Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1721154 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-08-28 10:10 +0200 |
| Last post | 2017-08-29 07:00 +0200 |
| Articles | 20 on this page of 81 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 4.12 00/99] 4.12.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 90/99] iio: magnetometer: st_magn: fix status register address for LSM303AGR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 23/99] irda: do not leak initialized list.dev to userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 40/99] ALSA: firewire: fix NULL pointer dereference when releasing uninitialized data of iso-resource Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 38/99] ALSA: core: Fix unexpected error at replacing user TLV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 20/99] ipv6: repair fib6 tree in failure case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 44/99] ARCv2: PAE40: set MSB even if !CONFIG_ARC_HAS_PAE40 but PAE exists in SoC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 17/99] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 68/99] cifs: Fix df output for users with quota limits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 11/99] net: igmp: Use ingress interface rather than vrf device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 18/99] tipc: fix use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 13/99] ptr_ring: use kmalloc_array() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 36/99] KVM: x86: block guest protection keys unless the host has them enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 31/99] Input: ALPS - fix two-finger scroll breakage in right side on ALPS touchpad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 10/99] bpf: fix bpf_trace_printk on 32 bit archs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
[PATCH 4.12 93/99] iommu: Fix wrong freeing of iommu_device->dev Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 75/99] timers: Fix excessive granularity of new timers after a nohz idle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 79/99] netfilter: nat: fix src map lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 77/99] net: sunrpc: svcsock: fix NULL-pointer exception Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 99/99] powerpc/mm: Ensure cpumask update is ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 81/99] Bluetooth: hidp: fix possible might sleep error in hidp_session_thread Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
[PATCH 4.12 91/99] iio: magnetometer: st_magn: remove ihl property for LSM303AGR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 76/99] x86/mm: Fix use-after-free of ldt_struct Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 80/99] netfilter: nfnetlink: Improve input length sanitization in nfnetlink_rcv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 69/99] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 96/99] ntb: transport shouldnt disable link due to bogus values in SPADs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 89/99] iio: hid-sensor-trigger: Fix the race with user space powering up sensors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 73/99] ftrace: Check for null ret_stack on profile function graph entry function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 95/99] ntb: ntb_test: ensure the link is up before trying to configure the mws Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 63/99] tracing: Missing error code in tracer_alloc_buffers() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 82/99] Bluetooth: cmtp: fix possible might sleep error in cmtp_session Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 94/99] Clarify (and fix) MAX_LFS_FILESIZE macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 74/99] perf/core: Fix group {cpu,task} validation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 71/99] ring-buffer: Have ring_buffer_alloc_read_page() return error on offline CPU Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 35/99] KVM, pkeys: do not use PKRU value in vcpu->arch.guest_fpu.state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 83/99] Bluetooth: bnep: fix possible might sleep error in bnep_session Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 72/99] virtio_pci: fix cpu affinity support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 97/99] ACPI: APD: Fix HID for Hisilicon Hip07/08 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 87/99] ANDROID: binder: fix proc->tsk check. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 37/99] ALSA: usb-audio: Add delay quirk for H650e/Jabra 550a USB headsets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 85/99] binder: use group leader instead of open thread Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 78/99] netfilter: expect: fix crash when putting uninited expectation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 98/99] ACPI: EC: Fix regression related to wrong ECDT initialization order Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 70/99] nfsd: Limit end of page list when decoding NFSv4 WRITE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 39/99] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
[PATCH 4.12 33/99] KVM: s390: sthyi: fix specification exception detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 64/99] tracing: Fix kmemleak in tracing_map_array_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 52/99] arm64: fpsimd: Prevent registers leaking across exec Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 03/99] bonding: ratelimit failed speed/duplex update warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 07/99] ipv4: fix NULL dereference in free_fib_info_rcu() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 47/99] dax: fix deadlock due to misaligned PMD faults Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 57/99] drm/atomic: If the atomic check fails, return its value first Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 45/99] PM/hibernate: touch NMI watchdog when creating snapshot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 43/99] ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 08/99] net_sched/sfq: update hierarchical backlog when drop packet Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 61/99] ACPI: device property: Fix node lookup in acpi_graph_get_child_prop_value() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 48/99] i2c: designware: Fix system suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 66/99] RDMA/uverbs: Initialize cq_context appropriately Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 30/99] Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 46/99] mm, shmem: fix handling /sys/kernel/mm/transparent_hugepage/shmem_enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 60/99] Revert "drm/amdgpu: fix vblank_time when displays are off" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 32/99] KVM: s390: sthyi: fix sthyi inline assembly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 09/99] net_sched: remove warning from qdisc_hash_add Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 65/99] tracing: Fix freeing of filter in create_filter() when set_str is false Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 41/99] ALSA: firewire-motu: destroy stream data surely at failure of card initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 05/99] dccp: purge write queue in dccp_destroy_sock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 42/99] ARCv2: SLC: Make sure busy bit is set properly for region ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 49/99] mm/madvise.c: fix freeing of locked page with MADV_FREE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
[PATCH 4.12 21/99] tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 12/99] openvswitch: fix skb_panic due to the incorrect actions attrlen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 16/99] tun: handle register_netdevice() failures properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 24/99] net: sched: fix NULL pointer dereference when action calls some targets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 02/99] bonding: require speed/duplex only for 802.3ad, alb and tlb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 28/99] bpf/verifier: fix min/max handling in BPF_SUB Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 26/99] bpf, verifier: add additional patterns to evaluate_reg_imm_alu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 14/99] ipv4: better IP_MAX_MTU enforcement Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
[PATCH 4.12 19/99] ipv6: reset fn->rr_ptr when replacing route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
Re: [PATCH 4.12 00/99] 4.12.10-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-28 21:50 +0200
Re: [PATCH 4.12 00/99] 4.12.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-29 07:00 +0200
Re: [PATCH 4.12 00/99] 4.12.10-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-29 02:20 +0200
Re: [PATCH 4.12 00/99] 4.12.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-29 07:00 +0200
Page 1 of 5 [1] 2 3 4 5 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 00/99] 4.12.10-stable review |
| Message-ID | <ujnhn-38X-3@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.12.10 release.
There are 99 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Aug 30 08:04:17 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.12.10-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.12.10-rc1
Benjamin Herrenschmidt <benh@kernel.crashing.org>
powerpc/mm: Ensure cpumask update is ordered
Lv Zheng <lv.zheng@intel.com>
ACPI: EC: Fix regression related to wrong ECDT initialization order
Hanjun Guo <hanjun.guo@linaro.org>
ACPI: APD: Fix HID for Hisilicon Hip07/08
Dave Jiang <dave.jiang@intel.com>
ntb: transport shouldn't disable link due to bogus values in SPADs
Logan Gunthorpe <logang@deltatee.com>
ntb: ntb_test: ensure the link is up before trying to configure the mws
Linus Torvalds <torvalds@linux-foundation.org>
Clarify (and fix) MAX_LFS_FILESIZE macros
Joerg Roedel <jroedel@suse.de>
iommu: Fix wrong freeing of iommu_device->dev
Charles Milette <charlesmilette@gmail.com>
staging: rtl8188eu: add RNX-N150NUB support
Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
iio: magnetometer: st_magn: remove ihl property for LSM303AGR
Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
iio: magnetometer: st_magn: fix status register address for LSM303AGR
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
iio: hid-sensor-trigger: Fix the race with user space powering up sensors
Dragos Bogdan <dragos.bogdan@analog.com>
iio: imu: adis16480: Fix acceleration scale factor for adis16480
Martijn Coenen <maco@android.com>
ANDROID: binder: fix proc->tsk check.
Riley Andrews <riandrews@google.com>
binder: Use wake up hint for synchronous transactions.
Todd Kjos <tkjos@android.com>
binder: use group leader instead of open thread
Todd Kjos <tkjos@android.com>
Revert "android: binder: Sanity check at binder ioctl"
Jeffy Chen <jeffy.chen@rock-chips.com>
Bluetooth: bnep: fix possible might sleep error in bnep_session
Jeffy Chen <jeffy.chen@rock-chips.com>
Bluetooth: cmtp: fix possible might sleep error in cmtp_session
Jeffy Chen <jeffy.chen@rock-chips.com>
Bluetooth: hidp: fix possible might sleep error in hidp_session_thread
Mateusz Jurczyk <mjurczyk@google.com>
netfilter: nfnetlink: Improve input length sanitization in nfnetlink_rcv
Florian Westphal <fw@strlen.de>
netfilter: nat: fix src map lookup
Florian Westphal <fw@strlen.de>
netfilter: expect: fix crash when putting uninited expectation
Vadim Lomovtsev <vlomovts@redhat.com>
net: sunrpc: svcsock: fix NULL-pointer exception
Eric Biggers <ebiggers@google.com>
x86/mm: Fix use-after-free of ldt_struct
Nicholas Piggin <npiggin@gmail.com>
timers: Fix excessive granularity of new timers after a nohz idle
Mark Rutland <mark.rutland@arm.com>
perf/core: Fix group {cpu,task} validation
Steven Rostedt (VMware) <rostedt@goodmis.org>
ftrace: Check for null ret_stack on profile function graph entry function
Christoph Hellwig <hch@lst.de>
virtio_pci: fix cpu affinity support
Steven Rostedt (VMware) <rostedt@goodmis.org>
ring-buffer: Have ring_buffer_alloc_read_page() return error on offline CPU
Chuck Lever <chuck.lever@oracle.com>
