead
+ TRACE_IRQS_ON
move a0, sp
jal syscall_trace_leave
b resume_userspace
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.11 13/84] net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse |
| Message-ID | <tZ9TN-2c1-147@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia-Ju Bai <baijiaju1990@163.com>
[ Upstream commit 343eba69c6968190d8654b857aea952fed9a6749 ]
The kernel may sleep under a rcu read lock in tipc_msg_reverse, and the
function call path is:
tipc_l2_rcv_msg (acquire the lock by rcu_read_lock)
tipc_rcv
tipc_sk_rcv
tipc_msg_reverse
pskb_expand_head(GFP_KERNEL) --> may sleep
tipc_node_broadcast
tipc_node_xmit_skb
tipc_node_xmit
tipc_sk_rcv
tipc_msg_reverse
pskb_expand_head(GFP_KERNEL) --> may sleep
To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC".
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/msg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -508,7 +508,7 @@ bool tipc_msg_reverse(u32 own_node, str
}
if (skb_cloned(_skb) &&
- pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_KERNEL))
+ pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
goto exit;
/* Now reverse the concerned fields */
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 61/84] ARM64: PCI: Fix struct acpi_pci_root_ops allocation failure path |
| Message-ID | <tZa3n-2gz-1@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timmy Li <lixiaoping3@huawei.com>
commit 717902cc93118119a6fce7765da6cf2786987418 upstream.
Commit 093d24a20442 ("arm64: PCI: Manage controller-specific data on
per-controller basis") added code to allocate ACPI PCI root_ops
dynamically on a per host bridge basis but failed to update the
corresponding memory allocation failure path in pci_acpi_scan_root()
leading to a potential memory leakage.
Fix it by adding the required kfree call.
Fixes: 093d24a20442 ("arm64: PCI: Manage controller-specific data on per-controller basis")
Reviewed-by: Tomasz Nowicki <tn@semihalf.com>
Signed-off-by: Timmy Li <lixiaoping3@huawei.com>
[lorenzo.pieralisi@arm.com: refactored code, rewrote commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
CC: Will Deacon <will.deacon@arm.com>
CC: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/pci.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/arm64/kernel/pci.c
+++ b/arch/arm64/kernel/pci.c
@@ -191,8 +191,10 @@ struct pci_bus *pci_acpi_scan_root(struc
return NULL;
root_ops = kzalloc_node(sizeof(*root_ops), GFP_KERNEL, node);
- if (!root_ops)
+ if (!root_ops) {
+ kfree(ri);
return NULL;
+ }
ri->cfg = pci_acpi_setup_ecam_mapping(root);
if (!ri->cfg) {
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 23/84] ipv6: fix calling in6_ifa_hold incorrectly for dad work |
| Message-ID | <tZa3n-2gz-3@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit f8a894b218138888542a5058d0e902378fd0d4ec ]
Now when starting the dad work in addrconf_mod_dad_work, if the dad work
is idle and queued, it needs to hold ifa.
The problem is there's one gap in [1], during which if the pending dad work
is removed elsewhere. It will miss to hold ifa, but the dad word is still
idea and queue.
if (!delayed_work_pending(&ifp->dad_work))
in6_ifa_hold(ifp);
<--------------[1]
mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
An use-after-free issue can be caused by this.
Chen Wei found this issue when WARN_ON(!hlist_unhashed(&ifp->addr_lst)) in
net6_ifa_finish_destroy was hit because of it.
As Hannes' suggestion, this patch is to fix it by holding ifa first in
addrconf_mod_dad_work, then calling mod_delayed_work and putting ifa if
the dad_work is already in queue.
Note that this patch did not choose to fix it with:
if (!mod_delayed_work(delay))
in6_ifa_hold(ifp);
As with it, when delay == 0, dad_work would be scheduled immediately, all
addrconf_mod_dad_work(0) callings had to be moved under ifp->lock.
Reported-by: Wei Chen <weichen@redhat.com>
Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/addrconf.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -328,9 +328,9 @@ static void addrconf_mod_rs_timer(struct
static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
unsigned long delay)
{
- if (!delayed_work_pending(&ifp->dad_work))
- in6_ifa_hold(ifp);
- mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
+ in6_ifa_hold(ifp);
+ if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
+ in6_ifa_put(ifp);
}
static int snmp6_alloc_dev(struct inet6_dev *idev)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 64/84] ARM: davinci: PM: Free resources in error handling path in davinci_pm_init |
| Message-ID | <tZa3n-2gz-5@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit f3f6cc814f9cb61cfb738af2b126a8bf19e5ab4c upstream.
If 'sram_alloc' fails, we need to free already allocated resources.
Fixes: aa9aa1ec2df6 ("ARM: davinci: PM: rework init, remove platform device")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-davinci/pm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/arch/arm/mach-davinci/pm.c
+++ b/arch/arm/mach-davinci/pm.c
@@ -154,7 +154,8 @@ int __init davinci_pm_init(void)
davinci_sram_suspend = sram_alloc(davinci_cpu_suspend_sz, NULL);
if (!davinci_sram_suspend) {
pr_err("PM: cannot allocate SRAM memory\n");
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto no_sram_mem;
}
davinci_sram_push(davinci_sram_suspend, davinci_cpu_suspend,
@@ -162,6 +163,8 @@ int __init davinci_pm_init(void)
suspend_set_ops(&davinci_pm_ops);
+no_sram_mem:
+ iounmap(pm_config.ddrpsc_reg_base);
no_ddrpsc_mem:
iounmap(pm_config.ddrpll_reg_base);
no_ddrpll_mem:
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 80/84] mtd: nand: fsmc: fix NAND width handling |
| Message-ID | <tZa3o-2gz-9@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit ee56874f23e5c11576540bd695177a5ebc4f4352 upstream.
