Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1721298 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-08-28 10:40 +0200 |
| Last post | 2017-08-29 02:20 +0200 |
| Articles | 4 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 4.4 00/53] 4.4.85-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:40 +0200
[PATCH 4.4 10/53] ipv6: repair fib6 tree in failure case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:50 +0200
Re: [PATCH 4.4 00/53] 4.4.85-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-28 21:40 +0200
Re: [PATCH 4.4 00/53] 4.4.85-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-29 02:20 +0200
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:40 +0200 |
| Subject | [PATCH 4.4 00/53] 4.4.85-stable review |
| Message-ID | <ujnr3-3du-7@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.4.85 release.
There are 53 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Aug 30 08:05:03 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.85-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.4.85-rc1
James Morse <james.morse@arm.com>
ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal
Joerg Roedel <jroedel@suse.de>
ACPI: ioapic: Clear on-stack resource before using it
Logan Gunthorpe <logang@deltatee.com>
ntb_transport: fix bug calculating num_qps_mw
Logan Gunthorpe <logang@deltatee.com>
ntb_transport: fix qp count bug
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
ASoC: rsnd: don't call update callback if it was NULL
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
ASoC: rsnd: ssi: 24bit data needs right-aligned settings
Geert Uytterhoeven <geert+renesas@glider.be>
ASoC: rsnd: Add missing initialization of ADG req_rate
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
ASoC: rsnd: avoid pointless loop in rsnd_mod_interrupt()
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
ASoC: rsnd: disable SRC.out only when stop timing
Aaro Koskinen <aaro.koskinen@iki.fi>
ASoC: simple-card: don't fail if sysclk setting is not supported
Charles Milette <charlesmilette@gmail.com>
staging: rtl8188eu: add RNX-N150NUB support
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
iio: hid-sensor-trigger: Fix the race with user space powering up sensors
Dragos Bogdan <dragos.bogdan@analog.com>
iio: imu: adis16480: Fix acceleration scale factor for adis16480
Martijn Coenen <maco@android.com>
ANDROID: binder: fix proc->tsk check.
Riley Andrews <riandrews@google.com>
binder: Use wake up hint for synchronous transactions.
Todd Kjos <tkjos@android.com>
binder: use group leader instead of open thread
Jeffy Chen <jeffy.chen@rock-chips.com>
Bluetooth: bnep: fix possible might sleep error in bnep_session
Jeffy Chen <jeffy.chen@rock-chips.com>
Bluetooth: cmtp: fix possible might sleep error in cmtp_session
Jeffy Chen <jeffy.chen@rock-chips.com>
Bluetooth: hidp: fix possible might sleep error in hidp_session_thread
Mark Rutland <mark.rutland@arm.com>
perf/core: Fix group {cpu,task} validation
Chuck Lever <chuck.lever@oracle.com>
nfsd: Limit end of page list when decoding NFSv4 WRITE
Ronnie Sahlberg <lsahlber@redhat.com>
cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup()
Sachin Prabhu <sprabhu@redhat.com>
cifs: Fix df output for users with quota limits
Steven Rostedt (VMware) <rostedt@goodmis.org>
tracing: Fix freeing of filter in create_filter() when set_str is false
Koji Matsuoka <koji.matsuoka.xm@renesas.com>
drm: rcar-du: Fix H/V sync signal polarity configuration
Koji Matsuoka <koji.matsuoka.xm@renesas.com>
drm: rcar-du: Fix display timing controller parameter
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
drm: rcar-du: Fix crash in encoder failure error path
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
drm: rcar-du: lvds: Rename PLLEN bit to PLLON
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
drm: rcar-du: lvds: Fix PLL frequency-related configuration
Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
drm/atomic: If the atomic check fails, return its value first
Chris Wilson <chris@chris-wilson.co.uk>
drm: Release driver tracking before making the object available again
Ulf Hansson <ulf.hansson@linaro.org>
i2c: designware: Fix system suspend
Alexey Brodkin <Alexey.Brodkin@synopsys.com>
ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses
Takashi Iwai <tiwai@suse.de>
ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978)
Takashi Iwai <tiwai@suse.de>
ALSA: core: Fix unexpected error at replacing user TLV
KT Liao <kt.liao@emc.com.tw>
Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310
Aaron Ma <aaron.ma@canonical.com>
Input: trackpoint - add new trackpoint firmware ID
Tomas Winkler <tomas.winkler@intel.com>
mei: me: add lewisburg device ids
Tomas Winkler <tomas.winkler@intel.com>
mei: me: add broxton pci device ids
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
net_sched: fix order of queue length updates in qdisc_replace()
Xin Long <lucien.xin@gmail.com>
net: sched: fix NULL pointer dereference when action calls some targets
Colin Ian King <colin.king@canonical.com>
irda: do not leak initialized list.dev to userspace
Neal Cardwell <ncardwell@google.com>
tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP
Wei Wang <weiwan@google.com>
ipv6: repair fib6 tree in failure case
Wei Wang <weiwan@google.com>
ipv6: reset fn->rr_ptr when replacing route
Eric Dumazet <edumazet@google.com>
tipc: fix use-after-free
Alexander Potapenko <glider@google.com>
sctp: fully initialize the IPv6 address in sctp_v6_to_addr()
Eric Dumazet <edumazet@google.com>
ipv4: better IP_MAX_MTU enforcement
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
net_sched/sfq: update hierarchical backlog when drop packet
Eric Dumazet <edumazet@google.com>
ipv4: fix NULL dereference in free_fib_info_rcu()
Eric Dumazet <edumazet@google.com>
dccp: defer ccid_hc_tx_delete() at dismantle time
Eric Dumazet <edumazet@google.com>
dccp: purge write queue in dccp_destroy_sock()
Eric Dumazet <edumazet@google.com>
af_key: do not use GFP_KERNEL in atomic contexts
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/cache.h | 2 +
arch/arc/mm/cache.c | 13 +++++-
drivers/acpi/apei/ghes.c | 1 +
drivers/acpi/ioapic.c | 6 +++
drivers/android/binder.c | 14 ++++---
drivers/gpu/drm/drm_atomic.c | 5 ++-
drivers/gpu/drm/drm_gem.c | 6 +--
drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 6 +--
drivers/gpu/drm/rcar-du/rcar_du_kms.c | 10 ++---
drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c | 8 ++--
drivers/gpu/drm/rcar-du/rcar_lvds_regs.h | 2 +-
drivers/i2c/busses/i2c-designware-platdrv.c | 14 ++++++-
.../iio/common/hid-sensors/hid-sensor-trigger.c | 8 ++--
drivers/iio/imu/adis16480.c | 2 +-
drivers/input/mouse/elan_i2c_core.c | 1 +
drivers/input/mouse/trackpoint.c | 3 +-
drivers/input/mouse/trackpoint.h | 3 +-
drivers/misc/mei/hw-me-regs.h | 5 +++
drivers/misc/mei/pci-me.c | 4 ++
drivers/ntb/ntb_transport.c | 8 ++--
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
fs/cifs/dir.c | 18 +++++---
fs/cifs/smb2pdu.c | 4 +-
fs/nfsd/nfs4xdr.c | 6 +--
include/net/ip.h | 4 +-
include/net/sch_generic.h | 5 ++-
kernel/events/core.c | 39 +++++++++---------
kernel/trace/trace_events_filter.c | 4 ++
net/bluetooth/bnep/core.c | 11 +++--
net/bluetooth/cmtp/core.c | 17 ++++----
net/bluetooth/hidp/core.c | 33 ++++++++++-----
net/dccp/proto.c | 19 ++++++---
net/ipv4/fib_semantics.c | 12 +++---
net/ipv4/route.c | 2 +-
net/ipv4/tcp_input.c | 3 +-
net/ipv6/ip6_fib.c | 26 +++++++-----
net/irda/af_irda.c | 2 +-
net/key/af_key.c | 48 ++++++++++++----------
net/sched/act_ipt.c | 2 +
net/sched/sch_sfq.c | 5 ++-
net/sctp/ipv6.c | 2 +
net/tipc/netlink_compat.c | 6 ++-
sound/core/control.c | 2 +-
sound/pci/hda/patch_conexant.c | 1 +
sound/soc/generic/simple-card.c | 2 +-
sound/soc/sh/rcar/adg.c | 2 +-
sound/soc/sh/rcar/core.c | 21 ++++------
sound/soc/sh/rcar/src.c | 18 +++++++-
sound/soc/sh/rcar/ssi.c | 3 +-
50 files changed, 276 insertions(+), 167 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:50 +0200 |
| Subject | [PATCH 4.4 10/53] ipv6: repair fib6 tree in failure case |
| Message-ID | <ujnU6-3nf-37@gated-at.bofh.it> |
| In reply to | #1721298 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <weiwan@google.com>
[ Upstream commit 348a4002729ccab8b888b38cbc099efa2f2a2036 ]
In fib6_add(), it is possible that fib6_add_1() picks an intermediate
node and sets the node's fn->leaf to NULL in order to add this new
route. However, if fib6_add_rt2node() fails to add the new
route for some reason, fn->leaf will be left as NULL and could
potentially cause crash when fn->leaf is accessed in fib6_locate().
