December 2018 - Linux-stable-mirror

patch "staging: wilc1000: fix missing read_write setting when reading data" added to staging-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: wilc1000: fix missing read_write setting when reading data to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From c58eef061dda7d843dcc0ad6fea7e597d4c377c0 Mon Sep 17 00:00:00 2001 From: Colin Ian King <colin.king(a)canonical.com> Date: Wed, 19 Dec 2018 16:30:07 +0000 Subject: staging: wilc1000: fix missing read_write setting when reading data Currently the cmd.read_write setting is not initialized so it contains garbage from the stack. Fix this by setting it to 0 to indicate a read is required. Detected by CoverityScan, CID#1357925 ("Uninitialized scalar variable") Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Signed-off-by: Colin Ian King <colin.king(a)canonical.com> Cc: stable <stable(a)vger.kernel.org> Acked-by: Ajay Singh <ajay.kathat(a)microchip.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/wilc1000/wilc_sdio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/staging/wilc1000/wilc_sdio.c b/drivers/staging/wilc1000/wilc_sdio.c index 27fdfbdda5c0..e2f739fef21c 100644 --- a/drivers/staging/wilc1000/wilc_sdio.c +++ b/drivers/staging/wilc1000/wilc_sdio.c @@ -861,6 +861,7 @@ static int sdio_read_int(struct wilc *wilc, u32 *int_status) if (!sdio_priv->irq_gpio) { int i; + cmd.read_write = 0; cmd.function = 1; cmd.address = 0x04; cmd.data = 0; -- 2.20.1

