The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: e361362b08cab1098b64b0e5fd8c879f086b3f46
Gitweb: https://git.kernel.org/tip/e361362b08cab1098b64b0e5fd8c879f086b3f46
Author: Thomas Gleixner <tglx(a)linutronix.de>
AuthorDate: Wed, 23 Oct 2019 20:05:49 +02:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Tue, 05 Nov 2019 00:51:35 +01:00
x86/dumpstack/64: Don't evaluate exception stacks before setup
Cyrill reported the following crash:
BUG: unable to handle page fault for address: 0000000000001ff0
#PF: supervisor read access in kernel mode
RIP: 0010:get_stack_info+0xb3/0x148
It turns out that if the stack tracer is invoked before the exception stack
mappings are initialized in_exception_stack() can erroneously classify an
invalid address as an address inside of an exception stack:
begin = this_cpu_read(cea_exception_stacks); <- 0
end = begin + sizeof(exception stacks);
i.e. any address between 0 and end will be considered as exception stack
address and the subsequent code will then try to derefence the resulting
stack frame at a non mapped address.
end = begin + (unsigned long)ep->size;
==> end = 0x2000
regs = (struct pt_regs *)end - 1;
==> regs = 0x2000 - sizeof(struct pt_regs *) = 0x1ff0
info->next_sp = (unsigned long *)regs->sp;
==> Crashes due to accessing 0x1ff0
Prevent this by checking the validity of the cea_exception_stack base
address and bailing out if it is zero.
Fixes: afcd21dad88b ("x86/dumpstack/64: Use cpu_entry_area instead of orig_ist")
Reported-by: Cyrill Gorcunov <gorcunov(a)gmail.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Tested-by: Cyrill Gorcunov <gorcunov(a)gmail.com>
Acked-by: Josh Poimboeuf <jpoimboe(a)redhat.com>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1910231950590.1852@nanos.tec.linu…
---
arch/x86/kernel/dumpstack_64.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index 753b8cf..87b9789 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -94,6 +94,13 @@ static bool in_exception_stack(unsigned long *stack, struct stack_info *info)
BUILD_BUG_ON(N_EXCEPTION_STACKS != 6);
begin = (unsigned long)__this_cpu_read(cea_exception_stacks);
+ /*
+ * Handle the case where stack trace is collected _before_
+ * cea_exception_stacks had been initialized.
+ */
+ if (!begin)
+ return false;
+
end = begin + sizeof(struct cea_exception_stacks);
/* Bail if @stack is outside the exception stack area. */
if (stk < begin || stk >= end)
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 95180e47e77a - Linux 5.3.8
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://artifacts.cki-project.org/pipelines/263637
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out the following commit:
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 95180e47e77a - Linux 5.3.8
We grabbed the e2bf0eb6cdbe commit of the stable queue repository.
We then merged the patchset with `git am`:
io_uring-fix-up-o_nonblock-handling-for-sockets.patch
dm-snapshot-introduce-account_start_copy-and-account.patch
dm-snapshot-rework-cow-throttling-to-fix-deadlock.patch
btrfs-fix-inode-cache-block-reserve-leak-on-failure-.patch
btrfs-qgroup-always-free-prealloc-meta-reserve-in-bt.patch
iio-adc-meson_saradc-fix-memory-allocation-order.patch
iio-fix-center-temperature-of-bmc150-accel-core.patch
libsubcmd-make-_fortify_source-defines-dependent-on-.patch
perf-tests-avoid-raising-segv-using-an-obvious-null-.patch
perf-map-fix-overlapped-map-handling.patch
perf-script-brstackinsn-fix-recovery-from-lbr-binary.patch
perf-jevents-fix-period-for-intel-fixed-counters.patch
perf-tools-propagate-get_cpuid-error.patch
perf-annotate-propagate-perf_env__arch-error.patch
perf-annotate-fix-the-signedness-of-failure-returns.patch
perf-annotate-propagate-the-symbol__annotate-error-r.patch
perf-annotate-fix-arch-specific-init-failure-errors.patch
perf-annotate-return-appropriate-error-code-for-allo.patch
perf-annotate-don-t-return-1-for-error-when-doing-bp.patch
staging-rtl8188eu-fix-null-dereference-when-kzalloc-.patch
rdma-siw-fix-serialization-issue-in-write_space.patch
rdma-hfi1-prevent-memory-leak-in-sdma_init.patch
rdma-iw_cxgb4-fix-srq-access-from-dump_qp.patch
rdma-iwcm-fix-a-lock-inversion-issue.patch
hid-hyperv-use-in-place-iterator-api-in-the-channel-.patch
