Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1680046 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-07-03 15:40 +0200 |
| Last post | 2017-07-04 10:10 +0200 |
| Articles | 20 on this page of 79 — 4 participants |
Back to article view | Back to linux.kernel
[PATCH 4.4 000/101] 4.4.76-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
[PATCH 4.4 094/101] iommu/vt-d: Dont over-free page table directories Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 061/101] amd-xgbe: Check xgbe_init() return code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 082/101] ravb: Fix use-after-free on `ifconfig eth0 down` Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 090/101] ARM: 8685/1: ensure memblock-limit is pmd-aligned Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 086/101] xfrm: Oops on error in pfkey_msg2xfrm_state() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 096/101] iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 079/101] perf probe: Fix to show correct locations for events on modules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 089/101] ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 057/101] net: sctp: fix array overrun read on sctp_timer_tbl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
Re: [PATCH 4.4 057/101] net: sctp: fix array overrun read on sctp_timer_tbl Ben Hutchings <ben.hutchings@codethink.co.uk> - 2017-07-04 20:50 +0200
Re: [PATCH 4.4 057/101] net: sctp: fix array overrun read on sctp_timer_tbl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-05 14:20 +0200
[PATCH 4.4 085/101] xfrm: NULL dereference on allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 095/101] iommu: Handle default domain attach failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
Re: [PATCH 4.4 095/101] iommu: Handle default domain attach failure Ben Hutchings <ben.hutchings@codethink.co.uk> - 2017-07-05 21:00 +0200
[PATCH 4.4 053/101] gianfar: Do not reuse pages from emergency reserve Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 098/101] KVM: x86: fix emulation of RSM and IRET instructions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 060/101] platform/x86: ideapad-laptop: handle ACPI event 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 091/101] x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 062/101] net: dsa: Check return value of phy_connect_direct() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 059/101] scsi: virtio_scsi: Reject commands when virtqueue is broken Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 058/101] xen-netfront: Fix Rx stall during network stress and OOM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 097/101] cpufreq: s3c2416: double free on driver init error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 087/101] watchdog: bcm281xx: Fix use of uninitialized spinlock. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 055/101] virtio_console: fix a crash in config_work_handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 056/101] swiotlb-xen: update dev_addr after swapping pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 093/101] ocfs2: o2hb: revert hb threshold to keep compatible Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 076/101] swiotlb: ensure that page-sized mappings are page-aligned Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 080/101] net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 092/101] x86/mm: Fix flush_tlb_page() on Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 088/101] sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 072/101] arm64: assembler: make adr_l work in modules under KASLR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
Re: [PATCH 4.4 072/101] arm64: assembler: make adr_l work in modules under KASLR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-04 11:30 +0200
Re: [PATCH 4.4 072/101] arm64: assembler: make adr_l work in modules under KASLR Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-07-04 11:30 +0200
[PATCH 4.4 083/101] jump label: fix passing kbuild_cflags when checking for asm goto support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 084/101] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 078/101] be2net: fix status check in be_cmd_pmac_add() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 081/101] sctp: check af before verify address in sctp_addr_id2transport Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 039/101] net: korina: Fix NAPI versus resources freeing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 067/101] ibmveth: Add a proper check for the availability of the checksum features Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 010/101] ipv6: fix calling in6_ifa_hold incorrectly for dad work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 035/101] qla2xxx: Fix erroneous invalid handle message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 024/101] MIPS: Fix IRQ tracing & lockdep when rescheduling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 018/101] netfilter: synproxy: fix conntrackd interaction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 048/101] bgmac: Fix reversed test of build_skb() return value. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 015/101] ipv6: Do not leak throw route references Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 049/101] net: bgmac: Fix SOF bit checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 040/101] MIPS: ralink: MT7688 pinmux fixes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 042/101] MIPS: ralink: Fix invalid assignment of SoC type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 026/101] ALSA: hda - set input_path bitmap to zero after moving it to new place Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 030/101] block: fix module reference leak on put_disk() call for cgroups throttle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 071/101] spi: davinci: use dma_mapping_error() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
Re: [PATCH 4.4 071/101] spi: davinci: use dma_mapping_error() Ben Hutchings <ben.hutchings@codethink.co.uk> - 2017-07-05 16:30 +0200
[PATCH 4.4 029/101] sysctl: enable strict writes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 012/101] decnet: always not take dst->__refcnt when inserting dst into hash table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 070/101] scsi: lpfc: avoid double free of resource identifiers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 074/101] x86/mpx: Use compatible types in comparison to fix sparse error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 025/101] ALSA: hda - Fix endless loop of codec configure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 051/101] net: bgmac: Remove superflous netif_carrier_on() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 033/101] scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 064/101] vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 068/101] kernel/panic.c: add missing \n Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 050/101] net: bgmac: Start transmit queue in bgmac_open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 037/101] net: mvneta: Fix for_each_present_cpu usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 027/101] drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 041/101] MIPS: ralink: fix USB frequency scaling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 017/101] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 003/101] decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 021/101] mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 005/101] af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 002/101] net: dont call strlen on non-terminated string in dev_set_alias() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 006/101] Fix an intermittent pr_emerg warning about lo becoming free. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 004/101] net: Zero ifla_vf_info in rtnl_fill_vfinfo() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 011/101] net/mlx5: Wait for FW readiness before initializing command interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 020/101] drm/ast: Handle configuration without P2A bridge Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 007/101] net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
Re: [PATCH 4.4 000/101] 4.4.76-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-03 21:40 +0200
Re: [PATCH 4.4 000/101] 4.4.76-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-04 10:10 +0200
Re: [PATCH 4.4 000/101] 4.4.76-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-04 10:10 +0200
Page 1 of 4 [1] 2 3 4 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:40 +0200 |
| Subject | [PATCH 4.4 000/101] 4.4.76-stable review |
| Message-ID | <tZ9K1-27f-3@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.4.76 release.
There are 101 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Jul 5 13:32:59 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.76-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.4.76-rc1
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: nVMX: Fix exception injection
Radim Krčmář <rkrcmar@redhat.com>
KVM: x86: zero base3 of unusable segments
Radim Krčmář <rkrcmar@redhat.com>
KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh()
Ladi Prosek <lprosek@redhat.com>
KVM: x86: fix emulation of RSM and IRET instructions
Dan Carpenter <dan.carpenter@oracle.com>
cpufreq: s3c2416: double free on driver init error path
Pan Bian <bianpan2016@163.com>
iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid()
Robin Murphy <robin.murphy@arm.com>
iommu: Handle default domain attach failure
David Dillow <dillow@google.com>
iommu/vt-d: Don't over-free page table directories
Junxiao Bi <junxiao.bi@oracle.com>
ocfs2: o2hb: revert hb threshold to keep compatible
Andy Lutomirski <luto@kernel.org>
x86/mm: Fix flush_tlb_page() on Xen
Joerg Roedel <jroedel@suse.de>
x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space
Doug Berger <opendmb@gmail.com>
ARM: 8685/1: ensure memblock-limit is pmd-aligned
Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation
Matt Fleming <matt@codeblueprint.co.uk>
sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting
Eric Anholt <eric@anholt.net>
watchdog: bcm281xx: Fix use of uninitialized spinlock.
