Commit-ID: 02e184476eff848273826c1d6617bb37e5bcc7ad
Gitweb: https://git.kernel.org/tip/02e184476eff848273826c1d6617bb37e5bcc7ad
Author: Yabin Cui <yabinc(a)google.com>
AuthorDate: Thu, 23 Aug 2018 15:59:35 -0700
Committer: Ingo Molnar <mingo(a)kernel.org>
CommitDate: Mon, 10 Sep 2018 14:01:46 +0200
perf/core: Force USER_DS when recording user stack data
Perf can record user stack data in response to a synchronous request, such
as a tracepoint firing. If this happens under set_fs(KERNEL_DS), then we
end up reading user stack data using __copy_from_user_inatomic() under
set_fs(KERNEL_DS). I think this conflicts with the intention of using
set_fs(KERNEL_DS). And it is explicitly forbidden by hardware on ARM64
when both CONFIG_ARM64_UAO and CONFIG_ARM64_PAN are used.
So fix this by forcing USER_DS when recording user stack data.
Signed-off-by: Yabin Cui <yabinc(a)google.com>
Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme(a)kernel.org>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Namhyung Kim <namhyung(a)kernel.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Fixes: 88b0193d9418 ("perf/callchain: Force USER_DS when invoking perf_callchain_user()")
Link: http://lkml.kernel.org/r/20180823225935.27035-1-yabinc@google.com
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
---
kernel/events/core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index abaed4f8bb7f..c80549bf82c6 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5943,6 +5943,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
unsigned long sp;
unsigned int rem;
u64 dyn_size;
+ mm_segment_t fs;
/*
* We dump:
@@ -5960,7 +5961,10 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
/* Data. */
sp = perf_user_stack_pointer(regs);
+ fs = get_fs();
+ set_fs(USER_DS);
rem = __output_copy_user(handle, (void *) sp, dump_size);
+ set_fs(fs);
dyn_size = dump_size - rem;
perf_output_skip(handle, rem);
This is the start of the stable review cycle for the 4.4.148 release.
There are 43 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Aug 16 17:14:59 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.148-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.148-rc1
Guenter Roeck <linux(a)roeck-us.net>
x86/speculation/l1tf: Fix up CPU feature flags
Andi Kleen <ak(a)linux.intel.com>
x86/mm/kmmio: Make the tracer robust against L1TF
Andi Kleen <ak(a)linux.intel.com>
x86/mm/pat: Make set_memory_np() L1TF safe
Andi Kleen <ak(a)linux.intel.com>
x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
Andi Kleen <ak(a)linux.intel.com>
x86/speculation/l1tf: Invert all not present mappings
Michal Hocko <mhocko(a)suse.cz>
x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
Vlastimil Babka <vbabka(a)suse.cz>
x86/speculation/l1tf: Protect PAE swap entries against L1TF
Konrad Rzeszutek Wilk <konrad.wilk(a)oracle.com>
x86/cpufeatures: Add detection of L1D cache flush support.
