This is the start of the stable review cycle for the 4.14.4 release.
There are 95 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Dec 6 16:00:27 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.4-rc1
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "x86/entry/64: Add missing irqflags tracing to native_load_gs_index()"
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Prevent zero length "index" write
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Don't try indexed reads to alternate slave addresses
Xiong Zhang <xiong.y.zhang(a)intel.com>
drm/i915/gvt: Correct ADDR_4K/2M/1G_MASK definition
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915/fbdev: Serialise early hotplug events with async fbdev config
Hans de Goede <j.w.r.degoede(a)gmail.com>
drm/i915: Re-register PMIC bus access notifier on runtime resume
Hans de Goede <j.w.r.degoede(a)gmail.com>
drm/i915: Fix false-positive assert_rpm_wakelock_held in i915_pmic_bus_access_notifier v2
NeilBrown <neilb(a)suse.com>
md: forbid a RAID5 from having both a bitmap and a journal.
Sasha Neftin <sasha.neftin(a)intel.com>
e1000e: fix the use of magic numbers for buffer overrun issue
Don Hiatt <don.hiatt(a)intel.com>
IB/hfi1: Do not warn on lid conversions for OPA
Don Hiatt <don.hiatt(a)intel.com>
IB/core: Do not warn on lid conversions for OPA
Sandipan Das <sandipan(a)linux.vnet.ibm.com>
include/linux/compiler-clang.h: handle randomizable anonymous structs
Michel Dänzer <michel.daenzer(a)amd.com>
drm/amdgpu: Set adev->vcn.irq.num_types for VCN
Leo Liu <leo.liu(a)amd.com>
drm/amdgpu: move UVD/VCE and VCN structure out from union
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/edid: Don't send non-zero YQ in AVI infoframe for HDMI 1.x sinks
Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com>
drm/fsl-dcu: Don't set connector DPMS property
Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
drm/fb_helper: Disable all crtc's when initial setup fails.
Rex Zhu <Rex.Zhu(a)amd.com>
drm/amd/pp: fix typecast error in powerplay.
Christian König <christian.koenig(a)amd.com>
drm/ttm: once more fix ttm_buffer_object_transfer
Peter Griffin <peter.griffin(a)linaro.org>
drm/hisilicon: Ensure LDI regs are properly configured.
Jonathan Liu <net147(a)gmail.com>
drm/panel: simple: Add missing panel_simple_unprepare() calls
Roman Kapl <rka(a)sysgo.com>
drm/radeon: fix atombios on big endian
Jyri Sarha <jsarha(a)ti.com>
drm/tilcdc: Precalculate total frametime in tilcdc_crtc_set_mode()
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/vblank: Tune drm_crtc_accurate_vblank_count() WARN down to a debug
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/vblank: Fix flip event vblank count
Michel Dänzer <michel.daenzer(a)amd.com>
drm/ttm: Always and only destroy bo->ttm_resv in ttm_bo_release_list
Christian König <christian.koenig(a)amd.com>
drm/amdgpu: reserve root PD while releasing it
Christian König <christian.koenig(a)amd.com>
dma-buf: make reservation_object_copy_fences rcu save
Christian König <christian.koenig(a)amd.com>
drm/ttm: fix ttm_bo_cleanup_refs_or_queue once more
Ken Wang <Ken.Wang(a)amd.com>
drm/amdgpu: Remove check which is not valid for certain VBIOS
ozeng <oak.zeng(a)amd.com>
drm/amdgpu: Properly allocate VM invalidate eng v2
Christian König <christian.koenig(a)amd.com>
drm/amdgpu: fix error handling in amdgpu_bo_do_create
Ken Wang <Ken.Wang(a)amd.com>
drm/amdgpu: correct reference clock value on vega10
