Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1707850 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-08-09 22:40 +0200 |
| Last post | 2017-08-10 04:40 +0200 |
| Articles | 20 on this page of 93 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 3.18 00/92] 3.18.64-stable review - take 2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 23/92] mailbox: handle empty message in tx_tick Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 36/92] pstore: Use dynamic spinlock initializer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 10/92] Revert "powerpc/numa: Fix percpu allocations to be NUMA aware" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 18/92] strscpy: zero any trailing garbage bytes in the destination Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 06/92] drm/vmwgfx: Fix gcc-7.1.1 warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 02/92] pstore: Make spinlock per zone instead of global Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 27/92] ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 28/92] net: sctp: fix race for one-to-many sockets in sendmsgs auto associate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 11/92] Staging: comedi: comedi_fops: Avoid orphaned proc entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 16/92] isdn: Fix a sleep-in-atomic bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 37/92] net: skb_needs_check() accepts CHECKSUM_NONE for tx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 08/92] KVM: PPC: Book3S HV: Reload HTM registers explicitly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 34/92] pstore: Allow prz to control need for locking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 50/92] xfrm: Dont use sk_family for socket policy lookups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 71/92] net: Zero terminate ifr_name in dev_ifname(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 14/92] Bluetooth: cmtp: cmtp_add_connection() should verify that its dealing with l2cap socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 03/92] net: reduce skb_warn_bad_offload() noise Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 35/92] pstore: Correctly initialize spinlock and flags Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:40 +0200
[PATCH 3.18 30/92] net, sched: fix soft lockup in tc_classify Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 53/92] Make asm/word-at-a-time.h available on all architectures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 76/92] packet: fix use-after-free in prb_retire_rx_blk_timer_expired() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 48/92] spi: dw: Make debugfs name unique between instances Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 82/92] wext: handle NULL extra data in iwe_stream_add_point better Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 80/92] net: phy: Correctly process PHY_HALTED in phy_stop_machine() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 64/92] media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 75/92] mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 59/92] ASoC: do not close shared backend dailink Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 72/92] ipv6: avoid overflow of offset in ip6_find_1stfragopt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 46/92] vfio-pci: use 32-bit comparisons for register address for gcc-4.5 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 49/92] vlan: Propagate MAC address to VLANs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 88/92] mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 13/92] Bluetooth: Fix potential NULL dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 39/92] x86/mce/AMD: Make the init code more robust Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 21/92] mailbox: always wait in mbox_send_message for blocking Tx mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 68/92] iscsi-target: Fix initial login PDU asynchronous socket close OOPs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 57/92] workqueue: restore WQ_UNBOUND/max_active==1 to be ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 85/92] x86/boot: Add missing declaration of string functions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 89/92] lib/Kconfig.debug: fix frv build failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 70/92] f2fs: sanity check checkpoint segno and blkoff Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 19/92] isdn/i4l: fix buffer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 92/92] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 81/92] xen-netback: correctly schedule rate-limited queues Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 24/92] mpt3sas: Dont overreach ioc->reply_post[] during initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 91/92] mm: dont dereference struct page fields of invalid pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 61/92] mm/page_alloc: Remove kernel address exposure in free_reserved_area() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 47/92] ASoC: tlv320aic3x: Mark the RESET register as volatile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 87/92] ARM: 8632/1: ftrace: fix syscall name matching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 38/92] tpm: fix a kernel memory leak in tpm-sysfs.c Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 83/92] sh_eth: R8A7740 supports packet shecksumming Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 58/92] ALSA: hda - Fix speaker output from VAIO VPCL14M1R Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 79/92] sctp: fix the check for _sctp_walk_params and _sctp_walk_errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 78/92] sctp: dont dereference ptr before leaving _sctp_walk_{params, errors}() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 84/92] tg3: Fix race condition in tg3_get_stats64(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 69/92] iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 86/92] scsi: qla2xxx: Get mutex lock before checking optrom_state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 54/92] arch/powerpc: provide zero_bytemask() for big-endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 63/92] ext4: fix overflow caused by missing cast in ext4_resize_fs() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 44/92] drm/msm: Ensure that the hardware write pointer is valid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 62/92] ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 45/92] drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 07/92] KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 90/92] signal: protect SIGNAL_UNKILLABLE from unintentional clearing. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 66/92] iscsi-target: Always wait for kthread_should_stop() before kthread exit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 22:50 +0200
[PATCH 3.18 22/92] mailbox: skip complete wait event if timer expired Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 56/92] libata: array underflow in ata_find_dev() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 31/92] ipmi/watchdog: fix watchdog timeout set on reboot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 55/92] tile: use global strscpy() rather than private copy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 77/92] dccp: fix a memleak for dccp_feat_init err process Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 73/92] ipv4: initialize fib_trie prior to register_netdev_notifier call. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 42/92] ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 32/92] dentry name snapshots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 17/92] string: provide strscpy() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 20/92] wil6210: fix deadlock when using fw_no_recovery option Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 25/92] kaweth: fix firmware download Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 43/92] net/mlx4: Remove BUG_ON from ICM allocation routine Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 65/92] target: Avoid mappedlun symlink creation during lun shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 67/92] iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 51/92] tile: add <asm/word-at-a-time.h> and enable support functions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 26/92] kaweth: fix oops upon failed memory allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 33/92] [media] v4l: s5c73m3: fix negation operator Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 52/92] word-at-a-time.h: support zero_bytemask() on alpha and tile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 40/92] r8169: add support for RTL8168 series add-on card. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 74/92] rtnetlink: allocate more memory for dev_set_mac_address() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:00 +0200
[PATCH 3.18 04/92] powerpc/pseries: Fix of_node_put() underflow during reconfig remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:10 +0200
[PATCH 3.18 09/92] KVM: PPC: Book3S HV: Save/restore host values of debug registers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:10 +0200
[PATCH 3.18 05/92] md/raid5: add thread_group worker async_tx_issue_pending_all Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:10 +0200
[PATCH 3.18 01/92] af_key: Add lock to key dump Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:10 +0200
[PATCH 3.18 12/92] Bluetooth: bnep: bnep_add_connection() should verify that its dealing with l2cap socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 23:10 +0200
Re: [PATCH 3.18 00/92] 3.18.64-stable review - take 2 Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-10 02:00 +0200
Re: [PATCH 3.18 00/92] 3.18.64-stable review - take 2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-10 04:40 +0200
Re: [PATCH 3.18 00/92] 3.18.64-stable review - take 2 Guenter Roeck <linux@roeck-us.net> - 2017-08-10 02:30 +0200
Re: [PATCH 3.18 00/92] 3.18.64-stable review - take 2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-10 04:40 +0200
Page 1 of 5 [1] 2 3 4 5 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 00/92] 3.18.64-stable review - take 2 |
| Message-ID | <ucFVM-3Rs-3@gated-at.bofh.it> |
This is the second start of the stable review cycle for the 3.18.64
release (the first try had too many problems...)
There are 92 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri Aug 11 20:21:39 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.64-rc2.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.18.64-rc2
zheng li <james.z.li@ericsson.com>
ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output
Ard Biesheuvel <ard.biesheuvel@linaro.org>
mm: don't dereference struct page fields of invalid pages
Jamie Iles <jamie.iles@oracle.com>
signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
Sudip Mukherjee <sudipm.mukherjee@gmail.com>
lib/Kconfig.debug: fix frv build failure
Michal Hocko <mhocko@suse.com>
mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER
Rabin Vincent <rabinv@axis.com>
ARM: 8632/1: ftrace: fix syscall name matching
Milan P. Gandhi <mgandhi@redhat.com>
scsi: qla2xxx: Get mutex lock before checking optrom_state
Nicholas Mc Guire <hofrat@osadl.org>
x86/boot: Add missing declaration of string functions
Michael Chan <michael.chan@broadcom.com>
tg3: Fix race condition in tg3_get_stats64().
Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
sh_eth: R8A7740 supports packet shecksumming
Arnd Bergmann <arnd@arndb.de>
wext: handle NULL extra data in iwe_stream_add_point better
Wei Liu <wei.liu2@citrix.com>
xen-netback: correctly schedule rate-limited queues
Florian Fainelli <f.fainelli@gmail.com>
net: phy: Correctly process PHY_HALTED in phy_stop_machine()
Xin Long <lucien.xin@gmail.com>
sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
Alexander Potapenko <glider@google.com>
sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
Xin Long <lucien.xin@gmail.com>
dccp: fix a memleak for dccp_feat_init err process
WANG Cong <xiyou.wangcong@gmail.com>
packet: fix use-after-free in prb_retire_rx_blk_timer_expired()
Thomas Jarosch <thomas.jarosch@intra2net.com>
mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled
WANG Cong <xiyou.wangcong@gmail.com>
rtnetlink: allocate more memory for dev_set_mac_address()
Mahesh Bandewar <maheshb@google.com>
ipv4: initialize fib_trie prior to register_netdev_notifier call.
