October 2019 - Linux-stable-mirror

by Jens Axboe

Hi, For some reason I forgot to mark these stable, but they should go into stable. In order of applying them, they are: bc808bced39f4e4b626c5ea8c63d5e41fce7205a ef03681ae8df770745978148a7fb84796ae99cba a1f58ba46f794b1168d1107befcf3d4b9f9fd453 84d55dc5b9e57b513a702fbc358e1b5489651590 fb5ccc98782f654778cb8d96ba8a998304f9a51f 935d1e45908afb8853c497f2c2bbbb685dec51dc 498ccd9eda49117c34e0041563d0da6ac40e52b8 2b2ed9750fc9d040b9f6d076afcef6f00b6f1f7c Thanks! -- Jens Axboe

5 years, 2 months

3
11
0 0

Re: [PATCH 1/3] mm, meminit: Recalculate pcpu batch and high limits after init completes

by Mel Gorman

On Sat, Oct 26, 2019 at 01:10:35PM +0000, Sasha Levin wrote: > Hi, > > [This is an automated email] > > This commit has been processed because it contains a -stable tag. > The stable tag indicates that it's relevant for the following trees: 4.1+ > > The bot has tested the following trees: v5.3.7, v4.19.80, v4.14.150, v4.9.197, v4.4.197. > > v5.3.7: Build OK! > v4.19.80: Build failed! Errors: > > v4.14.150: Failed to apply! Possible dependencies: > 3c2c648842843 ("mm/page_alloc.c: fix typos in comments") > 66e8b438bd5c7 ("mm/memblock.c: make the index explicit argument of for_each_memblock_type") > c9e97a1997fbf ("mm: initialize pages on demand during boot") > > v4.9.197: Failed to apply! Possible dependencies: > 3c2c648842843 ("mm/page_alloc.c: fix typos in comments") > 66e8b438bd5c7 ("mm/memblock.c: make the index explicit argument of for_each_memblock_type") > c9e97a1997fbf ("mm: initialize pages on demand during boot") > > v4.4.197: Failed to apply! Possible dependencies: > 0a687aace3b8e ("mm,oom: do not loop !__GFP_FS allocation if the OOM killer is disabled") > 0caeef63e6d2f ("libnvdimm: Add a poison list and export badblocks") > 0e749e54244ee ("dax: increase granularity of dax_clear_blocks() operations") > 34c0fd540e79f ("mm, dax, pmem: introduce pfn_t") > 3c2c648842843 ("mm/page_alloc.c: fix typos in comments") > 3da88fb3bacfa ("mm, oom: move GFP_NOFS check to out_of_memory") > 4b94ffdc4163b ("x86, mm: introduce vmem_altmap to augment vmemmap_populate()") > 5020e285856cb ("mm, oom: give __GFP_NOFAIL allocations access to memory reserves") > 52db400fcd502 ("pmem, dax: clean up clear_pmem()") > 66e8b438bd5c7 ("mm/memblock.c: make the index explicit argument of for_each_memblock_type") > 7cf91a98e607c ("mm/compaction: speed up pageblock_pfn_to_page() when zone is contiguous") > 87ba05dff3510 ("libnvdimm: don't fail init for full badblocks list") > 8c9c1701c7c23 ("mm/memblock: introduce for_each_memblock_type()") > 9476df7d80dfc ("mm: introduce find_dev_pagemap()") > ad9a8bde2cb19 ("libnvdimm, pmem: move definition of nvdimm_namespace_add_poison to nd.h") > b2e0d1625e193 ("dax: fix lifetime of in-kernel dax mappings with dax_map_atomic()") > b95f5f4391fad ("libnvdimm: convert to statically allocated badblocks") > ba6c19fd113a3 ("include/linux/memblock.h: Clean up code for several trivial details") > c9e97a1997fbf ("mm: initialize pages on demand during boot") > > > NOTE: The patch will not be queued to stable trees until it is upstream. > > How should we proceed with this patch? > What were the 4.19.80 build errors? For the older kernels, it would have to be confirmed those kernels are definietly affected. The test machines I tried fails to even boot on those kernels so I need to find a NUMA machine that is old enough to boot those kernels and confirmed affected by the bug before determining what the backport needs to look like. -- Mel Gorman SUSE Labs