Dan Carpenter <dan.carpenter@oracle.com>
xfrm: Oops on error in pfkey_msg2xfrm_state()
Dan Carpenter <dan.carpenter@oracle.com>
xfrm: NULL dereference on allocation failure
Sabrina Dubroca <sd@queasysnail.net>
xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
Gleb Fotengauer-Malinovskiy <glebfm@altlinux.org>
jump label: fix passing kbuild_cflags when checking for asm goto support
Eugeniu Rosca <erosca@de.adit-jv.com>
ravb: Fix use-after-free on `ifconfig eth0 down`
Xin Long <lucien.xin@gmail.com>
sctp: check af before verify address in sctp_addr_id2transport
Jack Morgenstein <jackm@dev.mellanox.co.il>
net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV
Masami Hiramatsu <mhiramat@kernel.org>
perf probe: Fix to show correct locations for events on modules
Ivan Vecera <cera@cera.cz>
be2net: fix status check in be_cmd_pmac_add()
Heiko Carstens <heiko.carstens@de.ibm.com>
s390/ctl_reg: make __ctl_load a full memory barrier
Nikita Yushchenko <nikita.yoush@cogentembedded.com>
swiotlb: ensure that page-sized mappings are page-aligned
Dave Kleikamp <dave.kleikamp@oracle.com>
coredump: Ensure proper size of sparse core files
Tobias Klauser <tklauser@distanz.ch>
x86/mpx: Use compatible types in comparison to fix sparse error
Felix Fietkau <nbd@nbd.name>
mac80211: initialize SMPS field in HT capabilities
Ard Biesheuvel <ard.biesheuvel@linaro.org>
arm64: assembler: make adr_l work in modules under KASLR
Kevin Hilman <khilman@baylibre.com>
spi: davinci: use dma_mapping_error()
Roberto Sassu <rsassu@suse.de>
scsi: lpfc: avoid double free of resource identifiers
Brendan McGrath <redmcg@redmandi.dyndns.org>
HID: i2c-hid: Add sleep between POWER ON and RESET
Jiri Slaby <jslaby@suse.cz>
kernel/panic.c: add missing \n
Thomas Huth <thuth@redhat.com>
ibmveth: Add a proper check for the availability of the checksum features
Balakrishnan Raman <ramanb@cumulusnetworks.com>
vxlan: do not age static remote mac entries
Michael S. Tsirkin <mst@redhat.com>
virtio_net: fix PAGE_SIZE > 64k
Greg Kurz <groug@kaod.org>
vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null
Ding Pixel <pding@amd.com>
drm/amdgpu: check ring being ready before using
Florian Fainelli <f.fainelli@gmail.com>
net: dsa: Check return value of phy_connect_direct()
Lendacky, Thomas <Thomas.Lendacky@amd.com>
amd-xgbe: Check xgbe_init() return code
Zach Ploskey <zach@ploskey.com>
platform/x86: ideapad-laptop: handle ACPI event 1
Eric Farman <farman@linux.vnet.ibm.com>
scsi: virtio_scsi: Reject commands when virtqueue is broken
Vineeth Remanan Pillai <vineethp@amazon.com>
xen-netfront: Fix Rx stall during network stress and OOM
Colin Ian King <colin.king@canonical.com>
net: sctp: fix array overrun read on sctp_timer_tbl
Stefano Stabellini <sstabellini@kernel.org>
swiotlb-xen: update dev_addr after swapping pages
G. Campana <gcampana@quarkslab.com>
virtio_console: fix a crash in config_work_handler
Liu Bo <bo.li.liu@oracle.com>
Btrfs: fix truncate down when no_holes feature is enabled
Eric Dumazet <edumazet@google.com>
gianfar: Do not reuse pages from emergency reserve
Gavin Shan <gwshan@linux.vnet.ibm.com>
powerpc/eeh: Enable IO path on permanent error
Florian Fainelli <f.fainelli@gmail.com>
net: bgmac: Remove superflous netif_carrier_on()
Florian Fainelli <f.fainelli@gmail.com>
net: bgmac: Start transmit queue in bgmac_open
Florian Fainelli <f.fainelli@gmail.com>
net: bgmac: Fix SOF bit checking
David S. Miller <davem@davemloft.net>
bgmac: Fix reversed test of build_skb() return value.
Rafał Miłecki <zajec5@gmail.com>
mtd: bcm47xxpart: don't fail because of bit-flips
wangweidong <wangweidong1@huawei.com>
bgmac: fix a missing check for build_skb
Rafał Miłecki <zajec5@gmail.com>
mtd: bcm47xxpart: limit scanned flash area on BCM47XX (MIPS) only
Álvaro Fernández Rojas <noltari@gmail.com>
MIPS: ralink: fix MT7628 wled_an pinmux gpio
Álvaro Fernández Rojas <noltari@gmail.com>
MIPS: ralink: fix MT7628 pinmux typos
John Crispin <blogic@openwrt.org>
MIPS: ralink: Fix invalid assignment of SoC type
John Crispin <blogic@openwrt.org>
MIPS: ralink: fix USB frequency scaling
John Crispin <blogic@openwrt.org>
MIPS: ralink: MT7688 pinmux fixes
Florian Fainelli <f.fainelli@gmail.com>
net: korina: Fix NAPI versus resources freeing
Felix Fietkau <nbd@nbd.name>
MIPS: ath79: fix regression in PCI window initialization
Gregory CLEMENT <gregory.clement@free-electrons.com>
net: mvneta: Fix for_each_present_cpu usage
Jon Mason <jon.mason@broadcom.com>
ARM: dts: BCM5301X: Correct GIC_PPI interrupt flags
Quinn Tran <quinn.tran@cavium.com>
qla2xxx: Fix erroneous invalid handle message
Johannes Thumshirn <jthumshirn@suse.de>
scsi: lpfc: Set elsiocb contexts to NULL after freeing it
Damien Le Moal <damien.lemoal@wdc.com>
scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type
Dmitry Vyukov <dvyukov@google.com>
KVM: x86: fix fixing of hypercalls
Mark Rutland <mark.rutland@arm.com>
mm: numa: avoid waiting on freed migrated pages
Roman Pen <roman.penyaev@profitbricks.com>
block: fix module reference leak on put_disk() call for cgroups throttle
Kees Cook <keescook@chromium.org>
sysctl: enable strict writes
Baolin Wang <baolin.wang@linaro.org>
usb: gadget: f_fs: Fix possibe deadlock
Deepak Rawat <drawat@vmware.com>
drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
Hui Wang <hui.wang@canonical.com>
ALSA: hda - set input_path bitmap to zero after moving it to new place
Takashi Iwai <tiwai@suse.de>
ALSA: hda - Fix endless loop of codec configure
Paul Burton <paul.burton@imgtec.com>
MIPS: Fix IRQ tracing & lockdep when rescheduling
Paul Burton <paul.burton@imgtec.com>
MIPS: pm-cps: Drop manual cache-line alignment of ready_count
James Hogan <james.hogan@imgtec.com>
MIPS: Avoid accidental raw backtrace
David Rientjes <rientjes@google.com>
mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
Russell Currey <ruscur@russell.cc>
drm/ast: Handle configuration without P2A bridge
Kinglong Mee <kinglongmee@gmail.com>
NFSv4: fix a reference leak caused WARNING messages
Eric Leblond <eric@regit.org>
netfilter: synproxy: fix conntrackd interaction
Eric Dumazet <edumazet@google.com>
netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
Serhey Popovych <serhe.popovych@gmail.com>
rtnetlink: add IFLA_GROUP to ifla_policy
Serhey Popovych <serhe.popovych@gmail.com>
ipv6: Do not leak throw route references
Bert Kenward <bkenward@solarflare.com>
sfc: provide dummy definitions of vswitch functions
Gao Feng <gfree.wind@vip.163.com>
net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
Wei Wang <weiwan@google.com>
decnet: always not take dst->__refcnt when inserting dst into hash table
Eli Cohen <eli@mellanox.com>
net/mlx5: Wait for FW readiness before initializing command interface
Xin Long <lucien.xin@gmail.com>
ipv6: fix calling in6_ifa_hold incorrectly for dad work
WANG Cong <xiyou.wangcong@gmail.com>
igmp: add a missing spin_lock_init()
WANG Cong <xiyou.wangcong@gmail.com>
igmp: acquire pmc lock for ip_mc_clear_src()
Jia-Ju Bai <baijiaju1990@163.com>
net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
Krister Johansen <kjlx@templeofstupid.com>
Fix an intermittent pr_emerg warning about lo becoming free.