6 years

1
0
0 0

[PATCH 4.19 00/67] 4.19.12-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.12 release. There are 67 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Dec 22 08:58:49 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.12-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.12-rc1 Omar Sandoval <osandov(a)fb.com> Btrfs: fix missing delayed iputs on unmount Israel Rukshin <israelr(a)mellanox.com> nvmet-rdma: fix response use after free James Smart <jsmart2021(a)gmail.com> nvme: validate controller state before rescheduling keep alive Masahiro Yamada <yamada.masahiro(a)socionext.com> i2c: uniphier-f: fix violation of tLOW requirement for Fast-mode Masahiro Yamada <yamada.masahiro(a)socionext.com> i2c: uniphier: fix violation of tLOW requirement for Fast-mode Hans de Goede <hdegoede(a)redhat.com> i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node Adamski, Krzysztof (Nokia - PL/Wroclaw) <krzysztof.adamski(a)nokia.com> i2c: axxia: properly handle master timeout Ido Schimmel <idosch(a)mellanox.com> mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl Stefan Hajnoczi <stefanha(a)redhat.com> vhost/vsock: fix reset orphans race with close timeout Steve French <stfrench(a)microsoft.com> cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs) Sam Bobroff <sbobroff(a)linux.ibm.com> drm/ast: Fix connector leak during driver unload Dan Williams <dan.j.williams(a)intel.com> acpi/nfit: Fix user-initiated ARS to be "ARS-long" rather than "ARS-short" Dan Williams <dan.j.williams(a)intel.com> tools/testing/nvdimm: Align test resources to 128M James Zhu <James.Zhu(a)amd.com> drm/amdgpu/vcn: Update vcn.cur_state during suspend Baruch Siach <baruch(a)tkos.co.il> net: mvpp2: fix phylink handling of invalid PHY modes Baruch Siach <baruch(a)tkos.co.il> net: mvpp2: fix detection of 10G SFP modules Russell King <rmk+kernel(a)armlinux.org.uk> thermal: armada: fix legacy validity test sense Nicolas Saenz Julienne <nsaenzjulienne(a)suse.de> ethernet: fman: fix wrong of_node_put() in probe function Nathan Jones <nathanj439(a)gmail.com> ARM: 8816/1: dma-mapping: fix potential uninitialized return Vladimir Murzin <vladimir.murzin(a)arm.com> ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart Chris Cole <chris(a)sageembedded.com> ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling Alexei Starovoitov <ast(a)kernel.org> bpf: check pending signals while verifying programs Saeed Mahameed <saeedm(a)mellanox.com> net/mlx4_en: Fix build break when CONFIG_INET is off Anderson Luiz Alves <alacn1(a)gmail.com> mv88e6060: disable hardware level MAC learning Matteo Croce <mcroce(a)redhat.com> macvlan: return correct error value Juha-Matti Tilli <juha-matti.tilli(a)iki.fi> libata: whitelist all SAMSUNG MZ7KM* solid-state disks Tony Lindgren <tony(a)atomide.com> Input: omap-keypad - fix keyboard debounce configuration Teika Kazura <teika(a)gmx.com> Input: synaptics - enable SMBus for HP 15-ay000 Dan Carpenter <dan.carpenter(a)oracle.com> clk: mmp: Off by one in mmp_clk_add() Dan Carpenter <dan.carpenter(a)oracle.com> clk: mvebu: Off by one bugs in cp110_of_clk_get() Evan Quan <evan.quan(a)amd.com> drm/amd/powerplay: issue pre-display settings for display change event Wen Yang <wen.yang99(a)zte.com.cn> drm/msm: Fix error return checking YueHaibing <yuehaibing(a)huawei.com> drm/msm: dpu: Fix "WARNING: invalid free of devm_ allocated data" Sean Paul <seanpaul(a)chromium.org> drm/msm: dpu: Don't set legacy plane->crtc pointer Todor Tomov <todor.tomov(a)linaro.org> drm/msm/hdmi: Enable HPD after HDMI IRQ is set up Yangtao Li <tiny.windzz(a)gmail.com> ide: pmac: add of_node_put() Yangtao Li <tiny.windzz(a)gmail.com> drivers/tty: add missing of_node_put() Yangtao Li <tiny.windzz(a)gmail.com> drivers/sbus/char: add of_node_put() Yangtao Li <tiny.windzz(a)gmail.com> sbus: char: add of_node_put() Trond Myklebust <trond.myklebust(a)hammerspace.com> SUNRPC: Fix a potential race in xprt_connect() Dave Kleikamp <dave.kleikamp(a)oracle.com> nfs: don't dirty kernel pages read by direct-io Pan Bian <bianpan2016(a)163.com> liquidio: read sc->iq_no before release sc David Miller <davem(a)davemloft.net> bpf: Fix verifier log string check for bad alignment. Toni Peltonen <peltzi(a)peltzi.fi> bonding: fix 802.3ad state sent to partner when unbinding slave Dmitry Bogdanov <dmitry.bogdanov(a)aquantia.com> net: aquantia: fix rx checksum offload bits Thierry Reding <treding(a)nvidia.com> net: stmmac: Move debugfs init/exit to ->probe()/->remove() Jose Abreu <joabreu(a)synopsys.com> ARC: io.h: Implement reads{x}()/writes{x}() Christian König <christian.koenig(a)amd.com> drm/amdgpu: wait for IB test on first device open Christian König <christian.koenig(a)amd.com> drm/ttm: fix LRU handling in ttm_buffer_object_transfer Sean Paul <seanpaul(a)chromium.org> drm/msm: Grab a vblank reference when waiting for commit_done Abhinav Kumar <abhinavk(a)codeaurora.org> drm/msm/dsi: configure VCO rate for 10nm PLL driver Rob Clark <robdclark(a)gmail.com> drm/msm: fix handling of cmdstream offset Dan Carpenter <dan.carpenter(a)oracle.com> drm/msm/gpu: Fix a couple memory leaks in debugfs Sharat Masetty <smasetty(a)codeaurora.org> drm/msm: Fix task dump in gpu recovery YiFei Zhu <zhuyifei1999(a)gmail.com> x86/earlyprintk/efi: Fix infinite loop on some screen widths Roman Li <Roman.Li(a)amd.com> drm/amd/display: Fix 6x4K displays light-up on Vega20 (v2) Kunihiko Hayashi <hayashi.kunihiko(a)socionext.com> net: ethernet: ave: Replace NET_IP_ALIGN with AVE_FRAME_HEADROOM Yonghong Song <yhs(a)fb.com> tools/bpf: add addition type tests to test_btf Martin KaFai Lau <kafai(a)fb.com> tools/bpf: fix two test_btf unit test cases Cathy Avery <cavery(a)redhat.com> scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload Fred Herard <fred.herard(a)oracle.com> scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: rcar: check bus state before reinitializing Vitaly Kuznetsov <vkuznets(a)redhat.com> Input: hyper-v - fix wakeup from suspend-to-idle Alexey Khoroshilov <khoroshilov(a)ispras.ru> mac80211_hwsim: fix module init error paths for netlink Michael J. Ruhl <michael.j.ruhl(a)intel.com> IB/hfi1: Remove race conditions in user_sdma send path Peter Zijlstra <peterz(a)infradead.org> locking/qspinlock, x86: Provide liveness guarantee Peter Zijlstra <peterz(a)infradead.org> locking/qspinlock: Re-order code ------------- Diffstat: Makefile | 4 +- arch/arc/include/asm/io.h | 72 ++++ arch/arm/mm/cache-v7.S | 8 +- arch/arm/mm/cache-v7m.S | 14 +- arch/arm/mm/dma-mapping.c | 2 +- arch/x86/include/asm/qspinlock.h | 21 ++ arch/x86/platform/efi/early_printk.c | 2 +- drivers/acpi/nfit/core.c | 2 +- drivers/ata/libata-core.c | 1 + drivers/clk/mmp/clk.c | 2 +- drivers/clk/mvebu/cp110-system-controller.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 6 +- drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 3 +- .../amd/display/dc/dce110/dce110_hw_sequencer.c | 2 + drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c | 3 + drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c | 2 - drivers/gpu/drm/ast/ast_fb.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 1 - drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 - drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 4 +- drivers/gpu/drm/msm/hdmi/hdmi.c | 6 + drivers/gpu/drm/msm/hdmi/hdmi.h | 1 + drivers/gpu/drm/msm/hdmi/hdmi_connector.c | 10 +- drivers/gpu/drm/msm/msm_atomic.c | 5 + drivers/gpu/drm/msm/msm_debugfs.c | 15 +- drivers/gpu/drm/msm/msm_gpu.c | 9 +- drivers/gpu/drm/msm/msm_iommu.c | 2 +- drivers/gpu/drm/msm/msm_rd.c | 5 +- drivers/gpu/drm/ttm/ttm_bo_util.c | 4 +- drivers/hid/hid-hyperv.c | 2 +- drivers/i2c/busses/i2c-axxia.c | 40 ++- drivers/i2c/busses/i2c-rcar.c | 9 +- drivers/i2c/busses/i2c-scmi.c | 10 +- drivers/i2c/busses/i2c-uniphier-f.c | 19 +- drivers/i2c/busses/i2c-uniphier.c | 8 +- drivers/ide/pmac.c | 1 + drivers/infiniband/hw/hfi1/user_sdma.c | 24 +- drivers/infiniband/hw/hfi1/user_sdma.h | 9 +- drivers/input/keyboard/omap4-keypad.c | 18 +- drivers/input/mouse/synaptics.c | 1 + drivers/input/serio/hyperv-keyboard.c | 2 +- drivers/net/bonding/bond_3ad.c | 3 + drivers/net/dsa/mv88e6060.c | 10 +- .../ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 2 +- drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c | 4 +- drivers/net/ethernet/freescale/fman/fman.c | 5 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 34 +- drivers/net/ethernet/mellanox/mlx4/Kconfig | 2 +- .../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 10 +- drivers/net/ethernet/socionext/sni_ave.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 23 +- drivers/net/macvlan.c | 7 +- drivers/net/wireless/mac80211_hwsim.c | 12 +- drivers/nvme/host/core.c | 10 +- drivers/nvme/target/rdma.c | 3 +- drivers/sbus/char/display7seg.c | 1 + drivers/sbus/char/envctrl.c | 2 + drivers/scsi/libiscsi.c | 4 +- drivers/scsi/vmw_pvscsi.c | 4 +- drivers/thermal/armada_thermal.c | 2 +- drivers/tty/serial/suncore.c | 1 + drivers/vhost/vsock.c | 22 +- fs/btrfs/disk-io.c | 51 +-- fs/cifs/Kconfig | 2 +- fs/nfs/direct.c | 9 +- kernel/bpf/verifier.c | 3 + kernel/locking/qspinlock.c | 71 ++-- net/sunrpc/xprt.c | 11 +- tools/testing/nvdimm/test/nfit.c | 35 +- tools/testing/selftests/bpf/test_btf.c | 375 ++++++++++++++++++++- tools/testing/selftests/bpf/test_verifier.c | 2 +- 71 files changed, 868 insertions(+), 222 deletions(-)