This patch makes sure fib6_repair_tree() is called to properly repair
fn->leaf in the above failure case.
Here is the syzkaller reported general protection fault in fib6_locate:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 40937 Comm: syz-executor3 Not tainted
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d7d64100 ti: ffff8801d01a0000 task.ti: ffff8801d01a0000
RIP: 0010:[<ffffffff82a3e0e1>] [<ffffffff82a3e0e1>] __ipv6_prefix_equal64_half include/net/ipv6.h:475 [inline]
RIP: 0010:[<ffffffff82a3e0e1>] [<ffffffff82a3e0e1>] ipv6_prefix_equal include/net/ipv6.h:492 [inline]
RIP: 0010:[<ffffffff82a3e0e1>] [<ffffffff82a3e0e1>] fib6_locate_1 net/ipv6/ip6_fib.c:1210 [inline]
RIP: 0010:[<ffffffff82a3e0e1>] [<ffffffff82a3e0e1>] fib6_locate+0x281/0x3c0 net/ipv6/ip6_fib.c:1233
RSP: 0018:ffff8801d01a36a8 EFLAGS: 00010202
RAX: 0000000000000020 RBX: ffff8801bc790e00 RCX: ffffc90002983000
RDX: 0000000000001219 RSI: ffff8801d01a37a0 RDI: 0000000000000100
RBP: ffff8801d01a36f0 R08: 00000000000000ff R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8801d01a37a0 R15: 0000000000000000
FS: 00007f6afd68c700(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004c6340 CR3: 00000000ba41f000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffff8801d01a37a8 ffff8801d01a3780 ffffed003a0346f5 0000000c82a23ea0
ffff8800b7bd7700 ffff8801d01a3780 ffff8800b6a1c940 ffffffff82a23ea0
ffff8801d01a3920 ffff8801d01a3748 ffffffff82a223d6 ffff8801d7d64988
Call Trace:
[<ffffffff82a223d6>] ip6_route_del+0x106/0x570 net/ipv6/route.c:2109
[<ffffffff82a23f9d>] inet6_rtm_delroute+0xfd/0x100 net/ipv6/route.c:3075
[<ffffffff82621359>] rtnetlink_rcv_msg+0x549/0x7a0 net/core/rtnetlink.c:3450
[<ffffffff8274c1d1>] netlink_rcv_skb+0x141/0x370 net/netlink/af_netlink.c:2281
[<ffffffff82613ddf>] rtnetlink_rcv+0x2f/0x40 net/core/rtnetlink.c:3456
[<ffffffff8274ad38>] netlink_unicast_kernel net/netlink/af_netlink.c:1206 [inline]
[<ffffffff8274ad38>] netlink_unicast+0x518/0x750 net/netlink/af_netlink.c:1232
[<ffffffff8274b83e>] netlink_sendmsg+0x8ce/0xc30 net/netlink/af_netlink.c:1778
[<ffffffff82564aff>] sock_sendmsg_nosec net/socket.c:609 [inline]
[<ffffffff82564aff>] sock_sendmsg+0xcf/0x110 net/socket.c:619
[<ffffffff82564d62>] sock_write_iter+0x222/0x3a0 net/socket.c:834
[<ffffffff8178523d>] new_sync_write+0x1dd/0x2b0 fs/read_write.c:478
[<ffffffff817853f4>] __vfs_write+0xe4/0x110 fs/read_write.c:491
[<ffffffff81786c38>] vfs_write+0x178/0x4b0 fs/read_write.c:538
[<ffffffff817892a9>] SYSC_write fs/read_write.c:585 [inline]
[<ffffffff817892a9>] SyS_write+0xd9/0x1b0 fs/read_write.c:577
[<ffffffff82c71e32>] entry_SYSCALL_64_fastpath+0x12/0x17
Note: there is no "Fixes" tag as this seems to be a bug introduced
very early.