nfsd: Limit end of page list when decoding NFSv4 WRITE
Ronnie Sahlberg <lsahlber@redhat.com>
cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup()
Sachin Prabhu <sprabhu@redhat.com>
cifs: Fix df output for users with quota limits
Nicholas Piggin <npiggin@gmail.com>
kbuild: linker script do not match C names unless LD_DEAD_CODE_DATA_ELIMINATION is configured
Bharat Potnuri <bharat@chelsio.com>
RDMA/uverbs: Initialize cq_context appropriately
Steven Rostedt (VMware) <rostedt@goodmis.org>
tracing: Fix freeing of filter in create_filter() when set_str is false
Chunyu Hu <chuhu@redhat.com>
tracing: Fix kmemleak in tracing_map_array_free()
Dan Carpenter <dan.carpenter@oracle.com>
tracing: Missing error code in tracer_alloc_buffers()
Steven Rostedt (VMware) <rostedt@goodmis.org>
tracing: Call clear_boot_tracer() at lateinit_sync
Sakari Ailus <sakari.ailus@linux.intel.com>
ACPI: device property: Fix node lookup in acpi_graph_get_child_prop_value()
Alex Deucher <alexdeucher@gmail.com>
Revert "drm/amdgpu: fix vblank_time when displays are off"
fred gao <fred.gao@intel.com>
drm/i915/gvt: Fix the kernel null pointer error
Jani Nikula <jani.nikula@intel.com>
drm/i915/vbt: ignore extraneous child devices for a port
Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
drm/atomic: If the atomic check fails, return its value first
Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
drm/atomic: Handle -EDEADLK with out-fences correctly
Jonathan Liu <net147@gmail.com>
drm/sun4i: Implement drm_driver lastclose to restore fbdev console
Chris Wilson <chris@chris-wilson.co.uk>
drm: Release driver tracking before making the object available again
Nikhil Mahale <nmahale@nvidia.com>
drm: Fix framebuffer leak
Dave Martin <Dave.Martin@arm.com>
arm64: fpsimd: Prevent registers leaking across exec
Pavel Tatashin <pasha.tatashin@oracle.com>
mm/memblock.c: reversed logic in memblock_discard()
Eric Biggers <ebiggers@google.com>
fork: fix incorrect fput of ->exe_file causing use-after-free
Eric Biggers <ebiggers@google.com>
mm/madvise.c: fix freeing of locked page with MADV_FREE
Ulf Hansson <ulf.hansson@linaro.org>
i2c: designware: Fix system suspend
Ross Zwisler <ross.zwisler@linux.intel.com>
dax: fix deadlock due to misaligned PMD faults
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
mm, shmem: fix handling /sys/kernel/mm/transparent_hugepage/shmem_enabled
Chen Yu <yu.c.chen@intel.com>
PM/hibernate: touch NMI watchdog when creating snapshot
Vineet Gupta <vgupta@synopsys.com>
ARCv2: PAE40: set MSB even if !CONFIG_ARC_HAS_PAE40 but PAE exists in SoC
Alexey Brodkin <Alexey.Brodkin@synopsys.com>
ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses
Alexey Brodkin <abrodkin@synopsys.com>
ARCv2: SLC: Make sure busy bit is set properly for region ops
Takashi Sakamoto <o-takashi@sakamocchi.jp>
ALSA: firewire-motu: destroy stream data surely at failure of card initialization
Takashi Sakamoto <o-takashi@sakamocchi.jp>
ALSA: firewire: fix NULL pointer dereference when releasing uninitialized data of iso-resource
Takashi Iwai <tiwai@suse.de>
ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978)
Takashi Iwai <tiwai@suse.de>
ALSA: core: Fix unexpected error at replacing user TLV
Joakim Tjernlund <joakim.tjernlund@infinera.com>
ALSA: usb-audio: Add delay quirk for H650e/Jabra 550a USB headsets
Paolo Bonzini <pbonzini@redhat.com>
KVM: x86: block guest protection keys unless the host has them enabled
Paolo Bonzini <pbonzini@redhat.com>
KVM, pkeys: do not use PKRU value in vcpu->arch.guest_fpu.state
Paolo Bonzini <pbonzini@redhat.com>
KVM: x86: simplify handling of PKRU
Heiko Carstens <heiko.carstens@de.ibm.com>
KVM: s390: sthyi: fix specification exception detection
Heiko Carstens <heiko.carstens@de.ibm.com>
KVM: s390: sthyi: fix sthyi inline assembly
Masaki Ota <masaki.ota@jp.alps.com>
Input: ALPS - fix two-finger scroll breakage in right side on ALPS touchpad
KT Liao <kt.liao@emc.com.tw>
Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310
Aaron Ma <aaron.ma@canonical.com>
Input: trackpoint - add new trackpoint firmware ID
Edward Cree <ecree@solarflare.com>
bpf/verifier: fix min/max handling in BPF_SUB
Daniel Borkmann <daniel@iogearbox.net>
bpf: fix mixed signed/unsigned derived min/max value bounds
John Fastabend <john.fastabend@gmail.com>
bpf, verifier: add additional patterns to evaluate_reg_imm_alu
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
net_sched: fix order of queue length updates in qdisc_replace()
Xin Long <lucien.xin@gmail.com>
net: sched: fix NULL pointer dereference when action calls some targets
Colin Ian King <colin.king@canonical.com>
irda: do not leak initialized list.dev to userspace
Huy Nguyen <huyn@mellanox.com>
net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled
Neal Cardwell <ncardwell@google.com>
tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP
Wei Wang <weiwan@google.com>
ipv6: repair fib6 tree in failure case
Wei Wang <weiwan@google.com>
ipv6: reset fn->rr_ptr when replacing route
Eric Dumazet <edumazet@google.com>
tipc: fix use-after-free
Alexander Potapenko <glider@google.com>
sctp: fully initialize the IPv6 address in sctp_v6_to_addr()
Eric Dumazet <edumazet@google.com>
tun: handle register_netdevice() failures properly
Colin Ian King <colin.king@canonical.com>
nfp: fix infinite loop on umapping cleanup
Eric Dumazet <edumazet@google.com>
ipv4: better IP_MAX_MTU enforcement
Eric Dumazet <edumazet@google.com>
ptr_ring: use kmalloc_array()
Liping Zhang <zlpnobody@gmail.com>
openvswitch: fix skb_panic due to the incorrect actions attrlen
David Ahern <dsahern@gmail.com>
net: igmp: Use ingress interface rather than vrf device
Daniel Borkmann <daniel@iogearbox.net>
bpf: fix bpf_trace_printk on 32 bit archs
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
net_sched: remove warning from qdisc_hash_add
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
net_sched/sfq: update hierarchical backlog when drop packet
Eric Dumazet <edumazet@google.com>
ipv4: fix NULL dereference in free_fib_info_rcu()
Eric Dumazet <edumazet@google.com>
dccp: defer ccid_hc_tx_delete() at dismantle time
Eric Dumazet <edumazet@google.com>
dccp: purge write queue in dccp_destroy_sock()
Eric Dumazet <edumazet@google.com>
af_key: do not use GFP_KERNEL in atomic contexts
Andreas Born <futur.andy@googlemail.com>
bonding: ratelimit failed speed/duplex update warning
Andreas Born <futur.andy@googlemail.com>
bonding: require speed/duplex only for 802.3ad, alb and tlb
Tushar Dave <tushar.n.dave@oracle.com>
sparc64: remove unnecessary log message
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/cache.h | 2 +
arch/arc/include/asm/mmu.h | 2 +
arch/arc/mm/cache.c | 50 +++++-
arch/arc/mm/tlb.c | 12 +-
arch/arm64/kernel/fpsimd.c | 2 +
arch/powerpc/include/asm/mmu_context.h | 20 ++-
arch/powerpc/include/asm/pgtable-be-types.h | 1 +
arch/powerpc/include/asm/pgtable-types.h | 1 +
arch/s390/kvm/sthyi.c | 7 +-
arch/sparc/kernel/pci_sun4v.c | 2 -
arch/x86/include/asm/fpu/internal.h | 6 +-
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/include/asm/mmu_context.h | 4 +-
arch/x86/kvm/cpuid.c | 2 +-
arch/x86/kvm/kvm_cache_regs.h | 5 -
arch/x86/kvm/mmu.h | 2 +-
arch/x86/kvm/svm.c | 7 -
arch/x86/kvm/vmx.c | 25 +--
arch/x86/kvm/x86.c | 17 +-
drivers/acpi/acpi_apd.c | 4 +-
drivers/acpi/ec.c | 17 +-
drivers/acpi/internal.h | 1 -
drivers/acpi/property.c | 2 +-
drivers/acpi/scan.c | 1 -
drivers/android/binder.c | 19 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 2 -
drivers/gpu/drm/drm_atomic.c | 11 +-
drivers/gpu/drm/drm_gem.c | 6 +-
drivers/gpu/drm/drm_plane.c | 1 +
drivers/gpu/drm/i915/gvt/cmd_parser.c | 2 +-
drivers/gpu/drm/i915/intel_bios.c | 15 +-
drivers/gpu/drm/sun4i/sun4i_drv.c | 8 +
drivers/i2c/busses/i2c-designware-platdrv.c | 14 +-
.../iio/common/hid-sensors/hid-sensor-trigger.c | 8 +-
drivers/iio/imu/adis16480.c | 2 +-
drivers/iio/magnetometer/st_magn_core.c | 4 +-
drivers/infiniband/core/uverbs_cmd.c | 2 +-
drivers/input/mouse/alps.c | 41 +++--
drivers/input/mouse/alps.h | 8 +
drivers/input/mouse/elan_i2c_core.c | 1 +
drivers/input/mouse/trackpoint.c | 3 +-
drivers/input/mouse/trackpoint.h | 3 +-
drivers/iommu/amd_iommu_types.h | 4 +-
drivers/iommu/intel-iommu.c | 4 +-
drivers/iommu/iommu-sysfs.c | 32 ++--
drivers/net/bonding/bond_main.c | 13 +-
drivers/net/ethernet/mellanox/mlx4/main.c | 4 +-
.../net/ethernet/netronome/nfp/nfp_net_common.c | 3 +-
drivers/net/tun.c | 3 +
drivers/ntb/ntb_transport.c | 4 +-
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
drivers/virtio/virtio_pci_common.c | 10 +-
fs/cifs/dir.c | 18 +-
fs/cifs/smb2pdu.c | 4 +-
fs/dax.c | 10 ++
fs/nfsd/nfs4xdr.c | 6 +-
include/asm-generic/vmlinux.lds.h | 38 ++--
include/linux/bpf_verifier.h | 1 +
include/linux/fs.h | 4 +-
include/linux/iommu.h | 12 +-
include/linux/ptr_ring.h | 9 +-
include/linux/skb_array.h | 3 +-
include/net/bonding.h | 5 +
include/net/ip.h | 4 +-
include/net/sch_generic.h | 5 +-
kernel/bpf/verifier.c | 191 ++++++++++++++++++---
kernel/events/core.c | 39 ++---
kernel/fork.c | 1 +
kernel/time/timer.c | 50 +++++-
kernel/trace/bpf_trace.c | 34 +++-
kernel/trace/ftrace.c | 4 +
kernel/trace/ring_buffer.c | 14 +-
kernel/trace/ring_buffer_benchmark.c | 2 +-
kernel/trace/trace.c | 19 +-
kernel/trace/trace_events_filter.c | 4 +
kernel/trace/tracing_map.c | 11 +-
mm/madvise.c | 2 +-
mm/memblock.c | 2 +-
mm/page_alloc.c | 20 ++-
mm/shmem.c | 4 +-
net/bluetooth/bnep/core.c | 11 +-
net/bluetooth/cmtp/core.c | 17 +-
net/bluetooth/hidp/core.c | 33 ++--
net/dccp/proto.c | 19 +-
net/ipv4/fib_semantics.c | 12 +-
net/ipv4/igmp.c | 10 +-
net/ipv4/route.c | 2 +-
net/ipv4/tcp_input.c | 3 +-
net/ipv6/ip6_fib.c | 26 +--
net/irda/af_irda.c | 2 +-
net/key/af_key.c | 48 +++---
net/netfilter/nf_conntrack_expect.c | 2 +-
net/netfilter/nf_nat_core.c | 17 +-
net/netfilter/nfnetlink.c | 6 +-
net/openvswitch/actions.c | 1 +
net/openvswitch/datapath.c | 7 +-
net/openvswitch/datapath.h | 2 +
net/sched/act_ipt.c | 2 +
net/sched/sch_api.c | 3 -
net/sched/sch_sfq.c | 5 +-
net/sctp/ipv6.c | 2 +
net/sunrpc/svcsock.c | 22 ++-
net/tipc/netlink_compat.c | 6 +-
sound/core/control.c | 2 +-
sound/firewire/iso-resources.c | 7 +-
sound/firewire/motu/motu.c | 1 +
sound/pci/hda/patch_conexant.c | 1 +
sound/usb/quirks.c | 9 +-
tools/testing/selftests/ntb/ntb_test.sh | 4 +
110 files changed, 864 insertions(+), 359 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 90/99] iio: magnetometer: st_magn: fix status register address for LSM303AGR |
| Message-ID | <ujnhp-38X-61@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com> commit 541ee9b24fca587f510fe1bc58508d5cf40707af upstream. Fixes: 97865fe41322 (iio: st_sensors: verify interrupt event to status) Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@st.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/iio/magnetometer/st_magn_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/magnetometer/st_magn_core.c +++ b/drivers/iio/magnetometer/st_magn_core.c @@ -358,7 +358,7 @@ static const struct st_sensor_settings s .mask_int1 = 0x01, .addr_ihl = 0x63, .mask_ihl = 0x04, - .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR, + .addr_stat_drdy = 0x67, }, .multi_read_bit = false, .bootime = 2,
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 23/99] irda: do not leak initialized list.dev to userspace |
| Message-ID | <ujnhp-38X-63@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit b024d949a3c24255a7ef1a470420eb478949aa4c ]
list.dev has not been initialized and so the copy_to_user is copying
data from the stack back to user space which is a potential
information leak. Fix this ensuring all of list is initialized to
zero.
Detected by CoverityScan, CID#1357894 ("Uninitialized scalar variable")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/irda/af_irda.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2225,7 +2225,7 @@ static int irda_getsockopt(struct socket
{
struct sock *sk = sock->sk;
struct irda_sock *self = irda_sk(sk);
- struct irda_device_list list;
+ struct irda_device_list list = { 0 };
struct irda_device_info *discoveries;
struct irda_ias_set * ias_opt; /* IAS get/query params */
struct ias_object * ias_obj; /* Object in IAS */
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 40/99] ALSA: firewire: fix NULL pointer dereference when releasing uninitialized data of iso-resource |
| Message-ID | <ujnhp-38X-65@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
commit 0c264af7be2013266c5b4c644f3f366399ee490a upstream.
