Hi,
I want to ask for the changes in cd7f3a249dbe (rtc: snvs: Add timeouts
to avoid kernel lockups) to be backported to the stable releases.
The reason is, that this patch fixes a real bug, that can cause the
kernel to lock up. I can reproduce this lockup reliably with an i.MX6UL,
PREEMPTIVE_RT_FULL enabled and v4.14.89.
Thanks,
Frieder
This is a note to let you know that I've just added the patch titled
stm class: Fix a module refcount leak in policy creation error path
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From c18614a1a11276837bdd44403d84d207c9951538 Mon Sep 17 00:00:00 2001
From: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Date: Wed, 19 Dec 2018 17:19:20 +0200
Subject: stm class: Fix a module refcount leak in policy creation error path
Commit c7fd62bc69d0 ("stm class: Introduce framing protocol drivers")
adds a bug into the error path of policy creation, that would do a
module_put() on a wrong module, if one tried to create a policy for
an stm device which already has a policy, using a different protocol.
IOW,
| mkdir /config/stp-policy/dummy_stm.0:p_basic.test
| mkdir /config/stp-policy/dummy_stm.0:p_sys-t.test # puts "p_basic"
| mkdir /config/stp-policy/dummy_stm.0:p_sys-t.test # "p_basic" -> -1
throws:
| general protection fault: 0000 [#1] SMP PTI
| CPU: 3 PID: 2887 Comm: mkdir
| RIP: 0010:module_put.part.31+0xe/0x90
| Call Trace:
| module_put+0x13/0x20
| stm_put_protocol+0x11/0x20 [stm_core]
| stp_policy_make+0xf1/0x210 [stm_core]
| ? __kmalloc+0x183/0x220
| ? configfs_mkdir+0x10d/0x4c0
| configfs_mkdir+0x169/0x4c0
| vfs_mkdir+0x108/0x1c0
| do_mkdirat+0xe8/0x110
| __x64_sys_mkdir+0x1b/0x20
| do_syscall_64+0x5a/0x140
| entry_SYSCALL_64_after_hwframe+0x44/0xa9
Correct this sad mistake by calling calling 'put' on the correct
reference, which happens to match another error path in the same
function, so we consolidate the two at the same time.
Signed-off-by: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Fixes: c7fd62bc69d0 ("stm class: Introduce framing protocol drivers")
Reported-by: Ammy Yi <ammy.yi(a)intel.com>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/hwtracing/stm/policy.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/hwtracing/stm/policy.c b/drivers/hwtracing/stm/policy.c
index 0910ec807187..4b9e44b227d8 100644
--- a/drivers/hwtracing/stm/policy.c
+++ b/drivers/hwtracing/stm/policy.c
@@ -440,10 +440,8 @@ stp_policy_make(struct config_group *group, const char *name)
stm->policy = kzalloc(sizeof(*stm->policy), GFP_KERNEL);
if (!stm->policy) {
- mutex_unlock(&stm->policy_mutex);
- stm_put_protocol(pdrv);
- stm_put_device(stm);
- return ERR_PTR(-ENOMEM);
+ ret = ERR_PTR(-ENOMEM);
+ goto unlock_policy;
}
config_group_init_type_name(&stm->policy->group, name,
@@ -458,7 +456,11 @@ stp_policy_make(struct config_group *group, const char *name)
mutex_unlock(&stm->policy_mutex);
if (IS_ERR(ret)) {
- stm_put_protocol(stm->pdrv);
+ /*
+ * pdrv and stm->pdrv at this point can be quite different,
+ * and only one of them needs to be 'put'
+ */
+ stm_put_protocol(pdrv);
stm_put_device(stm);
}
--
2.20.1
The 'nr_pages' attribute of the 'msc' subdevices parses a comma-separated
list of window sizes, passed from userspace. However, there is a bug in
the string parsing logic wherein it doesn't exclude the comma character
from the range of characters as it consumes them. This leads to an
out-of-bounds access given a sufficiently long list. For example:
> # echo 8,8,8,8 > /sys/bus/intel_th/devices/0-msc0/nr_pages
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in memchr+0x1e/0x40
> Read of size 1 at addr ffff8803ffcebcd1 by task sh/825
>
> CPU: 3 PID: 825 Comm: npktest.sh Tainted: G W 4.20.0-rc1+
> Call Trace:
> dump_stack+0x7c/0xc0
> print_address_description+0x6c/0x23c
> ? memchr+0x1e/0x40
> kasan_report.cold.5+0x241/0x308
> memchr+0x1e/0x40
> nr_pages_store+0x203/0xd00 [intel_th_msu]
Fix this by accounting for the comma character.