In commit eea628199d5b ("mtd: Add device-tree support to fsmc_nand"),
Device Tree support was added to the fmsc_nand driver. However, this
code has a bug in how it handles the bank-width DT property to set the
bus width.
Indeed, in the function fsmc_nand_probe_config_dt() that parses the
Device Tree, it sets pdata->width to either 8 or 16 depending on the
value of the bank-width DT property.
Then, the ->probe() function will test if pdata->width is equal to
FSMC_NAND_BW16 (which is 2) to set NAND_BUSWIDTH_16 in
nand->options. Therefore, with the DT probing, this condition will never
match.
This commit fixes that by removing the "width" field from
fsmc_nand_platform_data and instead have the fsmc_nand_probe_config_dt()
function directly set the appropriate nand->options value.
It is worth mentioning that if this commit gets backported to older
kernels, prior to the drop of non-DT probing, then non-DT probing will
be broken because nand->options will no longer be set to
NAND_BUSWIDTH_16.
Fixes: eea628199d5b ("mtd: Add device-tree support to fsmc_nand")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/fsmc_nand.c | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
--- a/drivers/mtd/nand/fsmc_nand.c
+++ b/drivers/mtd/nand/fsmc_nand.c
@@ -150,7 +150,6 @@ struct fsmc_nand_platform_data {
struct mtd_partition *partitions;
unsigned int nr_partitions;
unsigned int options;
- unsigned int width;
unsigned int bank;
enum access_mode mode;
@@ -844,18 +843,19 @@ static int fsmc_nand_probe_config_dt(str
u32 val;
int ret;
- /* Set default NAND width to 8 bits */
- pdata->width = 8;
+ pdata->options = 0;
+
if (!of_property_read_u32(np, "bank-width", &val)) {
if (val == 2) {
- pdata->width = 16;
+ pdata->options |= NAND_BUSWIDTH_16;
} else if (val != 1) {
dev_err(&pdev->dev, "invalid bank-width %u\n", val);
return -EINVAL;
}
}
+
if (of_get_property(np, "nand-skip-bbtscan", NULL))
- pdata->options = NAND_SKIP_BBTSCAN;
+ pdata->options |= NAND_SKIP_BBTSCAN;
pdata->nand_timings = devm_kzalloc(&pdev->dev,
sizeof(*pdata->nand_timings), GFP_KERNEL);
@@ -992,9 +992,6 @@ static int __init fsmc_nand_probe(struct
nand->badblockbits = 7;
nand_set_flash_node(nand, np);
- if (pdata->width == FSMC_NAND_BW16)
- nand->options |= NAND_BUSWIDTH_16;
-
switch (host->mode) {
case USE_DMA_ACCESS:
dma_cap_zero(mask);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 50/84] dm thin: do not queue freed thin mapping for next stage processing |
| Message-ID | <tZa3o-2gz-11@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vallish Vaidyeshwara <vallish@amazon.com>
commit 00a0ea33b495ee6149bf5a77ac5807ce87323abb upstream.
process_prepared_discard_passdown_pt1() should cleanup
dm_thin_new_mapping in cases of error.
dm_pool_inc_data_range() can fail trying to get a block reference:
metadata operation 'dm_pool_inc_data_range' failed: error = -61
When dm_pool_inc_data_range() fails, dm thin aborts current metadata
transaction and marks pool as PM_READ_ONLY. Memory for thin mapping
is released as well. However, current thin mapping will be queued
onto next stage as part of queue_passdown_pt2() or passdown_endio().
This dangling thin mapping memory when processed and accessed in
next stage will lead to device mapper crashing.
Code flow without fix:
-> process_prepared_discard_passdown_pt1(m)
-> dm_thin_remove_range()
-> discard passdown
--> passdown_endio(m) queues m onto next stage
-> dm_pool_inc_data_range() fails, frees memory m
but does not remove it from next stage queue
-> process_prepared_discard_passdown_pt2(m)
-> processes freed memory m and crashes
One such stack:
Call Trace:
[<ffffffffa037a46f>] dm_cell_release_no_holder+0x2f/0x70 [dm_bio_prison]
[<ffffffffa039b6dc>] cell_defer_no_holder+0x3c/0x80 [dm_thin_pool]
[<ffffffffa039b88b>] process_prepared_discard_passdown_pt2+0x4b/0x90 [dm_thin_pool]
[<ffffffffa0399611>] process_prepared+0x81/0xa0 [dm_thin_pool]
[<ffffffffa039e735>] do_worker+0xc5/0x820 [dm_thin_pool]
[<ffffffff8152bf54>] ? __schedule+0x244/0x680
[<ffffffff81087e72>] ? pwq_activate_delayed_work+0x42/0xb0
[<ffffffff81089f53>] process_one_work+0x153/0x3f0
[<ffffffff8108a71b>] worker_thread+0x12b/0x4b0
[<ffffffff8108a5f0>] ? rescuer_thread+0x350/0x350
[<ffffffff8108fd6a>] kthread+0xca/0xe0
[<ffffffff8108fca0>] ? kthread_park+0x60/0x60
[<ffffffff81530b45>] ret_from_fork+0x25/0x30
The fix is to first take the block ref count for discarded block and
then do a passdown discard of this block. If block ref count fails,
then bail out aborting current metadata transaction, mark pool as
PM_READ_ONLY and also free current thin mapping memory (existing error
handling code) without queueing this thin mapping onto next stage of
processing. If block ref count succeeds, then passdown discard of this
block. Discard callback of passdown_endio() will queue this thin mapping
onto next stage of processing.