6 years

4
73
0 0

[PATCH 4.4 00/40] 4.4.169-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.4.169 release. There are 40 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Dec 22 08:58:16 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.169-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.4.169-rc1 Dan Carpenter <dan.carpenter(a)oracle.com> ALSA: isa/wavefront: prevent some out of bound writes Trent Piepho <tpiepho(a)impinj.com> rtc: snvs: Add timeouts to avoid kernel lockups Guy Shapiro <guy.shapiro(a)mobi-wize.com> rtc: snvs: add a missing write sync Hans de Goede <hdegoede(a)redhat.com> i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node Adamski, Krzysztof (Nokia - PL/Wroclaw) <krzysztof.adamski(a)nokia.com> i2c: axxia: properly handle master timeout Steve French <stfrench(a)microsoft.com> cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs) Chris Cole <chris(a)sageembedded.com> ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling Anderson Luiz Alves <alacn1(a)gmail.com> mv88e6060: disable hardware level MAC learning Juha-Matti Tilli <juha-matti.tilli(a)iki.fi> libata: whitelist all SAMSUNG MZ7KM* solid-state disks Tony Lindgren <tony(a)atomide.com> Input: omap-keypad - fix keyboard debounce configuration Dan Carpenter <dan.carpenter(a)oracle.com> clk: mmp: Off by one in mmp_clk_add() Yangtao Li <tiny.windzz(a)gmail.com> ide: pmac: add of_node_put() Yangtao Li <tiny.windzz(a)gmail.com> drivers/tty: add missing of_node_put() Yangtao Li <tiny.windzz(a)gmail.com> drivers/sbus/char: add of_node_put() Yangtao Li <tiny.windzz(a)gmail.com> sbus: char: add of_node_put() Trond Myklebust <trond.myklebust(a)hammerspace.com> SUNRPC: Fix a potential race in xprt_connect() Toni Peltonen <peltzi(a)peltzi.fi> bonding: fix 802.3ad state sent to partner when unbinding slave Jose Abreu <joabreu(a)synopsys.com> ARC: io.h: Implement reads{x}()/writes{x}() Sean Paul <seanpaul(a)chromium.org> drm/msm: Grab a vblank reference when waiting for commit_done YiFei Zhu <zhuyifei1999(a)gmail.com> x86/earlyprintk/efi: Fix infinite loop on some screen widths Cathy Avery <cavery(a)redhat.com> scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload Fred Herard <fred.herard(a)oracle.com> scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset Alexey Khoroshilov <khoroshilov(a)ispras.ru> mac80211_hwsim: fix module init error paths for netlink Ilan Peer <ilan.peer(a)intel.com> mac80211: Fix condition validating WMM IE Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> mac80211: don't WARN on bad WMM parameters from buggy APs Yunlei He <heyunlei(a)huawei.com> f2fs: fix a panic caused by NULL flush_cmd_control Brian Norris <briannorris(a)chromium.org> Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec" Radu Rendec <radu.rendec(a)gmail.com> powerpc/msi: Fix NULL pointer access in teardown code Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Fix memory leak of instance function hash filters Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Fix memory leak in set_trigger_filter() Aaro Koskinen <aaro.koskinen(a)iki.fi> MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310 Jeff Moyer <jmoyer(a)redhat.com> aio: fix spectre gadget in lookup_ioctx Chen-Yu Tsai <wens(a)csie.org> pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11 Guenter Roeck <linux(a)roeck-us.net> powerpc/boot: Fix random libfdt related build errors Ingo Molnar <mingo(a)kernel.org> timer/debug: Change /proc/timer_list from 0444 to 0400 Davidlohr Bueso <dave(a)stgolabs.net> lib/interval_tree_test.c: allow users to limit scope of endpoint Davidlohr Bueso <dave(a)stgolabs.net> lib/rbtree-test: lower default params Davidlohr Bueso <dave(a)stgolabs.net> lib/rbtree_test.c: make input module parameters Davidlohr Bueso <dave(a)stgolabs.net> lib/interval_tree_test.c: allow full tree search Davidlohr Bueso <dave(a)stgolabs.net> lib/interval_tree_test.c: make test options module parameters ------------- Diffstat: Makefile | 4 +- arch/arc/include/asm/io.h | 72 +++++++++++++++++++ arch/arm/mm/cache-v7.S | 8 ++- arch/powerpc/boot/Makefile | 3 +- arch/powerpc/kernel/msi.c | 7 +- arch/x86/platform/efi/early_printk.c | 2 +- drivers/ata/libata-core.c | 1 + drivers/clk/mmp/clk.c | 2 +- drivers/gpu/drm/msm/msm_atomic.c | 5 ++ drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 6 -- drivers/i2c/busses/i2c-axxia.c | 40 ++++++++--- drivers/i2c/busses/i2c-scmi.c | 10 ++- drivers/ide/pmac.c | 1 + drivers/input/keyboard/omap4-keypad.c | 18 +++-- drivers/mmc/host/omap.c | 11 ++- drivers/net/bonding/bond_3ad.c | 3 + drivers/net/dsa/mv88e6060.c | 10 +-- drivers/net/wireless/mac80211_hwsim.c | 12 ++-- drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 2 +- drivers/rtc/rtc-snvs.c | 104 +++++++++++++++++++--------- drivers/sbus/char/display7seg.c | 1 + drivers/sbus/char/envctrl.c | 2 + drivers/scsi/libiscsi.c | 4 +- drivers/scsi/vmw_pvscsi.c | 4 +- drivers/tty/serial/suncore.c | 1 + fs/aio.c | 2 + fs/cifs/Kconfig | 2 +- fs/f2fs/segment.c | 5 +- kernel/time/timer_list.c | 2 +- kernel/trace/ftrace.c | 1 + kernel/trace/trace_events_trigger.c | 6 +- lib/interval_tree_test.c | 93 ++++++++++++++++--------- lib/rbtree_test.c | 55 +++++++++------ net/mac80211/mlme.c | 3 +- net/sunrpc/xprt.c | 11 ++- sound/isa/wavefront/wavefront_synth.c | 9 +++ 36 files changed, 376 insertions(+), 146 deletions(-)