When calling 'iso_resource_free()' for uninitialized data, this function
causes NULL pointer dereference due to its 'unit' member. This occurs when
unplugging audio and music units on IEEE 1394 bus at failure of card
registration.
This commit fixes the bug. The bug exists since kernel v4.5.
Fixes: 324540c4e05c ('ALSA: fireface: postpone sound card registration') at v4.12
Fixes: 8865a31e0fd8 ('ALSA: firewire-motu: postpone sound card registration') at v4.12
Fixes: b610386c8afb ('ALSA: firewire-tascam: deleyed registration of sound card') at v4.7
Fixes: 86c8dd7f4da3 ('ALSA: firewire-digi00x: delayed registration of sound card') at v4.7
Fixes: 6c29230e2a5f ('ALSA: oxfw: delayed registration of sound card') at v4.7
Fixes: 7d3c1d5901aa ('ALSA: fireworks: delayed registration of sound card') at v4.7
Fixes: 04a2c73c97eb ('ALSA: bebob: delayed registration of sound card') at v4.7
Fixes: b59fb1900b4f ('ALSA: dice: postpone card registration') at v4.5
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/firewire/iso-resources.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/sound/firewire/iso-resources.c
+++ b/sound/firewire/iso-resources.c
@@ -210,9 +210,14 @@ EXPORT_SYMBOL(fw_iso_resources_update);
*/
void fw_iso_resources_free(struct fw_iso_resources *r)
{
- struct fw_card *card = fw_parent_device(r->unit)->card;
+ struct fw_card *card;
int bandwidth, channel;
+ /* Not initialized. */
+ if (r->unit == NULL)
+ return;
+ card = fw_parent_device(r->unit)->card;
+
mutex_lock(&r->mutex);
if (r->allocated) {
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 38/99] ALSA: core: Fix unexpected error at replacing user TLV |
| Message-ID | <ujnhq-38X-67@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 88c54cdf61f508ebcf8da2d819f5dfc03e954d1d upstream.
When user tries to replace the user-defined control TLV, the kernel
checks the change of its content via memcmp(). The problem is that
the kernel passes the return value from memcmp() as is. memcmp()
gives a non-zero negative value depending on the comparison result,
and this shall be recognized as an error code.
The patch covers that corner-case, return 1 properly for the changed
TLV.
Fixes: 8aa9b586e420 ("[ALSA] Control API - more robust TLV implementation")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/control.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1157,7 +1157,7 @@ static int snd_ctl_elem_user_tlv(struct
mutex_lock(&ue->card->user_ctl_lock);
change = ue->tlv_data_size != size;
if (!change)
- change = memcmp(ue->tlv_data, new_data, size);
+ change = memcmp(ue->tlv_data, new_data, size) != 0;
kfree(ue->tlv_data);
ue->tlv_data = new_data;
ue->tlv_data_size = size;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 20/99] ipv6: repair fib6 tree in failure case |
| Message-ID | <ujnhq-38X-73@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <weiwan@google.com>
[ Upstream commit 348a4002729ccab8b888b38cbc099efa2f2a2036 ]
In fib6_add(), it is possible that fib6_add_1() picks an intermediate
node and sets the node's fn->leaf to NULL in order to add this new
route. However, if fib6_add_rt2node() fails to add the new
route for some reason, fn->leaf will be left as NULL and could
potentially cause crash when fn->leaf is accessed in fib6_locate().
This patch makes sure fib6_repair_tree() is called to properly repair
fn->leaf in the above failure case.
Here is the syzkaller reported general protection fault in fib6_locate:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 40937 Comm: syz-executor3 Not tainted
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d7d64100 ti: ffff8801d01a0000 task.ti: ffff8801d01a0000
RIP: 0010:[<ffffffff82a3e0e1>] [<ffffffff82a3e0e1>] __ipv6_prefix_equal64_half include/net/ipv6.h:475 [inline]
RIP: 0010:[<ffffffff82a3e0e1>] [<ffffffff82a3e0e1>] ipv6_prefix_equal include/net/ipv6.h:492 [inline]
RIP: 0010:[<ffffffff82a3e0e1>] [<ffffffff82a3e0e1>] fib6_locate_1 net/ipv6/ip6_fib.c:1210 [inline]
RIP: 0010:[<ffffffff82a3e0e1>] [<ffffffff82a3e0e1>] fib6_locate+0x281/0x3c0 net/ipv6/ip6_fib.c:1233
RSP: 0018:ffff8801d01a36a8 EFLAGS: 00010202
RAX: 0000000000000020 RBX: ffff8801bc790e00 RCX: ffffc90002983000
RDX: 0000000000001219 RSI: ffff8801d01a37a0 RDI: 0000000000000100
RBP: ffff8801d01a36f0 R08: 00000000000000ff R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8801d01a37a0 R15: 0000000000000000
FS: 00007f6afd68c700(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004c6340 CR3: 00000000ba41f000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffff8801d01a37a8 ffff8801d01a3780 ffffed003a0346f5 0000000c82a23ea0
ffff8800b7bd7700 ffff8801d01a3780 ffff8800b6a1c940 ffffffff82a23ea0
ffff8801d01a3920 ffff8801d01a3748 ffffffff82a223d6 ffff8801d7d64988
Call Trace:
[<ffffffff82a223d6>] ip6_route_del+0x106/0x570 net/ipv6/route.c:2109
[<ffffffff82a23f9d>] inet6_rtm_delroute+0xfd/0x100 net/ipv6/route.c:3075
[<ffffffff82621359>] rtnetlink_rcv_msg+0x549/0x7a0 net/core/rtnetlink.c:3450
[<ffffffff8274c1d1>] netlink_rcv_skb+0x141/0x370 net/netlink/af_netlink.c:2281
[<ffffffff82613ddf>] rtnetlink_rcv+0x2f/0x40 net/core/rtnetlink.c:3456
[<ffffffff8274ad38>] netlink_unicast_kernel net/netlink/af_netlink.c:1206 [inline]
[<ffffffff8274ad38>] netlink_unicast+0x518/0x750 net/netlink/af_netlink.c:1232
[<ffffffff8274b83e>] netlink_sendmsg+0x8ce/0xc30 net/netlink/af_netlink.c:1778
[<ffffffff82564aff>] sock_sendmsg_nosec net/socket.c:609 [inline]
[<ffffffff82564aff>] sock_sendmsg+0xcf/0x110 net/socket.c:619
[<ffffffff82564d62>] sock_write_iter+0x222/0x3a0 net/socket.c:834
[<ffffffff8178523d>] new_sync_write+0x1dd/0x2b0 fs/read_write.c:478
[<ffffffff817853f4>] __vfs_write+0xe4/0x110 fs/read_write.c:491
[<ffffffff81786c38>] vfs_write+0x178/0x4b0 fs/read_write.c:538
[<ffffffff817892a9>] SYSC_write fs/read_write.c:585 [inline]
[<ffffffff817892a9>] SyS_write+0xd9/0x1b0 fs/read_write.c:577
[<ffffffff82c71e32>] entry_SYSCALL_64_fastpath+0x12/0x17
Note: there is no "Fixes" tag as this seems to be a bug introduced
very early.
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_fib.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1016,7 +1016,7 @@ int fib6_add(struct fib6_node *root, str
/* Create subtree root node */
sfn = node_alloc();
if (!sfn)
- goto st_failure;
+ goto failure;
sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref);
@@ -1032,12 +1032,12 @@ int fib6_add(struct fib6_node *root, str
if (IS_ERR(sn)) {
/* If it is failed, discard just allocated
- root, and then (in st_failure) stale node
+ root, and then (in failure) stale node
in main tree.
*/
node_free(sfn);
err = PTR_ERR(sn);
- goto st_failure;
+ goto failure;
}
/* Now link new subtree to main tree */
@@ -1051,7 +1051,7 @@ int fib6_add(struct fib6_node *root, str
if (IS_ERR(sn)) {
err = PTR_ERR(sn);
- goto st_failure;
+ goto failure;
}
}
@@ -1093,22 +1093,22 @@ out:
atomic_inc(&pn->leaf->rt6i_ref);
}
#endif
- if (!(rt->dst.flags & DST_NOCACHE))
- dst_free(&rt->dst);
+ goto failure;
}
return err;
-#ifdef CONFIG_IPV6_SUBTREES
- /* Subtree creation failed, probably main tree node
- is orphan. If it is, shoot it.
+failure:
+ /* fn->leaf could be NULL if fn is an intermediate node and we
+ * failed to add the new route to it in both subtree creation
+ * failure and fib6_add_rt2node() failure case.
+ * In both cases, fib6_repair_tree() should be called to fix
+ * fn->leaf.
*/
-st_failure:
if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
fib6_repair_tree(info->nl_net, fn);
if (!(rt->dst.flags & DST_NOCACHE))
dst_free(&rt->dst);
return err;
-#endif
}
/*
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 44/99] ARCv2: PAE40: set MSB even if !CONFIG_ARC_HAS_PAE40 but PAE exists in SoC |
| Message-ID | <ujnhq-38X-69@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <vgupta@synopsys.com>
commit b5ddb6d54729d814356937572d6c9b599f10c29f upstream.
PAE40 confiuration in hardware extends some of the address registers
for TLB/cache ops to 2 words.
So far kernel was NOT setting the higher word if feature was not enabled
in software which is wrong. Those need to be set to 0 in such case.
Normally this would be done in the cache flush / tlb ops, however since
these registers only exist conditionally, this would have to be
conditional to a flag being set on boot which is expensive/ugly -
specially for the more common case of PAE exists but not in use.
Optimize that by zero'ing them once at boot - nobody will write to
them afterwards
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/include/asm/mmu.h | 2 ++
arch/arc/mm/cache.c | 34 ++++++++++++++++++++++++++++------
arch/arc/mm/tlb.c | 12 +++++++++++-
3 files changed, 41 insertions(+), 7 deletions(-)
--- a/arch/arc/include/asm/mmu.h
+++ b/arch/arc/include/asm/mmu.h
@@ -94,6 +94,8 @@ static inline int is_pae40_enabled(void)
return IS_ENABLED(CONFIG_ARC_HAS_PAE40);
}
+extern int pae40_exist_but_not_enab(void);
+
#endif /* !__ASSEMBLY__ */
#endif
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -1123,6 +1123,13 @@ noinline void __init arc_ioc_setup(void)
__dc_enable();
}
+/*
+ * Cache related boot time checks/setups only needed on master CPU:
+ * - Geometry checks (kernel build and hardware agree: e.g. L1_CACHE_BYTES)
+ * Assume SMP only, so all cores will have same cache config. A check on
+ * one core suffices for all
+ * - IOC setup / dma callbacks only need to be done once
+ */
void __init arc_cache_init_master(void)
{
unsigned int __maybe_unused cpu = smp_processor_id();
@@ -1202,12 +1209,27 @@ void __ref arc_cache_init(void)
printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
- /*
- * Only master CPU needs to execute rest of function:
- * - Assume SMP so all cores will have same cache config so
- * any geomtry checks will be same for all
- * - IOC setup / dma callbacks only need to be setup once
- */
if (!cpu)
arc_cache_init_master();
+
+ /*
+ * In PAE regime, TLB and cache maintenance ops take wider addresses
+ * And even if PAE is not enabled in kernel, the upper 32-bits still need
+ * to be zeroed to keep the ops sane.