Mateusz Jurczyk <mjurczyk@google.com>
af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
Mintz, Yuval <Yuval.Mintz@cavium.com>
net: Zero ifla_vf_info in rtnl_fill_vfinfo()
Mateusz Jurczyk <mjurczyk@google.com>
decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb
Alexander Potapenko <glider@google.com>
net: don't call strlen on non-terminated string in dev_set_alias()
Willem de Bruijn <willemb@google.com>
ipv6: release dst on error in ip6_dst_lookup_tail
-------------
Diffstat:
Documentation/sysctl/kernel.txt | 15 +-
Makefile | 16 +-
arch/arm/boot/dts/bcm5301x.dtsi | 4 +-
arch/arm/mm/mmu.c | 8 +-
arch/arm64/include/asm/acpi.h | 6 +-
arch/arm64/include/asm/assembler.h | 36 +++-
arch/mips/ath79/common.c | 16 +-
arch/mips/kernel/entry.S | 3 +
arch/mips/kernel/pm-cps.c | 9 +-
arch/mips/kernel/traps.c | 2 +
arch/mips/ralink/mt7620.c | 84 +++++---
arch/mips/ralink/rt288x.c | 2 +-
arch/powerpc/kernel/eeh.c | 10 +-
arch/s390/include/asm/ctl_reg.h | 4 +-
arch/x86/include/asm/kvm_emulate.h | 4 +-
arch/x86/kvm/emulate.c | 16 +-
arch/x86/kvm/pmu_intel.c | 2 +-
arch/x86/kvm/vmx.c | 2 +-
arch/x86/kvm/x86.c | 20 +-
arch/x86/mm/mpx.c | 12 +-
arch/x86/mm/tlb.c | 4 +-
block/blk-cgroup.c | 9 +
drivers/char/virtio_console.c | 2 +-
drivers/cpufreq/s3c2416-cpufreq.c | 1 -
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 7 +
drivers/gpu/drm/ast/ast_drv.h | 6 +-
drivers/gpu/drm/ast/ast_main.c | 264 +++++++++++++++----------
drivers/gpu/drm/ast/ast_post.c | 7 +-
drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 1 +
drivers/hid/i2c-hid/i2c-hid.c | 9 +
drivers/iommu/amd_iommu_v2.c | 2 +-
drivers/iommu/intel-iommu.c | 2 +-
drivers/iommu/iommu.c | 37 ++--
drivers/mtd/bcm47xxpart.c | 42 ++--
drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 4 +-
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 +-
drivers/net/ethernet/broadcom/bgmac.c | 13 +-
drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +-
drivers/net/ethernet/freescale/gianfar.c | 2 +-
drivers/net/ethernet/ibm/ibmveth.c | 7 +-
drivers/net/ethernet/korina.c | 8 +-
drivers/net/ethernet/marvell/mvneta.c | 8 +-
drivers/net/ethernet/mellanox/mlx4/eq.c | 23 ++-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 +-
drivers/net/ethernet/renesas/ravb_main.c | 24 +--
drivers/net/ethernet/sfc/falcon.c | 10 +
drivers/net/virtio_net.c | 10 +-
drivers/net/vxlan.c | 2 +-
drivers/net/xen-netfront.c | 2 +-
drivers/platform/x86/ideapad-laptop.c | 1 +
drivers/scsi/lpfc/lpfc_els.c | 2 +
drivers/scsi/lpfc/lpfc_sli.c | 7 +
drivers/scsi/qla2xxx/qla_isr.c | 4 +
drivers/scsi/qla2xxx/qla_target.c | 2 +-
drivers/scsi/sd.c | 3 +-
drivers/scsi/virtio_scsi.c | 11 +-
drivers/spi/spi-davinci.c | 4 +-
drivers/usb/gadget/function/f_fs.c | 8 +-
drivers/vfio/vfio_iommu_spapr_tce.c | 4 +
drivers/watchdog/bcm_kona_wdt.c | 3 +-
drivers/xen/swiotlb-xen.c | 5 +-
fs/binfmt_elf.c | 1 +
fs/btrfs/inode.c | 13 +-
fs/coredump.c | 18 ++
fs/nfs/nfs4proc.c | 2 -
fs/ocfs2/cluster/heartbeat.c | 8 +-
include/linux/coredump.h | 1 +
include/net/xfrm.h | 10 -
kernel/panic.c | 2 +-
kernel/sched/loadavg.c | 4 +-
kernel/sysctl.c | 2 +-
lib/swiotlb.c | 6 +-
mm/huge_memory.c | 6 +
mm/swap_cgroup.c | 2 +
net/8021q/vlan.c | 3 +-
net/caif/cfpkt_skbuff.c | 6 +-
net/core/dev.c | 3 +-
net/core/dst.c | 14 ++
net/core/rtnetlink.c | 5 +-
net/decnet/dn_route.c | 14 +-
net/decnet/netfilter/dn_rtmsg.c | 4 +-
net/dsa/slave.c | 6 +-
net/ipv4/igmp.c | 22 ++-
net/ipv6/addrconf.c | 6 +-
net/ipv6/fib6_rules.c | 22 +--
net/ipv6/ip6_fib.c | 3 +-
net/ipv6/ip6_output.c | 6 +-
net/key/af_key.c | 17 +-
net/mac80211/main.c | 13 +-
net/netfilter/nf_conntrack_netlink.c | 4 +
net/netfilter/xt_TCPMSS.c | 6 +-
net/sctp/debug.c | 2 +-
net/sctp/socket.c | 2 +-
net/unix/af_unix.c | 7 +-
net/xfrm/xfrm_policy.c | 47 -----
sound/pci/hda/hda_codec.h | 2 +
sound/pci/hda/hda_controller.c | 8 +-
sound/pci/hda/hda_generic.c | 1 +
tools/perf/util/probe-finder.c | 10 +-
99 files changed, 703 insertions(+), 456 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 094/101] iommu/vt-d: Dont over-free page table directories |
| Message-ID | <tZ9TH-2c1-1@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Dillow <dillow@google.com>
commit f7116e115acdd74bc75a4daf6492b11d43505125 upstream.
dma_pte_free_level() recurses down the IOMMU page tables and frees
directory pages that are entirely contained in the given PFN range.
Unfortunately, it incorrectly calculates the starting address covered
by the PTE under consideration, which can lead to it clearing an entry
that is still in use.
This occurs if we have a scatterlist with an entry that has a length
greater than 1026 MB and is aligned to 2 MB for both the IOMMU and
physical addresses. For example, if __domain_mapping() is asked to map a
two-entry scatterlist with 2 MB and 1028 MB segments to PFN 0xffff80000,
it will ask if dma_pte_free_pagetable() is asked to PFNs from
0xffff80200 to 0xffffc05ff, it will also incorrectly clear the PFNs from
0xffff80000 to 0xffff801ff because of this issue. The current code will
set level_pfn to 0xffff80200, and 0xffff80200-0xffffc01ff fits inside
the range being cleared. Properly setting the level_pfn for the current
level under consideration catches that this PTE is outside of the range
being cleared.
This patch also changes the value passed into dma_pte_free_level() when
it recurses. This only affects the first PTE of the range being cleared,
and is handled by the existing code that ensures we start our cursor no
lower than start_pfn.
This was found when using dma_map_sg() to map large chunks of contiguous
memory, which immediatedly led to faults on the first access of the
erroneously-deleted mappings.
Fixes: 3269ee0bd668 ("intel-iommu: Fix leaks in pagetable freeing")
Reviewed-by: Benjamin Serebrin <serebrin@google.com>
Signed-off-by: David Dillow <dillow@google.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel-iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1137,7 +1137,7 @@ static void dma_pte_free_level(struct dm
if (!dma_pte_present(pte) || dma_pte_superpage(pte))
goto next;
- level_pfn = pfn & level_mask(level - 1);
+ level_pfn = pfn & level_mask(level);
level_pte = phys_to_virt(dma_pte_addr(pte));
if (level > 2)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 061/101] amd-xgbe: Check xgbe_init() return code |
| Message-ID | <tZ9TI-2c1-29@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Lendacky, Thomas" <Thomas.Lendacky@amd.com>
[ Upstream commit 738f7f647371ff4cfc9646c99dba5b58ad142db3 ]
The xgbe_init() routine returns a return code indicating success or
failure, but the return code is not checked. Add code to xgbe_init()
to issue a message when failures are seen and add code to check the
xgbe_init() return code.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 4 +++-
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -2732,8 +2732,10 @@ static int xgbe_init(struct xgbe_prv_dat
/* Flush Tx queues */
ret = xgbe_flush_tx_queues(pdata);
- if (ret)
+ if (ret) {
+ netdev_err(pdata->netdev, "error flushing TX queues\n");
return ret;
+ }
/*
* Initialize DMA related features
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -877,7 +877,9 @@ static int xgbe_start(struct xgbe_prv_da
DBGPR("-->xgbe_start\n");
- hw_if->init(pdata);
+ ret = hw_if->init(pdata);
+ if (ret)
+ return ret;
ret = phy_if->phy_start(pdata);
if (ret)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 082/101] ravb: Fix use-after-free on `ifconfig eth0 down` |
| Message-ID | <tZ9TJ-2c1-37@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugeniu Rosca <erosca@de.adit-jv.com>
[ Upstream commit 79514ef670e9e575a1fe36922268c439d0f0ca8a ]
Commit a47b70ea86bd ("ravb: unmap descriptors when freeing rings") has
introduced the issue seen in [1] reproduced on H3ULCB board.