5 years, 2 months

1
0
0 0

[PATCH 4.9.y] Revert "net: sit: fix memory leak in sit_init_net()"

by Ajay Kaher

This reverts commit 375d6d454a95ebacb9c6eb0b715da05a4458ffef which is commit 07f12b26e21ab359261bf75cfcb424fdc7daeb6d upstream. Unnecessarily calling free_netdev() from sit_init_net(). ipip6_dev_free() of 4.9.y called free_netdev(), so no need to call again after ipip6_dev_free(). Cc: Mao Wenan <maowenan(a)huawei.com> Cc: David S. Miller <davem(a)davemloft.net> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ajay Kaher <akaher(a)vmware.com> --- net/ipv6/sit.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index 47ca2a2..16eba7b 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -1856,7 +1856,6 @@ static int __net_init sit_init_net(struct net *net) err_reg_dev: ipip6_dev_free(sitn->fb_tunnel_dev); - free_netdev(sitn->fb_tunnel_dev); err_alloc_dev: return err; } -- 2.7.4

5 years, 2 months

3
3
0 0

[PATCH 7/7] cifs: smbd: Return -EAGAIN when transport is reconnecting

by longli＠linuxonhyperv.com

From: Long Li <longli(a)microsoft.com> During reconnecting, the transport may have already been destroyed and is in the process being reconnected. In this case, return -EAGAIN to not fail and to retry this I/O. Signed-off-by: Long Li <longli(a)microsoft.com> Cc: stable(a)vger.kernel.org --- fs/cifs/transport.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index afe66f9cb15e..66fde7bfec4f 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -318,8 +318,11 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, int val = 1; __be32 rfc1002_marker; - if (cifs_rdma_enabled(server) && server->smbd_conn) { - rc = smbd_send(server, num_rqst, rqst); + if (cifs_rdma_enabled(server)) { + /* return -EAGAIN when connecting or reconnecting */ + rc = -EAGAIN; + if (server->smbd_conn) + rc = smbd_send(server, num_rqst, rqst); goto smbd_done; } -- 2.17.1

5 years, 2 months

2
1
0 0

[PATCH 6/7] cifs: smbd: Only queue work for error recovery on memory registration

by longli＠linuxonhyperv.com

From: Long Li <longli(a)microsoft.com> It's not necessary to queue invalidated memory registration to work queue, as all we need to do is to unmap the SG and make it usable again. This can save CPU cycles in normal data paths as memory registration errors are rare and normally only happens during reconnection. Signed-off-by: Long Li <longli(a)microsoft.com> Cc: stable(a)vger.kernel.org --- fs/cifs/smbdirect.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c index cf001f10d555..c00629a41d81 100644 --- a/fs/cifs/smbdirect.c +++ b/fs/cifs/smbdirect.c @@ -2269,12 +2269,7 @@ static void smbd_mr_recovery_work(struct work_struct *work) int rc; list_for_each_entry(smbdirect_mr, &info->mr_list, list) { - if (smbdirect_mr->state == MR_INVALIDATED) - ib_dma_unmap_sg( - info->id->device, smbdirect_mr->sgl, - smbdirect_mr->sgl_count, - smbdirect_mr->dir); - else if (smbdirect_mr->state == MR_ERROR) { + if (smbdirect_mr->state == MR_ERROR) { /* recover this MR entry */ rc = ib_dereg_mr(smbdirect_mr->mr); @@ -2602,11 +2597,20 @@ int smbd_deregister_mr(struct smbd_mr *smbdirect_mr) */ smbdirect_mr->state = MR_INVALIDATED; - /* - * Schedule the work to do MR recovery for future I/Os - * MR recovery is slow and we don't want it to block the current I/O - */ - queue_work(info->workqueue, &info->mr_recovery_work); + if (smbdirect_mr->state == MR_INVALIDATED) { + ib_dma_unmap_sg( + info->id->device, smbdirect_mr->sgl, + smbdirect_mr->sgl_count, + smbdirect_mr->dir); + smbdirect_mr->state = MR_READY; + if (atomic_inc_return(&info->mr_ready_count) == 1) + wake_up_interruptible(&info->wait_mr); + } else + /* + * Schedule the work to do MR recovery for future I/Os + * MR recovery is slow and we don't want it to block the + * current I/O */ + queue_work(info->workqueue, &info->mr_recovery_work); done: if (atomic_dec_and_test(&info->mr_used_count)) -- 2.17.1