Sabrina Dubroca <sd@queasysnail.net>
ipv6: avoid overflow of offset in ip6_find_1stfragopt
David S. Miller <davem@davemloft.net>
net: Zero terminate ifr_name in dev_ifname().
Jin Qian <jinqian@google.com>
f2fs: sanity check checkpoint segno and blkoff
Nicholas Bellinger <nab@linux-iscsi.org>
iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP
Nicholas Bellinger <nab@linux-iscsi.org>
iscsi-target: Fix initial login PDU asynchronous socket close OOPs
Nicholas Bellinger <nab@linux-iscsi.org>
iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race
Jiang Yi <jiangyilism@gmail.com>
iscsi-target: Always wait for kthread_should_stop() before kthread exit
Nicholas Bellinger <nab@linux-iscsi.org>
target: Avoid mappedlun symlink creation during lun shutdown
Prabhakar Lad <prabhakar.csengg@gmail.com>
media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl
Jerry Lee <jerrylee@qnap.com>
ext4: fix overflow caused by missing cast in ext4_resize_fs()
Jan Kara <jack@suse.cz>
ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
Josh Poimboeuf <jpoimboe@redhat.com>
mm/page_alloc: Remove kernel address exposure in free_reserved_area()
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: async_pf: make rcu irq exit if not triggered from idle task
Banajit Goswami <bgoswami@codeaurora.org>
ASoC: do not close shared backend dailink
Sergei A. Trusov <sergei.a.trusov@ya.ru>
ALSA: hda - Fix speaker output from VAIO VPCL14M1R
Tejun Heo <tj@kernel.org>
workqueue: restore WQ_UNBOUND/max_active==1 to be ordered
Dan Carpenter <dan.carpenter@oracle.com>
libata: array underflow in ata_find_dev()
Chris Metcalf <cmetcalf@ezchip.com>
tile: use global strscpy() rather than private copy
Chris Metcalf <cmetcalf@ezchip.com>
arch/powerpc: provide zero_bytemask() for big-endian
Chris Metcalf <cmetcalf@ezchip.com>
Make asm/word-at-a-time.h available on all architectures
Chris Metcalf <cmetcalf@ezchip.com>
word-at-a-time.h: support zero_bytemask() on alpha and tile
Chris Metcalf <cmetcalf@ezchip.com>
tile: add <asm/word-at-a-time.h> and enable support functions
Steffen Klassert <steffen.klassert@secunet.com>
xfrm: Don't use sk_family for socket policy lookups
Mike Manning <mmanning@brocade.com>
vlan: Propagate MAC address to VLANs
Phil Reid <preid@electromag.com.au>
spi: dw: Make debugfs name unique between instances
Peter Ujfalusi <peter.ujfalusi@ti.com>
ASoC: tlv320aic3x: Mark the RESET register as volatile
Arnd Bergmann <arnd@arndb.de>
vfio-pci: use 32-bit comparisons for register address for gcc-4.5
Jordan Crouse <jcrouse@codeaurora.org>
drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set
Jordan Crouse <jcrouse@codeaurora.org>
drm/msm: Ensure that the hardware write pointer is valid
Leon Romanovsky <leonro@mellanox.com>
net/mlx4: Remove BUG_ON from ICM allocation routine
Zheng Li <james.z.li@ericsson.com>
ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output
Pali Rohár <pali.rohar@gmail.com>
ARM: dts: n900: Mark eMMC slot with no-sdio and no-sd flags
Chun-Hao Lin <hau@realtek.com>
r8169: add support for RTL8168 series add-on card.
Thomas Gleixner <tglx@linutronix.de>
x86/mce/AMD: Make the init code more robust
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
tpm: fix a kernel memory leak in tpm-sysfs.c
Eric Dumazet <edumazet@google.com>
net: skb_needs_check() accepts CHECKSUM_NONE for tx
Kees Cook <keescook@chromium.org>
pstore: Use dynamic spinlock initializer
Kees Cook <keescook@chromium.org>
pstore: Correctly initialize spinlock and flags
Joel Fernandes <joelaf@google.com>
pstore: Allow prz to control need for locking
Andrzej Hajda <a.hajda@samsung.com>
v4l: s5c73m3: fix negation operator
Al Viro <viro@zeniv.linux.org.uk>
dentry name snapshots
Valentin Vidic <Valentin.Vidic@CARNet.hr>
ipmi/watchdog: fix watchdog timeout set on reboot
Daniel Borkmann <daniel@iogearbox.net>
net, sched: fix soft lockup in tc_classify
Ben Hutchings <ben.hutchings@codethink.co.uk>
sh_eth: Fix ethtool operation crash when net device is down
Daniel Borkmann <dborkman@redhat.com>
net: sctp: fix race for one-to-many sockets in sendmsg's auto associate
Jan Stancek <jstancek@redhat.com>
ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc
Oliver Neukum <oneukum@suse.com>
kaweth: fix oops upon failed memory allocation
Oliver Neukum <oneukum@suse.com>
kaweth: fix firmware download
Calvin Owens <calvinowens@fb.com>
mpt3sas: Don't overreach ioc->reply_post[] during initialization
Sudeep Holla <sudeep.holla@arm.com>
mailbox: handle empty message in tx_tick
Sudeep Holla <sudeep.holla@arm.com>
mailbox: skip complete wait event if timer expired
Sudeep Holla <sudeep.holla@arm.com>
mailbox: always wait in mbox_send_message for blocking Tx mode
Lior David <qca_liord@qca.qualcomm.com>
wil6210: fix deadlock when using fw_no_recovery option
Annie Cherkaev <annie.cherk@gmail.com>
isdn/i4l: fix buffer overflow
Chris Metcalf <cmetcalf@ezchip.com>
strscpy: zero any trailing garbage bytes in the destination
Chris Metcalf <cmetcalf@ezchip.com>
string: provide strscpy()
Jia-Ju Bai <baijiaju1990@163.com>
isdn: Fix a sleep-in-atomic bug
Florian Fainelli <f.fainelli@gmail.com>
net: phy: Do not perform software reset for Generic PHY
Al Viro <viro@zeniv.linux.org.uk>
Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket
Johan Hedberg <johan.hedberg@intel.com>
Bluetooth: Fix potential NULL dereference
Al Viro <viro@zeniv.linux.org.uk>
Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket
Cheah Kok Cheong <thrust73@gmail.com>
Staging: comedi: comedi_fops: Avoid orphaned proc entry
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Revert "powerpc/numa: Fix percpu allocations to be NUMA aware"
Paul Mackerras <paulus@ozlabs.org>
KVM: PPC: Book3S HV: Save/restore host values of debug registers
Paul Mackerras <paulus@ozlabs.org>
KVM: PPC: Book3S HV: Reload HTM registers explicitly
Paul Mackerras <paulus@ozlabs.org>
KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit
Sinclair Yeh <syeh@vmware.com>
drm/vmwgfx: Fix gcc-7.1.1 warning
Ofer Heifetz <oferh@marvell.com>
md/raid5: add thread_group worker async_tx_issue_pending_all
Laurent Vivier <lvivier@redhat.com>
powerpc/pseries: Fix of_node_put() underflow during reconfig remove
Eric Dumazet <edumazet@google.com>
net: reduce skb_warn_bad_offload() noise
Joel Fernandes <joelaf@google.com>
pstore: Make spinlock per zone instead of global
Yuejie Shi <syjcnss@gmail.com>
af_key: Add lock to key dump
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/include/asm/word-at-a-time.h | 2 +
arch/arc/include/asm/Kbuild | 1 +
arch/arm/boot/dts/omap3-n900.dts | 2 +
arch/arm/include/asm/ftrace.h | 18 +++
arch/avr32/include/asm/Kbuild | 1 +
arch/blackfin/include/asm/Kbuild | 1 +
arch/c6x/include/asm/Kbuild | 1 +
arch/cris/include/asm/Kbuild | 1 +
arch/frv/include/asm/Kbuild | 1 +
arch/hexagon/include/asm/Kbuild | 1 +