6 years

4
43
0 0

[PATCH 3.18 00/31] 3.18.131-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 3.18.131 release. There are 31 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Dec 22 08:57:30 UTC 2018. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.131-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 3.18.131-rc1 Lior David <qca_liord(a)qca.qualcomm.com> wil6210: missing length check in wmi_set_ie Kees Cook <keescook(a)chromium.org> swiotlb: clean up reporting Jens Axboe <axboe(a)kernel.dk> sr: pass down correctly sized SCSI sense buffer Thomas Gleixner <tglx(a)linutronix.de> posix-timers: Sanitize overrun handling Takashi Sakamoto <o-takashi(a)sakamocchi.jp> ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command Dan Carpenter <dan.carpenter(a)oracle.com> ALSA: isa/wavefront: prevent some out of bound writes Hans de Goede <hdegoede(a)redhat.com> i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node Steve French <stfrench(a)microsoft.com> cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs) Chris Cole <chris(a)sageembedded.com> ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling Juha-Matti Tilli <juha-matti.tilli(a)iki.fi> libata: whitelist all SAMSUNG MZ7KM* solid-state disks Tony Lindgren <tony(a)atomide.com> Input: omap-keypad - fix keyboard debounce configuration Yangtao Li <tiny.windzz(a)gmail.com> ide: pmac: add of_node_put() Yangtao Li <tiny.windzz(a)gmail.com> drivers/tty: add missing of_node_put() Yangtao Li <tiny.windzz(a)gmail.com> drivers/sbus/char: add of_node_put() Yangtao Li <tiny.windzz(a)gmail.com> sbus: char: add of_node_put() Trond Myklebust <trond.myklebust(a)hammerspace.com> SUNRPC: Fix a potential race in xprt_connect() Toni Peltonen <peltzi(a)peltzi.fi> bonding: fix 802.3ad state sent to partner when unbinding slave YiFei Zhu <zhuyifei1999(a)gmail.com> x86/earlyprintk/efi: Fix infinite loop on some screen widths Cathy Avery <cavery(a)redhat.com> scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload Fred Herard <fred.herard(a)oracle.com> scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset Benjamin Herrenschmidt <benh(a)kernel.crashing.org> powerpc: Look for "stdout-path" when setting up legacy consoles Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Fix memory leak of instance function hash filters Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Fix memory leak in set_trigger_filter() Aaro Koskinen <aaro.koskinen(a)iki.fi> MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310 Guenter Roeck <linux(a)roeck-us.net> powerpc/boot: Fix random libfdt related build errors Ingo Molnar <mingo(a)kernel.org> timer/debug: Change /proc/timer_list from 0444 to 0400 Davidlohr Bueso <dave(a)stgolabs.net> lib/interval_tree_test.c: allow users to limit scope of endpoint Davidlohr Bueso <dave(a)stgolabs.net> lib/rbtree-test: lower default params Davidlohr Bueso <dave(a)stgolabs.net> lib/rbtree_test.c: make input module parameters Davidlohr Bueso <dave(a)stgolabs.net> lib/interval_tree_test.c: allow full tree search Davidlohr Bueso <dave(a)stgolabs.net> lib/interval_tree_test.c: make test options module parameters ------------- Diffstat: Makefile | 4 +- arch/arm/mm/cache-v7.S | 8 +-- arch/powerpc/boot/Makefile | 3 +- arch/powerpc/kernel/legacy_serial.c | 6 ++- arch/x86/platform/efi/early_printk.c | 2 +- drivers/ata/libata-core.c | 1 + drivers/i2c/busses/i2c-scmi.c | 10 ++-- drivers/ide/pmac.c | 1 + drivers/input/keyboard/omap4-keypad.c | 18 +++++-- drivers/mmc/host/omap.c | 11 +++- drivers/net/bonding/bond_3ad.c | 3 ++ drivers/net/wireless/ath/wil6210/wmi.c | 7 ++- drivers/sbus/char/display7seg.c | 1 + drivers/sbus/char/envctrl.c | 2 + drivers/scsi/libiscsi.c | 4 +- drivers/scsi/sr_ioctl.c | 21 +++----- drivers/scsi/vmw_pvscsi.c | 4 +- drivers/tty/serial/suncore.c | 1 + fs/cifs/Kconfig | 2 +- include/linux/posix-timers.h | 4 +- include/sound/pcm.h | 2 +- kernel/time/posix-cpu-timers.c | 2 +- kernel/time/posix-timers.c | 29 +++++++---- kernel/time/timer_list.c | 2 +- kernel/trace/ftrace.c | 1 + kernel/trace/trace_events_trigger.c | 6 ++- lib/interval_tree_test.c | 93 ++++++++++++++++++++++------------ lib/rbtree_test.c | 55 ++++++++++++-------- lib/swiotlb.c | 18 +++---- net/sunrpc/xprt.c | 11 +++- sound/core/pcm_lib.c | 2 - sound/core/pcm_native.c | 6 +-- sound/isa/wavefront/wavefront_synth.c | 9 ++++ 33 files changed, 224 insertions(+), 125 deletions(-)

6 years

3
33
0 0

[PATCH V2] security/apparmor: fix matching on presence of extended attributes

by Eric Chiang

AppArmor recently added the ability for profiles to match extended attributes, with the intent of targeting "security.ima" and "security.evm" to differentiate between sign and unsigned files. The current implementation uses a path glob to match the extended attribute value. To require the presence of a extended attribute, profiles supply a wildcard: # Match any file with the "security.apparmor" attribute profile test /** xattrs=(security.apparmor="**") { # ... } However, the glob matching implementation is intended for file paths and doesn't handle null characters correctly. It's currently impossible to write a profile that targets IMA and EVM attributes, since the signatures can contain a null byte. Add the ability for AppArmor to check the presence of an extended attribute, and not its value. This fixes the profile matching allowing profiles conditional on EVM and IMA signatures: profile signed_binary /** xattrs=(security.evm security.ima) { # ... } A modified apparmor_parser and associated regression tests to exercise this fix can be found at: https://gitlab.com/ericchiang/apparmor/commits/parser-xattrs-keys Signed-off-by: Eric Chiang <ericchiang(a)google.com> CC: stable(a)vger.kernel.org --- security/apparmor/apparmorfs.c | 1 + security/apparmor/domain.c | 25 +++++++++++++++++++++---- security/apparmor/include/policy.h | 6 ++++++ security/apparmor/policy.c | 3 +++ security/apparmor/policy_unpack.c | 18 ++++++++++++++++++ 5 files changed, 49 insertions(+), 4 deletions(-) diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 8963203319ea..03d9b7f8a2fb 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -2212,6 +2212,7 @@ static struct aa_sfs_entry aa_sfs_entry_signal[] = { static struct aa_sfs_entry aa_sfs_entry_attach[] = { AA_SFS_FILE_BOOLEAN("xattr", 1), + AA_SFS_FILE_BOOLEAN("xattr_key", 1), { } }; static struct aa_sfs_entry aa_sfs_entry_domain[] = { diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c index 08c88de0ffda..9f223756b416 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c @@ -317,16 +317,33 @@ static int aa_xattrs_match(const struct linux_binprm *bprm, ssize_t size; struct dentry *d; char *value = NULL; - int value_size = 0, ret = profile->xattr_count; + int value_size = 0; + int ret = profile->xattr_count + profile->xattr_keys_count; - if (!bprm || !profile->xattr_count) + if (!bprm) return 0; + d = bprm->file->f_path.dentry; + + if (profile->xattr_keys_count) { + /* validate that these attributes are present, ignore values */ + for (i = 0; i < profile->xattr_keys_count; i++) { + size = vfs_getxattr_alloc(d, profile->xattr_keys[i], + &value, value_size, + GFP_KERNEL); + if (size < 0) { + ret = -EINVAL; + goto out; + } + } + } + + if (!profile->xattr_count) + goto out; + /* transition from exec match to xattr set */ state = aa_dfa_null_transition(profile->xmatch, state); - d = bprm->file->f_path.dentry; - for (i = 0; i < profile->xattr_count; i++) { size = vfs_getxattr_alloc(d, profile->xattrs[i], &value, value_size, GFP_KERNEL); diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h index 8e6707c837be..8ed1d30de7ce 100644 --- a/security/apparmor/include/policy.h +++ b/security/apparmor/include/policy.h @@ -112,6 +112,10 @@ struct aa_data { * @policy: general match rules governing policy * @file: The set of rules governing basic file access and domain transitions * @caps: capabilities for the profile + * @xattr_count: number of xattrs values + * @xattrs: extended attributes whose values must match the xmatch + * @xattr_keys_count: number of xattr keys values + * @xattr_keys: extended attributes that must be present to match the profile * @rlimits: rlimits for the profile * * @dents: dentries for the profiles file entries in apparmorfs @@ -152,6 +156,8 @@ struct aa_profile { int xattr_count; char **xattrs; + int xattr_keys_count; + char **xattr_keys; struct aa_rlimit rlimits; diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index df9c5890a878..e0f9cf8b8318 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -231,6 +231,9 @@ void aa_free_profile(struct aa_profile *profile) for (i = 0; i < profile->xattr_count; i++) kzfree(profile->xattrs[i]); kzfree(profile->xattrs); + for (i = 0; i < profile->xattr_keys_count; i++) + kzfree(profile->xattr_keys[i]); + kzfree(profile->xattr_keys); for (i = 0; i < profile->secmark_count; i++) kzfree(profile->secmark[i].label); kzfree(profile->secmark); diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index 379682e2a8d5..d1fd75093260 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -535,6 +535,24 @@ static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile) goto fail; } + if (unpack_nameX(e, AA_STRUCT, "xattr_keys")) { + int i, size; + + size = unpack_array(e, NULL); + profile->xattr_keys_count = size; + profile->xattr_keys = kcalloc(size, sizeof(char *), GFP_KERNEL); + if (!profile->xattr_keys) + goto fail; + for (i = 0; i < size; i++) { + if (!unpack_strdup(e, &profile->xattr_keys[i], NULL)) + goto fail; + } + if (!unpack_nameX(e, AA_ARRAYEND, NULL)) + goto fail; + if (!unpack_nameX(e, AA_STRUCTEND, NULL)) + goto fail; + } + return 1; fail: -- 2.20.1.415.g653613c723-goog