Vlastimil Babka <vbabka(a)suse.cz>
x86/speculation/l1tf: Extend 64bit swap file size limit
Konrad Rzeszutek Wilk <konrad.wilk(a)oracle.com>
x86/bugs: Move the l1tf function and define pr_fmt properly
Andi Kleen <ak(a)linux.intel.com>
x86/speculation/l1tf: Limit swap file size to MAX_PA/2
Andi Kleen <ak(a)linux.intel.com>
x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
Dan Williams <dan.j.williams(a)intel.com>
mm: fix cache mode tracking in vm_insert_mixed()
Andy Lutomirski <luto(a)kernel.org>
mm: Add vm_insert_pfn_prot()
Andi Kleen <ak(a)linux.intel.com>
x86/speculation/l1tf: Add sysfs reporting for l1tf
Andi Kleen <ak(a)linux.intel.com>
x86/speculation/l1tf: Make sure the first page is always reserved
Andi Kleen <ak(a)linux.intel.com>
x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
Linus Torvalds <torvalds(a)linux-foundation.org>
x86/speculation/l1tf: Protect swap entries against L1TF
Linus Torvalds <torvalds(a)linux-foundation.org>
x86/speculation/l1tf: Change order of offset/type in swap entry
Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
mm: x86: move _PAGE_SWP_SOFT_DIRTY from bit 7 to bit 1
Dave Hansen <dave.hansen(a)linux.intel.com>
x86/mm: Fix swap entry comment and macro
Dave Hansen <dave.hansen(a)linux.intel.com>
x86/mm: Move swap offset/type up in PTE to work around erratum
Andi Kleen <ak(a)linux.intel.com>
x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
Nick Desaulniers <ndesaulniers(a)google.com>
x86/irqflags: Provide a declaration for native_save_fl
Masami Hiramatsu <mhiramat(a)kernel.org>
kprobes/x86: Fix %p uses in error messages
Jiri Kosina <jkosina(a)suse.cz>
x86/speculation: Protect against userspace-userspace spectreRSB
Peter Zijlstra <peterz(a)infradead.org>
x86/paravirt: Fix spectre-v2 mitigations for paravirt guests
Oleksij Rempel <o.rempel(a)pengutronix.de>
ARM: dts: imx6sx: fix irq for pcie bridge
Michael Mera <dev(a)michaelmera.com>
IB/ocrdma: fix out of bounds access to local buffer
Jack Morgenstein <jackm(a)dev.mellanox.co.il>
IB/mlx4: Mark user MR as writable if actual virtual memory is writable
Jack Morgenstein <jackm(a)dev.mellanox.co.il>
IB/core: Make testing MR flags for writability a static inline function
Al Viro <viro(a)zeniv.linux.org.uk>
fix __legitimize_mnt()/mntput() race
Al Viro <viro(a)zeniv.linux.org.uk>
fix mntput/mntput race
Al Viro <viro(a)zeniv.linux.org.uk>
root dentries need RCU-delayed freeing
Bart Van Assche <bart.vanassche(a)wdc.com>
scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management enabled
Hans de Goede <hdegoede(a)redhat.com>
ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices
Juergen Gross <jgross(a)suse.com>
xen/netfront: don't cache skb_shinfo()
John David Anglin <dave.anglin(a)bell.net>
parisc: Define mb() and add memory barriers to assembler unlock sequences
Helge Deller <deller(a)gmx.de>
parisc: Enable CONFIG_MLONGCALLS by default
Kees Cook <keescook(a)chromium.org>
fork: unconditionally clear stack on fork
Thomas Egerer <hakke_007(a)gmx.de>
ipv4+ipv6: Make INET*_ESP select CRYPTO_ECHAINIV
Tadeusz Struk <tadeusz.struk(a)intel.com>
tpm: fix race condition in tpm_common_write()
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix check to prevent initializing reserved inodes
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/imx6sx.dtsi | 2 +-
arch/parisc/Kconfig | 2 +-
arch/parisc/include/asm/barrier.h | 32 +++++++++++
arch/parisc/kernel/entry.S | 2 +
arch/parisc/kernel/pacache.S | 1 +
arch/parisc/kernel/syscall.S | 4 ++
arch/x86/include/asm/cpufeatures.h | 10 ++--
arch/x86/include/asm/irqflags.h | 2 +
arch/x86/include/asm/page_32_types.h | 9 +++-
arch/x86/include/asm/pgtable-2level.h | 17 ++++++
arch/x86/include/asm/pgtable-3level.h | 37 ++++++++++++-
arch/x86/include/asm/pgtable-invert.h | 32 +++++++++++