+ * As an optimization for more common !PAE enabled case, zero them out
+ * once at init, rather than checking/setting to 0 for every runtime op
+ */
+ if (is_isa_arcv2() && pae40_exist_but_not_enab()) {
+
+ if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE))
+ write_aux_reg(ARC_REG_IC_PTAG_HI, 0);
+
+ if (IS_ENABLED(CONFIG_ARC_HAS_DCACHE))
+ write_aux_reg(ARC_REG_DC_PTAG_HI, 0);
+
+ if (l2_line_sz) {
+ write_aux_reg(ARC_REG_SLC_RGN_END1, 0);
+ write_aux_reg(ARC_REG_SLC_RGN_START1, 0);
+ }
+ }
}
--- a/arch/arc/mm/tlb.c
+++ b/arch/arc/mm/tlb.c
@@ -104,6 +104,8 @@
/* A copy of the ASID from the PID reg is kept in asid_cache */
DEFINE_PER_CPU(unsigned int, asid_cache) = MM_CTXT_FIRST_CYCLE;
+static int __read_mostly pae_exists;
+
/*
* Utility Routine to erase a J-TLB entry
* Caller needs to setup Index Reg (manually or via getIndex)
@@ -784,7 +786,7 @@ void read_decode_mmu_bcr(void)
mmu->u_dtlb = mmu4->u_dtlb * 4;
mmu->u_itlb = mmu4->u_itlb * 4;
mmu->sasid = mmu4->sasid;
- mmu->pae = mmu4->pae;
+ pae_exists = mmu->pae = mmu4->pae;
}
}
@@ -809,6 +811,11 @@ char *arc_mmu_mumbojumbo(int cpu_id, cha
return buf;
}
+int pae40_exist_but_not_enab(void)
+{
+ return pae_exists && !is_pae40_enabled();
+}
+
void arc_mmu_init(void)
{
char str[256];
@@ -859,6 +866,9 @@ void arc_mmu_init(void)
/* swapper_pg_dir is the pgd for the kernel, used by vmalloc */
write_aux_reg(ARC_REG_SCRATCH_DATA0, swapper_pg_dir);
#endif
+
+ if (pae40_exist_but_not_enab())
+ write_aux_reg(ARC_REG_TLBPD1HI, 0);
}
/*
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 17/99] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() |
| Message-ID | <ujnhq-38X-75@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <glider@google.com>
[ Upstream commit 15339e441ec46fbc3bf3486bb1ae4845b0f1bb8d ]
KMSAN reported use of uninitialized sctp_addr->v4.sin_addr.s_addr and
sctp_addr->v6.sin6_scope_id in sctp_v6_cmp_addr() (see below).
Make sure all fields of an IPv6 address are initialized, which
guarantees that the IPv4 fields are also initialized.
==================================================================
BUG: KMSAN: use of uninitialized memory in sctp_v6_cmp_addr+0x8d4/0x9f0
net/sctp/ipv6.c:517
CPU: 2 PID: 31056 Comm: syz-executor1 Not tainted 4.11.0-rc5+ #2944
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
01/01/2011
Call Trace:
dump_stack+0x172/0x1c0 lib/dump_stack.c:42
is_logbuf_locked mm/kmsan/kmsan.c:59 [inline]
kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:938
native_save_fl arch/x86/include/asm/irqflags.h:18 [inline]
arch_local_save_flags arch/x86/include/asm/irqflags.h:72 [inline]
arch_local_irq_save arch/x86/include/asm/irqflags.h:113 [inline]
__msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:467
sctp_v6_cmp_addr+0x8d4/0x9f0 net/sctp/ipv6.c:517
sctp_v6_get_dst+0x8c7/0x1630 net/sctp/ipv6.c:290
sctp_transport_route+0x101/0x570 net/sctp/transport.c:292
sctp_assoc_add_peer+0x66d/0x16f0 net/sctp/associola.c:651
sctp_sendmsg+0x35a5/0x4f90 net/sctp/socket.c:1871
inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg net/socket.c:643 [inline]
SYSC_sendto+0x608/0x710 net/socket.c:1696
SyS_sendto+0x8a/0xb0 net/socket.c:1664
entry_SYSCALL_64_fastpath+0x13/0x94
RIP: 0033:0x44b479
RSP: 002b:00007f6213f21c08 EFLAGS: 00000286 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 000000000044b479
RDX: 0000000000000041 RSI: 0000000020edd000 RDI: 0000000000000006
RBP: 00000000007080a8 R08: 0000000020b85fe4 R09: 000000000000001c
R10: 0000000000040005 R11: 0000000000000286 R12: 00000000ffffffff
R13: 0000000000003760 R14: 00000000006e5820 R15: 0000000000ff8000
origin description: ----dst_saddr@sctp_v6_get_dst
local variable created at:
sk_fullsock include/net/sock.h:2321 [inline]
inet6_sk include/linux/ipv6.h:309 [inline]
sctp_v6_get_dst+0x91/0x1630 net/sctp/ipv6.c:241
sctp_transport_route+0x101/0x570 net/sctp/transport.c:292
==================================================================
BUG: KMSAN: use of uninitialized memory in sctp_v6_cmp_addr+0x8d4/0x9f0
net/sctp/ipv6.c:517
CPU: 2 PID: 31056 Comm: syz-executor1 Not tainted 4.11.0-rc5+ #2944
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
01/01/2011
Call Trace:
dump_stack+0x172/0x1c0 lib/dump_stack.c:42
is_logbuf_locked mm/kmsan/kmsan.c:59 [inline]
kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:938
native_save_fl arch/x86/include/asm/irqflags.h:18 [inline]
arch_local_save_flags arch/x86/include/asm/irqflags.h:72 [inline]
arch_local_irq_save arch/x86/include/asm/irqflags.h:113 [inline]
__msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:467
sctp_v6_cmp_addr+0x8d4/0x9f0 net/sctp/ipv6.c:517
sctp_v6_get_dst+0x8c7/0x1630 net/sctp/ipv6.c:290
sctp_transport_route+0x101/0x570 net/sctp/transport.c:292
sctp_assoc_add_peer+0x66d/0x16f0 net/sctp/associola.c:651
sctp_sendmsg+0x35a5/0x4f90 net/sctp/socket.c:1871
inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg net/socket.c:643 [inline]
SYSC_sendto+0x608/0x710 net/socket.c:1696
SyS_sendto+0x8a/0xb0 net/socket.c:1664
entry_SYSCALL_64_fastpath+0x13/0x94
RIP: 0033:0x44b479
RSP: 002b:00007f6213f21c08 EFLAGS: 00000286 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 000000000044b479
RDX: 0000000000000041 RSI: 0000000020edd000 RDI: 0000000000000006
RBP: 00000000007080a8 R08: 0000000020b85fe4 R09: 000000000000001c
R10: 0000000000040005 R11: 0000000000000286 R12: 00000000ffffffff
R13: 0000000000003760 R14: 00000000006e5820 R15: 0000000000ff8000
origin description: ----dst_saddr@sctp_v6_get_dst
local variable created at:
sk_fullsock include/net/sock.h:2321 [inline]
inet6_sk include/linux/ipv6.h:309 [inline]
sctp_v6_get_dst+0x91/0x1630 net/sctp/ipv6.c:241
sctp_transport_route+0x101/0x570 net/sctp/transport.c:292
==================================================================
Signed-off-by: Alexander Potapenko <glider@google.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/ipv6.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -510,7 +510,9 @@ static void sctp_v6_to_addr(union sctp_a
{
addr->sa.sa_family = AF_INET6;
addr->v6.sin6_port = port;
+ addr->v6.sin6_flowinfo = 0;
addr->v6.sin6_addr = *saddr;
+ addr->v6.sin6_scope_id = 0;
}
/* Compare addresses exactly.
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 68/99] cifs: Fix df output for users with quota limits |
| Message-ID | <ujnhq-38X-77@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sachin Prabhu <sprabhu@redhat.com> commit 42bec214d8bd432be6d32a1acb0a9079ecd4d142 upstream. The df for a SMB2 share triggers a GetInfo call for FS_FULL_SIZE_INFORMATION. The values returned are used to populate struct statfs. The problem is that none of the information returned by the call contains the total blocks available on the filesystem. Instead we use the blocks available to the user ie. quota limitation when filling out statfs.f_blocks. The information returned does contain Actual free units on the filesystem and is used to populate statfs.f_bfree. For users with quota enabled, it can lead to situations where the total free space reported is more than the total blocks on the system ending up with df reports like the following # df -h /mnt/a Filesystem Size Used Avail Use% Mounted on //192.168.22.10/a 2.5G -2.3G 2.5G - /mnt/a To fix this problem, we instead populate both statfs.f_bfree with the same value as statfs.f_bavail ie. CallerAvailableAllocationUnits. This is similar to what is done already in the code for cifs and df now reports the quota information for the user used to mount the share. # df --si /mnt/a Filesystem Size Used Avail Use% Mounted on //192.168.22.10/a 2.7G 101M 2.6G 4% /mnt/a Signed-off-by: Sachin Prabhu <sprabhu@redhat.com> Signed-off-by: Pierguido Lambri <plambri@redhat.com> Signed-off-by: Steve French <smfrench@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- fs/cifs/smb2pdu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -3195,8 +3195,8 @@ copy_fs_info_to_kstatfs(struct smb2_fs_f kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); - kst->f_bfree = le64_to_cpu(pfs_inf->ActualAvailableAllocationUnits); - kst->f_bavail = le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); + kst->f_bfree = kst->f_bavail = + le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); return; }
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 11/99] net: igmp: Use ingress interface rather than vrf device |
| Message-ID | <ujnhq-38X-83@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <dsahern@gmail.com>
[ Upstream commit c7b725be84985532161bcb4fbecd056326998a77 ]
Anuradha reported that statically added groups for interfaces enslaved
to a VRF device were not persisting. The problem is that igmp queries
and reports need to use the data in the in_dev for the real ingress
device rather than the VRF device. Update igmp_rcv accordingly.
Fixes: e58e41596811 ("net: Enable support for VRF with ipv4 multicast")
Reported-by: Anuradha Karuppiah <anuradhak@cumulusnetworks.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
Reviewed-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/igmp.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1007,10 +1007,18 @@ int igmp_rcv(struct sk_buff *skb)
{
/* This basically follows the spec line by line -- see RFC1112 */
struct igmphdr *ih;
- struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+ struct net_device *dev = skb->dev;
+ struct in_device *in_dev;
int len = skb->len;
bool dropped = true;
+ if (netif_is_l3_master(dev)) {
+ dev = dev_get_by_index_rcu(dev_net(dev), IPCB(skb)->iif);
+ if (!dev)
+ goto drop;
+ }
+
+ in_dev = __in_dev_get_rcu(dev);
if (!in_dev)
goto drop;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 18/99] tipc: fix use-after-free |
| Message-ID | <ujnhq-38X-79@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 5bfd37b4de5c98e86b12bd13be5aa46c7484a125 ]
syszkaller reported use-after-free in tipc [1]
When msg->rep skb is freed, set the pointer to NULL,
so that caller does not free it again.