5 years, 2 months

2
1
0 0

RE: Patch "x86/hyperv: Make vapic support x2apic mode" has been added to the 4.19-stable tree

by Michael Kelley

From: gregkh(a)linuxfoundation.org <gregkh(a)linuxfoundation.org> > > This is a note to let you know that I've just added the patch titled > > x86/hyperv: Make vapic support x2apic mode > > to the 4.19-stable tree which can be found at: > > https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git > > The filename of the patch is: > x86-hyperv-make-vapic-support-x2apic-mode.patch > and it can be found in the queue-4.19 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > > From e211288b72f15259da86eed6eca680758dbe9e74 Mon Sep 17 00:00:00 2001 > From: Roman Kagan <rkagan(a)virtuozzo.com> > Date: Thu, 10 Oct 2019 12:33:05 +0000 > Subject: x86/hyperv: Make vapic support x2apic mode > > From: Roman Kagan <rkagan(a)virtuozzo.com> > > commit e211288b72f15259da86eed6eca680758dbe9e74 upstream. > > Now that there's Hyper-V IOMMU driver, Linux can switch to x2apic mode > when supported by the vcpus. > This patch should not go back to the 4.19 stable tree. I don't think it will break anything, but there's no Hyper-V vIOMMU driver in 4.19 so x2apic_enabled() is never true. Michael