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/amdgpu: Potential uninitialized variable in amdgpu_vm_update_directories()
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs()
Alex Deucher <alexander.deucher(a)amd.com>
Revert "drm/radeon: dont switch vt on suspend"
Jeff Lien <jeff.lien(a)wdc.com>
nvme-pci: add quirk for delay before CHK RDY for WDC SN200
Peter Rosin <peda(a)axentia.se>
hwmon: (jc42) optionally try to disable the SMBUS timeout
Rui Hua <huarui.dev(a)gmail.com>
bcache: recover data from backing when data is clean
Coly Li <colyli(a)suse.de>
bcache: only permit to recovery read error when cache device is clean
Huacai Chen <chenhc(a)lemote.com>
bcache: Fix building error on MIPS
Vaibhav Jain <vaibhav(a)linux.vnet.ibm.com>
cxl: Check if vphb exists before iterating over AFU devices
Hans de Goede <hdegoede(a)redhat.com>
i2c: i801: Fix Failed to allocate irq -2147483648 error
Heiner Kallweit <hkallweit1(a)gmail.com>
eeprom: at24: check at24_read/write arguments
Bartosz Golaszewski <brgl(a)bgdev.pl>
eeprom: at24: correctly set the size for at24mac402
Heiner Kallweit <hkallweit1(a)gmail.com>
eeprom: at24: fix reading from 24MAC402/24MAC602
Lv Zheng <lv.zheng(a)intel.com>
ACPI / EC: Fix regression related to PM ops support in ECDT device
Bastian Stender <bst(a)pengutronix.de>
mmc: core: prepend 0x to OCR entry in sysfs
Bastian Stender <bst(a)pengutronix.de>
mmc: core: prepend 0x to pre_eol_info entry in sysfs
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Ensure that debugfs files are removed
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: core: Do not leave the block driver in a suspended state
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Check return value of blk_get_request()
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: block: Fix missing blk_put_request()
Ulf Hansson <ulf.hansson(a)linaro.org>
mmc: sdhci: Avoid swiotlb buffer being full
Dr. David Alan Gilbert <dgilbert(a)redhat.com>
KVM: lapic: Fixup LDR on load in x2apic
Dr. David Alan Gilbert <dgilbert(a)redhat.com>
KVM: lapic: Split out x2apic ldr calculation
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: inject exceptions produced by x86_decode_insn
Liran Alon <liran.alon(a)oracle.com>
KVM: x86: Exit to user-mode on #UD intercept when emulator requires
Liran Alon <liran.alon(a)oracle.com>
KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/kexec: Fix kexec/kdump in P9 guest kernels
Mahesh Salgaonkar <mahesh(a)linux.vnet.ibm.com>
powerpc/powernv: Fix kexec crashes caused by tlbie tracing
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
arm64: ftrace: emit ftrace-mod.o contents through code
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
arm64: module-plts: factor out PLT generation code for ftrace
John Johansen <john.johansen(a)canonical.com>
apparmor: fix oops in audit_signal_cb hook
Peter Ujfalusi <peter.ujfalusi(a)ti.com>
omapdrm: hdmi4: Correct the SoC revision matching
Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
drm: omapdrm: Fix DPI on platforms using the DSI VDDS
Martin Schwidefsky <schwidefsky(a)de.ibm.com>
s390: revert ELF_ET_DYN_BASE base changes
Vasily Averin <vvs(a)virtuozzo.com>
lockd: lost rollback of set_grace_period() in lockd_down_net()
Ondrej Mosnáček <omosnacek(a)gmail.com>
crypto: skcipher - Fix skcipher_walk_aead_common
Stephan Mueller <smueller(a)chronox.de>
crypto: af_alg - remove locking in async callback
Stephan Mueller <smueller(a)chronox.de>