Code flow with fix:
-> process_prepared_discard_passdown_pt1(m)
-> dm_thin_remove_range()
-> dm_pool_inc_data_range()
--> if fails, free memory m and bail out
-> discard passdown
--> passdown_endio(m) queues m onto next stage
Reviewed-by: Eduardo Valentin <eduval@amazon.com>
Reviewed-by: Cristian Gafton <gafton@amazon.com>
Reviewed-by: Anchal Agarwal <anchalag@amazon.com>
Signed-off-by: Vallish Vaidyeshwara <vallish@amazon.com>
Reviewed-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-thin.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1094,6 +1094,19 @@ static void process_prepared_discard_pas
return;
}
+ /*
+ * Increment the unmapped blocks. This prevents a race between the
+ * passdown io and reallocation of freed blocks.
+ */
+ r = dm_pool_inc_data_range(pool->pmd, m->data_block, data_end);
+ if (r) {
+ metadata_operation_failed(pool, "dm_pool_inc_data_range", r);
+ bio_io_error(m->bio);
+ cell_defer_no_holder(tc, m->cell);
+ mempool_free(m, pool->mapping_pool);
+ return;
+ }
+
discard_parent = bio_alloc(GFP_NOIO, 1);
if (!discard_parent) {
DMWARN("%s: unable to allocate top level discard bio for passdown. Skipping passdown.",
@@ -1114,19 +1127,6 @@ static void process_prepared_discard_pas
end_discard(&op, r);
}
}
-
- /*
- * Increment the unmapped blocks. This prevents a race between the
- * passdown io and reallocation of freed blocks.
- */
- r = dm_pool_inc_data_range(pool->pmd, m->data_block, data_end);
- if (r) {
- metadata_operation_failed(pool, "dm_pool_inc_data_range", r);
- bio_io_error(m->bio);
- cell_defer_no_holder(tc, m->cell);
- mempool_free(m, pool->mapping_pool);
- return;
- }
}
static void process_prepared_discard_passdown_pt2(struct dm_thin_new_mapping *m)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 47/84] x86/intel_rdt: Fix memory leak on mount failure |
| Message-ID | <tZa3o-2gz-21@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vikas Shivappa <vikas.shivappa@linux.intel.com>
commit 79298acc4ba097e9ab78644e3e38902d73547c92 upstream.
If mount fails, the kn_info directory is not freed causing memory leak.
Add the missing error handling path.
Fixes: 4e978d06dedb ("x86/intel_rdt: Add "info" files to resctrl file system")
Signed-off-by: Vikas Shivappa <vikas.shivappa@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: ravi.v.shankar@intel.com
Cc: tony.luck@intel.com
Cc: fenghua.yu@intel.com
Cc: peterz@infradead.org
Cc: vikas.shivappa@intel.com
Cc: andi.kleen@intel.com
Link: http://lkml.kernel.org/r/1498503368-20173-3-git-send-email-vikas.shivappa@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
@@ -767,11 +767,13 @@ static struct dentry *rdt_mount(struct f
dentry = kernfs_mount(fs_type, flags, rdt_root,
RDTGROUP_SUPER_MAGIC, NULL);
if (IS_ERR(dentry))
- goto out_cdp;
+ goto out_destroy;
static_branch_enable(&rdt_enable_key);
goto out;
+out_destroy:
+ kernfs_remove(kn_info);
out_cdp:
cdp_disable();
out:
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 76/84] iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid() |
| Message-ID | <tZa3o-2gz-25@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Bian <bianpan2016@163.com>
commit 73dbd4a4230216b6a5540a362edceae0c9b4876b upstream.
In function amd_iommu_bind_pasid(), the control flow jumps
to label out_free when pasid_state->mm and mm is NULL. And
mmput(mm) is called. In function mmput(mm), mm is
referenced without validation. This will result in a NULL
dereference bug. This patch fixes the bug.
Signed-off-by: Pan Bian <bianpan2016@163.com>
Fixes: f0aac63b873b ('iommu/amd: Don't hold a reference to mm_struct')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu_v2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -696,9 +696,9 @@ out_clear_state:
out_unregister:
mmu_notifier_unregister(&pasid_state->mn, mm);
+ mmput(mm);
out_free:
- mmput(mm);
free_pasid_state(pasid_state);
out:
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 60/84] watchdog: bcm281xx: Fix use of uninitialized spinlock. |
| Message-ID | <tZa3o-2gz-31@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Anholt <eric@anholt.net>
commit fedf266f9955d9a019643cde199a2fd9a0259f6f upstream.
The bcm_kona_wdt_set_resolution_reg() call takes the spinlock, so
initialize it earlier. Fixes a warning at boot with lock debugging
enabled.
Fixes: 6adb730dc208 ("watchdog: bcm281xx: Watchdog Driver")
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/watchdog/bcm_kona_wdt.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/watchdog/bcm_kona_wdt.c
+++ b/drivers/watchdog/bcm_kona_wdt.c
@@ -304,6 +304,8 @@ static int bcm_kona_wdt_probe(struct pla
if (!wdt)
return -ENOMEM;
+ spin_lock_init(&wdt->lock);
+
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
wdt->base = devm_ioremap_resource(dev, res);
if (IS_ERR(wdt->base))
@@ -316,7 +318,6 @@ static int bcm_kona_wdt_probe(struct pla
return ret;
}
- spin_lock_init(&wdt->lock);
platform_set_drvdata(pdev, wdt);
watchdog_set_drvdata(&bcm_kona_wdt_wdd, wdt);
bcm_kona_wdt_wdd.parent = &pdev->dev;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 67/84] Revert "x86/entry: Fix the end of the stack for newly forked tasks" |
| Message-ID | <tZa3p-2gz-33@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@redhat.com>
commit ebd574994c63164d538a197172157318f58ac647 upstream.