Fix this by relocating the RX skb ringbuffer free operation, so that
swiotlb page unmapping can be done first. Freeing of aligned TX buffers
is not relevant to the issue seen in [1]. Still, reposition TX free
calls as well, to have all kfree() operations performed consistently
_after_ dma_unmap_*()/dma_free_*().
[1] Console screenshot with the problem reproduced:
salvator-x login: root
root@salvator-x:~# ifconfig eth0 up
Micrel KSZ9031 Gigabit PHY e6800000.ethernet-ffffffff:00: \
attached PHY driver [Micrel KSZ9031 Gigabit PHY] \
(mii_bus:phy_addr=e6800000.ethernet-ffffffff:00, irq=235)
IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
root@salvator-x:~#
root@salvator-x:~# ifconfig eth0 down
==================================================================
BUG: KASAN: use-after-free in swiotlb_tbl_unmap_single+0xc4/0x35c
Write of size 1538 at addr ffff8006d884f780 by task ifconfig/1649
CPU: 0 PID: 1649 Comm: ifconfig Not tainted 4.12.0-rc4-00004-g112eb07287d1 #32
Hardware name: Renesas H3ULCB board based on r8a7795 (DT)
Call trace:
[<ffff20000808f11c>] dump_backtrace+0x0/0x3a4
[<ffff20000808f4d4>] show_stack+0x14/0x1c
[<ffff20000865970c>] dump_stack+0xf8/0x150
[<ffff20000831f8b0>] print_address_description+0x7c/0x330
[<ffff200008320010>] kasan_report+0x2e0/0x2f4
[<ffff20000831eac0>] check_memory_region+0x20/0x14c
[<ffff20000831f054>] memcpy+0x48/0x68
[<ffff20000869ed50>] swiotlb_tbl_unmap_single+0xc4/0x35c
[<ffff20000869fcf4>] unmap_single+0x90/0xa4
[<ffff20000869fd14>] swiotlb_unmap_page+0xc/0x14
[<ffff2000080a2974>] __swiotlb_unmap_page+0xcc/0xe4
[<ffff2000088acdb8>] ravb_ring_free+0x514/0x870
[<ffff2000088b25dc>] ravb_close+0x288/0x36c
[<ffff200008aaf8c4>] __dev_close_many+0x14c/0x174
[<ffff200008aaf9b4>] __dev_close+0xc8/0x144
[<ffff200008ac2100>] __dev_change_flags+0xd8/0x194
[<ffff200008ac221c>] dev_change_flags+0x60/0xb0
[<ffff200008ba2dec>] devinet_ioctl+0x484/0x9d4
[<ffff200008ba7b78>] inet_ioctl+0x190/0x194
[<ffff200008a78c44>] sock_do_ioctl+0x78/0xa8
[<ffff200008a7a128>] sock_ioctl+0x110/0x3c4
[<ffff200008365a70>] vfs_ioctl+0x90/0xa0
[<ffff200008365dbc>] do_vfs_ioctl+0x148/0xc38
[<ffff2000083668f0>] SyS_ioctl+0x44/0x74
[<ffff200008083770>] el0_svc_naked+0x24/0x28
The buggy address belongs to the page:
page:ffff7e001b6213c0 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x4000000000000000()
raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 ffff7e001b6213e0 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8006d884f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8006d884f700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8006d884f780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff8006d884f800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8006d884f880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Disabling lock debugging due to kernel taint
root@salvator-x:~#
Fixes: a47b70ea86bd ("ravb: unmap descriptors when freeing rings")
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Acked-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/ravb_main.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -221,18 +221,6 @@ static void ravb_ring_free(struct net_de
int ring_size;
int i;
- /* Free RX skb ringbuffer */
- if (priv->rx_skb[q]) {
- for (i = 0; i < priv->num_rx_ring[q]; i++)
- dev_kfree_skb(priv->rx_skb[q][i]);
- }
- kfree(priv->rx_skb[q]);
- priv->rx_skb[q] = NULL;
-
- /* Free aligned TX buffers */
- kfree(priv->tx_align[q]);
- priv->tx_align[q] = NULL;
-
if (priv->rx_ring[q]) {
for (i = 0; i < priv->num_rx_ring[q]; i++) {
struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i];
@@ -261,6 +249,18 @@ static void ravb_ring_free(struct net_de
priv->tx_ring[q] = NULL;
}
+ /* Free RX skb ringbuffer */
+ if (priv->rx_skb[q]) {
+ for (i = 0; i < priv->num_rx_ring[q]; i++)
+ dev_kfree_skb(priv->rx_skb[q][i]);
+ }
+ kfree(priv->rx_skb[q]);
+ priv->rx_skb[q] = NULL;
+
+ /* Free aligned TX buffers */
+ kfree(priv->tx_align[q]);
+ priv->tx_align[q] = NULL;
+
/* Free TX skb ringbuffer.
* SKBs are freed by ravb_tx_free() call above.
*/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 090/101] ARM: 8685/1: ensure memblock-limit is pmd-aligned |
| Message-ID | <tZ9TJ-2c1-55@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Berger <opendmb@gmail.com>
commit 9e25ebfe56ece7541cd10a20d715cbdd148a2e06 upstream.
The pmd containing memblock_limit is cleared by prepare_page_table()
which creates the opportunity for early_alloc() to allocate unmapped
memory if memblock_limit is not pmd aligned causing a boot-time hang.
Commit 965278dcb8ab ("ARM: 8356/1: mm: handle non-pmd-aligned end of RAM")
attempted to resolve this problem, but there is a path through the
adjust_lowmem_bounds() routine where if all memory regions start and
end on pmd-aligned addresses the memblock_limit will be set to
arm_lowmem_limit.
Since arm_lowmem_limit can be affected by the vmalloc early parameter,
the value of arm_lowmem_limit may not be pmd-aligned. This commit
corrects this oversight such that memblock_limit is always rounded
down to pmd-alignment.
Fixes: 965278dcb8ab ("ARM: 8356/1: mm: handle non-pmd-aligned end of RAM")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/mmu.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1184,15 +1184,15 @@ void __init sanity_check_meminfo(void)
high_memory = __va(arm_lowmem_limit - 1) + 1;
+ if (!memblock_limit)
+ memblock_limit = arm_lowmem_limit;
+
/*
* Round the memblock limit down to a pmd size. This
* helps to ensure that we will allocate memory from the
* last full pmd, which should be mapped.
*/
- if (memblock_limit)
- memblock_limit = round_down(memblock_limit, PMD_SIZE);
- if (!memblock_limit)
- memblock_limit = arm_lowmem_limit;
+ memblock_limit = round_down(memblock_limit, PMD_SIZE);
memblock_set_current_limit(memblock_limit);
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 086/101] xfrm: Oops on error in pfkey_msg2xfrm_state() |
| Message-ID | <tZ9TK-2c1-63@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 1e3d0c2c70cd3edb5deed186c5f5c75f2b84a633 upstream.
There are some missing error codes here so we accidentally return NULL
instead of an error pointer. It results in a NULL pointer dereference.
Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/key/af_key.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1147,8 +1147,10 @@ static struct xfrm_state * pfkey_msg2xfr
if (key)
keysize = (key->sadb_key_bits + 7) / 8;
x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
- if (!x->aalg)
+ if (!x->aalg) {
+ err = -ENOMEM;
goto out;
+ }
strcpy(x->aalg->alg_name, a->name);
x->aalg->alg_key_len = 0;
if (key) {
@@ -1167,8 +1169,10 @@ static struct xfrm_state * pfkey_msg2xfr
goto out;
}
x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
- if (!x->calg)
+ if (!x->calg) {
+ err = -ENOMEM;
goto out;
+ }
strcpy(x->calg->alg_name, a->name);
x->props.calgo = sa->sadb_sa_encrypt;
} else {
@@ -1182,8 +1186,10 @@ static struct xfrm_state * pfkey_msg2xfr
if (key)
keysize = (key->sadb_key_bits + 7) / 8;
x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
- if (!x->ealg)
+ if (!x->ealg) {
+ err = -ENOMEM;
goto out;
+ }
strcpy(x->ealg->alg_name, a->name);
x->ealg->alg_key_len = 0;
if (key) {
@@ -1228,8 +1234,10 @@ static struct xfrm_state * pfkey_msg2xfr
struct xfrm_encap_tmpl *natt;
x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL);
- if (!x->encap)
+ if (!x->encap) {
+ err = -ENOMEM;
goto out;
+ }
natt = x->encap;
n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 096/101] iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid() |
| Message-ID | <tZ9TK-2c1-65@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Bian <bianpan2016@163.com>
commit 73dbd4a4230216b6a5540a362edceae0c9b4876b upstream.
In function amd_iommu_bind_pasid(), the control flow jumps
to label out_free when pasid_state->mm and mm is NULL. And
mmput(mm) is called. In function mmput(mm), mm is
referenced without validation. This will result in a NULL
dereference bug. This patch fixes the bug.
Signed-off-by: Pan Bian <bianpan2016@163.com>
Fixes: f0aac63b873b ('iommu/amd: Don't hold a reference to mm_struct')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu_v2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -699,9 +699,9 @@ out_clear_state:
out_unregister:
mmu_notifier_unregister(&pasid_state->mn, mm);
+ mmput(mm);
out_free:
- mmput(mm);
free_pasid_state(pasid_state);
out:
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 079/101] perf probe: Fix to show correct locations for events on modules |
| Message-ID | <tZ9TK-2c1-77@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <mhiramat@kernel.org>
[ Upstream commit d2d4edbebe07ddb77980656abe7b9bc7a9e0cdf7 ]
Fix to show correct locations for events on modules by relocating given
address instead of retrying after failure.
This happens when the module text size is big enough, bigger than
sh_addr, because the original code retries with given address + sh_addr
if it failed to find CU DIE at the given address.
Any address smaller than sh_addr always fails and it retries with the
correct address, but addresses bigger than sh_addr will get a CU DIE
which is on the given address (not adjusted by sh_addr).
In my environment(x86-64), the sh_addr of ".text" section is 0x10030.
Since i915 is a huge kernel module, we can see this issue as below.
$ grep "[Tt] .*\[i915\]" /proc/kallsyms | sort | head -n1
ffffffffc0270000 t i915_switcheroo_can_switch [i915]
ffffffffc0270000 + 0x10030 = ffffffffc0280030, so we'll check
symbols cross this boundary.
$ grep "[Tt] .*\[i915\]" /proc/kallsyms | grep -B1 ^ffffffffc028\
| head -n 2
ffffffffc027ff80 t haswell_init_clock_gating [i915]
ffffffffc0280110 t valleyview_init_clock_gating [i915]
So setup probes on both function and see what happen.
$ sudo ./perf probe -m i915 -a haswell_init_clock_gating \
-a valleyview_init_clock_gating
Added new events:
probe:haswell_init_clock_gating (on haswell_init_clock_gating in i915)
probe:valleyview_init_clock_gating (on valleyview_init_clock_gating in i915)
You can now use it in all perf tools, such as:
perf record -e probe:valleyview_init_clock_gating -aR sleep 1
$ sudo ./perf probe -l
probe:haswell_init_clock_gating (on haswell_init_clock_gating@gpu/drm/i915/intel_pm.c in i915)
probe:valleyview_init_clock_gating (on i915_vga_set_decode:4@gpu/drm/i915/i915_drv.c in i915)
As you can see, haswell_init_clock_gating is correctly shown,
but valleyview_init_clock_gating is not.
With this patch, both events are shown correctly.
$ sudo ./perf probe -l
probe:haswell_init_clock_gating (on haswell_init_clock_gating@gpu/drm/i915/intel_pm.c in i915)
probe:valleyview_init_clock_gating (on valleyview_init_clock_gating@gpu/drm/i915/intel_pm.c in i915)
Committer notes:
In my case:
# perf probe -m i915 -a haswell_init_clock_gating -a valleyview_init_clock_gating
Added new events:
probe:haswell_init_clock_gating (on haswell_init_clock_gating in i915)
probe:valleyview_init_clock_gating (on valleyview_init_clock_gating in i915)
You can now use it in all perf tools, such as:
perf record -e probe:valleyview_init_clock_gating -aR sleep 1
# perf probe -l
probe:haswell_init_clock_gating (on i915_getparam+432@gpu/drm/i915/i915_drv.c in i915)
probe:valleyview_init_clock_gating (on __i915_printk+240@gpu/drm/i915/i915_drv.c in i915)
#
# readelf -SW /lib/modules/4.9.0+/build/vmlinux | egrep -w '.text|Name'
[Nr] Name Type Address Off Size ES Flg Lk Inf Al
[ 1] .text PROGBITS ffffffff81000000 200000 822fd3 00 AX 0 0 4096
#
So both are b0rked, now with the fix:
# perf probe -m i915 -a haswell_init_clock_gating -a valleyview_init_clock_gating
Added new events:
probe:haswell_init_clock_gating (on haswell_init_clock_gating in i915)
probe:valleyview_init_clock_gating (on valleyview_init_clock_gating in i915)
You can now use it in all perf tools, such as:
perf record -e probe:valleyview_init_clock_gating -aR sleep 1
# perf probe -l
probe:haswell_init_clock_gating (on haswell_init_clock_gating@gpu/drm/i915/intel_pm.c in i915)
probe:valleyview_init_clock_gating (on valleyview_init_clock_gating@gpu/drm/i915/intel_pm.c in i915)
#
Both looks correct.
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/148411436777.9978.1440275861947194930.stgit@devbox
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/probe-finder.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -1460,16 +1460,12 @@ int debuginfo__find_probe_point(struct d
Dwarf_Addr _addr = 0, baseaddr = 0;
const char *fname = NULL, *func = NULL, *basefunc = NULL, *tmp;
int baseline = 0, lineno = 0, ret = 0;
- bool reloc = false;
-retry:
+ /* We always need to relocate the address for aranges */
+ if (debuginfo__get_text_offset(dbg, &baseaddr) == 0)
+ addr += baseaddr;
/* Find cu die */
if (!dwarf_addrdie(dbg->dbg, (Dwarf_Addr)addr, &cudie)) {
- if (!reloc && debuginfo__get_text_offset(dbg, &baseaddr) == 0) {
- addr += baseaddr;
- reloc = true;
- goto retry;
- }
pr_warning("Failed to find debug information for address %lx\n",
addr);
ret = -EINVAL;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 089/101] ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation |
| Message-ID | <tZ9TL-2c1-101@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
commit cb7cf772d83d2d4e6995c5bb9e0fb59aea8f7080 upstream.
The BAD_MADT_GICC_ENTRY() macro checks if a GICC MADT entry passes
muster from an ACPI specification standpoint. Current macro detects the
MADT GICC entry length through ACPI firmware version (it changed from 76
to 80 bytes in the transition from ACPI 5.1 to ACPI 6.0 specification)
but always uses (erroneously) the ACPICA (latest) struct (ie struct
acpi_madt_generic_interrupt - that is 80-bytes long) length to check if
the current GICC entry memory record exceeds the MADT table end in
memory as defined by the MADT table header itself, which may result in
false negatives depending on the ACPI firmware version and how the MADT
entries are laid out in memory (ie on ACPI 5.1 firmware MADT GICC
entries are 76 bytes long, so by adding 80 to a GICC entry start address
in memory the resulting address may well be past the actual MADT end,
triggering a false negative).
Fix the BAD_MADT_GICC_ENTRY() macro by reshuffling the condition checks
and update them to always use the firmware version specific MADT GICC
entry length in order to carry out boundary checks.