5 years, 2 months

2
1
0 0

[PATCH for-stable-4.14 00/48] arm64 spec mitigation backports

by Ard Biesheuvel

This is a backport to v4.14 of the arm64 patches that exist in mainline and v4.19-stable to support CPUs that implement the SSBS capability, which gives the OS and user space control over whether Speculative Store Bypass is permitted in certain contexts. This gives a substantial performance boost on hardware that implements it. At the same time, this series backports arm64 support for reporting of vulnerabilities via syfs. This is covered by the same series since it produces a much cleaner backport, where none of the 16 original patches required any changes beyond some manual mangling of the context to make them apply. NOTE: in addition to the 16 patches that were also backported to v4.19 earlier, this series contains an additional 32 (!) patches that were included as prerequisites, even though by themselves they wouldn't qualify as stable backports. This was a conscious decision, and made the backport considerably cleaner, and should also make future backports of arm64 specific fixes less painful. Build tested using a fair number of randconfig builds. Boot tested under KVM and on ThunderX2. Many thanks to Suzuki and Alexandru for the internal review and testing. Cc: Will Deacon <will(a)kernel.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Marc Zyngier <maz(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com> Cc: Jeremy Linton <jeremy.linton(a)arm.com> Cc: Andre Przywara <andre.przywara(a)arm.com> Cc: Alexandru Elisei <alexandru.elisei(a)arm.com> Dave Martin (1): arm64: capabilities: Update prototype for enable call back Dongjiu Geng (1): arm64: v8.4: Support for new floating point multiplication instructions James Morse (1): arm64: sysreg: Move to use definitions for all the SCTLR bits Jeremy Linton (6): arm64: add sysfs vulnerability show for meltdown arm64: Always enable ssb vulnerability detection arm64: Provide a command line to disable spectre_v2 mitigation arm64: Always enable spectre-v2 vulnerability detection arm64: add sysfs vulnerability show for spectre-v2 arm64: add sysfs vulnerability show for speculative store bypass Josh Poimboeuf (1): arm64/speculation: Support 'mitigations=' cmdline option Marc Zyngier (4): arm64: Get rid of __smccc_workaround_1_hvc_* arm64: Advertise mitigation of Spectre-v2, or lack thereof arm64: Force SSBS on context switch arm64: Use firmware to detect CPUs that are not affected by Spectre-v2 Mark Rutland (5): arm64: move SCTLR_EL{1,2} assertions to <asm/sysreg.h> arm64: add PSR_AA32_* definitions arm64: Introduce sysreg_clear_set() arm64: don't zero DIT on signal return arm64: fix SSBS sanitization Mian Yousaf Kaukab (2): arm64: Add sysfs vulnerability show for spectre-v1 arm64: enable generic CPU vulnerabilites support Shanker Donthineni (1): arm64: KVM: Use