arch/ia64/include/asm/Kbuild | 1 +
arch/m32r/include/asm/Kbuild | 1 +
arch/metag/include/asm/Kbuild | 1 +
arch/microblaze/include/asm/Kbuild | 1 +
arch/mips/include/asm/Kbuild | 1 +
arch/mn10300/include/asm/Kbuild | 1 +
arch/powerpc/include/asm/Kbuild | 1 +
arch/powerpc/include/asm/topology.h | 14 --
arch/powerpc/include/asm/word-at-a-time.h | 5 +
arch/powerpc/kernel/setup_64.c | 4 +-
arch/powerpc/kvm/book3s_hv.c | 29 +++-
arch/powerpc/kvm/book3s_hv_rmhandlers.S | 37 ++++-
arch/powerpc/platforms/pseries/reconfig.c | 1 -
arch/s390/include/asm/Kbuild | 1 +
arch/score/include/asm/Kbuild | 1 +
arch/tile/Kconfig | 2 +
arch/tile/gxio/mpipe.c | 33 +---
arch/tile/include/asm/Kbuild | 1 +
arch/tile/include/asm/uaccess.h | 66 ++------
arch/tile/include/asm/word-at-a-time.h | 42 ++++++
arch/tile/lib/exports.c | 2 -
arch/tile/lib/usercopy_32.S | 46 ------
arch/tile/lib/usercopy_64.S | 46 ------
arch/um/include/asm/Kbuild | 1 +
arch/unicore32/include/asm/Kbuild | 1 +
arch/x86/boot/string.c | 1 +
arch/x86/boot/string.h | 9 ++
arch/x86/kernel/cpu/mcheck/mce_amd.c | 3 +
arch/x86/kernel/kvm.c | 6 +-
arch/xtensa/include/asm/Kbuild | 1 +
drivers/ata/libata-scsi.c | 6 +-
drivers/char/ipmi/ipmi_watchdog.c | 7 +-
drivers/char/tpm/tpm-sysfs.c | 2 +
drivers/gpu/drm/msm/adreno/adreno_gpu.c | 9 +-
drivers/gpu/drm/msm/msm_gem_submit.c | 3 +-
drivers/gpu/drm/msm/msm_ringbuffer.c | 3 +-
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
drivers/isdn/i4l/isdn_common.c | 1 +
drivers/isdn/i4l/isdn_net.c | 5 +-
drivers/isdn/i4l/isdn_ppp.c | 2 +-
drivers/mailbox/mailbox.c | 13 +-
drivers/md/raid5.c | 2 +
drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c | 2 +-
drivers/media/platform/davinci/vpfe_capture.c | 22 +--
drivers/net/ethernet/broadcom/tg3.c | 3 +
drivers/net/ethernet/mellanox/mlx4/icm.c | 7 +-
drivers/net/ethernet/realtek/r8169.c | 1 +
drivers/net/ethernet/renesas/sh_eth.c | 11 ++
drivers/net/irda/mcs7780.c | 16 +-
drivers/net/phy/phy.c | 3 +
drivers/net/phy/phy_device.c | 2 +-
drivers/net/usb/kaweth.c | 10 +-
drivers/net/wireless/ath/wil6210/main.c | 15 +-
drivers/net/xen-netback/common.h | 1 +
drivers/net/xen-netback/interface.c | 6 +-
drivers/net/xen-netback/netback.c | 6 +-
drivers/scsi/mpt3sas/mpt3sas_base.c | 33 ++--
drivers/scsi/qla2xxx/qla_attr.c | 18 ++-
drivers/spi/spi-dw.c | 5 +-
drivers/staging/comedi/comedi_fops.c | 6 +-
drivers/target/iscsi/iscsi_target.c | 38 ++++-
drivers/target/iscsi/iscsi_target_core.h | 1 +
drivers/target/iscsi/iscsi_target_erl0.c | 6 +-
drivers/target/iscsi/iscsi_target_erl0.h | 2 +-
drivers/target/iscsi/iscsi_target_login.c | 4 +
drivers/target/iscsi/iscsi_target_nego.c | 208 +++++++++++++++++---------
drivers/target/target_core_fabric_configfs.c | 5 +
drivers/target/target_core_tpg.c | 3 +
drivers/vfio/pci/vfio_pci_rdwr.c | 5 +-
fs/dcache.c | 27 ++++
fs/debugfs/inode.c | 10 +-
fs/ext4/file.c | 3 +
fs/ext4/resize.c | 3 +-
fs/f2fs/super.c | 16 ++
fs/namei.c | 8 +-
fs/notify/fsnotify.c | 8 +-
fs/pstore/ram.c | 5 +-
fs/pstore/ram_core.c | 25 ++--
include/asm-generic/word-at-a-time.h | 80 +++++++++-
include/linux/dcache.h | 7 +
include/linux/fsnotify.h | 31 ----
include/linux/phy.h | 4 +
include/linux/pstore_ram.h | 11 +-
include/linux/sched.h | 10 ++
include/linux/slab.h | 4 +-
include/linux/string.h | 3 +
include/net/iw_handler.h | 3 +-
include/net/sctp/sctp.h | 4 +
include/target/target_core_base.h | 1 +
kernel/signal.c | 4 +-
kernel/workqueue.c | 10 ++
lib/Kconfig.debug | 2 +-
lib/string.c | 89 +++++++++++
mm/page_alloc.c | 10 +-
net/8021q/vlan.c | 5 +
net/8021q/vlan.h | 2 +
net/8021q/vlan_dev.c | 20 ++-
net/bluetooth/bnep/core.c | 10 +-
net/bluetooth/cmtp/core.c | 3 +
net/core/dev.c | 19 ++-
net/core/dev_ioctl.c | 1 +
net/core/rtnetlink.c | 3 +-
net/dccp/feat.c | 7 +-
net/ipv4/fib_frontend.c | 9 +-
net/ipv4/ip_output.c | 2 +-
net/ipv6/ip6_flowlabel.c | 4 +-
net/ipv6/ip6_output.c | 2 +-
net/ipv6/output_core.c | 8 +-
net/key/af_key.c | 46 +++++-
net/packet/af_packet.c | 2 +-
net/sched/cls_api.c | 4 +-
net/sctp/socket.c | 8 +-
net/xfrm/xfrm_policy.c | 9 +-
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/codecs/tlv320aic3x.c | 13 ++
sound/soc/soc-pcm.c | 4 +
127 files changed, 960 insertions(+), 486 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 23/92] mailbox: handle empty message in tx_tick |
| Message-ID | <ucFVM-3Rs-7@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@arm.com>
commit cb710ab1d8a23f68ff8f45aedf3e552bb90e70de upstream.
We already check if the message is empty before calling the client
tx_done callback. Calling completion on a wait event is also invalid
if the message is empty.
This patch moves the existing empty message check earlier.
Fixes: 2b6d83e2b8b7 ("mailbox: Introduce framework for mailbox")
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mailbox/mailbox.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -99,8 +99,11 @@ static void tx_tick(struct mbox_chan *ch
/* Submit next message */
msg_submit(chan);
+ if (!mssg)
+ return;
+
/* Notify the client */
- if (mssg && chan->cl->tx_done)
+ if (chan->cl->tx_done)
chan->cl->tx_done(chan->cl, mssg, r);
if (r != -ETIME && chan->cl->tx_block)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 36/92] pstore: Use dynamic spinlock initializer |
| Message-ID | <ucFVM-3Rs-11@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit e9a330c4289f2ba1ca4bf98c2b430ab165a8931b upstream.
The per-prz spinlock should be using the dynamic initializer so that
lockdep can correctly track it. Without this, under lockdep, we get a
warning at boot that the lock is in non-static memory.
Fixes: 109704492ef6 ("pstore: Make spinlock per zone instead of global")
Fixes: 76d5692a5803 ("pstore: Correctly initialize spinlock and flags")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/pstore/ram_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -528,7 +528,7 @@ struct persistent_ram_zone *persistent_r
}
/* Initialize general buffer state. */
- prz->buffer_lock = __RAW_SPIN_LOCK_UNLOCKED(buffer_lock);
+ raw_spin_lock_init(&prz->buffer_lock);
prz->flags = flags;
ret = persistent_ram_buffer_map(start, size, prz, memtype);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 10/92] Revert "powerpc/numa: Fix percpu allocations to be NUMA aware" |
| Message-ID | <ucFVM-3Rs-15@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit 138bb14846a5856747694ae9ef565c9eb4533a1e which is
commit ba4a648f12f4cd0a8003dd229b6ca8a53348ee4b upstream.
Michal Hocko writes:
JFYI. We have encountered a regression after applying this patch on a
large ppc machine. While the patch is the right thing to do it doesn't
work well with the current vmalloc area size on ppc and large machines
where NUMA nodes are very far from each other. Just for the reference
the boot fails on such a machine with bunch of warning preceeding it.