Petr Mladek reported the following warning when loading the livepatch
sample module:
WARNING: CPU: 1 PID: 3699 at arch/x86/kernel/stacktrace.c:132 save_stack_trace_tsk_reliable+0x133/0x1a0
...
Call Trace:
__schedule+0x273/0x820
schedule+0x36/0x80
kthreadd+0x305/0x310
? kthread_create_on_cpu+0x80/0x80
? icmp_echo.part.32+0x50/0x50
ret_from_fork+0x2c/0x40
That warning means the end of the stack is no longer recognized as such
for newly forked tasks. The problem was introduced with the following
commit:
ff3f7e2475bb ("x86/entry: Fix the end of the stack for newly forked tasks")
... which was completely misguided. It only partially fixed the
reported issue, and it introduced another bug in the process. None of
the other entry code saves the frame pointer before calling into C code,
so it doesn't make sense for ret_from_fork to do so either.
Contrary to what I originally thought, the original issue wasn't related
to newly forked tasks. It was actually related to ftrace. When entry
code calls into a function which then calls into an ftrace handler, the
stack frame looks different than normal.
The original issue will be fixed in the unwinder, in a subsequent patch.
Reported-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Jones <davej@codemonkey.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: live-patching@vger.kernel.org
Fixes: ff3f7e2475bb ("x86/entry: Fix the end of the stack for newly forked tasks")
Link: http://lkml.kernel.org/r/f350760f7e82f0750c8d1dd093456eb212751caa.1495553739.git.jpoimboe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/entry/entry_32.S | 30 +++++++++++++++++++-----------
arch/x86/entry/entry_64.S | 11 ++++-------
2 files changed, 23 insertions(+), 18 deletions(-)
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -255,6 +255,23 @@ ENTRY(__switch_to_asm)
END(__switch_to_asm)
/*
+ * The unwinder expects the last frame on the stack to always be at the same
+ * offset from the end of the page, which allows it to validate the stack.
+ * Calling schedule_tail() directly would break that convention because its an
+ * asmlinkage function so its argument has to be pushed on the stack. This
+ * wrapper creates a proper "end of stack" frame header before the call.
+ */
+ENTRY(schedule_tail_wrapper)
+ FRAME_BEGIN
+
+ pushl %eax
+ call schedule_tail
+ popl %eax
+
+ FRAME_END
+ ret
+ENDPROC(schedule_tail_wrapper)
+/*
* A newly forked process directly context switches into this address.
*
* eax: prev task we switched from
@@ -262,24 +279,15 @@ END(__switch_to_asm)
* edi: kernel thread arg
*/
ENTRY(ret_from_fork)
- FRAME_BEGIN /* help unwinder find end of stack */
-
- /*
- * schedule_tail() is asmlinkage so we have to put its 'prev' argument
- * on the stack.
- */
- pushl %eax
- call schedule_tail
- popl %eax
+ call schedule_tail_wrapper
testl %ebx, %ebx
jnz 1f /* kernel threads are uncommon */
2:
/* When we fork, we trace the syscall return in the child, too. */
- leal FRAME_OFFSET(%esp), %eax
+ movl %esp, %eax
call syscall_return_slowpath
- FRAME_END
jmp restore_all
/* kernel thread */
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -36,7 +36,6 @@
#include <asm/smap.h>
#include <asm/pgtable_types.h>
#include <asm/export.h>
-#include <asm/frame.h>
#include <linux/err.h>
.code64
@@ -409,19 +408,17 @@ END(__switch_to_asm)
* r12: kernel thread arg
*/
ENTRY(ret_from_fork)
- FRAME_BEGIN /* help unwinder find end of stack */
movq %rax, %rdi
- call schedule_tail /* rdi: 'prev' task parameter */
+ call schedule_tail /* rdi: 'prev' task parameter */
- testq %rbx, %rbx /* from kernel_thread? */
- jnz 1f /* kernel threads are uncommon */
+ testq %rbx, %rbx /* from kernel_thread? */
+ jnz 1f /* kernel threads are uncommon */
2:
- leaq FRAME_OFFSET(%rsp),%rdi /* pt_regs pointer */
+ movq %rsp, %rdi
call syscall_return_slowpath /* returns with IRQs disabled */
TRACE_IRQS_ON /* user mode is traced as IRQS on */
SWAPGS
- FRAME_END
jmp restore_regs_and_iret
1:
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 78/84] infiniband: hns: avoid gcc-7.0.1 warning for uninitialized data |
| Message-ID | <tZa3p-2gz-41@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 5b0ff9a00755d4d9c209033a77f1ed8f3186fe5c upstream.
hns_roce_v1_cq_set_ci() calls roce_set_bit() on an uninitialized field,
which will then change only a few of its bits, causing a warning with
the latest gcc:
infiniband/hw/hns/hns_roce_hw_v1.c: In function 'hns_roce_v1_cq_set_ci':
infiniband/hw/hns/hns_roce_hw_v1.c:1854:23: error: 'doorbell[1]' is used uninitialized in this function [-Werror=uninitialized]
roce_set_bit(doorbell[1], ROCEE_DB_OTHERS_H_ROCEE_DB_OTH_HW_SYNS_S, 1);
The code is actually correct since we always set all bits of the
port_vlan field, but gcc correctly points out that the first
access does contain uninitialized data.