SMCCC_ARCH_WORKAROUND_1 for Falkor BP hardening Suzuki K Poulose (22): arm64: Expose support for optional ARMv8-A features arm64: Fix the feature type for ID register fields arm64: Documentation: cpu-feature-registers: Remove RES0 fields arm64: Expose Arm v8.4 features arm64: capabilities: Move errata work around check on boot CPU arm64: capabilities: Move errata processing code arm64: capabilities: Prepare for fine grained capabilities arm64: capabilities: Add flags to handle the conflicts on late CPU arm64: capabilities: Unify the verification arm64: capabilities: Filter the entries based on a given mask arm64: capabilities: Prepare for grouping features and errata work arounds arm64: capabilities: Split the processing of errata work arounds arm64: capabilities: Allow features based on local CPU scope arm64: capabilities: Group handling of features and errata workarounds arm64: capabilities: Introduce weak features based on local CPU arm64: capabilities: Restrict KPTI detection to boot-time CPUs arm64: capabilities: Add support for features enabled early arm64: capabilities: Change scope of VHE to Boot CPU feature arm64: capabilities: Clean up midr range helpers arm64: Add helpers for checking CPU MIDR against a range arm64: Add MIDR encoding for Arm Cortex-A55 and Cortex-A35 arm64: capabilities: Add support for checks based on a list of MIDRs Will Deacon (4): arm64: cpufeature: Detect SSBS and advertise to userspace arm64: ssbd: Add support for PSTATE.SSBS rather than trapping to EL3 KVM: arm64: Set SCTLR_EL2.DSSBS if SSBD is forcefully disabled and !vhe arm64: ssbs: Don't treat CPUs with SSBS as unaffected by SSB Documentation/admin-guide/kernel-parameters.txt | 16 +- Documentation/arm64/cpu-feature-registers.txt | 26 +- arch/arm64/Kconfig | 1 + arch/arm64/include/asm/cpucaps.h | 6 +- arch/arm64/include/asm/cpufeature.h | 250 +++++++++- arch/arm64/include/asm/cputype.h | 43 ++ arch/arm64/include/asm/kvm_asm.h | 2 - arch/arm64/include/asm/kvm_host.h | 11 + arch/arm64/include/asm/processor.h | 22 +- arch/arm64/include/asm/ptrace.h | 58 ++- arch/arm64/include/asm/sysreg.h | 95 +++- arch/arm64/include/asm/virt.h | 6 - arch/arm64/include/uapi/asm/hwcap.h | 12 + arch/arm64/include/uapi/asm/ptrace.h | 1 + arch/arm64/kernel/bpi.S | 19 +- arch/arm64/kernel/cpu_errata.c | 495 +++++++++++-------- arch/arm64/kernel/cpufeature.c | 517 ++++++++++++++------ arch/arm64/kernel/cpuinfo.c | 12 + arch/arm64/kernel/fpsimd.c | 1 + arch/arm64/kernel/head.S | 13 +- arch/arm64/kernel/process.c | 31 ++ arch/arm64/kernel/ptrace.c | 13 +- arch/arm64/kernel/smp.c | 44 -- arch/arm64/kernel/ssbd.c | 22 + arch/arm64/kernel/traps.c | 4 +- arch/arm64/kvm/hyp/entry.S | 12 - arch/arm64/kvm/hyp/switch.c | 10 - arch/arm64/kvm/hyp/sysreg-sr.c | 11 + arch/arm64/mm/fault.c | 3 +- arch/arm64/mm/proc.S | 24 +- 30 files changed, 1268 insertions(+), 512 deletions(-) -- 2.20.1