6 years

1
0
0 0

+ hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race has been added to the -mm tree. Its filename is hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/hugetlbfs-use-i_mmap_rwsem-to-fix-… and later at http://ozlabs.org/~akpm/mmotm/broken-out/hugetlbfs-use-i_mmap_rwsem-to-fix-… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Mike Kravetz <mike.kravetz(a)oracle.com> Subject: hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race hugetlbfs page faults can race with truncate and hole punch operations. Current code in the page fault path attempts to handle this by 'backing out' operations if we encounter the race. One obvious omission in the current code is removing a page newly added to the page cache. This is pretty straight forward to address, but there is a more subtle and difficult issue of backing out hugetlb reservations. To handle this correctly, the 'reservation state' before page allocation needs to be noted so that it can be properly backed out. There are four distinct possibilities for reservation state: shared/reserved, shared/no-resv, private/reserved and private/no-resv. Backing out a reservation may require memory allocation which could fail so that needs to be taken into account as well. Instead of writing the required complicated code for this rare occurrence, just eliminate the race. i_mmap_rwsem is now held in read mode for the duration of page fault processing. Hold i_mmap_rwsem longer in truncation and hold punch code to cover the call to remove_inode_hugepages. With this modification, code in remove_inode_hugepages checking for races becomes 'dead' as it can not longer happen. Remove the dead code and expand comments to explain reasoning. Similarly, checks for races with truncation in the page fault path can be simplified and removed. Link: http://lkml.kernel.org/r/20181218223557.5202-3-mike.kravetz@oracle.com Fixes: ebed4bfc8da8 ("hugetlb: fix absurd HugePages_Rsvd") Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> Cc: "Aneesh Kumar K . V" <aneesh.kumar(a)linux.vnet.ibm.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: "Kirill A . Shutemov" <kirill.shutemov(a)linux.intel.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/hugetlbfs/inode.c | 50 +++++++++++++---------------------------- mm/hugetlb.c | 21 ++++++++--------- 2 files changed, 27 insertions(+), 44 deletions(-) --- a/fs/hugetlbfs/inode.c~hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race +++ a/fs/hugetlbfs/inode.c @@ -383,17 +383,16 @@ hugetlb_vmdelete_list(struct rb_root_cac * truncation is indicated by end of range being LLONG_MAX * In this case, we first scan the range and release found pages. * After releasing pages, hugetlb_unreserve_pages cleans up region/reserv - * maps and global counts. Page faults can not race with truncation - * in this routine. hugetlb_no_page() prevents page faults in the - * truncated range. It checks i_size before allocation, and again after - * with the page table lock for the page held. The same lock must be - * acquired to unmap a page. + * maps and global counts. * hole punch is indicated if end is not LLONG_MAX * In the hole punch case we scan the range and release found pages. * Only when releasing a page is the associated region/reserv map * deleted. The region/reserv map for ranges without associated - * pages are not modified. Page faults can race with hole punch. - * This is indicated if we find a mapped page. + * pages are not modified. + * + * Callers of this routine must hold the i_mmap_rwsem in write mode to prevent + * races with page faults. + * * Note: If the passed end of range value is beyond the end of file, but * not LLONG_MAX this routine still performs a hole punch operation. */ @@ -423,32 +422,14 @@ static void remove_inode_hugepages(struc for (i = 0; i < pagevec_count(&pvec); ++i) { struct page *page = pvec.pages[i]; - u32 hash; index = page->index; - hash = hugetlb_fault_mutex_hash(h, current->mm, - &pseudo_vma, - mapping, index, 0); - mutex_lock(&hugetlb_fault_mutex_table[hash]); - /* - * If page is mapped, it was faulted in after being - * unmapped in caller. Unmap (again) now after taking - * the fault mutex. The mutex will prevent faults - * until we finish removing the page. - * - * This race can only happen in the hole punch case. - * Getting here in a truncate operation is a bug. + * A mapped page is impossible as callers should unmap + * all references before calling. And, i_mmap_rwsem + * prevents the creation of additional mappings. */ - if (unlikely(page_mapped(page))) { - BUG_ON(truncate_op); - - i_mmap_lock_write(mapping); - hugetlb_vmdelete_list(&mapping->i_mmap, - index * pages_per_huge_page(h), - (index + 1) * pages_per_huge_page(h)); - i_mmap_unlock_write(mapping); - } + VM_BUG_ON(page_mapped(page)); lock_page(page); /* @@ -470,7 +451,6 @@ static void remove_inode_hugepages(struc } unlock_page(page); - mutex_unlock(&hugetlb_fault_mutex_table[hash]); } huge_pagevec_release(&pvec); cond_resched(); @@ -505,8 +485,8 @@ static int hugetlb_vmtruncate(struct ino i_mmap_lock_write(mapping); if (!RB_EMPTY_ROOT(&mapping->i_mmap.rb_root)) hugetlb_vmdelete_list(&mapping->i_mmap, pgoff, 0); - i_mmap_unlock_write(mapping); remove_inode_hugepages(inode, offset, LLONG_MAX); + i_mmap_unlock_write(mapping); return 0; } @@ -540,8 +520,8 @@ static long hugetlbfs_punch_hole(struct hugetlb_vmdelete_list(&mapping->i_mmap, hole_start >> PAGE_SHIFT, hole_end >> PAGE_SHIFT); - i_mmap_unlock_write(mapping); remove_inode_hugepages(inode, hole_start, hole_end); + i_mmap_unlock_write(mapping); inode_unlock(inode); } @@ -624,7 +604,11 @@ static long hugetlbfs_fallocate(struct f /* addr is the offset within the file (zero based) */ addr = index * hpage_size; - /* mutex taken here, fault path and hole punch */ + /* + * fault mutex taken here, protects against fault path + * and hole punch. inode_lock previously taken protects + * against truncation. + */ hash = hugetlb_fault_mutex_hash(h, mm, &pseudo_vma, mapping, index, addr); mutex_lock(&hugetlb_fault_mutex_table[hash]); --- a/mm/hugetlb.c~hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race +++ a/mm/hugetlb.c @@ -3760,16 +3760,16 @@ static vm_fault_t hugetlb_no_page(struct } /* - * Use page lock to guard against racing truncation - * before we get page_table_lock. + * We can not race with truncation due to holding i_mmap_rwsem. + * Check once here for faults beyond end of file. */ + size = i_size_read(mapping->host) >> huge_page_shift(h); + if (idx >= size) + goto out; + retry: page = find_lock_page(mapping, idx); if (!page) { - size = i_size_read(mapping->host) >> huge_page_shift(h); - if (idx >= size) - goto out; - /* * Check for page in userfault range */ @@ -3859,9 +3859,6 @@ retry: } ptl = huge_pte_lock(h, mm, ptep); - size = i_size_read(mapping->host) >> huge_page_shift(h); - if (idx >= size) - goto backout; ret = 0; if (!huge_pte_none(huge_ptep_get(ptep))) @@ -3964,8 +3961,10 @@ vm_fault_t hugetlb_fault(struct mm_struc /* * Acquire i_mmap_rwsem before calling huge_pte_alloc and hold - * until finished with ptep. This prevents huge_pmd_unshare from - * being called elsewhere and making the ptep no longer valid. + * until finished with ptep. This serves two purposes: + * 1) It prevents huge_pmd_unshare from being called elsewhere + * and making the ptep no longer valid. + * 2) It synchronizes us with file truncation. * * ptep could have already be assigned via huge_pte_offset. That * is OK, as huge_pte_alloc will return the same value unless _ Patches currently in -mm which might be from mike.kravetz(a)oracle.com are hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization.patch hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race.patch