This initializes the field to zero first before setting the
individual bits.
Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
@@ -1851,6 +1851,7 @@ void hns_roce_v1_cq_set_ci(struct hns_ro
u32 doorbell[2];
doorbell[0] = cons_index & ((hr_cq->cq_depth << 1) - 1);
+ doorbell[1] = 0;
roce_set_bit(doorbell[1], ROCEE_DB_OTHERS_H_ROCEE_DB_OTH_HW_SYNS_S, 1);
roce_set_field(doorbell[1], ROCEE_DB_OTHERS_H_ROCEE_DB_OTH_CMD_M,
ROCEE_DB_OTHERS_H_ROCEE_DB_OTH_CMD_S, 3);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 36/84] MIPS: head: Reorder instructions missing a delay slot |
| Message-ID | <tZa3p-2gz-39@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Beldan <karl.beldan@gmail.com>
commit 25d8b92e0af75d72ce8b99e63e5a449cc0888efa upstream.
In this sequence the 'move' is assumed in the delay slot of the 'beq',
but head.S is in reorder mode and the former gets pushed one 'nop'
farther by the assembler.
The corrected behavior made booting with an UHI supplied dtb erratic.
Fixes: 15f37e158892 ("MIPS: store the appended dtb address in a variable")
Signed-off-by: Karl Beldan <karl.beldan+oss@gmail.com>
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Cc: Jonas Gorski <jogo@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/16614/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/head.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/kernel/head.S
+++ b/arch/mips/kernel/head.S
@@ -106,8 +106,8 @@ NESTED(kernel_entry, 16, sp) # kernel
beq t0, t1, dtb_found
#endif
li t1, -2
- beq a0, t1, dtb_found
move t2, a1
+ beq a0, t1, dtb_found
li t2, 0
dtb_found:
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 81/84] KVM: x86: fix emulation of RSM and IRET instructions |
| Message-ID | <tZa3p-2gz-45@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ladi Prosek <lprosek@redhat.com>
commit 6ed071f051e12cf7baa1b69d3becb8f232fdfb7b upstream.
On AMD, the effect of set_nmi_mask called by emulate_iret_real and em_rsm
on hflags is reverted later on in x86_emulate_instruction where hflags are
overwritten with ctxt->emul_flags (the kvm_set_hflags call). This manifests
as a hang when rebooting Windows VMs with QEMU, OVMF, and >1 vcpu.
Instead of trying to merge ctxt->emul_flags into vcpu->arch.hflags after
an instruction is emulated, this commit deletes emul_flags altogether and
makes the emulator access vcpu->arch.hflags using two new accessors. This
way all changes, on the emulator side as well as in functions called from
the emulator and accessing vcpu state with emul_to_vcpu, are preserved.
More details on the bug and its manifestation with Windows and OVMF:
It's a KVM bug in the interaction between SMI/SMM and NMI, specific to AMD.
I believe that the SMM part explains why we started seeing this only with
OVMF.
KVM masks and unmasks NMI when entering and leaving SMM. When KVM emulates
the RSM instruction in em_rsm, the set_nmi_mask call doesn't stick because
later on in x86_emulate_instruction we overwrite arch.hflags with
ctxt->emul_flags, effectively reverting the effect of the set_nmi_mask call.
The AMD-specific hflag of interest here is HF_NMI_MASK.
When rebooting the system, Windows sends an NMI IPI to all but the current
cpu to shut them down. Only after all of them are parked in HLT will the
initiating cpu finish the restart. If NMI is masked, other cpus never get
the memo and the initiating cpu spins forever, waiting for
hal!HalpInterruptProcessorsStarted to drop. That's the symptom we observe.
Fixes: a584539b24b8 ("KVM: x86: pass the whole hflags field to emulator and back")
Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/kvm_emulate.h | 4 +++-
arch/x86/kvm/emulate.c | 16 +++++++++-------
arch/x86/kvm/x86.c | 15 ++++++++++++---
3 files changed, 24 insertions(+), 11 deletions(-)
--- a/arch/x86/include/asm/kvm_emulate.h
+++ b/arch/x86/include/asm/kvm_emulate.h
@@ -221,6 +221,9 @@ struct x86_emulate_ops {
void (*get_cpuid)(struct x86_emulate_ctxt *ctxt,
u32 *eax, u32 *ebx, u32 *ecx, u32 *edx);
void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked);
+
+ unsigned (*get_hflags)(struct x86_emulate_ctxt *ctxt);
+ void (*set_hflags)(struct x86_emulate_ctxt *ctxt, unsigned hflags);
};
typedef u32 __attribute__((vector_size(16))) sse128_t;
@@ -290,7 +293,6 @@ struct x86_emulate_ctxt {
/* interruptibility state, as a result of execution of STI or MOV SS */
int interruptibility;
- int emul_flags;
bool perm_ok; /* do not check permissions if true */
bool ud; /* inject an #UD if host doesn't support insn */
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2547,7 +2547,7 @@ static int em_rsm(struct x86_emulate_ctx
u64 smbase;
int ret;
- if ((ctxt->emul_flags & X86EMUL_SMM_MASK) == 0)