5 years, 2 months

4
58
0 0

[PATCH 1/2] iio: adis16480: Fix scales factors

by Nuno Sá

This patch fixes the scales for the gyroscope, accelerometer and barometer. The pressure scale was just wrong. For the others, the scale factors were not taking into account that a 32bit word is being read from the device. Fixes: 7abad1063deb ("iio: adis16480: Fix scale factors") Fixes: 9fe09f1337ee ("iio: imu: adis16480: Add support for ADIS1649x family of devices") Fixes: 49c4a18357c8 ("iio: imu: adis16480: Add support for ADIS16490") Cc: <Stable(a)vger.kernel.org> Signed-off-by: Nuno Sá <nuno.sa(a)analog.com> --- drivers/iio/imu/adis16480.c | 77 ++++++++++++++++++++----------------- 1 file changed, 41 insertions(+), 36 deletions(-) diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c index b99d73887c9f..3b53bbb11bfb 100644 --- a/drivers/iio/imu/adis16480.c +++ b/drivers/iio/imu/adis16480.c @@ -620,9 +620,13 @@ static int adis16480_read_raw(struct iio_dev *indio_dev, *val2 = (st->chip_info->temp_scale % 1000) * 1000; return IIO_VAL_INT_PLUS_MICRO; case IIO_PRESSURE: - *val = 0; - *val2 = 4000; /* 40ubar = 0.004 kPa */ - return IIO_VAL_INT_PLUS_MICRO; + /* + * max scale is 1310 mbar + * max raw value is 32767 shifted for 32bits + */ + *val = 131; /* 1310mbar = 131 kPa */ + *val2 = 32767 << 16; + return IIO_VAL_FRACTIONAL; default: return -EINVAL; } @@ -783,13 +787,14 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { .channels = adis16485_channels, .num_channels = ARRAY_SIZE(adis16485_channels), /* - * storing the value in rad/degree and the scale in degree - * gives us the result in rad and better precession than - * storing the scale directly in rad. + * Typically we do IIO_RAD_TO_DEGREE in the denominator, which + * is exactly the same as IIO_DEGREE_TO_RAD in numerator, since + * it gives better approximation. However, in this case we + * cannot do it since it would not fit in a 32bit variable. */ - .gyro_max_val = IIO_RAD_TO_DEGREE(22887), - .gyro_max_scale = 300, - .accel_max_val = IIO_M_S_2_TO_G(21973), + .gyro_max_val = 22887 << 16, + .gyro_max_scale = IIO_DEGREE_TO_RAD(300), + .accel_max_val = IIO_M_S_2_TO_G(21973 << 16), .accel_max_scale = 18, .temp_scale = 5650, /* 5.65 milli degree Celsius */ .int_clk = 2460000, @@ -799,9 +804,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { [ADIS16480] = { .channels = adis16480_channels, .num_channels = ARRAY_SIZE(adis16480_channels), - .gyro_max_val = IIO_RAD_TO_DEGREE(22500), - .gyro_max_scale = 450, - .accel_max_val = IIO_M_S_2_TO_G(12500), + .gyro_max_val = 22500 << 16, + .gyro_max_scale = IIO_DEGREE_TO_RAD(450), + .accel_max_val = IIO_M_S_2_TO_G(12500 << 16), .accel_max_scale = 10, .temp_scale = 5650, /* 5.65 milli degree Celsius */ .int_clk = 2460000, @@ -811,9 +816,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { [ADIS16485] = { .channels = adis16485_channels, .num_channels = ARRAY_SIZE(adis16485_channels), - .gyro_max_val = IIO_RAD_TO_DEGREE(22500), - .gyro_max_scale = 450, - .accel_max_val = IIO_M_S_2_TO_G(20000), + .gyro_max_val = 22500 << 16, + .gyro_max_scale = IIO_DEGREE_TO_RAD(450), + .accel_max_val = IIO_M_S_2_TO_G(20000 << 16), .accel_max_scale = 5, .temp_scale = 5650, /* 5.65 milli degree Celsius */ .int_clk = 2460000, @@ -823,9 +828,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { [ADIS16488] = { .channels = adis16480_channels, .num_channels = ARRAY_SIZE(adis16480_channels), - .gyro_max_val = IIO_RAD_TO_DEGREE(22500), - .gyro_max_scale = 450, - .accel_max_val = IIO_M_S_2_TO_G(22500), + .gyro_max_val = 22500 << 16, + .gyro_max_scale = IIO_DEGREE_TO_RAD(450), + .accel_max_val = IIO_M_S_2_TO_G(22500 << 16), .accel_max_scale = 18, .temp_scale = 5650, /* 5.65 milli degree Celsius */ .int_clk = 2460000, @@ -835,9 +840,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { [ADIS16495_1] = { .channels = adis16485_channels, .num_channels = ARRAY_SIZE(adis16485_channels), - .gyro_max_val = IIO_RAD_TO_DEGREE(20000), - .gyro_max_scale = 125, - .accel_max_val = IIO_M_S_2_TO_G(32000), + .gyro_max_val = 20000 << 16, + .gyro_max_scale = IIO_DEGREE_TO_RAD(125), + .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), .accel_max_scale = 8, .temp_scale = 12500, /* 12.5 milli degree Celsius */ .int_clk = 4250000, @@ -848,9 +853,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { [ADIS16495_2] = { .channels = adis16485_channels, .num_channels = ARRAY_SIZE(adis16485_channels), - .gyro_max_val = IIO_RAD_TO_DEGREE(18000), - .gyro_max_scale = 450, - .accel_max_val = IIO_M_S_2_TO_G(32000), + .gyro_max_val = 18000 << 16, + .gyro_max_scale = IIO_DEGREE_TO_RAD(450), + .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), .accel_max_scale = 8, .temp_scale = 12500, /* 12.5 milli degree Celsius */ .int_clk = 4250000, @@ -861,9 +866,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { [ADIS16495_3] = { .channels = adis16485_channels, .num_channels = ARRAY_SIZE(adis16485_channels), - .gyro_max_val = IIO_RAD_TO_DEGREE(20000), - .gyro_max_scale = 2000, - .accel_max_val = IIO_M_S_2_TO_G(32000), + .gyro_max_val = 20000 << 16, + .gyro_max_scale = IIO_DEGREE_TO_RAD(2000), + .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), .accel_max_scale = 8, .temp_scale = 12500, /* 12.5 milli degree Celsius */ .int_clk = 4250000, @@ -874,9 +879,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { [ADIS16497_1] = { .channels = adis16485_channels, .num_channels = ARRAY_SIZE(adis16485_channels), - .gyro_max_val = IIO_RAD_TO_DEGREE(20000), - .gyro_max_scale = 125, - .accel_max_val = IIO_M_S_2_TO_G(32000), + .gyro_max_val = 20000 << 16, + .gyro_max_scale = IIO_DEGREE_TO_RAD(125), + .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), .accel_max_scale = 40, .temp_scale = 12500, /* 12.5 milli degree Celsius */ .int_clk = 4250000, @@ -887,9 +892,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { [ADIS16497_2] = { .channels = adis16485_channels, .num_channels = ARRAY_SIZE(adis16485_channels), - .gyro_max_val = IIO_RAD_TO_DEGREE(18000), - .gyro_max_scale = 450, - .accel_max_val = IIO_M_S_2_TO_G(32000), + .gyro_max_val = 18000 << 16, + .gyro_max_scale = IIO_DEGREE_TO_RAD(450), + .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), .accel_max_scale = 40, .temp_scale = 12500, /* 12.5 milli degree Celsius */ .int_clk = 4250000, @@ -900,9 +905,9 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { [ADIS16497_3] = { .channels = adis16485_channels, .num_channels = ARRAY_SIZE(adis16485_channels), - .gyro_max_val = IIO_RAD_TO_DEGREE(20000), - .gyro_max_scale = 2000, - .accel_max_val = IIO_M_S_2_TO_G(32000), + .gyro_max_val = 20000 << 16, + .gyro_max_scale = IIO_DEGREE_TO_RAD(2000), + .accel_max_val = IIO_M_S_2_TO_G(32000 << 16), .accel_max_scale = 40, .temp_scale = 12500, /* 12.5 milli degree Celsius */ .int_clk = 4250000, -- 2.23.0