arch/x86/include/asm/pgtable.h | 84 +++++++++++++++++++++++------
arch/x86/include/asm/pgtable_64.h | 54 +++++++++++++++----
arch/x86/include/asm/pgtable_types.h | 10 ++--
arch/x86/include/asm/processor.h | 5 ++
arch/x86/kernel/cpu/bugs.c | 81 +++++++++++++++++-----------
arch/x86/kernel/cpu/common.c | 20 +++++++
arch/x86/kernel/kprobes/core.c | 4 +-
arch/x86/kernel/paravirt.c | 14 +++--
arch/x86/kernel/setup.c | 6 +++
arch/x86/mm/init.c | 23 ++++++++
arch/x86/mm/kmmio.c | 25 +++++----
arch/x86/mm/mmap.c | 21 ++++++++
arch/x86/mm/pageattr.c | 8 +--
drivers/acpi/acpi_lpss.c | 2 +
drivers/base/cpu.c | 8 +++
drivers/char/tpm/tpm-dev.c | 43 +++++++--------
drivers/infiniband/core/umem.c | 11 +---
drivers/infiniband/hw/mlx4/mr.c | 50 ++++++++++++++---
drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 2 +-
drivers/net/xen-netfront.c | 8 +--
drivers/scsi/sr.c | 29 +++++++---
fs/dcache.c | 6 ++-
fs/ext4/ialloc.c | 5 +-
fs/ext4/super.c | 8 +--
fs/namespace.c | 28 +++++++++-
include/asm-generic/pgtable.h | 12 +++++
include/linux/cpu.h | 2 +
include/linux/mm.h | 2 +
include/linux/swapfile.h | 2 +
include/linux/thread_info.h | 6 +--
include/rdma/ib_verbs.h | 14 +++++
mm/memory.c | 62 +++++++++++++++++----
mm/mprotect.c | 49 +++++++++++++++++
mm/swapfile.c | 46 ++++++++++------
net/ipv4/Kconfig | 1 +
net/ipv6/Kconfig | 1 +
49 files changed, 714 insertions(+), 192 deletions(-)
When executing 'fw_run_transaction()' with 'TCODE_WRITE_BLOCK_REQUEST',
an address of 'payload' argument is used for streaming DMA mapping by
'firewire_ohci' module if 'size' argument is larger than 8 byte.
Although in this case the address should not be on kernel stack, current
implementation of ALSA bebob driver uses data in kernel stack for a cue
to boot M-Audio devices. This often brings unexpected result, especially
for a case of CONFIG_VMAP_STACK=y.
This commit fixes the bug.
Reference: https://bugzilla.kernel.org/show_bug.cgi?id=201021
Reference: https://forum.manjaro.org/t/firewire-m-audio-410-driver-wont-load-firmware/…
Fixes: a2b2a7798fb6('ALSA: bebob: Send a cue to load firmware for M-Audio Firewire series')
Cc: <stable(a)vger.kernel.org> # v3.16+
Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
---
sound/firewire/bebob/bebob_maudio.c | 24 ++++++++++++++----------
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c
index bd55620c6a47..0c5a4cbb99ba 100644
--- a/sound/firewire/bebob/bebob_maudio.c
+++ b/sound/firewire/bebob/bebob_maudio.c
@@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
struct fw_device *device = fw_parent_device(unit);
int err, rcode;
u64 date;
- __le32 cues[3] = {
- cpu_to_le32(MAUDIO_BOOTLOADER_CUE1),
- cpu_to_le32(MAUDIO_BOOTLOADER_CUE2),
- cpu_to_le32(MAUDIO_BOOTLOADER_CUE3)
- };
+ __le32 *cues;
/* check date of software used to build */
err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE,
&date, sizeof(u64));
if (err < 0)
- goto end;
+ return err;
/*
* firmware version 5058 or later has date later than "20070401", but
* 'date' is not null-terminated.
@@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
if (date < 0x3230303730343031LL) {
dev_err(&unit->device,
"Use firmware version 5058 or later\n");
- err = -ENOSYS;
- goto end;
+ return -ENXIO;
}
+ cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL);
+ if (!cues)
+ return -ENOMEM;
+
+ cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1);
+ cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2);
+ cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3);
+
rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST,
device->node_id, device->generation,
device->max_speed, BEBOB_ADDR_REG_REQ,
- cues, sizeof(cues));
+ cues, 3 * sizeof(*cues));
+ kfree(cues);
if (rcode != RCODE_COMPLETE) {
dev_err(&unit->device,
"Failed to send a cue to load firmware\n");
err = -EIO;
}
-end:
+
return err;
}
--
2.17.1