See http://lkml.kernel.org/r/20170724134240.GL25221@dhcp22.suse.cz
It seems the right thing to do is to enlarge the vmalloc space on ppc
but this is not the case in the upstream kernel yet AFAIK. It is also
questionable whether that is a stable material but I will decision on
you here.
We have reverted this patch from our 4.4 based kernel.
Newer kernels do not have enlarged vmalloc space yet AFAIK so they won't
work properly eiter. This bug is quite rare though because you need a
specific HW configuration to trigger the issue - namely NUMA nodes have
to be far away from each other in the physical memory space.
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/topology.h | 14 --------------
arch/powerpc/kernel/setup_64.c | 4 ++--
2 files changed, 2 insertions(+), 16 deletions(-)
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -44,22 +44,8 @@ extern void __init dump_numa_cpu_topolog
extern int sysfs_add_device_to_node(struct device *dev, int nid);
extern void sysfs_remove_device_from_node(struct device *dev, int nid);
-static inline int early_cpu_to_node(int cpu)
-{
- int nid;
-
- nid = numa_cpu_lookup_table[cpu];
-
- /*
- * Fall back to node 0 if nid is unset (it should be, except bugs).
- * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)).
- */
- return (nid < 0) ? 0 : nid;
-}
#else
-static inline int early_cpu_to_node(int cpu) { return 0; }
-
static inline void dump_numa_cpu_topology(void) {}
static inline int sysfs_add_device_to_node(struct device *dev, int nid)
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -754,7 +754,7 @@ void ppc64_boot_msg(unsigned int src, co
static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align)
{
- return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align,
+ return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align,
__pa(MAX_DMA_ADDRESS));
}
@@ -765,7 +765,7 @@ static void __init pcpu_fc_free(void *pt
static int pcpu_cpu_distance(unsigned int from, unsigned int to)
{
- if (early_cpu_to_node(from) == early_cpu_to_node(to))
+ if (cpu_to_node(from) == cpu_to_node(to))
return LOCAL_DISTANCE;
else
return REMOTE_DISTANCE;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 18/92] strscpy: zero any trailing garbage bytes in the destination |
| Message-ID | <ucFVM-3Rs-17@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <cmetcalf@ezchip.com>
commit 990486c8af044f89bddfbde1d1cf9fde449bedbf upstream.
It's possible that the destination can be shadowed in userspace
(as, for example, the perf buffers are now). So we should take
care not to leak data that could be inspected by userspace.
Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/string.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/lib/string.c
+++ b/lib/string.c
@@ -211,12 +211,13 @@ ssize_t strscpy(char *dest, const char *
unsigned long c, data;
c = *(unsigned long *)(src+res);
- *(unsigned long *)(dest+res) = c;
if (has_zero(c, &data, &constants)) {
data = prep_zero_mask(c, data, &constants);
data = create_zero_mask(data);
+ *(unsigned long *)(dest+res) = c & zero_bytemask(data);
return res + find_zero(data);
}
+ *(unsigned long *)(dest+res) = c;
res += sizeof(unsigned long);
count -= sizeof(unsigned long);
max -= sizeof(unsigned long);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 06/92] drm/vmwgfx: Fix gcc-7.1.1 warning |
| Message-ID | <ucFVM-3Rs-19@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <syeh@vmware.com>
commit fcfffdd8f98ac305285dca568b5065ef86be6458 upstream.
The current code does not look correct, and the reason for it is
probably lost. Since this now generates a compiler warning,
fix it to what makes sense.
Reported-by: Arnd Bergmann <arnd@arndb.de>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -285,7 +285,7 @@ static int vmw_cmd_invalid(struct vmw_pr
struct vmw_sw_context *sw_context,
SVGA3dCmdHeader *header)
{
- return capable(CAP_SYS_ADMIN) ? : -EINVAL;
+ return -EINVAL;
}
static int vmw_cmd_ok(struct vmw_private *dev_priv,
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 02/92] pstore: Make spinlock per zone instead of global |
| Message-ID | <ucFVM-3Rs-21@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Fernandes <joelaf@google.com>
commit 109704492ef637956265ec2eb72ae7b3b39eb6f4 upstream.
Currently pstore has a global spinlock for all zones. Since the zones
are independent and modify different areas of memory, there's no need
to have a global lock, so we should use a per-zone lock as introduced
here. Also, when ramoops's ftrace use-case has a FTRACE_PER_CPU flag
introduced later, which splits the ftrace memory area into a single zone
per CPU, it will eliminate the need for locking. In preparation for this,
make the locking optional.
Signed-off-by: Joel Fernandes <joelaf@google.com>
[kees: updated commit message]
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Leo Yan <leo.yan@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/pstore/ram_core.c | 11 +++++------
include/linux/pstore_ram.h | 1 +
2 files changed, 6 insertions(+), 6 deletions(-)
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -80,8 +80,6 @@ static void buffer_size_add_atomic(struc
} while (atomic_cmpxchg(&prz->buffer->size, old, new) != old);
}
-static DEFINE_RAW_SPINLOCK(buffer_lock);
-
/* increase and wrap the start pointer, returning the old value */
static size_t buffer_start_add_locked(struct persistent_ram_zone *prz, size_t a)
{
@@ -89,7 +87,7 @@ static size_t buffer_start_add_locked(st
int new;
unsigned long flags;
- raw_spin_lock_irqsave(&buffer_lock, flags);
+ raw_spin_lock_irqsave(&prz->buffer_lock, flags);
old = atomic_read(&prz->buffer->start);
new = old + a;
@@ -97,7 +95,7 @@ static size_t buffer_start_add_locked(st
new -= prz->buffer_size;
atomic_set(&prz->buffer->start, new);
- raw_spin_unlock_irqrestore(&buffer_lock, flags);
+ raw_spin_unlock_irqrestore(&prz->buffer_lock, flags);
return old;
}
@@ -109,7 +107,7 @@ static void buffer_size_add_locked(struc
size_t new;
unsigned long flags;
- raw_spin_lock_irqsave(&buffer_lock, flags);
+ raw_spin_lock_irqsave(&prz->buffer_lock, flags);
old = atomic_read(&prz->buffer->size);
if (old == prz->buffer_size)
@@ -121,7 +119,7 @@ static void buffer_size_add_locked(struc
atomic_set(&prz->buffer->size, new);
exit:
- raw_spin_unlock_irqrestore(&buffer_lock, flags);
+ raw_spin_unlock_irqrestore(&prz->buffer_lock, flags);
}
static size_t (*buffer_start_add)(struct persistent_ram_zone *, size_t) = buffer_start_add_atomic;
@@ -489,6 +487,7 @@ static int persistent_ram_post_init(stru
prz->buffer->sig = sig;
persistent_ram_zap(prz);
+ prz->buffer_lock = __RAW_SPIN_LOCK_UNLOCKED(buffer_lock);
return 0;
}
--- a/include/linux/pstore_ram.h
+++ b/include/linux/pstore_ram.h
@@ -39,6 +39,7 @@ struct persistent_ram_zone {
void *vaddr;
struct persistent_ram_buffer *buffer;
size_t buffer_size;
+ raw_spinlock_t buffer_lock;
/* ECC correction */
char *par_buffer;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 27/92] ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc |
| Message-ID | <ucFVN-3Rs-25@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Stancek <jstancek@redhat.com>
commit 4762fb980465463734f02c67c67f40beb8903f73 upstream.
Use spin_lock_bh in ip6_fl_purge() to prevent following potentially
deadlock scenario between ip6_fl_purge() and ip6_fl_gc() timer.