5 years, 2 months

2
1
0 0

[v4.4.y] net: sched: Fix memory exposure from short TCA_U32_SEL

by Zubin Mithra

From: Kees Cook <keescook(a)chromium.org> commit 98c8f125fd8a6240ea343c1aa50a1be9047791b8 upstream Via u32_change(), TCA_U32_SEL has an unspecified type in the netlink policy, so max length isn't enforced, only minimum. This means nkeys (from userspace) was being trusted without checking the actual size of nla_len(), which could lead to a memory over-read, and ultimately an exposure via a call to u32_dump(). Reachability is CAP_NET_ADMIN within a namespace. Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Jamal Hadi Salim <jhs(a)mojatatu.com> Cc: Cong Wang <xiyou.wangcong(a)gmail.com> Cc: Jiri Pirko <jiri(a)resnulli.us> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: netdev(a)vger.kernel.org Signed-off-by: Kees Cook <keescook(a)chromium.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Zubin Mithra <zsm(a)chromium.org> --- Notes: * Syzkaller triggered an OOB read in u32_change with the following stacktrace: [<ffffffff81cb8911>] __dump_stack lib/dump_stack.c:15 [inline] [<ffffffff81cb8911>] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [<ffffffff81525640>] print_trailer+0x151/0x15a mm/slub.c:658 [<ffffffff81525913>] object_err+0x35/0x3d mm/slub.c:665 [<ffffffff8152619f>] print_address_description mm/kasan/report.c:188 [inline] [<ffffffff8152619f>] kasan_report_error mm/kasan/report.c:285 [inline] [<ffffffff8152619f>] kasan_report.part.0.cold+0x21a/0x4c1 mm/kasan/report.c:310 [<ffffffff814ec0a5>] kasan_report+0x25/0x30 mm/kasan/report.c:297 [<ffffffff814eb336>] check_memory_region_inline mm/kasan/kasan.c:292 [inline] [<ffffffff814eb336>] check_memory_region+0x116/0x190 mm/kasan/kasan.c:299 [<ffffffff814eb7d4>] memcpy+0x24/0x50 mm/kasan/kasan.c:334 [<ffffffff823b6d33>] u32_change+0xb03/0x1e60 net/sched/cls_u32.c:844 [<ffffffff8232f1a0>] tc_ctl_tfilter+0xc20/0x15f0 net/sched/cls_api.c:335 [<ffffffff822d82e5>] rtnetlink_rcv_msg+0x4f5/0x6d0 net/core/rtnetlink.c:3605 [<ffffffff823c92ef>] netlink_rcv_skb+0xdf/0x2f0 net/netlink/af_netlink.c:2361 [<ffffffff822d7de0>] rtnetlink_rcv+0x30/0x40 net/core/rtnetlink.c:3611 [<ffffffff823c7f02>] netlink_unicast_kernel net/netlink/af_netlink.c:1277 [inline] [<ffffffff823c7f02>] netlink_unicast+0x462/0x650 net/netlink/af_netlink.c:1303 [<ffffffff823c8891>] netlink_sendmsg+0x7a1/0xc50 net/netlink/af_netlink.c:1859 [<ffffffff8223b165>] sock_sendmsg_nosec net/socket.c:627 [inline] [<ffffffff8223b165>] sock_sendmsg+0xd5/0x110 net/socket.c:637 [<ffffffff8223ebe7>] ___sys_sendmsg+0x767/0x890 net/socket.c:1964 [<ffffffff8224175b>] __sys_sendmsg+0xbb/0x150 net/socket.c:1998 [<ffffffff82241822>] SYSC_sendmsg net/socket.c:2009 [inline] [<ffffffff82241822>] SyS_sendmsg+0x32/0x50 net/socket.c:2005 [<ffffffff82a489e7>] entry_SYSCALL_64_fastpath+0x1e/0xa0 * The commit is present in linux-4.9.y. * This backport is similar to the commit in linux-4.9.y and addresses conflicts related to struct_size() not being present. * Tests run: Chrome OS tryjobs, Syzkaller reproducer net/sched/cls_u32.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 4fbb67430ce48..4d745a2efd201 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -734,6 +734,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, struct nlattr *opt = tca[TCA_OPTIONS]; struct nlattr *tb[TCA_U32_MAX + 1]; u32 htid; + size_t sel_size; int err; #ifdef CONFIG_CLS_U32_PERF size_t size; @@ -827,8 +828,11 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, return -EINVAL; s = nla_data(tb[TCA_U32_SEL]); + sel_size = sizeof(*s) + sizeof(*s->keys) * s->nkeys; + if (nla_len(tb[TCA_U32_SEL]) < sel_size) + return -EINVAL; - n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL); + n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL); if (n == NULL) return -ENOBUFS; @@ -841,7 +845,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, } #endif - memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key)); + memcpy(&n->sel, s, sel_size); RCU_INIT_POINTER(n->ht_up, ht); n->handle = handle; n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0; -- 2.23.0.866.gb869b98d4c-goog

5 years, 2 months

2
1
0 0

stable/4.14.y: kvm: vmx: Basic APIC virtualization controls have three settings

by Jitindar SIngh, Suraj

The following patch fixes a bug where the guest is still able to access the apic registers via mmio once the apic has been disabled. 8d860bbeedef kvm: vmx: Basic APIC virtualization controls have three settings This causes the x86/apic kvm-unit-test to fail when run on a host missing this patch. Without: FAIL: apic_disable: *0xfee00030: 50014 FAIL: apic_disable: CR8: f PASS: apic_disable: CR8: f FAIL: apic_disable: *0xfee00080: f0 With: PASS: apic_disable: *0xfee00030: ffffffff PASS: apic_disable: CR8: 0 PASS: apic_disable: CR8: f PASS: apic_disable: *0xfee00080: ffffffff This patch has been upstream as of v4.18. This patch has 3 dependencies which introduce no functional change, however they add context which allows the patch listed above to apply cleanly. c2ba05ccfde2 KVM: X86: introduce invalidate_gpa argument to tlb flush 588716494258 kvm: vmx: Introduce lapic_mode enumeration a468f2dbf921 kvm: apic: Flush TLB after APIC mode/address change if VPIDs are in use This patch series should be applied against 4.14.y

5 years, 2 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror October 2019