On Thu, Aug 23, 2018 at 09:38:31AM -0400, Scott French wrote:
> Please remove the stfrench @ gmail address. I am not Steve
Now removed, sorry for the noise.
greg k-h
Commit 5769beaf180a8 ("powerpc/mm: Add proper pte access check helper
for other platforms") replaced generic pte_access_permitted() by an
arch specific one.
The generic one is defined as
(pte_present(pte) && (!(write) || pte_write(pte)))
The arch specific one is open coded checking that _PAGE_USER and
_PAGE_WRITE (_PAGE_RW) flags are set, but lacking to check that
_PAGE_RO and _PAGE_PRIVILEGED are unset, leading to a useless test
on targets like the 8xx which defines _PAGE_RW and _PAGE_USER as 0.
Commit 5fa5b16be5b31 ("powerpc/mm/hugetlb: Use pte_access_permitted
for hugetlb access check") replaced some tests performed with
pte helpers by a call to pte_access_permitted(), leading to the same
issue.
This patch rewrites powerpc/nohash pte_access_permitted()
using pte helpers.
Fixes: 5769beaf180a8 ("powerpc/mm: Add proper pte access check helper for other platforms")
Fixes: 5fa5b16be5b31 ("powerpc/mm/hugetlb: Use pte_access_permitted for hugetlb access check")
Cc: stable(a)vger.kernel.org # v4.15+
Signed-off-by: Christophe Leroy <christophe.leroy(a)c-s.fr>
---
arch/powerpc/include/asm/nohash/pgtable.h | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h
index 2160be2e4339..b321c82b3624 100644
--- a/arch/powerpc/include/asm/nohash/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/pgtable.h
@@ -51,17 +51,14 @@ static inline int pte_present(pte_t pte)
#define pte_access_permitted pte_access_permitted
static inline bool pte_access_permitted(pte_t pte, bool write)
{
- unsigned long pteval = pte_val(pte);
/*
* A read-only access is controlled by _PAGE_USER bit.
* We have _PAGE_READ set for WRITE and EXECUTE
*/
- unsigned long need_pte_bits = _PAGE_PRESENT | _PAGE_USER;
-
- if (write)
- need_pte_bits |= _PAGE_WRITE;
+ if (!pte_present(pte) || !pte_user(pte) || !pte_read(pte))
+ return false;
- if ((pteval & need_pte_bits) != need_pte_bits)
+ if (write && !pte_write(pte))
return false;
return true;
--
2.13.3
Hi Greg,
This patch is not marked for 4.4-stable, but it's already in 4.9 and 4.14 stable.
Please apply to 4.4-stable.
This patch turned the status from error to warning if d_type is not supported,
and thus operation won't be interrupted.
--
SZ Lin (林上智)
Hi Greg,
This patch is not marked for 4.4-stable, but it's already in 4.9 and 4.14 stable.
Please apply to 4.4-stable.
This patch fixed check machanism for d_type to avoid returning d_type not
supported even if underlying filesystem might be supporting it.
--
SZ Lin (林上智)
Hi Greg,
This patch is not marked for 4.4-stable, but it's already in 4.9 and 4.14 stable.
Please apply to 4.4-stable.
This patch added a check mechanism for d_type in upper layer of overlayfs to
avoid whiteouts issue.
--
SZ Lin (林上智)
Commit d70f2a14b72a4 ("include/linux/sched/mm.h: uninline
mmdrop_async(), etc") ignored the return value of arch_dup_mmap(). As a
result, on x86, a failure to duplicate the LDT (e.g., due to memory
allocation error), would leave the duplicated memory mapping in an
inconsistent state.
Fix by regarding the return value, as it was before the change.
Fixes: d70f2a14b72a4 ("include/linux/sched/mm.h: uninline mmdrop_async(), etc")
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: stable(a)vger.kernel.org
Signed-off-by: Nadav Amit <namit(a)vmware.com>
---
kernel/fork.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index 1b27babc4c78..4527d1d331de 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -549,8 +549,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
goto out;
}
/* a new mm has just been created */
- arch_dup_mmap(oldmm, mm);
- retval = 0;
+ retval = arch_dup_mmap(oldmm, mm);
out:
up_write(&mm->mmap_sem);
flush_tlb_mm(oldmm);
--
2.17.1
Use the new of_get_compatible_child() helper to lookup the usb sibling
node instead of using of_find_compatible_node(), which searches the
entire tree and thus can return an unrelated (non-sibling) node.