=================================
[ INFO: inconsistent lock state ]
3.19.0 #1 Not tainted
---------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/5/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
(ip6_fl_lock){+.?...}, at: [<ffffffff8171155d>] ip6_fl_gc+0x2d/0x180
{SOFTIRQ-ON-W} state was registered at:
[<ffffffff810ee9a0>] __lock_acquire+0x4a0/0x10b0
[<ffffffff810efd54>] lock_acquire+0xc4/0x2b0
[<ffffffff81751d2d>] _raw_spin_lock+0x3d/0x80
[<ffffffff81711798>] ip6_flowlabel_net_exit+0x28/0x110
[<ffffffff815f9759>] ops_exit_list.isra.1+0x39/0x60
[<ffffffff815fa320>] cleanup_net+0x100/0x1e0
[<ffffffff810ad80a>] process_one_work+0x20a/0x830
[<ffffffff810adf4b>] worker_thread+0x11b/0x460
[<ffffffff810b42f4>] kthread+0x104/0x120
[<ffffffff81752bfc>] ret_from_fork+0x7c/0xb0
irq event stamp: 84640
hardirqs last enabled at (84640): [<ffffffff81752080>] _raw_spin_unlock_irq+0x30/0x50
hardirqs last disabled at (84639): [<ffffffff81751eff>] _raw_spin_lock_irq+0x1f/0x80
softirqs last enabled at (84628): [<ffffffff81091ad1>] _local_bh_enable+0x21/0x50
softirqs last disabled at (84629): [<ffffffff81093b7d>] irq_exit+0x12d/0x150
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(ip6_fl_lock);
<Interrupt>
lock(ip6_fl_lock);
*** DEADLOCK ***
Signed-off-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_flowlabel.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -172,7 +172,7 @@ static void __net_exit ip6_fl_purge(stru
{
int i;
- spin_lock(&ip6_fl_lock);
+ spin_lock_bh(&ip6_fl_lock);
for (i = 0; i <= FL_HASH_MASK; i++) {
struct ip6_flowlabel *fl;
struct ip6_flowlabel __rcu **flp;
@@ -190,7 +190,7 @@ static void __net_exit ip6_fl_purge(stru
flp = &fl->next;
}
}
- spin_unlock(&ip6_fl_lock);
+ spin_unlock_bh(&ip6_fl_lock);
}
static struct ip6_flowlabel *fl_intern(struct net *net,
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 28/92] net: sctp: fix race for one-to-many sockets in sendmsgs auto associate |
| Message-ID | <ucFVN-3Rs-31@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <dborkman@redhat.com>
commit 2061dcd6bff8b774b4fac8b0739b6be3f87bc9f2 upstream.
I.e. one-to-many sockets in SCTP are not required to explicitly
call into connect(2) or sctp_connectx(2) prior to data exchange.
Instead, they can directly invoke sendmsg(2) and the SCTP stack
will automatically trigger connection establishment through 4WHS
via sctp_primitive_ASSOCIATE(). However, this in its current
implementation is racy: INIT is being sent out immediately (as
it cannot be bundled anyway) and the rest of the DATA chunks are
queued up for later xmit when connection is established, meaning
sendmsg(2) will return successfully. This behaviour can result
in an undesired side-effect that the kernel made the application
think the data has already been transmitted, although none of it
has actually left the machine, worst case even after close(2)'ing
the socket.
Instead, when the association from client side has been shut down
e.g. first gracefully through SCTP_EOF and then close(2), the
client could afterwards still receive the server's INIT_ACK due
to a connection with higher latency. This INIT_ACK is then considered
out of the blue and hence responded with ABORT as there was no
alive assoc found anymore. This can be easily reproduced f.e.
with sctp_test application from lksctp. One way to fix this race
is to wait for the handshake to actually complete.
The fix defers waiting after sctp_primitive_ASSOCIATE() and
sctp_primitive_SEND() succeeded, so that DATA chunks cooked up
from sctp_sendmsg() have already been placed into the output
queue through the side-effect interpreter, and therefore can then
be bundeled together with COOKIE_ECHO control chunks.
strace from example application (shortened):
socket(PF_INET, SOCK_SEQPACKET, IPPROTO_SCTP) = 3
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(0)=[], msg_controllen=48, {cmsg_len=48, cmsg_level=0x84 /* SOL_??? */, cmsg_type=, ...},
msg_flags=0}, 0) = 0 // graceful shutdown for SOCK_SEQPACKET via SCTP_EOF
close(3) = 0
tcpdump before patch (fooling the application):
22:33:36.306142 IP 192.168.1.114.41462 > 192.168.1.115.8888: sctp (1) [INIT] [init tag: 3879023686] [rwnd: 106496] [OS: 10] [MIS: 65535] [init TSN: 3139201684]
22:33:36.316619 IP 192.168.1.115.8888 > 192.168.1.114.41462: sctp (1) [INIT ACK] [init tag: 3345394793] [rwnd: 106496] [OS: 10] [MIS: 10] [init TSN: 3380109591]
22:33:36.317600 IP 192.168.1.114.41462 > 192.168.1.115.8888: sctp (1) [ABORT]
tcpdump after patch:
14:28:58.884116 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [INIT] [init tag: 438593213] [rwnd: 106496] [OS: 10] [MIS: 65535] [init TSN: 3092969729]
14:28:58.888414 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [INIT ACK] [init tag: 381429855] [rwnd: 106496] [OS: 10] [MIS: 10] [init TSN: 2141904492]
14:28:58.888638 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [COOKIE ECHO] , (2) [DATA] (B)(E) [TSN: 3092969729] [...]
14:28:58.893278 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [COOKIE ACK] , (2) [SACK] [cum ack 3092969729] [a_rwnd 106491] [#gap acks 0] [#dup tsns 0]
14:28:58.893591 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [DATA] (B)(E) [TSN: 3092969730] [...]
14:28:59.096963 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SACK] [cum ack 3092969730] [a_rwnd 106496] [#gap acks 0] [#dup tsns 0]
14:28:59.097086 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [DATA] (B)(E) [TSN: 3092969731] [...] , (2) [DATA] (B)(E) [TSN: 3092969732] [...]
14:28:59.103218 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SACK] [cum ack 3092969732] [a_rwnd 106486] [#gap acks 0] [#dup tsns 0]
14:28:59.103330 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [SHUTDOWN]
14:28:59.107793 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SHUTDOWN ACK]
14:28:59.107890 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [SHUTDOWN COMPLETE]
Looks like this bug is from the pre-git history museum. ;)
Fixes: 08707d5482df ("lksctp-2_5_31-0_5_1.patch")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/socket.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1604,7 +1604,7 @@ static int sctp_sendmsg(struct kiocb *io
sctp_assoc_t associd = 0;
sctp_cmsgs_t cmsgs = { NULL };
sctp_scope_t scope;
- bool fill_sinfo_ttl = false;
+ bool fill_sinfo_ttl = false, wait_connect = false;
struct sctp_datamsg *datamsg;
int msg_flags = msg->msg_flags;
__u16 sinfo_flags = 0;
@@ -1944,6 +1944,7 @@ static int sctp_sendmsg(struct kiocb *io
if (err < 0)
goto out_free;
+ wait_connect = true;
pr_debug("%s: we associated primitively\n", __func__);
}
@@ -1981,6 +1982,11 @@ static int sctp_sendmsg(struct kiocb *io
sctp_datamsg_put(datamsg);
err = msg_len;
+ if (unlikely(wait_connect)) {
+ timeo = sock_sndtimeo(sk, msg_flags & MSG_DONTWAIT);
+ sctp_wait_for_connect(asoc, &timeo);
+ }
+
/* If we are already past ASSOCIATE, the lower
* layers are responsible for association cleanup.
*/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 11/92] Staging: comedi: comedi_fops: Avoid orphaned proc entry |
| Message-ID | <ucFVN-3Rs-37@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheah Kok Cheong <thrust73@gmail.com>
commit bf279ece37d2a3eaaa9813fcd7a1d8a81eb29c20 upstream.
Move comedi_proc_init to the end to avoid orphaned proc entry
if module loading failed.
Signed-off-by: Cheah Kok Cheong <thrust73@gmail.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/comedi_fops.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -2590,9 +2590,6 @@ static int __init comedi_init(void)
comedi_class->dev_groups = comedi_dev_groups;
- /* XXX requires /proc interface */
- comedi_proc_init();
-
/* create devices files for legacy/manual use */
for (i = 0; i < comedi_num_legacy_minors; i++) {
struct comedi_device *dev;
@@ -2610,6 +2607,9 @@ static int __init comedi_init(void)
mutex_unlock(&dev->mutex);
}
+ /* XXX requires /proc interface */
+ comedi_proc_init();
+
return 0;
}
module_init(comedi_init);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 16/92] isdn: Fix a sleep-in-atomic bug |
| Message-ID | <ucFVN-3Rs-35@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia-Ju Bai <baijiaju1990@163.com>
commit e8f4ae85439f34bec3b0ab69223a41809dab28c9 upstream.
The driver may sleep under a spin lock, the function call path is:
isdn_ppp_mp_receive (acquire the lock)
isdn_ppp_mp_reassembly
isdn_ppp_push_higher
isdn_ppp_decompress
isdn_ppp_ccp_reset_trans
isdn_ppp_ccp_reset_alloc_state
kzalloc(GFP_KERNEL) --> may sleep
To fixed it, the "GFP_KERNEL" is replaced with "GFP_ATOMIC".