+ if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_MASK) == 0)
return emulate_ud(ctxt);
/*
@@ -2596,11 +2596,11 @@ static int em_rsm(struct x86_emulate_ctx
return X86EMUL_UNHANDLEABLE;
}
- if ((ctxt->emul_flags & X86EMUL_SMM_INSIDE_NMI_MASK) == 0)
+ if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_INSIDE_NMI_MASK) == 0)
ctxt->ops->set_nmi_mask(ctxt, false);
- ctxt->emul_flags &= ~X86EMUL_SMM_INSIDE_NMI_MASK;
- ctxt->emul_flags &= ~X86EMUL_SMM_MASK;
+ ctxt->ops->set_hflags(ctxt, ctxt->ops->get_hflags(ctxt) &
+ ~(X86EMUL_SMM_INSIDE_NMI_MASK | X86EMUL_SMM_MASK));
return X86EMUL_CONTINUE;
}
@@ -5317,6 +5317,7 @@ int x86_emulate_insn(struct x86_emulate_
const struct x86_emulate_ops *ops = ctxt->ops;
int rc = X86EMUL_CONTINUE;
int saved_dst_type = ctxt->dst.type;
+ unsigned emul_flags;
ctxt->mem_read.pos = 0;
@@ -5331,6 +5332,7 @@ int x86_emulate_insn(struct x86_emulate_
goto done;
}
+ emul_flags = ctxt->ops->get_hflags(ctxt);
if (unlikely(ctxt->d &
(No64|Undefined|Sse|Mmx|Intercept|CheckPerm|Priv|Prot|String))) {
if ((ctxt->mode == X86EMUL_MODE_PROT64 && (ctxt->d & No64)) ||
@@ -5364,7 +5366,7 @@ int x86_emulate_insn(struct x86_emulate_
fetch_possible_mmx_operand(ctxt, &ctxt->dst);
}
- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && ctxt->intercept) {
+ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && ctxt->intercept) {
rc = emulator_check_intercept(ctxt, ctxt->intercept,
X86_ICPT_PRE_EXCEPT);
if (rc != X86EMUL_CONTINUE)
@@ -5393,7 +5395,7 @@ int x86_emulate_insn(struct x86_emulate_
goto done;
}
- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
+ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
rc = emulator_check_intercept(ctxt, ctxt->intercept,
X86_ICPT_POST_EXCEPT);
if (rc != X86EMUL_CONTINUE)
@@ -5447,7 +5449,7 @@ int x86_emulate_insn(struct x86_emulate_
special_insn:
- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
+ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
rc = emulator_check_intercept(ctxt, ctxt->intercept,
X86_ICPT_POST_MEMACCESS);
if (rc != X86EMUL_CONTINUE)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5248,6 +5248,16 @@ static void emulator_set_nmi_mask(struct
kvm_x86_ops->set_nmi_mask(emul_to_vcpu(ctxt), masked);
}
+static unsigned emulator_get_hflags(struct x86_emulate_ctxt *ctxt)
+{
+ return emul_to_vcpu(ctxt)->arch.hflags;
+}
+
+static void emulator_set_hflags(struct x86_emulate_ctxt *ctxt, unsigned emul_flags)
+{
+ kvm_set_hflags(emul_to_vcpu(ctxt), emul_flags);
+}
+
static const struct x86_emulate_ops emulate_ops = {
.read_gpr = emulator_read_gpr,
.write_gpr = emulator_write_gpr,
@@ -5287,6 +5297,8 @@ static const struct x86_emulate_ops emul
.intercept = emulator_intercept,
.get_cpuid = emulator_get_cpuid,
.set_nmi_mask = emulator_set_nmi_mask,
+ .get_hflags = emulator_get_hflags,
+ .set_hflags = emulator_set_hflags,
};
static void toggle_interruptibility(struct kvm_vcpu *vcpu, u32 mask)
@@ -5341,7 +5353,6 @@ static void init_emulate_ctxt(struct kvm
BUILD_BUG_ON(HF_GUEST_MASK != X86EMUL_GUEST_MASK);
BUILD_BUG_ON(HF_SMM_MASK != X86EMUL_SMM_MASK);
BUILD_BUG_ON(HF_SMM_INSIDE_NMI_MASK != X86EMUL_SMM_INSIDE_NMI_MASK);
- ctxt->emul_flags = vcpu->arch.hflags;
init_decode_cache(ctxt);
vcpu->arch.emulate_regs_need_sync_from_vcpu = false;
@@ -5744,8 +5755,6 @@ restart:
unsigned long rflags = kvm_x86_ops->get_rflags(vcpu);
toggle_interruptibility(vcpu, ctxt->interruptibility);
vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
- if (vcpu->arch.hflags != ctxt->emul_flags)
- kvm_set_hflags(vcpu, ctxt->emul_flags);
kvm_rip_write(vcpu, ctxt->eip);
if (r == EMULATE_DONE &&
(ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 58/84] xfrm: NULL dereference on allocation failure |
| Message-ID | <tZa3p-2gz-43@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit e747f64336fc15e1c823344942923195b800aa1e upstream.
The default error code in pfkey_msg2xfrm_state() is -ENOBUFS. We
added a new call to security_xfrm_state_alloc() which sets "err" to zero
so there several places where we can return ERR_PTR(0) if kmalloc()
fails. The caller is expecting error pointers so it leads to a NULL
dereference.
Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/key/af_key.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1157,6 +1157,7 @@ static struct xfrm_state * pfkey_msg2xfr
goto out;
}
+ err = -ENOBUFS;
key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
if (sa->sadb_sa_auth) {
int keysize = 0;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 69/84] x86/boot/KASLR: Fix kexec crash due to virt_addr calculation bug |
| Message-ID | <tZa3p-2gz-49@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <bhe@redhat.com>
commit 8eabf42ae5237e6b699aeac687b5b629e3537c8d upstream.