[1]
==================================================================
BUG: KASAN: use-after-free in skb_push+0xd4/0xe0 net/core/skbuff.c:1466
Read of size 8 at addr ffff8801c6e71e90 by task syz-executor5/4115
CPU: 1 PID: 4115 Comm: syz-executor5 Not tainted 4.13.0-rc4+ #32
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
print_address_description+0x73/0x250 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report+0x24e/0x340 mm/kasan/report.c:409
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
skb_push+0xd4/0xe0 net/core/skbuff.c:1466
tipc_nl_compat_recv+0x833/0x18f0 net/tipc/netlink_compat.c:1209
genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:598
genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:623
netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397
genl_rcv+0x28/0x40 net/netlink/genetlink.c:634
netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]
netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291
netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1854
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:643
sock_write_iter+0x31a/0x5d0 net/socket.c:898
call_write_iter include/linux/fs.h:1743 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x684/0x970 fs/read_write.c:470
vfs_write+0x189/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x4512e9
RSP: 002b:00007f3bc8184c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 00000000004512e9
RDX: 0000000000000020 RSI: 0000000020fdb000 RDI: 0000000000000006
RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b5e76
R13: 00007f3bc8184b48 R14: 00000000004b5e86 R15: 0000000000000000
Allocated by task 4115:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
kmem_cache_alloc_node+0x13d/0x750 mm/slab.c:3651
__alloc_skb+0xf1/0x740 net/core/skbuff.c:219
alloc_skb include/linux/skbuff.h:903 [inline]
tipc_tlv_alloc+0x26/0xb0 net/tipc/netlink_compat.c:148
tipc_nl_compat_dumpit+0xf2/0x3c0 net/tipc/netlink_compat.c:248
tipc_nl_compat_handle net/tipc/netlink_compat.c:1130 [inline]
tipc_nl_compat_recv+0x756/0x18f0 net/tipc/netlink_compat.c:1199
genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:598
genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:623
netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397
genl_rcv+0x28/0x40 net/netlink/genetlink.c:634
netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]
netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291
netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1854
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:643
sock_write_iter+0x31a/0x5d0 net/socket.c:898
call_write_iter include/linux/fs.h:1743 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x684/0x970 fs/read_write.c:470
vfs_write+0x189/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
Freed by task 4115:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3503 [inline]
kmem_cache_free+0x77/0x280 mm/slab.c:3763
kfree_skbmem+0x1a1/0x1d0 net/core/skbuff.c:622
__kfree_skb net/core/skbuff.c:682 [inline]
kfree_skb+0x165/0x4c0 net/core/skbuff.c:699
tipc_nl_compat_dumpit+0x36a/0x3c0 net/tipc/netlink_compat.c:260
tipc_nl_compat_handle net/tipc/netlink_compat.c:1130 [inline]
tipc_nl_compat_recv+0x756/0x18f0 net/tipc/netlink_compat.c:1199
genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:598
genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:623
netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397
genl_rcv+0x28/0x40 net/netlink/genetlink.c:634
netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]
netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291
netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1854
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:643
sock_write_iter+0x31a/0x5d0 net/socket.c:898
call_write_iter include/linux/fs.h:1743 [inline]
new_sync_write fs/read_write.c:457 [inline]
__vfs_write+0x684/0x970 fs/read_write.c:470
vfs_write+0x189/0x510 fs/read_write.c:518
SYSC_write fs/read_write.c:565 [inline]
SyS_write+0xef/0x220 fs/read_write.c:557
entry_SYSCALL_64_fastpath+0x1f/0xbe
The buggy address belongs to the object at ffff8801c6e71dc0
which belongs to the cache skbuff_head_cache of size 224
The buggy address is located 208 bytes inside of
224-byte region [ffff8801c6e71dc0, ffff8801c6e71ea0)
The buggy address belongs to the page:
page:ffffea00071b9c40 count:1 mapcount:0 mapping:ffff8801c6e71000 index:0x0
flags: 0x200000000000100(slab)
raw: 0200000000000100 ffff8801c6e71000 0000000000000000 000000010000000c
raw: ffffea0007224a20 ffff8801d98caf48 ffff8801d9e79040 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801c6e71d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8801c6e71e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801c6e71e80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff8801c6e71f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801c6e71f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/netlink_compat.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -258,13 +258,15 @@ static int tipc_nl_compat_dumpit(struct
arg = nlmsg_new(0, GFP_KERNEL);
if (!arg) {
kfree_skb(msg->rep);
+ msg->rep = NULL;
return -ENOMEM;
}
err = __tipc_nl_compat_dumpit(cmd, msg, arg);
- if (err)
+ if (err) {
kfree_skb(msg->rep);
-
+ msg->rep = NULL;
+ }
kfree_skb(arg);
return err;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 13/99] ptr_ring: use kmalloc_array() |
| Message-ID | <ujnhq-38X-87@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 81fbfe8adaf38d4f5a98c19bebfd41c5d6acaee8 ]
As found by syzkaller, malicious users can set whatever tx_queue_len
on a tun device and eventually crash the kernel.
Lets remove the ALIGN(XXX, SMP_CACHE_BYTES) thing since a small
ring buffer is not fast anyway.
Fixes: 2e0ab8ca83c1 ("ptr_ring: array based FIFO for pointers")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/ptr_ring.h | 9 +++++----
include/linux/skb_array.h | 3 ++-
2 files changed, 7 insertions(+), 5 deletions(-)
--- a/include/linux/ptr_ring.h
+++ b/include/linux/ptr_ring.h
@@ -371,9 +371,9 @@ static inline void *ptr_ring_consume_bh(
__PTR_RING_PEEK_CALL_v; \
})
-static inline void **__ptr_ring_init_queue_alloc(int size, gfp_t gfp)
+static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
{
- return kzalloc(ALIGN(size * sizeof(void *), SMP_CACHE_BYTES), gfp);
+ return kcalloc(size, sizeof(void *), gfp);
}
static inline void __ptr_ring_set_size(struct ptr_ring *r, int size)
@@ -462,7 +462,8 @@ static inline int ptr_ring_resize(struct
* In particular if you consume ring in interrupt or BH context, you must
* disable interrupts/BH when doing so.
*/
-static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, int nrings,
+static inline int ptr_ring_resize_multiple(struct ptr_ring **rings,
+ unsigned int nrings,
int size,
gfp_t gfp, void (*destroy)(void *))
{
@@ -470,7 +471,7 @@ static inline int ptr_ring_resize_multip
void ***queues;
int i;
- queues = kmalloc(nrings * sizeof *queues, gfp);
+ queues = kmalloc_array(nrings, sizeof(*queues), gfp);
if (!queues)
goto noqueues;
--- a/include/linux/skb_array.h
+++ b/include/linux/skb_array.h
@@ -162,7 +162,8 @@ static inline int skb_array_resize(struc
}
static inline int skb_array_resize_multiple(struct skb_array **rings,
- int nrings, int size, gfp_t gfp)
+ int nrings, unsigned int size,
+ gfp_t gfp)
{
BUILD_BUG_ON(offsetof(struct skb_array, ring));
return ptr_ring_resize_multiple((struct ptr_ring **)rings,
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 36/99] KVM: x86: block guest protection keys unless the host has them enabled |
| Message-ID | <ujnhq-38X-89@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paolo Bonzini <pbonzini@redhat.com> commit c469268cd523245cc58255f6696e0c295485cb0b upstream. If the host has protection keys disabled, we cannot read and write the guest PKRU---RDPKRU and WRPKRU fail with #GP(0) if CR4.PKE=0. Block the PKU cpuid bit in that case. This ensures that guest_CR4.PKE=1 implies host_CR4.PKE=1. Fixes: 1be0e61c1f255faaeab04a390e00c8b9b9042870 Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- arch/x86/kvm/cpuid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -469,7 +469,7 @@ static inline int __do_cpuid_ent(struct entry->ecx &= kvm_cpuid_7_0_ecx_x86_features; cpuid_mask(&entry->ecx, CPUID_7_ECX); /* PKU is not yet implemented for shadow paging. */ - if (!tdp_enabled) + if (!tdp_enabled || !boot_cpu_has(X86_FEATURE_OSPKE)) entry->ecx &= ~F(PKU); entry->edx &= kvm_cpuid_7_0_edx_x86_features; entry->edx &= get_scattered_cpuid_leaf(7, 0, CPUID_EDX);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 31/99] Input: ALPS - fix two-finger scroll breakage in right side on ALPS touchpad |
| Message-ID | <ujnhr-38X-93@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masaki Ota <masaki.ota@jp.alps.com>
commit 4a646580f793d19717f7e034c8d473b509c27d49 upstream.
Fixed the issue that two finger scroll does not work correctly
on V8 protocol. The cause is that V8 protocol X-coordinate decode
is wrong at SS4 PLUS device. I added SS4 PLUS X decode definition.
Mote notes:
the problem manifests itself by the commit e7348396c6d5 ("Input: ALPS
- fix V8+ protocol handling (73 03 28)"), where a fix for the V8+
protocol was applied. Although the culprit must have been present
beforehand, the two-finger scroll worked casually even with the
wrongly reported values by some reason. It got broken by the commit
above just because it changed x_max value, and this made libinput
correctly figuring the MT events. Since the X coord is reported as
falsely doubled, the events on the right-half side go outside the
boundary, thus they are no longer handled. This resulted as a broken
two-finger scroll.
One finger event is decoded differently, and it didn't suffer from
this problem. The problem was only about MT events. --tiwai
Fixes: e7348396c6d5 ("Input: ALPS - fix V8+ protocol handling (73 03 28)")
Signed-off-by: Masaki Ota <masaki.ota@jp.alps.com>
Tested-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Paul Donohue <linux-kernel@PaulSD.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/alps.c | 41 +++++++++++++++++++++++++++++++----------
drivers/input/mouse/alps.h | 8 ++++++++
2 files changed, 39 insertions(+), 10 deletions(-)
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1215,14 +1215,24 @@ static int alps_decode_ss4_v2(struct alp
case SS4_PACKET_ID_TWO:
if (priv->flags & ALPS_BUTTONPAD) {
- f->mt[0].x = SS4_BTL_MF_X_V2(p, 0);
+ if (IS_SS4PLUS_DEV(priv->dev_id)) {
+ f->mt[0].x = SS4_PLUS_BTL_MF_X_V2(p, 0);
+ f->mt[1].x = SS4_PLUS_BTL_MF_X_V2(p, 1);
+ } else {
+ f->mt[0].x = SS4_BTL_MF_X_V2(p, 0);
+ f->mt[1].x = SS4_BTL_MF_X_V2(p, 1);
+ }
f->mt[0].y = SS4_BTL_MF_Y_V2(p, 0);
- f->mt[1].x = SS4_BTL_MF_X_V2(p, 1);
f->mt[1].y = SS4_BTL_MF_Y_V2(p, 1);
} else {
- f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
+ if (IS_SS4PLUS_DEV(priv->dev_id)) {
+ f->mt[0].x = SS4_PLUS_STD_MF_X_V2(p, 0);
+ f->mt[1].x = SS4_PLUS_STD_MF_X_V2(p, 1);
+ } else {
+ f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
+ f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
+ }
f->mt[0].y = SS4_STD_MF_Y_V2(p, 0);
- f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
f->mt[1].y = SS4_STD_MF_Y_V2(p, 1);
}
f->pressure = SS4_MF_Z_V2(p, 0) ? 0x30 : 0;
@@ -1239,16 +1249,27 @@ static int alps_decode_ss4_v2(struct alp
case SS4_PACKET_ID_MULTI:
if (priv->flags & ALPS_BUTTONPAD) {
- f->mt[2].x = SS4_BTL_MF_X_V2(p, 0);
+ if (IS_SS4PLUS_DEV(priv->dev_id)) {
+ f->mt[0].x = SS4_PLUS_BTL_MF_X_V2(p, 0);
+ f->mt[1].x = SS4_PLUS_BTL_MF_X_V2(p, 1);
+ } else {
+ f->mt[2].x = SS4_BTL_MF_X_V2(p, 0);
+ f->mt[3].x = SS4_BTL_MF_X_V2(p, 1);
+ }
+
f->mt[2].y = SS4_BTL_MF_Y_V2(p, 0);
- f->mt[3].x = SS4_BTL_MF_X_V2(p, 1);
f->mt[3].y = SS4_BTL_MF_Y_V2(p, 1);
no_data_x = SS4_MFPACKET_NO_AX_BL;
no_data_y = SS4_MFPACKET_NO_AY_BL;
} else {
- f->mt[2].x = SS4_STD_MF_X_V2(p, 0);
+ if (IS_SS4PLUS_DEV(priv->dev_id)) {
+ f->mt[0].x = SS4_PLUS_STD_MF_X_V2(p, 0);
+ f->mt[1].x = SS4_PLUS_STD_MF_X_V2(p, 1);
+ } else {
+ f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
+ f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
+ }
f->mt[2].y = SS4_STD_MF_Y_V2(p, 0);
- f->mt[3].x = SS4_STD_MF_X_V2(p, 1);
f->mt[3].y = SS4_STD_MF_Y_V2(p, 1);
no_data_x = SS4_MFPACKET_NO_AX;
no_data_y = SS4_MFPACKET_NO_AY;
@@ -2541,8 +2562,8 @@ static int alps_set_defaults_ss4_v2(stru
memset(otp, 0, sizeof(otp));
- if (alps_get_otp_values_ss4_v2(psmouse, 0, &otp[0][0]) ||
- alps_get_otp_values_ss4_v2(psmouse, 1, &otp[1][0]))
+ if (alps_get_otp_values_ss4_v2(psmouse, 1, &otp[1][0]) ||
+ alps_get_otp_values_ss4_v2(psmouse, 0, &otp[0][0]))
return -1;
alps_update_device_area_ss4_v2(otp, priv);
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -100,6 +100,10 @@ enum SS4_PACKET_ID {
((_b[1 + _i * 3] << 5) & 0x1F00) \
)
+#define SS4_PLUS_STD_MF_X_V2(_b, _i) (((_b[0 + (_i) * 3] << 4) & 0x0070) | \
+ ((_b[1 + (_i) * 3] << 4) & 0x0F80) \
+ )
+
#define SS4_STD_MF_Y_V2(_b, _i) (((_b[1 + (_i) * 3] << 3) & 0x0010) | \
((_b[2 + (_i) * 3] << 5) & 0x01E0) | \
((_b[2 + (_i) * 3] << 4) & 0x0E00) \
@@ -109,6 +113,10 @@ enum SS4_PACKET_ID {
((_b[0 + (_i) * 3] >> 3) & 0x0010) \
)
+#define SS4_PLUS_BTL_MF_X_V2(_b, _i) (SS4_PLUS_STD_MF_X_V2(_b, _i) | \
+ ((_b[0 + (_i) * 3] >> 4) & 0x0008) \
+ )
+
#define SS4_BTL_MF_Y_V2(_b, _i) (SS4_STD_MF_Y_V2(_b, _i) | \
((_b[0 + (_i) * 3] >> 3) & 0x0008) \
)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:10 +0200 |
| Subject | [PATCH 4.12 10/99] bpf: fix bpf_trace_printk on 32 bit archs |
| Message-ID | <ujnhr-38X-91@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 88a5c690b66110ad255380d8f629c629cf6ca559 ]
James reported that on MIPS32 bpf_trace_printk() is currently
broken while MIPS64 works fine:
bpf_trace_printk() uses conditional operators to attempt to
pass different types to __trace_printk() depending on the
format operators. This doesn't work as intended on 32-bit
architectures where u32 and long are passed differently to
u64, since the result of C conditional operators follows the
"usual arithmetic conversions" rules, such that the values
passed to __trace_printk() will always be u64 [causing issues
later in the va_list handling for vscnprintf()].