Signed-off-by: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver")
Cc: stable(a)vger.kernel.org # v4.4+
---
drivers/hwtracing/intel_th/msu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index d293e55553bd..ba7aaf421f36 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -1423,7 +1423,8 @@ nr_pages_store(struct device *dev, struct device_attribute *attr,
if (!end)
break;
- len -= end - p;
+ /* consume the number and the following comma, hence +1 */
+ len -= end - p + 1;
p = end + 1;
} while (len);
--
2.19.2
This is the start of the stable review cycle for the 4.19.11 release.
There are 44 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Dec 20 16:39:02 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.11-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.11-rc1
Masahiro Yamada <yamada.masahiro(a)socionext.com>
x86/build: Fix compiler support check for CONFIG_RETPOLINE
Damien Le Moal <damien.lemoal(a)wdc.com>
dm zoned: Fix target BIO completion handling
Junwei Zhang <Jerry.Zhang(a)amd.com>
drm/amdgpu: update SMC firmware image for polaris10 variants
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: update smu firmware images for VI variants (v2)
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: add some additional vega10 pci ids
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdkfd: add new vega10 pci ids
Kenneth Feng <kenneth.feng(a)amd.com>
drm/amdgpu/powerplay: Apply avfs cks-off voltages on VI
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915/execlists: Apply a full mb before execution for Braswell
Tina Zhang <tina.zhang(a)intel.com>
drm/i915/gvt: Fix tiled memory decoding bug on BDW
Brian Norris <briannorris(a)chromium.org>
Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/kms/nv50-: also flush fb writes when rewinding push buffer
Lyude Paul <lyude(a)redhat.com>
drm/nouveau/kms: Fix memory leak in nv50_mstm_del()
Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
powerpc: Look for "stdout-path" when setting up legacy consoles
Radu Rendec <radu.rendec(a)gmail.com>
powerpc/msi: Fix NULL pointer access in teardown code
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vb2: don't call __vb2_queue_cancel if vb2_start_streaming failed
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Fix memory leak of instance function hash filters
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Fix memory leak in set_trigger_filter()
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Fix memory leak in create_filter()
Mike Snitzer <snitzer(a)redhat.com>
dm: call blk_queue_split() to impose device limits on bios
Mike Snitzer <snitzer(a)redhat.com>
dm cache metadata: verify cache has blocks in blocks_are_clean_separate_dirty()
Mike Snitzer <snitzer(a)redhat.com>
dm thin: send event about thin-pool state change _after_ making it
Stefan Wahren <stefan.wahren(a)i2se.com>
ARM: dts: bcm2837: Fix polarity of wifi reset GPIOs
Lubomir Rintel <lkundrak(a)v3.sk>
ARM: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt
Chad Austin <chadaustin(a)fb.com>
fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS
Alek Du <alek.du(a)intel.com>
mmc: sdhci: fix the timeout check window for clock and reset
Faiz Abbas <faiz_abbas(a)ti.com>
mmc: sdhci-omap: Fix DCRC error handling during tuning
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
mmc: core: use mrq->sbc when sending CMD23 for RPMB
Aaro Koskinen <aaro.koskinen(a)iki.fi>
MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
Amir Goldstein <amir73il(a)gmail.com>
ovl: fix missing override creds in link of a metacopy upper
Amir Goldstein <amir73il(a)gmail.com>
ovl: fix decode of dir file handle with multi lower layers
Keith Busch <keith.busch(a)intel.com>
block/bio: Do not zero user pages
Robin Murphy <robin.murphy(a)arm.com>
arm64: dma-mapping: Fix FORCE_CONTIGUOUS buffer clearing
Andrea Arcangeli <aarcange(a)redhat.com>
userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered
Piotr Jaroszynski <pjaroszynski(a)nvidia.com>
fs/iomap.c: get/put the page in iomap_page_create/release()
Thierry Reding <treding(a)nvidia.com>
scripts/spdxcheck.py: always open files in binary mode
Jeff Moyer <jmoyer(a)redhat.com>
aio: fix spectre gadget in lookup_ioctx
Chen-Yu Tsai <wens(a)csie.org>
pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
Arnd Bergmann <arnd(a)arndb.de>
drm/msm: fix address space warning
Arnd Bergmann <arnd(a)arndb.de>
ARM: dts: qcom-apq8064-arrow-sd-600eval fix graph_endpoint warning
Arnd Bergmann <arnd(a)arndb.de>
i2c: aspeed: fix build warning
Arnd Bergmann <arnd(a)arndb.de>
slimbus: ngd: mark PM functions as __maybe_unused
Lubomir Rintel <lkundrak(a)v3.sk>
staging: olpc_dcon: add a missing dependency
Arnd Bergmann <arnd(a)arndb.de>
scsi: raid_attrs: fix unused variable warning
Vincent Guittot <vincent.guittot(a)linaro.org>
sched/pelt: Fix warning and clean up IRQ PELT config
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +-
arch/arm/boot/dts/bcm2837-rpi-3-b.dts | 2 +-
.../arm/boot/dts/qcom-apq8064-arrow-sd-600eval.dts | 5 +
arch/arm/mach-mmp/cputype.h | 6 +-
arch/arm64/mm/dma-mapping.c | 2 +-
arch/powerpc/kernel/legacy_serial.c | 6 +-
arch/powerpc/kernel/msi.c | 7 +-
arch/x86/Makefile | 10 +-
block/bio.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 36 +++++-
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 6 +
drivers/gpu/drm/amd/amdkfd/kfd_device.c | 6 +
drivers/gpu/drm/amd/powerplay/inc/smu7_ppsmc.h | 2 +
.../drm/amd/powerplay/smumgr/polaris10_smumgr.c | 6 +
drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 3 +
drivers/gpu/drm/i915/gvt/fb_decoder.c | 2 +-
drivers/gpu/drm/i915/intel_lrc.c | 7 +-
drivers/gpu/drm/msm/disp/dpu1/dpu_dbg.c | 8 +-
drivers/gpu/drm/nouveau/dispnv50/disp.c | 30 +++--
drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 6 -
drivers/i2c/busses/i2c-aspeed.c | 4 +-
drivers/md/dm-cache-metadata.c | 4 +
drivers/md/dm-thin.c | 68 ++++++------
drivers/md/dm-zoned-target.c | 122 +++++++--------------
drivers/md/dm.c | 2 +
drivers/media/common/videobuf2/videobuf2-core.c | 4 +-
drivers/mmc/core/block.c | 15 ++-
drivers/mmc/host/omap.c | 11 +-
drivers/mmc/host/sdhci-omap.c | 12 +-
drivers/mmc/host/sdhci.c | 18 ++-
drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 2 +-
drivers/scsi/raid_class.c | 4 +-
drivers/slimbus/qcom-ngd-ctrl.c | 6 +-
drivers/staging/olpc_dcon/Kconfig | 1 +
fs/aio.c | 2 +
fs/fuse/dir.c | 2 +-
fs/fuse/file.c | 21 ++--
fs/fuse/fuse_i.h | 2 +-
fs/iomap.c | 7 ++
fs/overlayfs/dir.c | 14 ++-
fs/overlayfs/export.c | 6 +-
fs/userfaultfd.c | 3 +-
init/Kconfig | 5 +
kernel/sched/core.c | 7 +-
kernel/sched/fair.c | 2 +-
kernel/sched/pelt.c | 2 +-
kernel/sched/pelt.h | 2 +-
kernel/sched/sched.h | 5 +-
kernel/trace/ftrace.c | 1 +
kernel/trace/trace_events_filter.c | 5 +-
kernel/trace/trace_events_trigger.c | 6 +-
scripts/spdxcheck.py | 6 +-
53 files changed, 311 insertions(+), 219 deletions(-)