crypto: algif_aead - skip SGL entries with NULL page
Naofumi Honda <honda(a)math.sci.hokudai.ac.jp>
nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat
Trond Myklebust <trond.myklebust(a)primarydata.com>
nfsd: Fix another OPEN stateid race
Trond Myklebust <trond.myklebust(a)primarydata.com>
nfsd: Fix stateid races between OPEN and CLOSE
Josef Bacik <jbacik(a)fb.com>
btrfs: clear space cache inode generation always
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm/hugetlb: fix NULL-pointer dereference on 5-level paging machine
Ian Kent <raven(a)themaw.net>
autofs: revert "autofs: fix AT_NO_AUTOMOUNT not being honored"
Ian Kent <raven(a)themaw.net>
autofs: revert "autofs: take more care to not update last_used on path walk"
OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp>
fs/fat/inode.c: fix sb_rdonly() change
Shakeel Butt <shakeelb(a)google.com>
mm, memcg: fix mem_cgroup_swapout() for THPs
Zi Yan <zi.yan(a)cs.rutgers.edu>
mm: migrate: fix an incorrect call of prep_transhuge_page()
chenjie <chenjie6(a)huawei.com>
mm/madvise.c: fix madvise() infinite loop under special circumstances
Kees Cook <keescook(a)chromium.org>
exec: avoid RLIMIT_STACK races with prlimit()
Dan Williams <dan.j.williams(a)intel.com>
IB/core: disable memory registration of filesystem-dax vmas
Dan Williams <dan.j.williams(a)intel.com>
v4l2: disable filesystem-dax mapping support
Dan Williams <dan.j.williams(a)intel.com>
mm: fail get_vaddr_frames() for filesystem-dax mappings
Dan Williams <dan.j.williams(a)intel.com>
mm: introduce get_user_pages_longterm
Dan Williams <dan.j.williams(a)intel.com>
device-dax: implement ->split() to catch invalid munmap attempts
Dan Williams <dan.j.williams(a)intel.com>
mm, hugetlbfs: introduce ->split() to vm_operations_struct
Dan Williams <dan.j.williams(a)intel.com>
mm: fix device-dax pud write-faults triggered by get_user_pages()
Mike Kravetz <mike.kravetz(a)oracle.com>
mm/cma: fix alloc_contig_range ret code/potential leak
Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
Wang Nan <wangnan0(a)huawei.com>
mm, oom_reaper: gather each vma to prevent leaking TLB entry
Michal Hocko <mhocko(a)suse.com>
mm, memory_hotplug: do not back off draining pcp free pages from kworker context
Stefan Brüns <stefan.bruens(a)rwth-aachen.de>
platform/x86: hp-wmi: Fix tablet mode detection for convertibles
-------------
Diffstat:
Documentation/devicetree/bindings/hwmon/jc42.txt | 4 +
Makefile | 4 +-
arch/arm64/Makefile | 3 -
arch/arm64/include/asm/module.h | 46 +++++++++-
arch/arm64/kernel/Makefile | 3 -
arch/arm64/kernel/ftrace-mod.S | 18 ----
arch/arm64/kernel/ftrace.c | 14 +--
arch/arm64/kernel/module-plts.c | 50 +++--------
arch/arm64/kernel/module.lds | 1 +
arch/powerpc/kernel/misc_64.S | 2 +
arch/powerpc/mm/hash_native_64.c | 15 +++-
arch/s390/include/asm/elf.h | 15 ++--
arch/x86/entry/entry_64.S | 10 +--
arch/x86/include/asm/pgtable.h | 6 ++
arch/x86/kvm/lapic.c | 12 ++-
arch/x86/kvm/svm.c | 2 +
arch/x86/kvm/vmx.c | 2 +
arch/x86/kvm/x86.c | 5 ++
crypto/af_alg.c | 21 +++--
crypto/algif_aead.c | 56 +++++++-----
crypto/algif_skcipher.c | 23 ++---
crypto/skcipher.c | 3 +
drivers/acpi/ec.c | 69 +++++++++------
drivers/acpi/internal.h | 1 +
drivers/acpi/scan.c | 21 +++++
drivers/dax/device.c | 12 +++
drivers/dma-buf/reservation.c | 56 +++++++++---
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 20 ++---
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 38 ++++-----
drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 6 --