Kernel text KASLR is separated into physical address and virtual
address randomization. And for virtual address randomization, we
only randomiza to get an offset between 16M and KERNEL_IMAGE_SIZE.
So the initial value of 'virt_addr' should be LOAD_PHYSICAL_ADDR,
but not the original kernel loading address 'output'.
The bug will cause kernel boot failure if kernel is loaded at a different
position than the address, 16M, which is decided at compiled time.
Kexec/kdump is such practical case.
To fix it, just assign LOAD_PHYSICAL_ADDR to virt_addr as initial
value.
Tested-by: Dave Young <dyoung@redhat.com>
Signed-off-by: Baoquan He <bhe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 8391c73 ("x86/KASLR: Randomize virtual address separately")
Link: http://lkml.kernel.org/r/1498567146-11990-3-git-send-email-bhe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/compressed/kaslr.c | 3 ---
arch/x86/boot/compressed/misc.c | 4 ++--
arch/x86/boot/compressed/misc.h | 2 --
3 files changed, 2 insertions(+), 7 deletions(-)
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -564,9 +564,6 @@ void choose_random_location(unsigned lon
{
unsigned long random_addr, min_addr;
- /* By default, keep output position unchanged. */
- *virt_addr = *output;
-
if (cmdline_find_option_bool("nokaslr")) {
warn("KASLR disabled: 'nokaslr' on cmdline.");
return;
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -338,7 +338,7 @@ asmlinkage __visible void *extract_kerne
unsigned long output_len)
{
const unsigned long kernel_total_size = VO__end - VO__text;
- unsigned long virt_addr = (unsigned long)output;
+ unsigned long virt_addr = LOAD_PHYSICAL_ADDR;
/* Retain x86 boot parameters pointer passed from startup_32/64. */
boot_params = rmode;
@@ -397,7 +397,7 @@ asmlinkage __visible void *extract_kerne
#ifndef CONFIG_RELOCATABLE
if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
error("Destination address does not match LOAD_PHYSICAL_ADDR");
- if ((unsigned long)output != virt_addr)
+ if (virt_addr != LOAD_PHYSICAL_ADDR)
error("Destination virtual address changed when not relocatable");
#endif
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -81,8 +81,6 @@ static inline void choose_random_locatio
unsigned long output_size,
unsigned long *virt_addr)
{
- /* No change from existing output location. */
- *virt_addr = *output;
}
#endif
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 75/84] iommu/dma: Dont reserve PCI I/O windows |
| Message-ID | <tZa3p-2gz-53@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <robin.murphy@arm.com>
commit 938f1bbe35e3a7cb07e1fa7c512e2ef8bb866bdf upstream.
Even if a host controller's CPU-side MMIO windows into PCI I/O space do
happen to leak into PCI memory space such that it might treat them as
peer addresses, trying to reserve the corresponding I/O space addresses
doesn't do anything to help solve that problem. Stop doing a silly thing.
Fixes: fade1ec055dc ("iommu/dma: Avoid PCI host bridge windows")
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/dma-iommu.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -175,8 +175,7 @@ static void iova_reserve_pci_windows(str
unsigned long lo, hi;
resource_list_for_each_entry(window, &bridge->windows) {
- if (resource_type(window->res) != IORESOURCE_MEM &&
- resource_type(window->res) != IORESOURCE_IO)
+ if (resource_type(window->res) != IORESOURCE_MEM)
continue;
lo = iova_pfn(iovad, window->res->start - window->offset);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 74/84] ocfs2: fix deadlock caused by recursive locking in xattr |
| Message-ID | <tZa3p-2gz-51@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Ren <zren@suse.com>
commit 8818efaaacb78c60a9d90c5705b6c99b75d7d442 upstream.
Another deadlock path caused by recursive locking is reported. This
kind of issue was introduced since commit 743b5f1434f5 ("ocfs2: take
inode lock in ocfs2_iop_set/get_acl()"). Two deadlock paths have been
fixed by commit b891fa5024a9 ("ocfs2: fix deadlock issue when taking
inode lock at vfs entry points"). Yes, we intend to fix this kind of
case in incremental way, because it's hard to find out all possible
paths at once.
This one can be reproduced like this. On node1, cp a large file from
home directory to ocfs2 mountpoint. While on node2, run
setfacl/getfacl. Both nodes will hang up there. The backtraces:
On node1:
__ocfs2_cluster_lock.isra.39+0x357/0x740 [ocfs2]
ocfs2_inode_lock_full_nested+0x17d/0x840 [ocfs2]
ocfs2_write_begin+0x43/0x1a0 [ocfs2]
generic_perform_write+0xa9/0x180
__generic_file_write_iter+0x1aa/0x1d0
ocfs2_file_write_iter+0x4f4/0xb40 [ocfs2]
__vfs_write+0xc3/0x130
vfs_write+0xb1/0x1a0
SyS_write+0x46/0xa0
On node2:
__ocfs2_cluster_lock.isra.39+0x357/0x740 [ocfs2]
ocfs2_inode_lock_full_nested+0x17d/0x840 [ocfs2]
ocfs2_xattr_set+0x12e/0xe80 [ocfs2]
ocfs2_set_acl+0x22d/0x260 [ocfs2]
ocfs2_iop_set_acl+0x65/0xb0 [ocfs2]
set_posix_acl+0x75/0xb0
posix_acl_xattr_set+0x49/0xa0
__vfs_setxattr+0x69/0x80
__vfs_setxattr_noperm+0x72/0x1a0
vfs_setxattr+0xa7/0xb0
setxattr+0x12d/0x190
path_setxattr+0x9f/0xb0
SyS_setxattr+0x14/0x20
Fix this one by using ocfs2_inode_{lock|unlock}_tracker, which is
exported by commit 439a36b8ef38 ("ocfs2/dlmglue: prepare tracking logic
to avoid recursive cluster lock").