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/isdn/i4l/isdn_ppp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn
id);
return NULL;
} else {
- rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_KERNEL);
+ rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_ATOMIC);
if (!rs)
return NULL;
rs->state = CCPResetIdle;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 37/92] net: skb_needs_check() accepts CHECKSUM_NONE for tx |
| Message-ID | <ucFVN-3Rs-39@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 6e7bc478c9a006c701c14476ec9d389a484b4864 upstream.
My recent change missed fact that UFO would perform a complete
UDP checksum before segmenting in frags.
In this case skb->ip_summed is set to CHECKSUM_NONE.
We need to add this valid case to skb_needs_check()
Fixes: b2504a5dbef3 ("net: reduce skb_warn_bad_offload() noise")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/dev.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2435,9 +2435,10 @@ EXPORT_SYMBOL(skb_mac_gso_segment);
static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
{
if (tx_path)
- return skb->ip_summed != CHECKSUM_PARTIAL;
- else
- return skb->ip_summed == CHECKSUM_NONE;
+ return skb->ip_summed != CHECKSUM_PARTIAL &&
+ skb->ip_summed != CHECKSUM_NONE;
+
+ return skb->ip_summed == CHECKSUM_NONE;
}
/**
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 08/92] KVM: PPC: Book3S HV: Reload HTM registers explicitly |
| Message-ID | <ucFVN-3Rs-23@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Mackerras <paulus@ozlabs.org>
Commit 46a704f8409f ("KVM: PPC: Book3S HV: Preserve userspace HTM
state properly", 2017-06-15) added code which assumes that the kernel
is able to handle a TM (transactional memory) unavailable interrupt
from userspace by reloading the TM-related registers and enabling TM
for the process. That ability was added in the 4.9 kernel; earlier
kernel versions simply panic on getting the TM unavailable interrupt.
Since commit 46a704f8409f has been backported to the 3.18 stable tree
as commit 0b423daba180, 3.18.59 and subsequent versions are vulnerable
to a userspace-triggerable panic.
This patch fixes the problem by explicitly reloading the TM-related
registers before returning to userspace, rather than disabling TM
for the process.
Commit 46a704f8409f also failed to enable TM for the kernel, leading
to a TM unavailable interrupt in the kernel, causing an oops. This
fixes that problem too, by enabling TM before accessing the TM
registers. That problem is fixed upstream by the patch "KVM: PPC:
Book3S HV: Enable TM before accessing TM registers".
Fixes: 0b423daba180 ("KVM: PPC: Book3S HV: Preserve userspace HTM state properly")
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kvm/book3s_hv.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1974,10 +1974,11 @@ static int kvmppc_vcpu_run_hv(struct kvm
run->fail_entry.hardware_entry_failure_reason = 0;
return -EINVAL;
}
+ /* Enable TM so we can read the TM SPRs */
+ mtmsr(mfmsr() | MSR_TM);
current->thread.tm_tfhar = mfspr(SPRN_TFHAR);
current->thread.tm_tfiar = mfspr(SPRN_TFIAR);
current->thread.tm_texasr = mfspr(SPRN_TEXASR);
- current->thread.regs->msr &= ~MSR_TM;
}
#endif
@@ -2043,6 +2044,19 @@ static int kvmppc_vcpu_run_hv(struct kvm
}
mtspr(SPRN_VRSAVE, user_vrsave);
+ /*
+ * Since we don't do lazy TM reload, we need to reload
+ * the TM registers here.
+ */
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs &&
+ (current->thread.regs->msr & MSR_TM)) {
+ mtspr(SPRN_TFHAR, current->thread.tm_tfhar);
+ mtspr(SPRN_TFIAR, current->thread.tm_tfiar);
+ mtspr(SPRN_TEXASR, current->thread.tm_texasr);
+ }
+#endif
+
out:
vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
atomic_dec(&vcpu->kvm->arch.vcpus_running);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 34/92] pstore: Allow prz to control need for locking |
| Message-ID | <ucFVN-3Rs-43@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Fernandes <joelaf@google.com>
commit 663deb47880f2283809669563c5a52ac7c6aef1a upstream.
In preparation of not locking at all for certain buffers depending on if
there's contention, make locking optional depending on the initialization
of the prz.
Signed-off-by: Joel Fernandes <joelaf@google.com>
[kees: moved locking flag into prz instead of via caller arguments]
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/pstore/ram.c | 5 +++--
fs/pstore/ram_core.c | 24 +++++++++++++++---------
include/linux/pstore_ram.h | 10 +++++++++-
3 files changed, 27 insertions(+), 12 deletions(-)
--- a/fs/pstore/ram.c
+++ b/fs/pstore/ram.c
@@ -365,7 +365,7 @@ static int ramoops_init_przs(struct devi
cxt->przs[i] = persistent_ram_new(*paddr, sz, 0,
&cxt->ecc_info,
- cxt->memtype);
+ cxt->memtype, 0);
if (IS_ERR(cxt->przs[i])) {
err = PTR_ERR(cxt->przs[i]);
dev_err(dev, "failed to request mem region (0x%zx@0x%llx): %d\n",
@@ -395,7 +395,8 @@ static int ramoops_init_prz(struct devic
return -ENOMEM;
}
- *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info, cxt->memtype);
+ *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info,
+ cxt->memtype, 0);
if (IS_ERR(*prz)) {
int err = PTR_ERR(*prz);
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -85,9 +85,10 @@ static size_t buffer_start_add_locked(st
{
int old;
int new;
- unsigned long flags;
+ unsigned long flags = 0;
- raw_spin_lock_irqsave(&prz->buffer_lock, flags);
+ if (!(prz->flags & PRZ_FLAG_NO_LOCK))
+ raw_spin_lock_irqsave(&prz->buffer_lock, flags);
old = atomic_read(&prz->buffer->start);
new = old + a;
@@ -95,7 +96,8 @@ static size_t buffer_start_add_locked(st
new -= prz->buffer_size;
atomic_set(&prz->buffer->start, new);
- raw_spin_unlock_irqrestore(&prz->buffer_lock, flags);
+ if (!(prz->flags & PRZ_FLAG_NO_LOCK))
+ raw_spin_unlock_irqrestore(&prz->buffer_lock, flags);
return old;
}
@@ -105,9 +107,10 @@ static void buffer_size_add_locked(struc
{
size_t old;
size_t new;
- unsigned long flags;
+ unsigned long flags = 0;
- raw_spin_lock_irqsave(&prz->buffer_lock, flags);
+ if (!(prz->flags & PRZ_FLAG_NO_LOCK))
+ raw_spin_lock_irqsave(&prz->buffer_lock, flags);
old = atomic_read(&prz->buffer->size);
if (old == prz->buffer_size)
@@ -119,7 +122,8 @@ static void buffer_size_add_locked(struc
atomic_set(&prz->buffer->size, new);
exit:
- raw_spin_unlock_irqrestore(&prz->buffer_lock, flags);
+ if (!(prz->flags & PRZ_FLAG_NO_LOCK))
+ raw_spin_unlock_irqrestore(&prz->buffer_lock, flags);
}
static size_t (*buffer_start_add)(struct persistent_ram_zone *, size_t) = buffer_start_add_atomic;
@@ -459,7 +463,8 @@ static int persistent_ram_buffer_map(phy
}
static int persistent_ram_post_init(struct persistent_ram_zone *prz, u32 sig,
- struct persistent_ram_ecc_info *ecc_info)
+ struct persistent_ram_ecc_info *ecc_info,
+ unsigned long flags)
{
int ret;
@@ -488,6 +493,7 @@ static int persistent_ram_post_init(stru
prz->buffer->sig = sig;
persistent_ram_zap(prz);
prz->buffer_lock = __RAW_SPIN_LOCK_UNLOCKED(buffer_lock);
+ prz->flags = flags;
return 0;
}
@@ -512,7 +518,7 @@ void persistent_ram_free(struct persiste
struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
u32 sig, struct persistent_ram_ecc_info *ecc_info,
- unsigned int memtype)
+ unsigned int memtype, u32 flags)
{
struct persistent_ram_zone *prz;
int ret = -ENOMEM;
@@ -527,7 +533,7 @@ struct persistent_ram_zone *persistent_r
if (ret)
goto err;
- ret = persistent_ram_post_init(prz, sig, ecc_info);
+ ret = persistent_ram_post_init(prz, sig, ecc_info, flags);
if (ret)
goto err;
--- a/include/linux/pstore_ram.h
+++ b/include/linux/pstore_ram.h
@@ -23,6 +23,13 @@
#include <linux/types.h>
#include <linux/init.h>
+/*
+ * Choose whether access to the RAM zone requires locking or not. If a zone
+ * can be written to from different CPUs like with ftrace for example, then
+ * PRZ_FLAG_NO_LOCK is used. For all other cases, locking is required.