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 15 +++-
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 15 +++-
drivers/gpu/drm/amd/amdgpu/soc15.c | 5 +-
drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
.../amd/powerplay/hwmgr/process_pptables_v1_0.c | 4 +-
drivers/gpu/drm/drm_edid.c | 12 ++-
drivers/gpu/drm/drm_fb_helper.c | 4 +
drivers/gpu/drm/drm_vblank.c | 6 +-
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c | 5 --
drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c | 3 +
drivers/gpu/drm/i915/gvt/gtt.c | 6 +-
drivers/gpu/drm/i915/i915_drv.c | 2 +
drivers/gpu/drm/i915/intel_fbdev.c | 10 ++-
drivers/gpu/drm/i915/intel_hdmi.c | 3 +-
drivers/gpu/drm/i915/intel_i2c.c | 4 +-
drivers/gpu/drm/i915/intel_uncore.c | 13 +++
drivers/gpu/drm/i915/intel_uncore.h | 1 +
drivers/gpu/drm/omapdrm/dss/dpi.c | 4 +-
drivers/gpu/drm/omapdrm/dss/hdmi4_core.c | 23 +++--
drivers/gpu/drm/panel/panel-simple.c | 2 +
drivers/gpu/drm/radeon/atombios_dp.c | 38 ++++-----
drivers/gpu/drm/radeon/radeon_fb.c | 1 -
drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 13 ++-
drivers/gpu/drm/ttm/ttm_bo.c | 43 +++++-----
drivers/gpu/drm/ttm/ttm_bo_util.c | 1 +
drivers/gpu/drm/vc4/vc4_hdmi.c | 3 +-
drivers/hwmon/jc42.c | 21 +++++
drivers/i2c/busses/i2c-i801.c | 3 +
drivers/infiniband/core/umem.c | 2 +-
drivers/infiniband/core/user_mad.c | 11 ++-
drivers/infiniband/hw/hfi1/mad.c | 7 +-
drivers/md/bcache/alloc.c | 2 +-
drivers/md/bcache/extents.c | 2 +-
drivers/md/bcache/journal.c | 2 +-
drivers/md/bcache/request.c | 9 +-
drivers/md/bitmap.c | 6 ++
drivers/md/md.c | 2 +-
drivers/md/raid5.c | 7 ++
drivers/media/v4l2-core/videobuf-dma-sg.c | 5 +-
drivers/misc/cxl/pci.c | 12 ++-
drivers/misc/eeprom/at24.c | 19 ++++-
drivers/mmc/core/block.c | 67 +++++++++++++--
drivers/mmc/core/bus.c | 3 +
drivers/mmc/core/debugfs.c | 1 +
drivers/mmc/core/mmc.c | 4 +-
drivers/mmc/core/sd.c | 2 +-
drivers/mmc/host/sdhci.c | 28 +++---
drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +-
drivers/net/ethernet/intel/e1000e/netdev.c | 9 +-
drivers/nvme/host/nvme.h | 2 +-
drivers/nvme/host/pci.c | 2 +
drivers/platform/x86/hp-wmi.c | 2 +-
fs/autofs4/root.c | 17 ++--
fs/btrfs/extent-tree.c | 14 +--
fs/exec.c | 7 +-
fs/fat/inode.c | 2 +-
fs/lockd/svc.c | 2 +
fs/namei.c | 15 +---
fs/nfsd/nfs4state.c | 99 ++++++++++++++++------
include/acpi/acpi_bus.h | 1 +
include/acpi/acpi_drivers.h | 1 +
include/asm-generic/pgtable.h | 8 ++
include/crypto/if_alg.h | 1 +
include/drm/drm_edid.h | 3 +-
include/linux/compiler-clang.h | 3 +
include/linux/fs.h | 17 +++-
include/linux/hugetlb.h | 8 --
include/linux/migrate.h | 2 +-
include/linux/mm.h | 14 +++
include/uapi/linux/bcache.h | 2 +-
mm/frame_vector.c | 12 +++
mm/gup.c | 64 ++++++++++++++
mm/huge_memory.c | 36 +++-----
mm/hugetlb.c | 12 ++-
mm/madvise.c | 4 +-
mm/memcontrol.c | 2 +-
mm/mmap.c | 8 +-
mm/oom_kill.c | 7 +-
mm/page_alloc.c | 13 +--
security/apparmor/include/audit.h | 12 +--
112 files changed, 958 insertions(+), 445 deletions(-)
0-day reported this build error:
arch/x86/boot/compressed/pgtable_64.o: In function `l5_paging_required':
pgtable_64.c:(.text+0x22): undefined reference to `__force_order'
The issue is only with GCC < 5 and when KASLR is disabled. Newer GCC
works fine.
__force_order is used by special_insns.h asm code to force instruction
serialization.
It doesn't actually referenced from the code, but GCC < 5 with -fPIE
would still generate undefined symbol.