Fixes: b6cfb277378e ("ACPI / ARM64: add BAD_MADT_GICC_ENTRY() macro")
Reported-by: Julien Grall <julien.grall@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Julien Grall <julien.grall@arm.com>
Cc: Hanjun Guo <hanjun.guo@linaro.org>
Cc: Al Stone <ahs3@redhat.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/acpi.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/arm64/include/asm/acpi.h
+++ b/arch/arm64/include/asm/acpi.h
@@ -22,9 +22,9 @@
#define ACPI_MADT_GICC_LENGTH \
(acpi_gbl_FADT.header.revision < 6 ? 76 : 80)
-#define BAD_MADT_GICC_ENTRY(entry, end) \
- (!(entry) || (unsigned long)(entry) + sizeof(*(entry)) > (end) || \
- (entry)->header.length != ACPI_MADT_GICC_LENGTH)
+#define BAD_MADT_GICC_ENTRY(entry, end) \
+ (!(entry) || (entry)->header.length != ACPI_MADT_GICC_LENGTH || \
+ (unsigned long)(entry) + ACPI_MADT_GICC_LENGTH > (end))
/* Basic configuration for ACPI */
#ifdef CONFIG_ACPI
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 057/101] net: sctp: fix array overrun read on sctp_timer_tbl |
| Message-ID | <tZ9TL-2c1-99@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 0e73fc9a56f22f2eec4d2b2910c649f7af67b74d ]
The comparison on the timeout can lead to an array overrun
read on sctp_timer_tbl because of an off-by-one error. Fix
this by using < instead of <= and also compare to the array
size rather than SCTP_EVENT_TIMEOUT_MAX.
Fixes CoverityScan CID#1397639 ("Out-of-bounds read")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/debug.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -166,7 +166,7 @@ static const char *const sctp_timer_tbl[
/* Lookup timer debug name. */
const char *sctp_tname(const sctp_subtype_t id)
{
- if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX)
+ if (id.timeout < ARRAY_SIZE(sctp_timer_tbl))
return sctp_timer_tbl[id.timeout];
return "unknown_timer";
}
[toc] | [prev] | [next] | [standalone]
| From | Ben Hutchings <ben.hutchings@codethink.co.uk> |
|---|---|
| Date | 2017-07-04 20:50 +0200 |
| Subject | Re: [PATCH 4.4 057/101] net: sctp: fix array overrun read on sctp_timer_tbl |
| Message-ID | <tZB3z-3Dr-3@gated-at.bofh.it> |
| In reply to | #1680096 |
On Mon, 2017-07-03 at 15:34 +0200, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Colin Ian King <colin.king@canonical.com>
>
>
> [ Upstream commit 0e73fc9a56f22f2eec4d2b2910c649f7af67b74d ]
>
> The comparison on the timeout can lead to an array overrun
> read on sctp_timer_tbl because of an off-by-one error.
[...]
The off-by-one error was only introduced in 4.11 by:
commit 7b9438de0cd4b46a6914416bfede6cf839cd9e68
Author: Xin Long <lucien.xin@gmail.com>
Date: Wed Jan 18 00:44:43 2017 +0800
sctp: add stream reconf timer
So it is harmless but also useless to apply this to 4.4 and 4.9.
Ben.
--
Ben Hutchings
Software Developer, Codethink Ltd.
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-05 14:20 +0200 |
| Subject | Re: [PATCH 4.4 057/101] net: sctp: fix array overrun read on sctp_timer_tbl |
| Message-ID | <tZRrH-67q-9@gated-at.bofh.it> |
| In reply to | #1681125 |
On Tue, Jul 04, 2017 at 07:48:36PM +0100, Ben Hutchings wrote: > On Mon, 2017-07-03 at 15:34 +0200, Greg Kroah-Hartman wrote: > > 4.4-stable review patch. If anyone has any objections, please let me know. > > > > ------------------ > > > > From: Colin Ian King <colin.king@canonical.com> > > > > > > [ Upstream commit 0e73fc9a56f22f2eec4d2b2910c649f7af67b74d ] > > > > The comparison on the timeout can lead to an array overrun > > read on sctp_timer_tbl because of an off-by-one error. > [...] > > The off-by-one error was only introduced in 4.11 by: > > commit 7b9438de0cd4b46a6914416bfede6cf839cd9e68 > Author: Xin Long <lucien.xin@gmail.com> > Date: Wed Jan 18 00:44:43 2017 +0800 > > sctp: add stream reconf timer > > So it is harmless but also useless to apply this to 4.4 and 4.9. Thanks, I've now dropped it from both of those trees. greg k-h
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 085/101] xfrm: NULL dereference on allocation failure |
| Message-ID | <tZ9TM-2c1-115@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit e747f64336fc15e1c823344942923195b800aa1e upstream.
The default error code in pfkey_msg2xfrm_state() is -ENOBUFS. We
added a new call to security_xfrm_state_alloc() which sets "err" to zero
so there several places where we can return ERR_PTR(0) if kmalloc()
fails. The caller is expecting error pointers so it leads to a NULL
dereference.
Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/key/af_key.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1135,6 +1135,7 @@ static struct xfrm_state * pfkey_msg2xfr
goto out;
}
+ err = -ENOBUFS;
key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
if (sa->sadb_sa_auth) {
int keysize = 0;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 15:50 +0200 |
| Subject | [PATCH 4.4 095/101] iommu: Handle default domain attach failure |
| Message-ID | <tZ9TM-2c1-133@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <robin.murphy@arm.com>
commit 797a8b4d768c58caac58ee3e8cb36a164d1b7751 upstream.
We wouldn't normally expect ops->attach_dev() to fail, but on IOMMUs
with limited hardware resources, or generally misconfigured systems,
it is certainly possible. We report failure correctly from the external
iommu_attach_device() interface, but do not do so in iommu_group_add()
when attaching to the default domain. The result of failure there is
that the device, group and domain all get left in a broken,
part-configured state which leads to weird errors and misbehaviour down
the line when IOMMU API calls sort-of-but-don't-quite work.
Check the return value of __iommu_attach_device() on the default domain,
and refactor the error handling paths to cope with its failure and clean
up correctly in such cases.
Fixes: e39cb8a3aa98 ("iommu: Make sure a device is always attached to a domain")
Reported-by: Punit Agrawal <punit.agrawal@arm.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommu.c | 37 ++++++++++++++++++++++++-------------
1 file changed, 24 insertions(+), 13 deletions(-)
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -391,36 +391,30 @@ int iommu_group_add_device(struct iommu_
device->dev = dev;
ret = sysfs_create_link(&dev->kobj, &group->kobj, "iommu_group");
- if (ret) {
- kfree(device);
- return ret;
- }
+ if (ret)
+ goto err_free_device;
device->name = kasprintf(GFP_KERNEL, "%s", kobject_name(&dev->kobj));
rename:
if (!device->name) {
- sysfs_remove_link(&dev->kobj, "iommu_group");
- kfree(device);
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto err_remove_link;
}
ret = sysfs_create_link_nowarn(group->devices_kobj,
&dev->kobj, device->name);
if (ret) {
- kfree(device->name);
if (ret == -EEXIST && i >= 0) {
/*
* Account for the slim chance of collision
* and append an instance to the name.
*/
+ kfree(device->name);
device->name = kasprintf(GFP_KERNEL, "%s.%d",
kobject_name(&dev->kobj), i++);
goto rename;
}
-
- sysfs_remove_link(&dev->kobj, "iommu_group");
- kfree(device);
- return ret;
+ goto err_free_name;
}
kobject_get(group->devices_kobj);
@@ -432,8 +426,10 @@ rename:
mutex_lock(&group->mutex);
list_add_tail(&device->list, &group->devices);
if (group->domain)
- __iommu_attach_device(group->domain, dev);
+ ret = __iommu_attach_device(group->domain, dev);
mutex_unlock(&group->mutex);
+ if (ret)
+ goto err_put_group;
/* Notify any listeners about change to group. */
blocking_notifier_call_chain(&group->notifier,
@@ -444,6 +440,21 @@ rename:
pr_info("Adding device %s to group %d\n", dev_name(dev), group->id);
return 0;
+
+err_put_group:
+ mutex_lock(&group->mutex);
+ list_del(&device->list);
+ mutex_unlock(&group->mutex);
+ dev->iommu_group = NULL;
+ kobject_put(group->devices_kobj);
+err_free_name:
+ kfree(device->name);
+err_remove_link:
+ sysfs_remove_link(&dev->kobj, "iommu_group");
+err_free_device:
+ kfree(device);
+ pr_err("Failed to add device %s to group %d: %d\n", dev_name(dev), group->id, ret);
+ return ret;
}
EXPORT_SYMBOL_GPL(iommu_group_add_device);
[toc] | [prev] | [next] | [standalone]
| From | Ben Hutchings <ben.hutchings@codethink.co.uk> |
|---|---|
| Date | 2017-07-05 21:00 +0200 |
| Subject | Re: [PATCH 4.4 095/101] iommu: Handle default domain attach failure |
| Message-ID | <tZXGO-1Dt-21@gated-at.bofh.it> |
| In reply to | #1680111 |
On Mon, 2017-07-03 at 15:35 +0200, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Robin Murphy <robin.murphy@arm.com>
>
> commit 797a8b4d768c58caac58ee3e8cb36a164d1b7751 upstream.