This also addresses a potential use-after-free (e.g. after probe
deferral) as the tree-wide helper drops a reference to its first
argument (i.e. the parent device node).
While at it, also fix the related phy-node reference leak.
Fixes: f5e4edb8c888 ("power: twl4030_charger: find associated phy by more reliable means.")
Cc: stable <stable(a)vger.kernel.org> # 4.2
Cc: NeilBrown <neilb(a)suse.de>
Cc: Felipe Balbi <balbi(a)ti.com>
Cc: Sebastian Reichel <sre(a)kernel.org>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
drivers/power/supply/twl4030_charger.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
index bbcaee56db9d..b6a7d9f74cf3 100644
--- a/drivers/power/supply/twl4030_charger.c
+++ b/drivers/power/supply/twl4030_charger.c
@@ -996,12 +996,13 @@ static int twl4030_bci_probe(struct platform_device *pdev)
if (bci->dev->of_node) {
struct device_node *phynode;
- phynode = of_find_compatible_node(bci->dev->of_node->parent,
- NULL, "ti,twl4030-usb");
+ phynode = of_get_compatible_child(bci->dev->of_node->parent,
+ "ti,twl4030-usb");
if (phynode) {
bci->usb_nb.notifier_call = twl4030_bci_usb_ncb;
bci->transceiver = devm_usb_get_phy_by_node(
bci->dev, phynode, &bci->usb_nb);
+ of_node_put(phynode);
if (IS_ERR(bci->transceiver)) {
ret = PTR_ERR(bci->transceiver);
if (ret == -EPROBE_DEFER)
--
2.18.0
Various mips64 and ppc64 qemu tests crash as follows
in v4.14.y and v4.17.y (the log is from ppc64).
------------[ cut here ]------------
kernel BUG at kernel/time/hrtimer.c:1673!
Oops: Exception in kernel mode, sig: 5 [#1]
BE NUMA CoreNet Generic
Modules linked in:
CPU: 0 PID: 1 Comm: init Not tainted 4.17.19-rc1-00309-g8fe1830 #1
NIP: c000000000085d6c LR: c00000000089d840 CTR: c00000000000cd00
REGS: c00000003e1e7990 TRAP: 0700 Not tainted (4.17.19-rc1-00309-g8fe1830)
MSR: 000000008002b000 <CE,EE,FP,ME> CR: 48000284 XER: 00000000
SOFTE: 0
GPR00: c00000000089d7ec c00000003e1e7c10 c000000000cb9c00 c00000003e1e8238
GPR04: c00000003e1e7c80 ffffffffffffffff 000000003b9aca00 0000000000000000
GPR08: 0000000031012c01 0000000031012c01 0000000000000002 0000000031012c01
GPR12: 0000000028000482 c000000000d35000 0000000000000000 0000000000000000
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR24: 0000000000000000 0000000000000000 0000000000000016 00000000ffff9008
GPR28: c00000003e1e7e10 c00000003e1e8000 0000000000000000 000000009336eabb
NIP [c000000000085d6c] .nanosleep_copyout+0x4c/0x50
LR [c00000000089d840] .do_nanosleep+0x160/0x190
Call Trace:
[c00000003e1e7c10] [c00000000089d7ec] .do_nanosleep+0x10c/0x190 (unreliable)
[c00000003e1e7cc0] [c000000000085e78] .hrtimer_nanosleep+0x108/0x1d0
[c00000003e1e7da0] [c000000000086068] .__se_compat_sys_nanosleep+0x78/0xb0
[c00000003e1e7e30] [c000000000000618] system_call+0x58/0x64
Instruction dump:
7c832378 e8890010 4bffbadd 60000000 38210070 e8010010 2fa30000 3940fff2
3860fdfc 7c63579e 7c0803a6 4e800020 <0fe00000> 7c0802a6 fb81ffe0 fbc1fff0
---[ end trace 15c7fbc119007c42 ]---
I started to bisect, but abandoned it after finding commit 62d7ce7f40a9
("posix-timers: Fix nanosleep_copyout() for CONFIG_COMPAT_32BIT_TIME")
in both branches. Since there is no "config COMPAT_32BIT_TIME" in v4.14.y
or v4.17.y, some relevant code is commented out by the commit, which in
turn results in the crash.
Guenter