I didn't noticed this before and failed to move __force_order definition
from pagetable.c (which compiles only with KASLR enabled) to
pgtable_64.c.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Fixes: 10c9a5346f72 ("x86/boot/compressed/64: Detect and handle 5-level paging at boot-time")
Cc: stable(a)vger.kernel.org
---
arch/x86/boot/compressed/pagetable.c | 3 ---
arch/x86/boot/compressed/pgtable_64.c | 11 +++++++++++
2 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/arch/x86/boot/compressed/pagetable.c b/arch/x86/boot/compressed/pagetable.c
index 6bd51de4475c..250826ac216e 100644
--- a/arch/x86/boot/compressed/pagetable.c
+++ b/arch/x86/boot/compressed/pagetable.c
@@ -38,9 +38,6 @@
#define __PAGE_OFFSET __PAGE_OFFSET_BASE
#include "../../mm/ident_map.c"
-/* Used by pgtable.h asm code to force instruction serialization. */
-unsigned long __force_order;
-
/* Used to track our page table allocation area. */
struct alloc_pgt_data {
unsigned char *pgt_buf;
diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
index 7bcf03b376da..491fa2d08bca 100644
--- a/arch/x86/boot/compressed/pgtable_64.c
+++ b/arch/x86/boot/compressed/pgtable_64.c
@@ -1,5 +1,16 @@
#include <asm/processor.h>
+/*
+ * __force_order is used by special_insns.h asm code to force instruction
+ * serialization.
+ *
+ * It doesn't actually referenced from the code, but GCC < 5 with -fPIE
+ * would still generate undefined symbol.
+ *
+ * Let's workaround this by defining the variable.
+ */
+unsigned long __force_order;
+
int l5_paging_required(void)
{
/* Check if leaf 7 is supported. */
--
2.15.0
On Wed, 2017-12-06 at 00:17 +0300, ptikhomirov wrote:
> I mean threads in scsi_dec_host_busy() the part under rcu_read_lock are
> divided into two groups: a) finished before call_rcu, b) beginning rcu
> section after call_rcu. So first, in scsi_eh_inc_host_failed() we will
> see all changes to host busy from group (a), second, all threads in group
> (b) will see our change to host_failed. Either there is nobody in (b) and
> we will start EH, or the thread from (b) which entered spin_lock last will
> start EH.
>
> In your case tasks from b does not see host_failed was incremented, and
> will not start EH.
Hello Pavel,
What does "your case" mean? In my previous e-mail I explained a scenario that
cannot happen so it's not clear to me what "your case" refers to?
Additionally, it seems like you are assuming that RCU guarantees ordering of
RCU read-locked sections against call_rcu()? That's not how RCU works. RCU
guarantees serialization of read-locked sections against grace periods. The
function scsi_eh_inc_host_failed() is invoked through call_rcu() and hence
will be called during a grace period.
Anyway, the different scenarios I see are as follows:
(a) scsi_dec_host_busy() finishes before scsi_eh_inc_host_failed() starts.
(b) scsi_dec_host_busy() starts after scsi_eh_inc_host_failed() has
finished.
In case (a) scsi_eh_inc_host_failed() will wake up the error handler. And in
case (b) scsi_dec_host_busy() will wake up the error handler. So it's not
clear to me why you think that there is a scenario in which the EH won't be
woken up?
Bart.
The patch titled
Subject: fs/proc/kcore.c: use probe_kernel_read() instead of memcpy()
has been added to the -mm tree. Its filename is
fs-proc-kcorec-use-probe_kernel_read-instead-of-memcpy.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/fs-proc-kcorec-use-probe_kernel_re…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/fs-proc-kcorec-use-probe_kernel_re…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Heiko Carstens <heiko.carstens(a)de.ibm.com>
Subject: fs/proc/kcore.c: use probe_kernel_read() instead of memcpy()
df04abfd181a ("fs/proc/kcore.c: Add bounce buffer for ktext data") added a
bounce buffer to avoid hardened usercopy checks. Copying to the bounce
buffer was implemented with a simple memcpy() assuming that it is always
valid to read from kernel memory iff the kern_addr_valid() check passed.
A simple, but pointless, test case like "dd if=/proc/kcore of=/dev/null"
now can easily crash the kernel, since the former execption handling on
invalid kernel addresses now doesn't work anymore.
Also adding a kern_addr_valid() implementation wouldn't help here. Most
architectures simply return 1 here, while a couple implemented a page
table walk to figure out if something is mapped at the address in
question.
With DEBUG_PAGEALLOC active mappings are established and removed all the
time, so that relying on the result of kern_addr_valid() before executing
the memcpy() also doesn't work.
Therefore simply use probe_kernel_read() to copy to the bounce buffer.
This also allows to simplify read_kcore().
At least on s390 this fixes the observed crashes and doesn't introduce
warnings that were removed with df04abfd181a ("fs/proc/kcore.c: Add bounce
buffer for ktext data"), even though the generic probe_kernel_read()
implementation uses uaccess functions.