For example the samples/bpf/tracex5 test printed lines like
below on MIPS32, where the fd and buf have come from the u64
fd argument, and the size from the buf argument:
[...] 1180.941542: 0x00000001: write(fd=1, buf= (null), size=6258688)
Instead of this:
[...] 1625.616026: 0x00000001: write(fd=1, buf=009e4000, size=512)
One way to get it working is to expand various combinations
of argument types into 8 different combinations for 32 bit
and 64 bit kernels. Fix tested by James on MIPS32 and MIPS64
as well that it resolves the issue.
Fixes: 9c959c863f82 ("tracing: Allow BPF programs to call bpf_trace_printk()")
Reported-by: James Hogan <james.hogan@imgtec.com>
Tested-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/bpf_trace.c | 34 ++++++++++++++++++++++++++++++----
1 file changed, 30 insertions(+), 4 deletions(-)
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -203,10 +203,36 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt
fmt_cnt++;
}
- return __trace_printk(1/* fake ip will not be printed */, fmt,
- mod[0] == 2 ? arg1 : mod[0] == 1 ? (long) arg1 : (u32) arg1,
- mod[1] == 2 ? arg2 : mod[1] == 1 ? (long) arg2 : (u32) arg2,
- mod[2] == 2 ? arg3 : mod[2] == 1 ? (long) arg3 : (u32) arg3);
+/* Horrid workaround for getting va_list handling working with different
+ * argument type combinations generically for 32 and 64 bit archs.
+ */
+#define __BPF_TP_EMIT() __BPF_ARG3_TP()
+#define __BPF_TP(...) \
+ __trace_printk(1 /* Fake ip will not be printed. */, \
+ fmt, ##__VA_ARGS__)
+
+#define __BPF_ARG1_TP(...) \
+ ((mod[0] == 2 || (mod[0] == 1 && __BITS_PER_LONG == 64)) \
+ ? __BPF_TP(arg1, ##__VA_ARGS__) \
+ : ((mod[0] == 1 || (mod[0] == 0 && __BITS_PER_LONG == 32)) \
+ ? __BPF_TP((long)arg1, ##__VA_ARGS__) \
+ : __BPF_TP((u32)arg1, ##__VA_ARGS__)))
+
+#define __BPF_ARG2_TP(...) \
+ ((mod[1] == 2 || (mod[1] == 1 && __BITS_PER_LONG == 64)) \
+ ? __BPF_ARG1_TP(arg2, ##__VA_ARGS__) \
+ : ((mod[1] == 1 || (mod[1] == 0 && __BITS_PER_LONG == 32)) \
+ ? __BPF_ARG1_TP((long)arg2, ##__VA_ARGS__) \
+ : __BPF_ARG1_TP((u32)arg2, ##__VA_ARGS__)))
+
+#define __BPF_ARG3_TP(...) \
+ ((mod[2] == 2 || (mod[2] == 1 && __BITS_PER_LONG == 64)) \
+ ? __BPF_ARG2_TP(arg3, ##__VA_ARGS__) \
+ : ((mod[2] == 1 || (mod[2] == 0 && __BITS_PER_LONG == 32)) \
+ ? __BPF_ARG2_TP((long)arg3, ##__VA_ARGS__) \
+ : __BPF_ARG2_TP((u32)arg3, ##__VA_ARGS__)))
+
+ return __BPF_TP_EMIT();
}
static const struct bpf_func_proto bpf_trace_printk_proto = {
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:20 +0200 |
| Subject | [PATCH 4.12 93/99] iommu: Fix wrong freeing of iommu_device->dev |
| Message-ID | <ujnr7-3du-59@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
commit 2926a2aa5c14fb2add75e6584845b1c03022235f upstream.
The struct iommu_device has a 'struct device' embedded into
it, not as a pointer, but the whole struct. In the
conversion of the iommu drivers to use struct iommu_device
it was forgotten that the relase function for that struct
device simply calls kfree() on the pointer.
This frees memory that was never allocated and causes memory
corruption.
To fix this issue, use a pointer to struct device instead of
embedding the whole struct. This needs some updates in the
iommu sysfs code as well as the Intel VT-d and AMD IOMMU
driver.
Reported-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Fixes: 39ab9555c241 ('iommu: Add sysfs bindings for struct iommu_device')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu_types.h | 4 +++-
drivers/iommu/intel-iommu.c | 4 +++-
drivers/iommu/iommu-sysfs.c | 34 +++++++++++++++++++++-------------
include/linux/iommu.h | 12 +++++++++++-
4 files changed, 38 insertions(+), 16 deletions(-)
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -571,7 +571,9 @@ struct amd_iommu {
static inline struct amd_iommu *dev_to_amd_iommu(struct device *dev)
{
- return container_of(dev, struct amd_iommu, iommu.dev);
+ struct iommu_device *iommu = dev_to_iommu_device(dev);
+
+ return container_of(iommu, struct amd_iommu, iommu);
}
#define ACPIHID_UID_LEN 256
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4749,7 +4749,9 @@ static void intel_disable_iommus(void)
static inline struct intel_iommu *dev_to_intel_iommu(struct device *dev)
{
- return container_of(dev, struct intel_iommu, iommu.dev);
+ struct iommu_device *iommu_dev = dev_to_iommu_device(dev);
+
+ return container_of(iommu_dev, struct intel_iommu, iommu);
}
static ssize_t intel_iommu_show_version(struct device *dev,
--- a/drivers/iommu/iommu-sysfs.c
+++ b/drivers/iommu/iommu-sysfs.c
@@ -62,32 +62,40 @@ int iommu_device_sysfs_add(struct iommu_
va_list vargs;
int ret;
- device_initialize(&iommu->dev);
-
- iommu->dev.class = &iommu_class;
- iommu->dev.parent = parent;
- iommu->dev.groups = groups;
+ iommu->dev = kzalloc(sizeof(*iommu->dev), GFP_KERNEL);
+ if (!iommu->dev)
+ return -ENOMEM;
+
+ device_initialize(iommu->dev);
+
+ iommu->dev->class = &iommu_class;
+ iommu->dev->parent = parent;
+ iommu->dev->groups = groups;
va_start(vargs, fmt);
- ret = kobject_set_name_vargs(&iommu->dev.kobj, fmt, vargs);
+ ret = kobject_set_name_vargs(&iommu->dev->kobj, fmt, vargs);
va_end(vargs);
if (ret)
goto error;
- ret = device_add(&iommu->dev);
+ ret = device_add(iommu->dev);
if (ret)
goto error;
+ dev_set_drvdata(iommu->dev, iommu);
+
return 0;
error:
- put_device(&iommu->dev);
+ put_device(iommu->dev);
return ret;
}
void iommu_device_sysfs_remove(struct iommu_device *iommu)
{
- device_unregister(&iommu->dev);
+ dev_set_drvdata(iommu->dev, NULL);
+ device_unregister(iommu->dev);
+ iommu->dev = NULL;
}
/*
* IOMMU drivers can indicate a device is managed by a given IOMMU using
@@ -102,14 +110,14 @@ int iommu_device_link(struct iommu_devic
if (!iommu || IS_ERR(iommu))
return -ENODEV;
- ret = sysfs_add_link_to_group(&iommu->dev.kobj, "devices",
+ ret = sysfs_add_link_to_group(&iommu->dev->kobj, "devices",
&link->kobj, dev_name(link));
if (ret)
return ret;
- ret = sysfs_create_link_nowarn(&link->kobj, &iommu->dev.kobj, "iommu");
+ ret = sysfs_create_link_nowarn(&link->kobj, &iommu->dev->kobj, "iommu");
if (ret)
- sysfs_remove_link_from_group(&iommu->dev.kobj, "devices",
+ sysfs_remove_link_from_group(&iommu->dev->kobj, "devices",
dev_name(link));
return ret;
@@ -121,5 +129,5 @@ void iommu_device_unlink(struct iommu_de
return;
sysfs_remove_link(&link->kobj, "iommu");
- sysfs_remove_link_from_group(&iommu->dev.kobj, "devices", dev_name(link));
+ sysfs_remove_link_from_group(&iommu->dev->kobj, "devices", dev_name(link));
}
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -240,7 +240,7 @@ struct iommu_device {
struct list_head list;
const struct iommu_ops *ops;
struct fwnode_handle *fwnode;
- struct device dev;
+ struct device *dev;
};
int iommu_device_register(struct iommu_device *iommu);
@@ -265,6 +265,11 @@ static inline void iommu_device_set_fwno
iommu->fwnode = fwnode;
}
+static inline struct iommu_device *dev_to_iommu_device(struct device *dev)
+{
+ return (struct iommu_device *)dev_get_drvdata(dev);
+}
+
#define IOMMU_GROUP_NOTIFY_ADD_DEVICE 1 /* Device added */
#define IOMMU_GROUP_NOTIFY_DEL_DEVICE 2 /* Pre Device removed */
#define IOMMU_GROUP_NOTIFY_BIND_DRIVER 3 /* Pre Driver bind */
@@ -589,6 +594,11 @@ static inline void iommu_device_set_fwno
{
}
+static inline struct iommu_device *dev_to_iommu_device(struct device *dev)
+{
+ return NULL;
+}
+
static inline void iommu_device_unregister(struct iommu_device *iommu)
{
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:20 +0200 |
| Subject | [PATCH 4.12 75/99] timers: Fix excessive granularity of new timers after a nohz idle |
| Message-ID | <ujnr7-3du-67@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Piggin <npiggin@gmail.com>
commit 2fe59f507a65dbd734b990a11ebc7488f6f87a24 upstream.
When a timer base is idle, it is forwarded when a new timer is added
to ensure that granularity does not become excessive. When not idle,
the timer tick is expected to increment the base.
However there are several problems:
- If an existing timer is modified, the base is forwarded only after
the index is calculated.
- The base is not forwarded by add_timer_on.