>
> We wouldn't normally expect ops->attach_dev() to fail, but on IOMMUs
> with limited hardware resources, or generally misconfigured systems,
> it is certainly possible. We report failure correctly from the external
> iommu_attach_device() interface, but do not do so in iommu_group_add()
> when attaching to the default domain. The result of failure there is
> that the device, group and domain all get left in a broken,
> part-configured state which leads to weird errors and misbehaviour down
> the line when IOMMU API calls sort-of-but-don't-quite work.
>
> Check the return value of __iommu_attach_device() on the default domain,
> and refactor the error handling paths to cope with its failure and clean
> up correctly in such cases.
[...]
> @@ -432,8 +426,10 @@ rename:
> mutex_lock(&group->mutex);
> list_add_tail(&device->list, &group->devices);
> if (group->domain)
> - __iommu_attach_device(group->domain, dev);
> + ret = __iommu_attach_device(group->domain, dev);
> mutex_unlock(&group->mutex);
> + if (ret)
> + goto err_put_group;
It's still (briefly) possible for other tasks to observe the device in
the broken state. Shouldn't the error check be done before
mutex_unlock()?
> /* Notify any listeners about change to group. */
> blocking_notifier_call_chain(&group->notifier,
> @@ -444,6 +440,21 @@ rename:
> pr_info("Adding device %s to group %d\n", dev_name(dev), group->id);
>
> return 0;
> +
> +err_put_group:
> + mutex_lock(&group->mutex);
> + list_del(&device->list);
> + mutex_unlock(&group->mutex);
> + dev->iommu_group = NULL;
> + kobject_put(group->devices_kobj);
> +err_free_name:
> + kfree(device->name);
> +err_remove_link:
> + sysfs_remove_link(&dev->kobj, "iommu_group");
> +err_free_device:
> + kfree(device);
> + pr_err("Failed to add device %s to group %d: %d\n", dev_name(dev), group->id, ret);
> + return ret;
> }
> EXPORT_SYMBOL_GPL(iommu_group_add_device);
>
It seems like this cleanup statement in iommu_group_remove_device()
should also be done here under err_put_group:
sysfs_remove_link(group->devices_kobj, device->name);
Ben.
--
Ben Hutchings
Software Developer, Codethink Ltd.
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:50 +0200 |
| Subject | [PATCH 4.4 053/101] gianfar: Do not reuse pages from emergency reserve |
| Message-ID | <tZaPM-2Pz-1@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 69fed99baac186013840ced3524562841296034f ]
A driver using dev_alloc_page() must not reuse a page that had to
use emergency memory reserve.
Otherwise all packets using this page will be immediately dropped,
unless for very specific sockets having SOCK_MEMALLOC bit set.
This issue might be hard to debug, because only a fraction of the RX
ring buffer would suffer from drops.
Fixes: 75354148ce69 ("gianfar: Add paged allocation and Rx S/G")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Claudiu Manoil <claudiu.manoil@freescale.com>
Acked-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/freescale/gianfar.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2939,7 +2939,7 @@ static bool gfar_add_rx_frag(struct gfar
size, GFAR_RXB_TRUESIZE);
/* try reuse page */
- if (unlikely(page_count(page) != 1))
+ if (unlikely(page_count(page) != 1 || page_is_pfmemalloc(page)))
return false;
/* change offset to the other half */
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:50 +0200 |
| Subject | [PATCH 4.4 098/101] KVM: x86: fix emulation of RSM and IRET instructions |
| Message-ID | <tZaPM-2Pz-5@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ladi Prosek <lprosek@redhat.com>
commit 6ed071f051e12cf7baa1b69d3becb8f232fdfb7b upstream.
On AMD, the effect of set_nmi_mask called by emulate_iret_real and em_rsm
on hflags is reverted later on in x86_emulate_instruction where hflags are
overwritten with ctxt->emul_flags (the kvm_set_hflags call). This manifests
as a hang when rebooting Windows VMs with QEMU, OVMF, and >1 vcpu.
Instead of trying to merge ctxt->emul_flags into vcpu->arch.hflags after
an instruction is emulated, this commit deletes emul_flags altogether and
makes the emulator access vcpu->arch.hflags using two new accessors. This
way all changes, on the emulator side as well as in functions called from
the emulator and accessing vcpu state with emul_to_vcpu, are preserved.
More details on the bug and its manifestation with Windows and OVMF:
It's a KVM bug in the interaction between SMI/SMM and NMI, specific to AMD.
I believe that the SMM part explains why we started seeing this only with
OVMF.
KVM masks and unmasks NMI when entering and leaving SMM. When KVM emulates
the RSM instruction in em_rsm, the set_nmi_mask call doesn't stick because
later on in x86_emulate_instruction we overwrite arch.hflags with
ctxt->emul_flags, effectively reverting the effect of the set_nmi_mask call.
The AMD-specific hflag of interest here is HF_NMI_MASK.
When rebooting the system, Windows sends an NMI IPI to all but the current
cpu to shut them down. Only after all of them are parked in HLT will the
initiating cpu finish the restart. If NMI is masked, other cpus never get
the memo and the initiating cpu spins forever, waiting for
hal!HalpInterruptProcessorsStarted to drop. That's the symptom we observe.