While looking into this I'm also wondering if kern_addr_valid() could be
completely removed...(?)
Link: http://lkml.kernel.org/r/20171202132739.99971-1-heiko.carstens@de.ibm.com
Fixes: df04abfd181a ("fs/proc/kcore.c: Add bounce buffer for ktext data")
Fixes: f5509cc18daa ("mm: Hardened usercopy")
Signed-off-by: Heiko Carstens <heiko.carstens(a)de.ibm.com>
Acked-by: Kees Cook <keescook(a)chromium.org>
Cc: Jiri Olsa <jolsa(a)kernel.org>
Cc: Al Viro <viro(a)ZenIV.linux.org.uk>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/proc/kcore.c | 18 +++++-------------
1 file changed, 5 insertions(+), 13 deletions(-)
diff -puN fs/proc/kcore.c~fs-proc-kcorec-use-probe_kernel_read-instead-of-memcpy fs/proc/kcore.c
--- a/fs/proc/kcore.c~fs-proc-kcorec-use-probe_kernel_read-instead-of-memcpy
+++ a/fs/proc/kcore.c
@@ -512,23 +512,15 @@ read_kcore(struct file *file, char __use
return -EFAULT;
} else {
if (kern_addr_valid(start)) {
- unsigned long n;
-
/*
* Using bounce buffer to bypass the
* hardened user copy kernel text checks.
*/
- memcpy(buf, (char *) start, tsz);
- n = copy_to_user(buffer, buf, tsz);
- /*
- * We cannot distinguish between fault on source
- * and fault on destination. When this happens
- * we clear too and hope it will trigger the
- * EFAULT again.
- */
- if (n) {
- if (clear_user(buffer + tsz - n,
- n))
+ if (probe_kernel_read(buf, (void *) start, tsz)) {
+ if (clear_user(buffer, tsz))
+ return -EFAULT;
+ } else {
+ if (copy_to_user(buffer, buf, tsz))
return -EFAULT;
}
} else {
_
Patches currently in -mm which might be from heiko.carstens(a)de.ibm.com are
fs-proc-kcorec-use-probe_kernel_read-instead-of-memcpy.patch
Please consider backporting the following commit to 4.14:
commit 094009531612246d9e13f9e0c3ae2205d7f63a0a
Author: Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
Date: Tue Nov 14 14:21:32 2017 +0100
ipv6: set all.accept_dad to 0 by default
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
This fixes a regression introduced in 4.14 that has since been fixed in
mainline.
Thanks,
Dan
From: James Hogan <jhogan(a)kernel.org>
Since commit 68923cdc2eb3 ("MIPS: CM: Add cluster & block args to
mips_cm_lock_other()"), mips_smp_send_ipi_mask() has used
mips_cm_lock_other_cpu() with each CPU number, rather than
mips_cm_lock_other() with the first VPE in each core. Prior to r6,
multicore multithreaded systems such as dual-core dual-thread
interAptivs with CPU Idle enabled (e.g. MIPS Creator Ci40) results in
mips_cm_lock_other() repeatedly hitting WARN_ON(vp != 0).
There doesn't appear to be anything fundamentally wrong about passing a
non-zero VP/VPE number, even if it is a core's region that is locked
into the other region before r6, so remove that particular WARN_ON().
Fixes: 68923cdc2eb3 ("MIPS: CM: Add cluster & block args to mips_cm_lock_other()")
Signed-off-by: James Hogan <jhogan(a)kernel.org>
Reviewed-by: Paul Burton <paul.burton(a)mips.com>
Cc: Ralf Baechle <ralf(a)linux-mips.org>
Cc: linux-mips(a)linux-mips.org
Cc: <stable(a)vger.kernel.org> # 4.14+
---
arch/mips/kernel/mips-cm.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
index dd5567b1e305..8f5bd04f320a 100644
--- a/arch/mips/kernel/mips-cm.c
+++ b/arch/mips/kernel/mips-cm.c
@@ -292,7 +292,6 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core,
*this_cpu_ptr(&cm_core_lock_flags));
} else {
WARN_ON(cluster != 0);
- WARN_ON(vp != 0);
WARN_ON(block != CM_GCR_Cx_OTHER_BLOCK_LOCAL);
/*
--
2.14.1