- There is a window after a timer is restarted from a nohz idle, after
it is marked not-idle and before the timer tick on this CPU, where a
timer may be added but the ancient base does not get forwarded.
These result in excessive granularity (a 1 jiffy timeout can blow out
to 100s of jiffies), which cause the rcu lockup detector to trigger,
among other things.
Fix this by keeping track of whether the timer base has been idle
since it was last run or forwarded, and if so then forward it before
adding a new timer.
There is still a case where mod_timer optimises the case of a pending
timer mod with the same expiry time, where the timer can see excessive
granularity relative to the new, shorter interval. A comment is added,
but it's not changed because it is an important fastpath for
networking.
This has been tested and found to fix the RCU softlockup messages.
Testing was also done with tracing to measure requested versus
achieved wakeup latencies for all non-deferrable timers in an idle
system (with no lockup watchdogs running). Wakeup latency relative to
absolute latency is calculated (note this suffers from round-up skew
at low absolute times) and analysed:
max avg std
upstream 506.0 1.20 4.68
patched 2.0 1.08 0.15
The bug was noticed due to the lockup detector Kconfig changes
dropping it out of people's .configs and resulting in larger base
clk skew When the lockup detectors are enabled, no CPU can go idle for
longer than 4 seconds, which limits the granularity errors.
Sub-optimal timer behaviour is observable on a smaller scale in that
case:
max avg std
upstream 9.0 1.05 0.19
patched 2.0 1.04 0.11
Fixes: Fixes: a683f390b93f ("timers: Forward the wheel clock whenever possible")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: David Miller <davem@davemloft.net>
Cc: dzickus@redhat.com
Cc: sfr@canb.auug.org.au
Cc: mpe@ellerman.id.au
Cc: Stephen Boyd <sboyd@codeaurora.org>
Cc: linuxarm@huawei.com
Cc: abdhalee@linux.vnet.ibm.com
Cc: John Stultz <john.stultz@linaro.org>
Cc: akpm@linux-foundation.org
Cc: paulmck@linux.vnet.ibm.com
Cc: torvalds@linux-foundation.org
Link: http://lkml.kernel.org/r/20170822084348.21436-1-npiggin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/timer.c | 50 +++++++++++++++++++++++++++++++++++++++++---------
1 file changed, 41 insertions(+), 9 deletions(-)
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -203,6 +203,7 @@ struct timer_base {
bool migration_enabled;
bool nohz_active;
bool is_idle;
+ bool must_forward_clk;
DECLARE_BITMAP(pending_map, WHEEL_SIZE);
struct hlist_head vectors[WHEEL_SIZE];
} ____cacheline_aligned;
@@ -856,13 +857,19 @@ get_target_base(struct timer_base *base,
static inline void forward_timer_base(struct timer_base *base)
{
- unsigned long jnow = READ_ONCE(jiffies);
+ unsigned long jnow;
/*
- * We only forward the base when it's idle and we have a delta between
- * base clock and jiffies.
+ * We only forward the base when we are idle or have just come out of
+ * idle (must_forward_clk logic), and have a delta between base clock
+ * and jiffies. In the common case, run_timers will take care of it.
*/
- if (!base->is_idle || (long) (jnow - base->clk) < 2)
+ if (likely(!base->must_forward_clk))
+ return;
+
+ jnow = READ_ONCE(jiffies);
+ base->must_forward_clk = base->is_idle;
+ if ((long)(jnow - base->clk) < 2)
return;
/*
@@ -938,6 +945,11 @@ __mod_timer(struct timer_list *timer, un
* same array bucket then just return:
*/
if (timer_pending(timer)) {
+ /*
+ * The downside of this optimization is that it can result in
+ * larger granularity than you would get from adding a new
+ * timer with this expiry.
+ */
if (timer->expires == expires)
return 1;
@@ -948,6 +960,7 @@ __mod_timer(struct timer_list *timer, un
* dequeue/enqueue dance.
*/
base = lock_timer_base(timer, &flags);
+ forward_timer_base(base);
clk = base->clk;
idx = calc_wheel_index(expires, clk);
@@ -964,6 +977,7 @@ __mod_timer(struct timer_list *timer, un
}
} else {
base = lock_timer_base(timer, &flags);
+ forward_timer_base(base);
}
ret = detach_if_pending(timer, base, false);
@@ -991,12 +1005,10 @@ __mod_timer(struct timer_list *timer, un
spin_lock(&base->lock);
WRITE_ONCE(timer->flags,
(timer->flags & ~TIMER_BASEMASK) | base->cpu);
+ forward_timer_base(base);
}
}
- /* Try to forward a stale timer base clock */
- forward_timer_base(base);
-
timer->expires = expires;
/*
* If 'idx' was calculated above and the base time did not advance
@@ -1112,6 +1124,7 @@ void add_timer_on(struct timer_list *tim
WRITE_ONCE(timer->flags,
(timer->flags & ~TIMER_BASEMASK) | cpu);
}
+ forward_timer_base(base);
debug_activate(timer, timer->expires);
internal_add_timer(base, timer);
@@ -1497,10 +1510,16 @@ u64 get_next_timer_interrupt(unsigned lo
if (!is_max_delta)
expires = basem + (u64)(nextevt - basej) * TICK_NSEC;
/*
- * If we expect to sleep more than a tick, mark the base idle:
+ * If we expect to sleep more than a tick, mark the base idle.
+ * Also the tick is stopped so any added timer must forward
+ * the base clk itself to keep granularity small. This idle
+ * logic is only maintained for the BASE_STD base, deferrable
+ * timers may still see large granularity skew (by design).
*/
- if ((expires - basem) > TICK_NSEC)
+ if ((expires - basem) > TICK_NSEC) {
+ base->must_forward_clk = true;
base->is_idle = true;
+ }
}
spin_unlock(&base->lock);
@@ -1611,6 +1630,19 @@ static __latent_entropy void run_timer_s
{
struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]);
+ /*
+ * must_forward_clk must be cleared before running timers so that any
+ * timer functions that call mod_timer will not try to forward the
+ * base. idle trcking / clock forwarding logic is only used with
+ * BASE_STD timers.
+ *
+ * The deferrable base does not do idle tracking at all, so we do
+ * not forward it. This can result in very large variations in
+ * granularity for deferrable timers, but they can be deferred for
+ * long periods due to idle.
+ */
+ base->must_forward_clk = false;
+
__run_timers(base);
if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && base->nohz_active)
__run_timers(this_cpu_ptr(&timer_bases[BASE_DEF]));
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:20 +0200 |
| Subject | [PATCH 4.12 79/99] netfilter: nat: fix src map lookup |
| Message-ID | <ujnr7-3du-79@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 97772bcd56efa21d9d8976db6f205574ea602f51 upstream.
When doing initial conversion to rhashtable I replaced the bucket
walk with a single rhashtable_lookup_fast().
When moving to rhlist I failed to properly walk the list of identical
tuples, but that is what is needed for this to work correctly.
The table contains the original tuples, so the reply tuples are all
distinct.
We currently decide that mapping is (not) in range only based on the
first entry, but in case its not we need to try the reply tuple of the
next entry until we either find an in-range mapping or we checked
all the entries.
This bug makes nat core attempt collision resolution while it might be
able to use the mapping as-is.
Fixes: 870190a9ec90 ("netfilter: nat: convert nat bysrc hash to rhashtable")
Reported-by: Jaco Kroon <jaco@uls.co.za>
Tested-by: Jaco Kroon <jaco@uls.co.za>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_nat_core.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -222,20 +222,21 @@ find_appropriate_src(struct net *net,
.tuple = tuple,
.zone = zone
};
- struct rhlist_head *hl;
+ struct rhlist_head *hl, *h;
hl = rhltable_lookup(&nf_nat_bysource_table, &key,
nf_nat_bysource_params);
- if (!hl)
- return 0;
- ct = container_of(hl, typeof(*ct), nat_bysource);
+ rhl_for_each_entry_rcu(ct, h, hl, nat_bysource) {
+ nf_ct_invert_tuplepr(result,
+ &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+ result->dst = tuple->dst;
- nf_ct_invert_tuplepr(result,
- &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
- result->dst = tuple->dst;
+ if (in_range(l3proto, l4proto, result, range))
+ return 1;
+ }
- return in_range(l3proto, l4proto, result, range);
+ return 0;
}
/* For [FUTURE] fragmentation handling, we want the least-used
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:20 +0200 |
| Subject | [PATCH 4.12 77/99] net: sunrpc: svcsock: fix NULL-pointer exception |
| Message-ID | <ujnr8-3du-89@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Lomovtsev <vlomovts@redhat.com>
commit eebe53e87f97975ee58a21693e44797608bf679c upstream.
While running nfs/connectathon tests kernel NULL-pointer exception
has been observed due to races in svcsock.c.
Race is appear when kernel accepts connection by kernel_accept
(which creates new socket) and start queuing ingress packets
to new socket. This happens in ksoftirq context which could run
concurrently on a different core while new socket setup is not done yet.
The fix is to re-order socket user data init sequence and add
write/read barrier calls to be sure that we got proper values
for callback pointers before actually calling them.
Test results: nfs/connectathon reports '0' failed tests for about 200+ iterations.