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_fib.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -996,7 +996,7 @@ int fib6_add(struct fib6_node *root, str
/* Create subtree root node */
sfn = node_alloc();
if (!sfn)
- goto st_failure;
+ goto failure;
sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref);
@@ -1012,12 +1012,12 @@ int fib6_add(struct fib6_node *root, str
if (IS_ERR(sn)) {
/* If it is failed, discard just allocated
- root, and then (in st_failure) stale node
+ root, and then (in failure) stale node
in main tree.
*/
node_free(sfn);
err = PTR_ERR(sn);
- goto st_failure;
+ goto failure;
}
/* Now link new subtree to main tree */
@@ -1031,7 +1031,7 @@ int fib6_add(struct fib6_node *root, str
if (IS_ERR(sn)) {
err = PTR_ERR(sn);
- goto st_failure;
+ goto failure;
}
}
@@ -1073,22 +1073,22 @@ out:
atomic_inc(&pn->leaf->rt6i_ref);
}
#endif
- if (!(rt->dst.flags & DST_NOCACHE))
- dst_free(&rt->dst);
+ goto failure;
}
return err;
-#ifdef CONFIG_IPV6_SUBTREES
- /* Subtree creation failed, probably main tree node
- is orphan. If it is, shoot it.
+failure:
+ /* fn->leaf could be NULL if fn is an intermediate node and we
+ * failed to add the new route to it in both subtree creation
+ * failure and fib6_add_rt2node() failure case.
+ * In both cases, fib6_repair_tree() should be called to fix
+ * fn->leaf.
*/
-st_failure:
if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
fib6_repair_tree(info->nl_net, fn);
if (!(rt->dst.flags & DST_NOCACHE))
dst_free(&rt->dst);
return err;
-#endif
}
/*
[toc] | [prev] | [next] | [standalone]
| From | Shuah Khan <shuahkh@osg.samsung.com> |
|---|---|
| Date | 2017-08-28 21:40 +0200 |
| Message-ID | <ujy37-19O-7@gated-at.bofh.it> |
| In reply to | #1721298 |
On 08/28/2017 02:05 AM, Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.4.85 release. > There are 53 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Wed Aug 30 08:05:03 UTC 2017. > Anything received after that time might be too late. > > The whole patch series can be found in one patch at: > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.85-rc1.gz > or in the git tree and branch at: > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y > and the diffstat can be found below. > > thanks, > > greg k-h > Compiled and booted on my test system. No dmesg regressions. thanks, -- Shuah
[toc] | [prev] | [next] | [standalone]
| From | Guenter Roeck <linux@roeck-us.net> |
|---|---|
| Date | 2017-08-29 02:20 +0200 |
| Message-ID | <ujCq6-3Ti-7@gated-at.bofh.it> |
| In reply to | #1721298 |
On 08/28/2017 01:05 AM, Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.4.85 release. > There are 53 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Wed Aug 30 08:05:03 UTC 2017. > Anything received after that time might be too late. > Build results: total: 145 pass: 145 fail: 0 Qemu test results: total: 115 pass: 115 fail: 0 Details are available at http://kerneltests.org/builders. Guenter
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web