+ */
+#define PRZ_FLAG_NO_LOCK BIT(0)
+
struct persistent_ram_buffer;
struct rs_control;
@@ -39,6 +46,7 @@ struct persistent_ram_zone {
void *vaddr;
struct persistent_ram_buffer *buffer;
size_t buffer_size;
+ u32 flags;
raw_spinlock_t buffer_lock;
/* ECC correction */
@@ -55,7 +63,7 @@ struct persistent_ram_zone {
struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
u32 sig, struct persistent_ram_ecc_info *ecc_info,
- unsigned int memtype);
+ unsigned int memtype, u32 flags);
void persistent_ram_free(struct persistent_ram_zone *prz);
void persistent_ram_zap(struct persistent_ram_zone *prz);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 50/92] xfrm: Dont use sk_family for socket policy lookups |
| Message-ID | <ucFVN-3Rs-41@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <steffen.klassert@secunet.com>
commit 4c86d77743a54fb2d8a4d18a037a074c892bb3be upstream.
On IPv4-mapped IPv6 addresses sk_family is AF_INET6,
but the flow informations are created based on AF_INET.
So the routing set up 'struct flowi4' but we try to
access 'struct flowi6' what leads to an out of bounds
access. Fix this by using the family we get with the
dst_entry, like we do it for the standard policy lookup.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_policy.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1211,15 +1211,14 @@ static inline int policy_to_flow_dir(int
}
static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir,
- const struct flowi *fl)
+ const struct flowi *fl, u16 family)
{
struct xfrm_policy *pol;
struct net *net = sock_net(sk);
read_lock_bh(&net->xfrm.xfrm_policy_lock);
if ((pol = sk->sk_policy[dir]) != NULL) {
- bool match = xfrm_selector_match(&pol->selector, fl,
- sk->sk_family);
+ bool match = xfrm_selector_match(&pol->selector, fl, family);
int err = 0;
if (match) {
@@ -2150,7 +2149,7 @@ struct dst_entry *xfrm_lookup(struct net
if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
num_pols = 1;
- pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+ pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family);
err = xfrm_expand_policies(fl, family, pols,
&num_pols, &num_xfrms);
if (err < 0)
@@ -2428,7 +2427,7 @@ int __xfrm_policy_check(struct sock *sk,
pol = NULL;
if (sk && sk->sk_policy[dir]) {
- pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+ pol = xfrm_sk_policy_lookup(sk, dir, &fl, family);
if (IS_ERR(pol)) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
return 0;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 71/92] net: Zero terminate ifr_name in dev_ifname(). |
| Message-ID | <ucFVO-3Rs-53@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: "David S. Miller" <davem@davemloft.net> [ Upstream commit 63679112c536289826fec61c917621de95ba2ade ] The ifr.ifr_name is passed around and assumed to be NULL terminated. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/core/dev_ioctl.c | 1 + 1 file changed, 1 insertion(+) --- a/net/core/dev_ioctl.c +++ b/net/core/dev_ioctl.c @@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, s if (copy_from_user(&ifr, arg, sizeof(struct ifreq))) return -EFAULT; + ifr.ifr_name[IFNAMSIZ-1] = 0; error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex); if (error)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 14/92] Bluetooth: cmtp: cmtp_add_connection() should verify that its dealing with l2cap socket |
| Message-ID | <ucFVO-3Rs-59@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 96c26653ce65bf84f3212f8b00d4316c1efcbf4c upstream.
... rather than relying on ciptool(8) never passing it anything else. Give
it e.g. an AF_UNIX connected socket (from socketpair(2)) and it'll oops,
trying to evaluate &l2cap_pi(sock->sk)->chan->dst...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/cmtp/core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -334,6 +334,9 @@ int cmtp_add_connection(struct cmtp_conn
BT_DBG("");
+ if (!l2cap_is_socket(sock))
+ return -EBADFD;
+
session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
if (!session)
return -ENOMEM;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 03/92] net: reduce skb_warn_bad_offload() noise |
| Message-ID | <ucFVO-3Rs-57@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit b2504a5dbef3305ef41988ad270b0e8ec289331c upstream.
Dmitry reported warnings occurring in __skb_gso_segment() [1]
All SKB_GSO_DODGY producers can allow user space to feed
packets that trigger the current check.
We could prevent them from doing so, rejecting packets, but
this might add regressions to existing programs.
It turns out our SKB_GSO_DODGY handlers properly set up checksum
information that is needed anyway when packets needs to be segmented.
By checking again skb_needs_check() after skb_mac_gso_segment(),
we should remove these pesky warnings, at a very minor cost.
With help from Willem de Bruijn
[1]
WARNING: CPU: 1 PID: 6768 at net/core/dev.c:2439 skb_warn_bad_offload+0x2af/0x390 net/core/dev.c:2434
lo: caps=(0x000000a2803b7c69, 0x0000000000000000) len=138 data_len=0 gso_size=15883 gso_type=4 ip_summed=0
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 6768 Comm: syz-executor1 Not tainted 4.9.0 #5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
ffff8801c063ecd8 ffffffff82346bdf ffffffff00000001 1ffff100380c7d2e
ffffed00380c7d26 0000000041b58ab3 ffffffff84b37e38 ffffffff823468f1
ffffffff84820740 ffffffff84f289c0 dffffc0000000000 ffff8801c063ee20
Call Trace:
[<ffffffff82346bdf>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff82346bdf>] dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
[<ffffffff81827e34>] panic+0x1fb/0x412 kernel/panic.c:179
[<ffffffff8141f704>] __warn+0x1c4/0x1e0 kernel/panic.c:542
[<ffffffff8141f7e5>] warn_slowpath_fmt+0xc5/0x100 kernel/panic.c:565
[<ffffffff8356cbaf>] skb_warn_bad_offload+0x2af/0x390 net/core/dev.c:2434
[<ffffffff83585cd2>] __skb_gso_segment+0x482/0x780 net/core/dev.c:2706
[<ffffffff83586f19>] skb_gso_segment include/linux/netdevice.h:3985 [inline]
[<ffffffff83586f19>] validate_xmit_skb+0x5c9/0xc20 net/core/dev.c:2969
[<ffffffff835892bb>] __dev_queue_xmit+0xe6b/0x1e70 net/core/dev.c:3383
[<ffffffff8358a2d7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3424
[<ffffffff83ad161d>] packet_snd net/packet/af_packet.c:2930 [inline]
[<ffffffff83ad161d>] packet_sendmsg+0x32ed/0x4d30 net/packet/af_packet.c:2955
[<ffffffff834f0aaa>] sock_sendmsg_nosec net/socket.c:621 [inline]
[<ffffffff834f0aaa>] sock_sendmsg+0xca/0x110 net/socket.c:631
[<ffffffff834f329a>] ___sys_sendmsg+0x8fa/0x9f0 net/socket.c:1954
[<ffffffff834f5e58>] __sys_sendmsg+0x138/0x300 net/socket.c:1988
[<ffffffff834f604d>] SYSC_sendmsg net/socket.c:1999 [inline]
[<ffffffff834f604d>] SyS_sendmsg+0x2d/0x50 net/socket.c:1995
[<ffffffff84371941>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Mark Salyzyn <salyzyn@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/dev.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2454,11 +2454,12 @@ static inline bool skb_needs_check(struc
struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
netdev_features_t features, bool tx_path)
{
+ struct sk_buff *segs;
+
if (unlikely(skb_needs_check(skb, tx_path))) {
int err;
- skb_warn_bad_offload(skb);
-
+ /* We're going to init ->check field in TCP or UDP header */
err = skb_cow_head(skb, 0);
if (err < 0)
return ERR_PTR(err);
@@ -2470,7 +2471,12 @@ struct sk_buff *__skb_gso_segment(struct
skb_reset_mac_header(skb);
skb_reset_mac_len(skb);
- return skb_mac_gso_segment(skb, features);
+ segs = skb_mac_gso_segment(skb, features);
+
+ if (unlikely(skb_needs_check(skb, tx_path)))
+ skb_warn_bad_offload(skb);
+
+ return segs;
}
EXPORT_SYMBOL(__skb_gso_segment);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:40 +0200 |
| Subject | [PATCH 3.18 35/92] pstore: Correctly initialize spinlock and flags |
| Message-ID | <ucFVO-3Rs-63@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit 76d5692a58031696e282384cbd893832bc92bd76 upstream.