Crash log:
---<-snip->---
[ 6708.638984] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 6708.647093] pgd = ffff0000094e0000
[ 6708.650497] [00000000] *pgd=0000010ffff90003, *pud=0000010ffff90003, *pmd=0000010ffff80003, *pte=0000000000000000
[ 6708.660761] Internal error: Oops: 86000005 [#1] SMP
[ 6708.665630] Modules linked in: nfsv3 nfnetlink_queue nfnetlink_log nfnetlink rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache overlay xt_CONNSECMARK xt_SECMARK xt_conntrack iptable_security ip_tables ah4 xfrm4_mode_transport sctp tun binfmt_misc ext4 jbd2 mbcache loop tcp_diag udp_diag inet_diag rpcrdma ib_isert iscsi_target_mod ib_iser rdma_cm iw_cm libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib ib_ucm ib_uverbs ib_umad ib_cm ib_core nls_koi8_u nls_cp932 ts_kmp nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack vfat fat ghash_ce sha2_ce sha1_ce cavium_rng_vf i2c_thunderx sg thunderx_edac i2c_smbus edac_core cavium_rng nfsd auth_rpcgss nfs_acl lockd grace sunrpc xfs libcrc32c nicvf nicpf ast i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops
[ 6708.736446] ttm drm i2c_core thunder_bgx thunder_xcv mdio_thunder mdio_cavium dm_mirror dm_region_hash dm_log dm_mod [last unloaded: stap_3c300909c5b3f46dcacd49aab3334af_87021]
[ 6708.752275] CPU: 84 PID: 0 Comm: swapper/84 Tainted: G W OE 4.11.0-4.el7.aarch64 #1
[ 6708.760787] Hardware name: www.cavium.com CRB-2S/CRB-2S, BIOS 0.3 Mar 13 2017
[ 6708.767910] task: ffff810006842e80 task.stack: ffff81000689c000
[ 6708.773822] PC is at 0x0
[ 6708.776739] LR is at svc_data_ready+0x38/0x88 [sunrpc]
[ 6708.781866] pc : [<0000000000000000>] lr : [<ffff0000029d7378>] pstate: 60000145
[ 6708.789248] sp : ffff810ffbad3900
[ 6708.792551] x29: ffff810ffbad3900 x28: ffff000008c73d58
[ 6708.797853] x27: 0000000000000000 x26: ffff81000bbe1e00
[ 6708.803156] x25: 0000000000000020 x24: ffff800f7410bf28
[ 6708.808458] x23: ffff000008c63000 x22: ffff000008c63000
[ 6708.813760] x21: ffff800f7410bf28 x20: ffff81000bbe1e00
[ 6708.819063] x19: ffff810012412400 x18: 00000000d82a9df2
[ 6708.824365] x17: 0000000000000000 x16: 0000000000000000
[ 6708.829667] x15: 0000000000000000 x14: 0000000000000001
[ 6708.834969] x13: 0000000000000000 x12: 722e736f622e676e
[ 6708.840271] x11: 00000000f814dd99 x10: 0000000000000000
[ 6708.845573] x9 : 7374687225000000 x8 : 0000000000000000
[ 6708.850875] x7 : 0000000000000000 x6 : 0000000000000000
[ 6708.856177] x5 : 0000000000000028 x4 : 0000000000000000
[ 6708.861479] x3 : 0000000000000000 x2 : 00000000e5000000
[ 6708.866781] x1 : 0000000000000000 x0 : ffff81000bbe1e00
[ 6708.872084]
[ 6708.873565] Process swapper/84 (pid: 0, stack limit = 0xffff81000689c000)
[ 6708.880341] Stack: (0xffff810ffbad3900 to 0xffff8100068a0000)
[ 6708.886075] Call trace:
[ 6708.888513] Exception stack(0xffff810ffbad3710 to 0xffff810ffbad3840)
[ 6708.894942] 3700: ffff810012412400 0001000000000000
[ 6708.902759] 3720: ffff810ffbad3900 0000000000000000 0000000060000145 ffff800f79300000
[ 6708.910577] 3740: ffff000009274d00 00000000000003ea 0000000000000015 ffff000008c63000
[ 6708.918395] 3760: ffff810ffbad3830 ffff800f79300000 000000000000004d 0000000000000000
[ 6708.926212] 3780: ffff810ffbad3890 ffff0000080f88dc ffff800f79300000 000000000000004d
[ 6708.934030] 37a0: ffff800f7930093c ffff000008c63000 0000000000000000 0000000000000140
[ 6708.941848] 37c0: ffff000008c2c000 0000000000040b00 ffff81000bbe1e00 0000000000000000
[ 6708.949665] 37e0: 00000000e5000000 0000000000000000 0000000000000000 0000000000000028
[ 6708.957483] 3800: 0000000000000000 0000000000000000 0000000000000000 7374687225000000
[ 6708.965300] 3820: 0000000000000000 00000000f814dd99 722e736f622e676e 0000000000000000
[ 6708.973117] [< (null)>] (null)
[ 6708.977824] [<ffff0000086f9fa4>] tcp_data_queue+0x754/0xc5c
[ 6708.983386] [<ffff0000086fa64c>] tcp_rcv_established+0x1a0/0x67c
[ 6708.989384] [<ffff000008704120>] tcp_v4_do_rcv+0x15c/0x22c
[ 6708.994858] [<ffff000008707418>] tcp_v4_rcv+0xaf0/0xb58
[ 6709.000077] [<ffff0000086df784>] ip_local_deliver_finish+0x10c/0x254
[ 6709.006419] [<ffff0000086dfea4>] ip_local_deliver+0xf0/0xfc
[ 6709.011980] [<ffff0000086dfad4>] ip_rcv_finish+0x208/0x3a4
[ 6709.017454] [<ffff0000086e018c>] ip_rcv+0x2dc/0x3c8
[ 6709.022328] [<ffff000008692fc8>] __netif_receive_skb_core+0x2f8/0xa0c
[ 6709.028758] [<ffff000008696068>] __netif_receive_skb+0x38/0x84
[ 6709.034580] [<ffff00000869611c>] netif_receive_skb_internal+0x68/0xdc
[ 6709.041010] [<ffff000008696bc0>] napi_gro_receive+0xcc/0x1a8
[ 6709.046690] [<ffff0000014b0fc4>] nicvf_cq_intr_handler+0x59c/0x730 [nicvf]
[ 6709.053559] [<ffff0000014b1380>] nicvf_poll+0x38/0xb8 [nicvf]
[ 6709.059295] [<ffff000008697a6c>] net_rx_action+0x2f8/0x464
[ 6709.064771] [<ffff000008081824>] __do_softirq+0x11c/0x308
[ 6709.070164] [<ffff0000080d14e4>] irq_exit+0x12c/0x174
[ 6709.075206] [<ffff00000813101c>] __handle_domain_irq+0x78/0xc4
[ 6709.081027] [<ffff000008081608>] gic_handle_irq+0x94/0x190
[ 6709.086501] Exception stack(0xffff81000689fdf0 to 0xffff81000689ff20)
[ 6709.092929] fde0: 0000810ff2ec0000 ffff000008c10000
[ 6709.100747] fe00: ffff000008c70ef4 0000000000000001 0000000000000000 ffff810ffbad9b18
[ 6709.108565] fe20: ffff810ffbad9c70 ffff8100169d3800 ffff810006843ab0 ffff81000689fe80
[ 6709.116382] fe40: 0000000000000bd0 0000ffffdf979cd0 183f5913da192500 0000ffff8a254ce4
[ 6709.124200] fe60: 0000ffff8a254b78 0000aaab10339808 0000000000000000 0000ffff8a0c2a50
[ 6709.132018] fe80: 0000ffffdf979b10 ffff000008d6d450 ffff000008c10000 ffff000008d6d000
[ 6709.139836] fea0: 0000000000000054 ffff000008cd3dbc 0000000000000000 0000000000000000
[ 6709.147653] fec0: 0000000000000000 0000000000000000 0000000000000000 ffff81000689ff20
[ 6709.155471] fee0: ffff000008085240 ffff81000689ff20 ffff000008085244 0000000060000145
[ 6709.163289] ff00: ffff81000689ff10 ffff00000813f1e4 ffffffffffffffff ffff00000813f238
[ 6709.171107] [<ffff000008082eb4>] el1_irq+0xb4/0x140
[ 6709.175976] [<ffff000008085244>] arch_cpu_idle+0x44/0x11c
[ 6709.181368] [<ffff0000087bf3b8>] default_idle_call+0x20/0x30
[ 6709.187020] [<ffff000008116d50>] do_idle+0x158/0x1e4
[ 6709.191973] [<ffff000008116ff4>] cpu_startup_entry+0x2c/0x30
[ 6709.197624] [<ffff00000808e7cc>] secondary_start_kernel+0x13c/0x160
[ 6709.203878] [<0000000001bc71c4>] 0x1bc71c4
[ 6709.207967] Code: bad PC value
[ 6709.211061] SMP: stopping secondary CPUs
[ 6709.218830] Starting crashdump kernel...
[ 6709.222749] Bye!
---<-snip>---
Signed-off-by: Vadim Lomovtsev <vlomovts@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcsock.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -421,6 +421,9 @@ static void svc_data_ready(struct sock *
dprintk("svc: socket %p(inet %p), busy=%d\n",
svsk, sk,
test_bit(XPT_BUSY, &svsk->sk_xprt.xpt_flags));
+
+ /* Refer to svc_setup_socket() for details. */
+ rmb();
svsk->sk_odata(sk);
if (!test_and_set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags))
svc_xprt_enqueue(&svsk->sk_xprt);
@@ -437,6 +440,9 @@ static void svc_write_space(struct sock
if (svsk) {
dprintk("svc: socket %p(inet %p), write_space busy=%d\n",
svsk, sk, test_bit(XPT_BUSY, &svsk->sk_xprt.xpt_flags));
+
+ /* Refer to svc_setup_socket() for details. */
+ rmb();
svsk->sk_owspace(sk);
svc_xprt_enqueue(&svsk->sk_xprt);
}
@@ -760,8 +766,12 @@ static void svc_tcp_listen_data_ready(st
dprintk("svc: socket %p TCP (listen) state change %d\n",
sk, sk->sk_state);
- if (svsk)
+ if (svsk) {
+ /* Refer to svc_setup_socket() for details. */
+ rmb();
svsk->sk_odata(sk);
+ }
+
/*
* This callback may called twice when a new connection
* is established as a child socket inherits everything
@@ -794,6 +804,8 @@ static void svc_tcp_state_change(struct
if (!svsk)
printk("svc: socket %p: no user data\n", sk);
else {
+ /* Refer to svc_setup_socket() for details. */
+ rmb();
svsk->sk_ostate(sk);
if (sk->sk_state != TCP_ESTABLISHED) {
set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
@@ -1381,12 +1393,18 @@ static struct svc_sock *svc_setup_socket
return ERR_PTR(err);
}
- inet->sk_user_data = svsk;
svsk->sk_sock = sock;
svsk->sk_sk = inet;
svsk->sk_ostate = inet->sk_state_change;
svsk->sk_odata = inet->sk_data_ready;
svsk->sk_owspace = inet->sk_write_space;
+ /*
+ * This barrier is necessary in order to prevent race condition
+ * with svc_data_ready(), svc_listen_data_ready() and others
+ * when calling callbacks above.
+ */
+ wmb();
+ inet->sk_user_data = svsk;
/* Initialize the socket */
if (sock->type == SOCK_DGRAM)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-08-28 10:20 +0200 |
| Subject | [PATCH 4.12 99/99] powerpc/mm: Ensure cpumask update is ordered |
| Message-ID | <ujnr8-3du-101@gated-at.bofh.it> |
| In reply to | #1721154 |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
commit 1a92a80ad386a1a6e3b36d576d52a1a456394b70 upstream.
There is no guarantee that the various isync's involved with
the context switch will order the update of the CPU mask with
the first TLB entry for the new context being loaded by the HW.
Be safe here and add a memory barrier to order any subsequent
load/store which may bring entries into the TLB.
The corresponding barrier on the other side already exists as
pte updates use pte_xchg() which uses __cmpxchg_u64 which has
a sync after the atomic operation.
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
[mpe: Add comments in the code]
[mpe: Backport to 4.12, minor context change]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/mmu_context.h | 20 +++++++++++++++++++-
arch/powerpc/include/asm/pgtable-be-types.h | 1 +
arch/powerpc/include/asm/pgtable-types.h | 1 +
3 files changed, 21 insertions(+), 1 deletion(-)
--- a/arch/powerpc/include/asm/mmu_context.h
+++ b/arch/powerpc/include/asm/mmu_context.h
@@ -80,9 +80,27 @@ static inline void switch_mm_irqs_off(st
struct task_struct *tsk)
{
/* Mark this context has been used on the new CPU */
- if (!cpumask_test_cpu(smp_processor_id(), mm_cpumask(next)))
+ if (!cpumask_test_cpu(smp_processor_id(), mm_cpumask(next))) {
cpumask_set_cpu(smp_processor_id(), mm_cpumask(next));
+ /*
+ * This full barrier orders the store to the cpumask above vs
+ * a subsequent operation which allows this CPU to begin loading
+ * translations for next.
+ *
+ * When using the radix MMU that operation is the load of the
+ * MMU context id, which is then moved to SPRN_PID.
+ *
+ * For the hash MMU it is either the first load from slb_cache
+ * in switch_slb(), and/or the store of paca->mm_ctx_id in
+ * copy_mm_to_paca().
+ *
+ * On the read side the barrier is in pte_xchg(), which orders
+ * the store to the PTE vs the load of mm_cpumask.
+ */
+ smp_mb();
+ }
+
/* 32-bit keeps track of the current PGDIR in the thread struct */
#ifdef CONFIG_PPC32
tsk->thread.pgdir = next->pgd;
--- a/arch/powerpc/include/asm/pgtable-be-types.h
+++ b/arch/powerpc/include/asm/pgtable-be-types.h
@@ -87,6 +87,7 @@ static inline bool pte_xchg(pte_t *ptep,
unsigned long *p = (unsigned long *)ptep;
__be64 prev;
+ /* See comment in switch_mm_irqs_off() */
prev = (__force __be64)__cmpxchg_u64(p, (__force unsigned long)pte_raw(old),
(__force unsigned long)pte_raw(new));
--- a/arch/powerpc/include/asm/pgtable-types.h
+++ b/arch/powerpc/include/asm/pgtable-types.h
@@ -62,6 +62,7 @@ static inline bool pte_xchg(pte_t *ptep,
{
unsigned long *p = (unsigned long *)ptep;
+ /* See comment in switch_mm_irqs_off() */
return pte_val(old) == __cmpxchg_u64(p, pte_val(old), pte_val(new));
}
#endif
[toc] | [prev] | [next] | [standalone]
Page 1 of 5 [1] 2 3 4 5 Next page →
Back to top | Article view | linux.kernel
csiph-web