6 years

1
0
0 0

+ hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization has been added to the -mm tree. Its filename is hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/hugetlbfs-use-i_mmap_rwsem-for-mor… and later at http://ozlabs.org/~akpm/mmotm/broken-out/hugetlbfs-use-i_mmap_rwsem-for-mor… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Mike Kravetz <mike.kravetz(a)oracle.com> Subject: hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization While looking at BUGs associated with invalid huge page map counts, it was discovered and observed that a huge pte pointer could become 'invalid' and point to another task's page table. Consider the following: A task takes a page fault on a shared hugetlbfs file and calls huge_pte_alloc to get a ptep. Suppose the returned ptep points to a shared pmd. Now, another task truncates the hugetlbfs file. As part of truncation, it unmaps everyone who has the file mapped. If the range being truncated is covered by a shared pmd, huge_pmd_unshare will be called. For all but the last user of the shared pmd, huge_pmd_unshare will clear the pud pointing to the pmd. If the task in the middle of the page fault is not the last user, the ptep returned by huge_pte_alloc now points to another task's page table or worse. This leads to bad things such as incorrect page map/reference counts or invalid memory references. To fix, expand the use of i_mmap_rwsem as follows: - i_mmap_rwsem is held in read mode whenever huge_pmd_share is called. huge_pmd_share is only called via huge_pte_alloc, so callers of huge_pte_alloc take i_mmap_rwsem before calling. In addition, callers of huge_pte_alloc continue to hold the semaphore until finished with the ptep. - i_mmap_rwsem is held in write mode whenever huge_pmd_unshare is called. Link: http://lkml.kernel.org/r/20181218223557.5202-2-mike.kravetz@oracle.com Fixes: 39dde65c9940 ("shared page table for hugetlb page") Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> Cc: "Aneesh Kumar K . V" <aneesh.kumar(a)linux.vnet.ibm.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: "Kirill A . Shutemov" <kirill.shutemov(a)linux.intel.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/hugetlb.c | 70 ++++++++++++++++++++++++++++++++---------- mm/memory-failure.c | 14 +++++++- mm/migrate.c | 13 +++++++ mm/rmap.c | 3 + mm/userfaultfd.c | 11 +++++- 5 files changed, 91 insertions(+), 20 deletions(-) --- a/mm/hugetlb.c~hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization +++ a/mm/hugetlb.c @@ -3238,6 +3238,7 @@ int copy_hugetlb_page_range(struct mm_st struct page *ptepage; unsigned long addr; int cow; + struct address_space *mapping = vma->vm_file->f_mapping; struct hstate *h = hstate_vma(vma); unsigned long sz = huge_page_size(h); struct mmu_notifier_range range; @@ -3253,11 +3254,23 @@ int copy_hugetlb_page_range(struct mm_st for (addr = vma->vm_start; addr < vma->vm_end; addr += sz) { spinlock_t *src_ptl, *dst_ptl; + src_pte = huge_pte_offset(src, addr, sz); if (!src_pte) continue; + + /* + * i_mmap_rwsem must be held to call huge_pte_alloc. + * Continue to hold until finished with dst_pte, otherwise + * it could go away if part of a shared pmd. + * + * Technically, i_mmap_rwsem is only needed in the non-cow + * case as cow mappings are not shared. + */ + i_mmap_lock_read(mapping); dst_pte = huge_pte_alloc(dst, addr, sz); if (!dst_pte) { + i_mmap_unlock_read(mapping); ret = -ENOMEM; break; } @@ -3272,8 +3285,10 @@ int copy_hugetlb_page_range(struct mm_st * after taking the lock below. */ dst_entry = huge_ptep_get(dst_pte); - if ((dst_pte == src_pte) || !huge_pte_none(dst_entry)) + if ((dst_pte == src_pte) || !huge_pte_none(dst_entry)) { + i_mmap_unlock_read(mapping); continue; + } dst_ptl = huge_pte_lock(h, dst, dst_pte); src_ptl = huge_pte_lockptr(h, src, src_pte); @@ -3322,6 +3337,8 @@ int copy_hugetlb_page_range(struct mm_st } spin_unlock(src_ptl); spin_unlock(dst_ptl); + + i_mmap_unlock_read(mapping); } if (cow) @@ -3772,14 +3789,18 @@ retry: }; /* - * hugetlb_fault_mutex must be dropped before - * handling userfault. Reacquire after handling - * fault to make calling code simpler. + * hugetlb_fault_mutex and i_mmap_rwsem must be + * dropped before handling userfault. Reacquire + * after handling fault to make calling code simpler. */ hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, haddr); mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); + ret = handle_userfault(&vmf, VM_UFFD_MISSING); + + i_mmap_lock_read(mapping); mutex_lock(&hugetlb_fault_mutex_table[hash]); goto out; } @@ -3927,6 +3948,11 @@ vm_fault_t hugetlb_fault(struct mm_struc ptep = huge_pte_offset(mm, haddr, huge_page_size(h)); if (ptep) { + /* + * Since we hold no locks, ptep could be stale. That is + * OK as we are only making decisions based on content and + * not actually modifying content here. + */ entry = huge_ptep_get(ptep); if (unlikely(is_hugetlb_entry_migration(entry))) { migration_entry_wait_huge(vma, mm, ptep); @@ -3934,20 +3960,31 @@ vm_fault_t hugetlb_fault(struct mm_struc } else if (unlikely(is_hugetlb_entry_hwpoisoned(entry))) return VM_FAULT_HWPOISON_LARGE | VM_FAULT_SET_HINDEX(hstate_index(h)); - } else { - ptep = huge_pte_alloc(mm, haddr, huge_page_size(h)); - if (!ptep) - return VM_FAULT_OOM; } + /* + * Acquire i_mmap_rwsem before calling huge_pte_alloc and hold + * until finished with ptep. This prevents huge_pmd_unshare from + * being called elsewhere and making the ptep no longer valid. + * + * ptep could have already be assigned via huge_pte_offset. That + * is OK, as huge_pte_alloc will return the same value unless + * something changed. + */ mapping = vma->vm_file->f_mapping; - idx = vma_hugecache_offset(h, vma, haddr); + i_mmap_lock_read(mapping); + ptep = huge_pte_alloc(mm, haddr, huge_page_size(h)); + if (!ptep) { + i_mmap_unlock_read(mapping); + return VM_FAULT_OOM; + } /* * Serialize hugepage allocation and instantiation, so that we don't * get spurious allocation failures if two CPUs race to instantiate * the same page in the page cache. */ + idx = vma_hugecache_offset(h, vma, haddr); hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, haddr); mutex_lock(&hugetlb_fault_mutex_table[hash]); @@ -4035,6 +4072,7 @@ out_ptl: } out_mutex: mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); /* * Generally it's safe to hold refcount during waiting page lock. But * here we just wait to defer the next page fault to avoid busy loop and @@ -4640,10 +4678,12 @@ void adjust_range_if_pmd_sharing_possibl * Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc() * and returns the corresponding pte. While this is not necessary for the * !shared pmd case because we can allocate the pmd later as well, it makes the - * code much cleaner. pmd allocation is essential for the shared case because - * pud has to be populated inside the same i_mmap_rwsem section - otherwise - * racing tasks could either miss the sharing (see huge_pte_offset) or select a - * bad pmd for sharing. + * code much cleaner. + * + * This routine must be called with i_mmap_rwsem held in at least read mode. + * For hugetlbfs, this prevents removal of any page table entries associated + * with the address space. This is important as we are setting up sharing + * based on existing page table entries (mappings). */ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) { @@ -4660,7 +4700,6 @@ pte_t *huge_pmd_share(struct mm_struct * if (!vma_shareable(vma, addr)) return (pte_t *)pmd_alloc(mm, pud, addr); - i_mmap_lock_write(mapping); vma_interval_tree_foreach(svma, &mapping->i_mmap, idx, idx) { if (svma == vma) continue; @@ -4690,7 +4729,6 @@ pte_t *huge_pmd_share(struct mm_struct * spin_unlock(ptl); out: pte = (pte_t *)pmd_alloc(mm, pud, addr); - i_mmap_unlock_write(mapping); return pte; } @@ -4701,7 +4739,7 @@ out: * indicated by page_count > 1, unmap is achieved by clearing pud and * decrementing the ref count. If count == 1, the pte page is not shared. * - * called with page table lock held. + * Called with page table lock held and i_mmap_rwsem held in write mode. * * returns: 1 successfully unmapped a shared pte page * 0 the underlying pte page is not shared, or it is the last user --- a/mm/memory-failure.c~hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization +++ a/mm/memory-failure.c @@ -1028,7 +1028,19 @@ static bool hwpoison_user_mappings(struc if (kill) collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED); - unmap_success = try_to_unmap(hpage, ttu); + if (!PageHuge(hpage)) { + unmap_success = try_to_unmap(hpage, ttu); + } else { + /* + * For hugetlb pages, try_to_unmap could potentially call + * huge_pmd_unshare. Because of this, take semaphore in + * write mode here and set TTU_RMAP_LOCKED to indicate we + * have taken the lock at this higer level. + */ + i_mmap_lock_write(mapping); + unmap_success = try_to_unmap(hpage, ttu|TTU_RMAP_LOCKED); + i_mmap_unlock_write(mapping); + } if (!unmap_success) pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n", pfn, page_mapcount(hpage)); --- a/mm/migrate.c~hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization +++ a/mm/migrate.c @@ -1324,8 +1324,19 @@ static int unmap_and_move_huge_page(new_ goto put_anon; if (page_mapped(hpage)) { + struct address_space *mapping = page_mapping(hpage); + + /* + * try_to_unmap could potentially call huge_pmd_unshare. + * Because of this, take semaphore in write mode here and + * set TTU_RMAP_LOCKED to let lower levels know we have + * taken the lock. + */ + i_mmap_lock_write(mapping); try_to_unmap(hpage, - TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS); + TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS| + TTU_RMAP_LOCKED); + i_mmap_unlock_write(mapping); page_was_mapped = 1; } --- a/mm/rmap.c~hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization +++ a/mm/rmap.c @@ -1380,6 +1380,9 @@ static bool try_to_unmap_one(struct page /* * If sharing is possible, start and end will be adjusted * accordingly. + * + * If called for a huge page, caller must hold i_mmap_rwsem + * in write mode as it is possible to call huge_pmd_unshare. */ adjust_range_if_pmd_sharing_possible(vma, &range.start, &range.end); --- a/mm/userfaultfd.c~hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization +++ a/mm/userfaultfd.c @@ -267,10 +267,14 @@ retry: VM_BUG_ON(dst_addr & ~huge_page_mask(h)); /* - * Serialize via hugetlb_fault_mutex + * Serialize via i_mmap_rwsem and hugetlb_fault_mutex. + * i_mmap_rwsem ensures the dst_pte remains valid even + * in the case of shared pmds. fault mutex prevents + * races with other faulting threads. */ - idx = linear_page_index(dst_vma, dst_addr); mapping = dst_vma->vm_file->f_mapping; + i_mmap_lock_read(mapping); + idx = linear_page_index(dst_vma, dst_addr); hash = hugetlb_fault_mutex_hash(h, dst_mm, dst_vma, mapping, idx, dst_addr); mutex_lock(&hugetlb_fault_mutex_table[hash]); @@ -279,6 +283,7 @@ retry: dst_pte = huge_pte_alloc(dst_mm, dst_addr, huge_page_size(h)); if (!dst_pte) { mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); goto out_unlock; } @@ -286,6 +291,7 @@ retry: dst_pteval = huge_ptep_get(dst_pte); if (!huge_pte_none(dst_pteval)) { mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); goto out_unlock; } @@ -293,6 +299,7 @@ retry: dst_addr, src_addr, &page); mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); vm_alloc_shared = vm_shared; cond_resched(); _ Patches currently in -mm which might be from mike.kravetz(a)oracle.com are hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization.patch hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race.patch