The ram backend wasn't always initializing its spinlock correctly. Since
it was coming from kzalloc memory, though, it was harmless on
architectures that initialize unlocked spinlocks to 0 (at least x86 and
ARM). This also fixes a possibly ignored flag setting too.
When running under CONFIG_DEBUG_SPINLOCK, the following Oops was visible:
[ 0.760836] persistent_ram: found existing buffer, size 29988, start 29988
[ 0.765112] persistent_ram: found existing buffer, size 30105, start 30105
[ 0.769435] persistent_ram: found existing buffer, size 118542, start 118542
[ 0.785960] persistent_ram: found existing buffer, size 0, start 0
[ 0.786098] persistent_ram: found existing buffer, size 0, start 0
[ 0.786131] pstore: using zlib compression
[ 0.790716] BUG: spinlock bad magic on CPU#0, swapper/0/1
[ 0.790729] lock: 0xffffffc0d1ca9bb0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
[ 0.790742] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.10.0-rc2+ #913
[ 0.790747] Hardware name: Google Kevin (DT)
[ 0.790750] Call trace:
[ 0.790768] [<ffffff900808ae88>] dump_backtrace+0x0/0x2bc
[ 0.790780] [<ffffff900808b164>] show_stack+0x20/0x28
[ 0.790794] [<ffffff9008460ee0>] dump_stack+0xa4/0xcc
[ 0.790809] [<ffffff9008113cfc>] spin_dump+0xe0/0xf0
[ 0.790821] [<ffffff9008113d3c>] spin_bug+0x30/0x3c
[ 0.790834] [<ffffff9008113e28>] do_raw_spin_lock+0x50/0x1b8
[ 0.790846] [<ffffff9008a2d2ec>] _raw_spin_lock_irqsave+0x54/0x6c
[ 0.790862] [<ffffff90083ac3b4>] buffer_size_add+0x48/0xcc
[ 0.790875] [<ffffff90083acb34>] persistent_ram_write+0x60/0x11c
[ 0.790888] [<ffffff90083aab1c>] ramoops_pstore_write_buf+0xd4/0x2a4
[ 0.790900] [<ffffff90083a9d3c>] pstore_console_write+0xf0/0x134
[ 0.790912] [<ffffff900811c304>] console_unlock+0x48c/0x5e8
[ 0.790923] [<ffffff900811da18>] register_console+0x3b0/0x4d4
[ 0.790935] [<ffffff90083aa7d0>] pstore_register+0x1a8/0x234
[ 0.790947] [<ffffff90083ac250>] ramoops_probe+0x6b8/0x7d4
[ 0.790961] [<ffffff90085ca548>] platform_drv_probe+0x7c/0xd0
[ 0.790972] [<ffffff90085c76ac>] driver_probe_device+0x1b4/0x3bc
[ 0.790982] [<ffffff90085c7ac8>] __device_attach_driver+0xc8/0xf4
[ 0.790996] [<ffffff90085c4bfc>] bus_for_each_drv+0xb4/0xe4
[ 0.791006] [<ffffff90085c7414>] __device_attach+0xd0/0x158
[ 0.791016] [<ffffff90085c7b18>] device_initial_probe+0x24/0x30
[ 0.791026] [<ffffff90085c648c>] bus_probe_device+0x50/0xe4
[ 0.791038] [<ffffff90085c35b8>] device_add+0x3a4/0x76c
[ 0.791051] [<ffffff90087d0e84>] of_device_add+0x74/0x84
[ 0.791062] [<ffffff90087d19b8>] of_platform_device_create_pdata+0xc0/0x100
[ 0.791073] [<ffffff90087d1a2c>] of_platform_device_create+0x34/0x40
[ 0.791086] [<ffffff900903c910>] of_platform_default_populate_init+0x58/0x78
[ 0.791097] [<ffffff90080831fc>] do_one_initcall+0x88/0x160
[ 0.791109] [<ffffff90090010ac>] kernel_init_freeable+0x264/0x31c
[ 0.791123] [<ffffff9008a25bd0>] kernel_init+0x18/0x11c
[ 0.791133] [<ffffff9008082ec0>] ret_from_fork+0x10/0x50
[ 0.793717] console [pstore-1] enabled
[ 0.797845] pstore: Registered ramoops as persistent store backend
[ 0.804647] ramoops: attached 0x100000@0xf7edc000, ecc: 0/0
Fixes: 663deb47880f ("pstore: Allow prz to control need for locking")
Fixes: 109704492ef6 ("pstore: Make spinlock per zone instead of global")
Reported-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/pstore/ram_core.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -463,8 +463,7 @@ static int persistent_ram_buffer_map(phy
}
static int persistent_ram_post_init(struct persistent_ram_zone *prz, u32 sig,
- struct persistent_ram_ecc_info *ecc_info,
- unsigned long flags)
+ struct persistent_ram_ecc_info *ecc_info)
{
int ret;
@@ -490,10 +489,9 @@ static int persistent_ram_post_init(stru
prz->buffer->sig);
}
+ /* Rewind missing or invalid memory area. */
prz->buffer->sig = sig;
persistent_ram_zap(prz);
- prz->buffer_lock = __RAW_SPIN_LOCK_UNLOCKED(buffer_lock);
- prz->flags = flags;
return 0;
}
@@ -529,11 +527,15 @@ struct persistent_ram_zone *persistent_r
goto err;
}
+ /* Initialize general buffer state. */
+ prz->buffer_lock = __RAW_SPIN_LOCK_UNLOCKED(buffer_lock);
+ prz->flags = flags;
+
ret = persistent_ram_buffer_map(start, size, prz, memtype);
if (ret)
goto err;
- ret = persistent_ram_post_init(prz, sig, ecc_info, flags);
+ ret = persistent_ram_post_init(prz, sig, ecc_info);
if (ret)
goto err;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-09 22:50 +0200 |
| Subject | [PATCH 3.18 30/92] net, sched: fix soft lockup in tc_classify |
| Message-ID | <ucG5r-3Vm-1@gated-at.bofh.it> |
| In reply to | #1707850 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
commit 628185cfddf1dfb701c4efe2cfd72cf5b09f5702 upstream.
Shahar reported a soft lockup in tc_classify(), where we run into an
endless loop when walking the classifier chain due to tp->next == tp
which is a state we should never run into. The issue only seems to
trigger under load in the tc control path.
What happens is that in tc_ctl_tfilter(), thread A allocates a new
tp, initializes it, sets tp_created to 1, and calls into tp->ops->change()
with it. In that classifier callback we had to unlock/lock the rtnl
mutex and returned with -EAGAIN. One reason why we need to drop there
is, for example, that we need to request an action module to be loaded.
This happens via tcf_exts_validate() -> tcf_action_init/_1() meaning
after we loaded and found the requested action, we need to redo the
whole request so we don't race against others. While we had to unlock
rtnl in that time, thread B's request was processed next on that CPU.
Thread B added a new tp instance successfully to the classifier chain.
When thread A returned grabbing the rtnl mutex again, propagating -EAGAIN
and destroying its tp instance which never got linked, we goto replay
and redo A's request.
This time when walking the classifier chain in tc_ctl_tfilter() for
checking for existing tp instances we had a priority match and found
the tp instance that was created and linked by thread B. Now calling
again into tp->ops->change() with that tp was successful and returned
without error.
tp_created was never cleared in the second round, thus kernel thinks
that we need to link it into the classifier chain (once again). tp and
*back point to the same object due to the match we had earlier on. Thus
for thread B's already public tp, we reset tp->next to tp itself and
link it into the chain, which eventually causes the mentioned endless
loop in tc_classify() once a packet hits the data path.
Fix is to clear tp_created at the beginning of each request, also when
we replay it. On the paths that can cause -EAGAIN we already destroy
the original tp instance we had and on replay we really need to start
from scratch. It seems that this issue was first introduced in commit
12186be7d2e1 ("net_cls: fix unconfigured struct tcf_proto keeps chaining
and avoid kernel panic when we use cls_cgroup").
Fixes: 12186be7d2e1 ("net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup")
Reported-by: Shahar Klein <shahark@mellanox.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Tested-by: Shahar Klein <shahark@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/cls_api.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -137,13 +137,15 @@ static int tc_ctl_tfilter(struct sk_buff
unsigned long cl;
unsigned long fh;
int err;
- int tp_created = 0;
+ int tp_created;
if ((n->nlmsg_type != RTM_GETTFILTER) &&
!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
return -EPERM;
replay:
+ tp_created = 0;
+
err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL);
if (err < 0)
return err;
[toc] | [prev] | [next] | [standalone]
Page 1 of 5 [1] 2 3 4 5 Next page →
Back to top | Article view | linux.kernel
csiph-web