Link: http://lkml.kernel.org/r/20170622014746.5815-1-zren@suse.com
Fixes: 743b5f1434f5 ("ocfs2: take inode lock in ocfs2_iop_set/get_acl()")
Signed-off-by: Eric Ren <zren@suse.com>
Reported-by: Thomas Voegtle <tv@lio96.de>
Tested-by: Thomas Voegtle <tv@lio96.de>
Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
Cc: Mark Fasheh <mfasheh@versity.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dlmglue.c | 4 ++++
fs/ocfs2/xattr.c | 23 +++++++++++++----------
2 files changed, 17 insertions(+), 10 deletions(-)
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -2591,6 +2591,10 @@ void ocfs2_inode_unlock_tracker(struct i
struct ocfs2_lock_res *lockres;
lockres = &OCFS2_I(inode)->ip_inode_lockres;
+ /* had_lock means that the currect process already takes the cluster
+ * lock previously. If had_lock is 1, we have nothing to do here, and
+ * it will get unlocked where we got the lock.
+ */
if (!had_lock) {
ocfs2_remove_holder(lockres, oh);
ocfs2_inode_unlock(inode, ex);
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -1328,20 +1328,21 @@ static int ocfs2_xattr_get(struct inode
void *buffer,
size_t buffer_size)
{
- int ret;
+ int ret, had_lock;
struct buffer_head *di_bh = NULL;
+ struct ocfs2_lock_holder oh;
- ret = ocfs2_inode_lock(inode, &di_bh, 0);
- if (ret < 0) {
- mlog_errno(ret);
- return ret;
+ had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 0, &oh);
+ if (had_lock < 0) {
+ mlog_errno(had_lock);
+ return had_lock;
}
down_read(&OCFS2_I(inode)->ip_xattr_sem);
ret = ocfs2_xattr_get_nolock(inode, di_bh, name_index,
name, buffer, buffer_size);
up_read(&OCFS2_I(inode)->ip_xattr_sem);
- ocfs2_inode_unlock(inode, 0);
+ ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock);
brelse(di_bh);
@@ -3537,11 +3538,12 @@ int ocfs2_xattr_set(struct inode *inode,
{
struct buffer_head *di_bh = NULL;
struct ocfs2_dinode *di;
- int ret, credits, ref_meta = 0, ref_credits = 0;
+ int ret, credits, had_lock, ref_meta = 0, ref_credits = 0;
struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
struct inode *tl_inode = osb->osb_tl_inode;
struct ocfs2_xattr_set_ctxt ctxt = { NULL, NULL, NULL, };
struct ocfs2_refcount_tree *ref_tree = NULL;
+ struct ocfs2_lock_holder oh;
struct ocfs2_xattr_info xi = {
.xi_name_index = name_index,
@@ -3572,8 +3574,9 @@ int ocfs2_xattr_set(struct inode *inode,
return -ENOMEM;
}
- ret = ocfs2_inode_lock(inode, &di_bh, 1);
- if (ret < 0) {
+ had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 1, &oh);
+ if (had_lock < 0) {
+ ret = had_lock;
mlog_errno(ret);
goto cleanup_nolock;
}
@@ -3670,7 +3673,7 @@ cleanup:
if (ret)
mlog_errno(ret);
}
- ocfs2_inode_unlock(inode, 1);
+ ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock);
cleanup_nolock:
brelse(di_bh);
brelse(xbs.xattr_bh);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:00 +0200 |
| Subject | [PATCH 4.11 33/84] netfilter: synproxy: fix conntrackd interaction |
| Message-ID | <tZa3q-2gz-61@gated-at.bofh.it> |
| In reply to | #1680110 |
4.11-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Leblond <eric@regit.org> commit 87e94dbc210a720a34be5c1174faee5c84be963e upstream. This patch fixes the creation of connection tracking entry from netlink when synproxy is used. It was missing the addition of the synproxy extension. This was causing kernel crashes when a conntrack entry created by conntrackd was used after the switch of traffic from active node to the passive node. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/netfilter/nf_conntrack_netlink.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -45,6 +45,8 @@ #include <net/netfilter/nf_conntrack_zones.h> #include <net/netfilter/nf_conntrack_timestamp.h> #include <net/netfilter/nf_conntrack_labels.h> +#include <net/netfilter/nf_conntrack_seqadj.h> +#include <net/netfilter/nf_conntrack_synproxy.h> #ifdef CONFIG_NF_NAT_NEEDED #include <net/netfilter/nf_nat_core.h> #include <net/netfilter/nf_nat_l4proto.h> @@ -1814,6 +1816,8 @@ ctnetlink_create_conntrack(struct net *n nf_ct_tstamp_ext_add(ct, GFP_ATOMIC); nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC); nf_ct_labels_ext_add(ct); + nfct_seqadj_ext_add(ct); + nfct_synproxy_ext_add(ct); /* we must add conntrack extensions before confirmation. */ ct->status |= IPS_CONFIRMED;
[toc] | [prev] | [next] | [standalone]
Page 1 of 4 [1] 2 3 4 Next page →
Back to top | Article view | linux.kernel
csiph-web