Fixes: a584539b24b8 ("KVM: x86: pass the whole hflags field to emulator and back")
Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/kvm_emulate.h | 4 +++-
arch/x86/kvm/emulate.c | 16 +++++++++-------
arch/x86/kvm/x86.c | 15 ++++++++++++---
3 files changed, 24 insertions(+), 11 deletions(-)
--- a/arch/x86/include/asm/kvm_emulate.h
+++ b/arch/x86/include/asm/kvm_emulate.h
@@ -221,6 +221,9 @@ struct x86_emulate_ops {
void (*get_cpuid)(struct x86_emulate_ctxt *ctxt,
u32 *eax, u32 *ebx, u32 *ecx, u32 *edx);
void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked);
+
+ unsigned (*get_hflags)(struct x86_emulate_ctxt *ctxt);
+ void (*set_hflags)(struct x86_emulate_ctxt *ctxt, unsigned hflags);
};
typedef u32 __attribute__((vector_size(16))) sse128_t;
@@ -290,7 +293,6 @@ struct x86_emulate_ctxt {
/* interruptibility state, as a result of execution of STI or MOV SS */
int interruptibility;
- int emul_flags;
bool perm_ok; /* do not check permissions if true */
bool ud; /* inject an #UD if host doesn't support insn */
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2531,7 +2531,7 @@ static int em_rsm(struct x86_emulate_ctx
u64 smbase;
int ret;
- if ((ctxt->emul_flags & X86EMUL_SMM_MASK) == 0)
+ if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_MASK) == 0)
return emulate_ud(ctxt);
/*
@@ -2580,11 +2580,11 @@ static int em_rsm(struct x86_emulate_ctx
return X86EMUL_UNHANDLEABLE;
}
- if ((ctxt->emul_flags & X86EMUL_SMM_INSIDE_NMI_MASK) == 0)
+ if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_INSIDE_NMI_MASK) == 0)
ctxt->ops->set_nmi_mask(ctxt, false);
- ctxt->emul_flags &= ~X86EMUL_SMM_INSIDE_NMI_MASK;
- ctxt->emul_flags &= ~X86EMUL_SMM_MASK;
+ ctxt->ops->set_hflags(ctxt, ctxt->ops->get_hflags(ctxt) &
+ ~(X86EMUL_SMM_INSIDE_NMI_MASK | X86EMUL_SMM_MASK));
return X86EMUL_CONTINUE;
}
@@ -5296,6 +5296,7 @@ int x86_emulate_insn(struct x86_emulate_
const struct x86_emulate_ops *ops = ctxt->ops;
int rc = X86EMUL_CONTINUE;
int saved_dst_type = ctxt->dst.type;
+ unsigned emul_flags;
ctxt->mem_read.pos = 0;
@@ -5310,6 +5311,7 @@ int x86_emulate_insn(struct x86_emulate_
goto done;
}
+ emul_flags = ctxt->ops->get_hflags(ctxt);
if (unlikely(ctxt->d &
(No64|Undefined|Sse|Mmx|Intercept|CheckPerm|Priv|Prot|String))) {
if ((ctxt->mode == X86EMUL_MODE_PROT64 && (ctxt->d & No64)) ||
@@ -5343,7 +5345,7 @@ int x86_emulate_insn(struct x86_emulate_
fetch_possible_mmx_operand(ctxt, &ctxt->dst);
}
- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && ctxt->intercept) {
+ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && ctxt->intercept) {
rc = emulator_check_intercept(ctxt, ctxt->intercept,
X86_ICPT_PRE_EXCEPT);
if (rc != X86EMUL_CONTINUE)
@@ -5372,7 +5374,7 @@ int x86_emulate_insn(struct x86_emulate_
goto done;
}
- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
+ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
rc = emulator_check_intercept(ctxt, ctxt->intercept,
X86_ICPT_POST_EXCEPT);
if (rc != X86EMUL_CONTINUE)
@@ -5426,7 +5428,7 @@ int x86_emulate_insn(struct x86_emulate_
special_insn:
- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
+ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
rc = emulator_check_intercept(ctxt, ctxt->intercept,
X86_ICPT_POST_MEMACCESS);
if (rc != X86EMUL_CONTINUE)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4999,6 +4999,16 @@ static void emulator_set_nmi_mask(struct
kvm_x86_ops->set_nmi_mask(emul_to_vcpu(ctxt), masked);
}
+static unsigned emulator_get_hflags(struct x86_emulate_ctxt *ctxt)
+{
+ return emul_to_vcpu(ctxt)->arch.hflags;
+}
+
+static void emulator_set_hflags(struct x86_emulate_ctxt *ctxt, unsigned emul_flags)
+{
+ kvm_set_hflags(emul_to_vcpu(ctxt), emul_flags);
+}
+
static const struct x86_emulate_ops emulate_ops = {
.read_gpr = emulator_read_gpr,
.write_gpr = emulator_write_gpr,
@@ -5038,6 +5048,8 @@ static const struct x86_emulate_ops emul
.intercept = emulator_intercept,
.get_cpuid = emulator_get_cpuid,
.set_nmi_mask = emulator_set_nmi_mask,
+ .get_hflags = emulator_get_hflags,
+ .set_hflags = emulator_set_hflags,
};
static void toggle_interruptibility(struct kvm_vcpu *vcpu, u32 mask)
@@ -5090,7 +5102,6 @@ static void init_emulate_ctxt(struct kvm
BUILD_BUG_ON(HF_GUEST_MASK != X86EMUL_GUEST_MASK);
BUILD_BUG_ON(HF_SMM_MASK != X86EMUL_SMM_MASK);
BUILD_BUG_ON(HF_SMM_INSIDE_NMI_MASK != X86EMUL_SMM_INSIDE_NMI_MASK);
- ctxt->emul_flags = vcpu->arch.hflags;
init_decode_cache(ctxt);
vcpu->arch.emulate_regs_need_sync_from_vcpu = false;
@@ -5486,8 +5497,6 @@ restart:
unsigned long rflags = kvm_x86_ops->get_rflags(vcpu);
toggle_interruptibility(vcpu, ctxt->interruptibility);
vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
- if (vcpu->arch.hflags != ctxt->emul_flags)
- kvm_set_hflags(vcpu, ctxt->emul_flags);
kvm_rip_write(vcpu, ctxt->eip);
if (r == EMULATE_DONE)
kvm_vcpu_check_singlestep(vcpu, rflags, &r);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:50 +0200 |
| Subject | [PATCH 4.4 060/101] platform/x86: ideapad-laptop: handle ACPI event 1 |
| Message-ID | <tZaPM-2Pz-13@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Zach Ploskey <zach@ploskey.com> [ Upstream commit cfee5d63767b2e7997c1f36420d008abbe61565c ] On Ideapad laptops, ACPI event 1 is currently not handled. Many models log "ideapad_laptop: Unknown event: 1" every 20 seconds or so while running on battery power. Some convertible laptops receive this event when switching in and out of tablet mode. This adds and additional case for event 1 in ideapad_acpi_notify to call ideapad_input_report(priv, vpc_bit), so that the event is reported to userspace and we avoid unnecessary logging. Fixes bug #107481 (https://bugzilla.kernel.org/show_bug.cgi?id=107481) Fixes bug #65751 (https://bugzilla.kernel.org/show_bug.cgi?id=65751) Signed-off-by: Zach Ploskey <zach@ploskey.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/platform/x86/ideapad-laptop.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/platform/x86/ideapad-laptop.c +++ b/drivers/platform/x86/ideapad-laptop.c @@ -807,6 +807,7 @@ static void ideapad_acpi_notify(acpi_han case 11: case 7: case 6: + case 1: ideapad_input_report(priv, vpc_bit); break; case 5:
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:50 +0200 |
| Subject | [PATCH 4.4 091/101] x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space |
| Message-ID | <tZaPM-2Pz-23@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
commit 5ed386ec09a5d75bcf073967e55e895c2607a5c3 upstream.
When this function fails it just sends a SIGSEGV signal to
user-space using force_sig(). This signal is missing
essential information about the cause, e.g. the trap_nr or
an error code.
Fix this by propagating the error to the only caller of
mpx_handle_bd_fault(), do_bounds(), which sends the correct
SIGSEGV signal to the process.
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: fe3d197f84319 ('x86, mpx: On-demand kernel allocation of bounds tables')
Link: http://lkml.kernel.org/r/1491488362-27198-1-git-send-email-joro@8bytes.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/mpx.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -525,15 +525,7 @@ int mpx_handle_bd_fault(void)
if (!kernel_managing_mpx_tables(current->mm))
return -EINVAL;
- if (do_mpx_bt_fault()) {
- force_sig(SIGSEGV, current);
- /*
- * The force_sig() is essentially "handling" this
- * exception, so we do not pass up the error
- * from do_mpx_bt_fault().
- */
- }
- return 0;
+ return do_mpx_bt_fault();
}
/*
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-03 16:50 +0200 |
| Subject | [PATCH 4.4 062/101] net: dsa: Check return value of phy_connect_direct() |
| Message-ID | <tZaPN-2Pz-33@gated-at.bofh.it> |
| In reply to | #1680046 |
4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Fainelli <f.fainelli@gmail.com> [ Upstream commit 4078b76cac68e50ccf1f76a74e7d3d5788aec3fe ] We need to check the return value of phy_connect_direct() in dsa_slave_phy_connect() otherwise we may be continuing the initialization of a slave network device with a PHY that already attached somewhere else and which will soon be in error because the PHY device is in error. The conditions for such an error to occur are that we have a port of our switch that is not disabled, and has the same port number as a PHY address (say both 5) that can be probed using the DSA slave MII bus. We end-up having this slave network device find a PHY at the same address as our port number, and we try to attach to it. A slave network (e.g: port 0) has already attached to our PHY device, and we try to re-attach it with a different network device, but since we ignore the error we would end-up initializating incorrect device references by the time the slave network interface is opened. The code has been (re)organized several times, making it hard to provide an exact Fixes tag, this is a bugfix nonetheless. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/dsa/slave.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) --- a/net/dsa/slave.c +++ b/net/dsa/slave.c @@ -1006,10 +1006,8 @@ static int dsa_slave_phy_connect(struct /* Use already configured phy mode */ if (p->phy_interface == PHY_INTERFACE_MODE_NA) p->phy_interface = p->phy->interface; - phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link, - p->phy_interface); - - return 0; + return phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link, + p->phy_interface); } static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
[toc] | [prev] | [next] | [standalone]
Page 1 of 4 [1] 2 3 4 Next page →
Back to top | Article view | linux.kernel
csiph-web