6 years

1
0
0 0

stable-rc/linux-4.14.y boot: 35 boots: 0 failed, 34 passed with 1 untried/unknown (v4.14.89-73-gdafc7cbbb79e)

by kernelci.org bot

stable-rc/linux-4.14.y boot: 35 boots: 0 failed, 34 passed with 1 untried/unknown (v4.14.89-73-gdafc7cbbb79e) Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.14.y/kernel/v4.1… Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.14.y/kernel/v4.14.89-73… Tree: stable-rc Branch: linux-4.14.y Git Describe: v4.14.89-73-gdafc7cbbb79e Git Commit: dafc7cbbb79e3fa3743ebcb0e0014b95905752b9 Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Tested: 20 unique boards, 11 SoC families, 6 builds out of 197 --- For more info write to <info(a)kernelci.org>

6 years

1
0
0 0

patch "staging: wilc1000: fix missing read_write setting when reading data" added to staging-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: wilc1000: fix missing read_write setting when reading data to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the staging-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From c58eef061dda7d843dcc0ad6fea7e597d4c377c0 Mon Sep 17 00:00:00 2001 From: Colin Ian King <colin.king(a)canonical.com> Date: Wed, 19 Dec 2018 16:30:07 +0000 Subject: staging: wilc1000: fix missing read_write setting when reading data Currently the cmd.read_write setting is not initialized so it contains garbage from the stack. Fix this by setting it to 0 to indicate a read is required. Detected by CoverityScan, CID#1357925 ("Uninitialized scalar variable") Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Signed-off-by: Colin Ian King <colin.king(a)canonical.com> Cc: stable <stable(a)vger.kernel.org> Acked-by: Ajay Singh <ajay.kathat(a)microchip.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/wilc1000/wilc_sdio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/staging/wilc1000/wilc_sdio.c b/drivers/staging/wilc1000/wilc_sdio.c index 27fdfbdda5c0..e2f739fef21c 100644 --- a/drivers/staging/wilc1000/wilc_sdio.c +++ b/drivers/staging/wilc1000/wilc_sdio.c @@ -861,6 +861,7 @@ static int sdio_read_int(struct wilc *wilc, u32 *int_status) if (!sdio_priv->irq_gpio) { int i; + cmd.read_write = 0; cmd.function = 1; cmd.address = 0x04; cmd.data = 0; -- 2.20.1

6 years

1
0
0 0

[PATCH v7] cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.

by Macpaul Lin

Mediatek Preloader is a proprietary embedded boot loader for loading Little Kernel and Linux into device DRAM. This boot loader also handle firmware update. Mediatek Preloader will be enumerated as a virtual COM port when the device is connected to Windows or Linux OS via CDC-ACM class driver. When the USB enumeration has been done, Mediatek Preloader will send out handshake command "READY" to PC actively instead of waiting command from the download tool. Since Linux 4.12, the commit "tty: reset termios state on device registration" (93857edd9829e144acb6c7e72d593f6e01aead66) causes Mediatek Preloader receiving some abnoraml command like "READYXX" as it sent. This will be recognized as an incorrect response. The behavior change also causes the download handshake fail. This change only affects subsequent connects if the reconnected device happens to get the same minor number. By disabling the ECHO termios flag could avoid this problem. However, it cannot be done by user space configuration when download tool open /dev/ttyACM0. This is because the device running Mediatek Preloader will send handshake command "READY" immediately once the CDC-ACM driver is ready. This patch wants to fix above problem by introducing "DISABLE_ECHO" property in driver_info. When Mediatek Preloader is connected, the CDC-ACM driver could disable ECHO flag in termios to avoid the problem. Signed-off-by: Macpaul Lin <macpaul.lin(a)mediatek.com> Cc: stable(a)vger.kernel.org --- Changes for v2: - Move quirks testing of DISABLE_ECHO flag into acm_tty_install(). - Change quirks testing into bitwise comparison. Changes for v3: - Replace quirks testing from init_termios to tty->termios. - Remove parenthesis for ECHO flag. Changes for v4: - Drop quirks varible to simplify the patch. - Move termios operation right after the driver_data has been installed. - Write general style comment for suppressing initial echoing. Changes for v5: - Fix: termios operation right abover the driver_data has been installed. - Update commit comment about this patch affects the reconnected device which get the same minor numbers. Changes for v6: - Update VID/PID:0x0e8d/0x0003 as Mediatek Inc BROM. - Update VID/PID:0x0e8d/0x2000 as Mediatek Inc Preloader. Changes for v7: - Keep VID/PID:0x0e8d/0x0003 unchanged because of 2 different UNION descriptor implementated in Mediatek Inc BROM (MT6589/MT6765). drivers/usb/class/cdc-acm.c | 10 ++++++++++ drivers/usb/class/cdc-acm.h | 1 + 2 files changed, 11 insertions(+) diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 1b68fed..ed8c62b 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -581,6 +581,13 @@ static int acm_tty_install(struct tty_driver *driver, struct tty_struct *tty) if (retval) goto error_init_termios; + /* + * Suppress initial echoing for some devices which might send data + * immediately after acm driver has been installed. + */ + if (acm->quirks & DISABLE_ECHO) + tty->termios.c_lflag &= ~ECHO; + tty->driver_data = acm; return 0; @@ -1657,6 +1664,9 @@ static int acm_pre_reset(struct usb_interface *intf) { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov(a)gmail.com */ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ }, + { USB_DEVICE(0x0e8d, 0x2000), /* MediaTek Inc Preloader */ + .driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */ + }, { USB_DEVICE(0x0e8d, 0x3329), /* MediaTek Inc GPS */ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ }, diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h index ca06b20..515aad0 100644 --- a/drivers/usb/class/cdc-acm.h +++ b/drivers/usb/class/cdc-acm.h @@ -140,3 +140,4 @@ struct acm { #define QUIRK_CONTROL_LINE_STATE BIT(6) #define CLEAR_HALT_CONDITIONS BIT(7) #define SEND_ZERO_PACKET BIT(8) +#define DISABLE_ECHO BIT(9) -- 1.9.1

6 years

3
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2018