kselftest-exclude-failed-targets-from-runlist.patch
selftests-kselftest-runner.sh-add-45-second-timeout-.patch
nfs-fix-nfsi-nrequests-count-error-on-nfs_inode_remo.patch
arm64-cpufeature-effectively-expose-frint-capability.patch
arm64-fix-incorrect-irqflag-restore-for-priority-mas.patch
arm64-ftrace-ensure-synchronisation-in-plt-setup-for.patch
tty-serial-owl-fix-the-link-time-qualifier-of-owl_ua.patch
tty-serial-rda-fix-the-link-time-qualifier-of-rda_ua.patch
serial-sifive-select-serial_earlycon.patch
tty-n_hdlc-fix-build-on-sparc.patch
misc-fastrpc-prevent-memory-leak-in-fastrpc_dma_buf_.patch
rdma-core-fix-an-error-handling-path-in-res_get_comm.patch
rdma-cm-fix-memory-leak-in-cm_add-remove_one.patch
rdma-nldev-reshuffle-the-code-to-avoid-need-to-rebin.patch
rdma-mlx5-do-not-allow-rereg-of-a-odp-mr.patch
rdma-mlx5-order-num_pending_prefetch-properly-with-s.patch
rdma-mlx5-add-missing-synchronize_srcu-for-mw-cases.patch
gpio-max77620-use-correct-unit-for-debounce-times.patch
fs-cifs-mute-wunused-const-variable-message.patch
arm64-vdso32-fix-broken-compat-vdso-build-warnings.patch
arm64-vdso32-detect-binutils-support-for-dmb-ishld.patch
serial-mctrl_gpio-check-for-null-pointer.patch
serial-8250_omap-fix-gpio-check-for-auto-rts-cts.patch
arm64-default-to-building-compat-vdso-with-clang-whe.patch
arm64-vdso32-don-t-use-kbuild_cppflags-unconditional.patch
efi-cper-fix-endianness-of-pcie-class-code.patch
efi-x86-do-not-clean-dummy-variable-in-kexec-path.patch
mips-include-mark-__cmpxchg-as-__always_inline.patch
riscv-avoid-kernel-hangs-when-trapped-in-bug.patch
riscv-avoid-sending-a-sigtrap-to-a-user-thread-trapp.patch
riscv-correct-the-handling-of-unexpected-ebreak-in-d.patch
x86-xen-return-from-panic-notifier.patch
ocfs2-clear-zero-in-unaligned-direct-io.patch
fs-ocfs2-fix-possible-null-pointer-dereferences-in-o.patch
fs-ocfs2-fix-a-possible-null-pointer-dereference-in-.patch
fs-ocfs2-fix-a-possible-null-pointer-dereference-in-.patch
btrfs-silence-maybe-uninitialized-warning-in-clone_r.patch
arm64-armv8_deprecated-checking-return-value-for-mem.patch
x86-cpu-add-comet-lake-to-the-intel-cpu-models-heade.patch
sched-fair-scale-bandwidth-quota-and-period-without-.patch
sched-vtime-fix-guest-system-mis-accounting-on-task-.patch
perf-core-rework-memory-accounting-in-perf_mmap.patch
perf-core-fix-corner-case-in-perf_rotate_context.patch
perf-x86-amd-change-fix-nmi-latency-mitigation-to-us.patch
drm-amdgpu-fix-memory-leak.patch
iio-imu-adis16400-release-allocated-memory-on-failur.patch
iio-imu-adis16400-fix-memory-leak.patch
iio-imu-st_lsm6dsx-fix-waitime-for-st_lsm6dsx-i2c-co.patch
mips-include-mark-__xchg-as-__always_inline.patch
mips-fw-sni-fix-out-of-bounds-init-of-o32-stack.patch
s390-cio-fix-virtio-ccw-dma-without-pv.patch
virt-vbox-fix-memory-leak-in-hgcm_call_preprocess_li.patch
nbd-fix-possible-sysfs-duplicate-warning.patch
nfsv4-fix-leak-of-clp-cl_acceptor-string.patch
sunrpc-fix-race-to-sk_err-after-xs_error_report.patch
s390-uaccess-avoid-false-positive-compiler-warnings.patch
tracing-initialize-iter-seq-after-zeroing-in-tracing.patch
perf-annotate-fix-multiple-memory-and-file-descripto.patch
perf-aux-fix-tracking-of-auxiliary-trace-buffer-allo.patch
usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch
nbd-verify-socket-is-supported-during-setup.patch
arm64-dts-qcom-add-lenovo-miix-630.patch
arm64-dts-qcom-add-hp-envy-x2.patch
arm64-dts-qcom-add-asus-novago-tp370ql.patch
rtw88-fix-misuse-of-genmask-macro.patch
s390-pci-fix-msi-message-data.patch
thunderbolt-correct-path-indices-for-pcie-tunnel.patch
thunderbolt-use-32-bit-writes-when-writing-ring-prod.patch
ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch
fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch
fuse-truncate-pending-writes-on-o_trunc.patch
alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch
alsa-timer-fix-mutex-deadlock-at-releasing-card.patch
alsa-hda-realtek-fix-2-front-mics-of-codec-0x623.patch
alsa-hda-realtek-add-support-for-alc623.patch
ath10k-fix-latency-issue-for-qca988x.patch
uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch
nl80211-fix-validation-of-mesh-path-nexthop.patch
usb-gadget-reject-endpoints-with-0-maxpacket-value.patch
usb-storage-revert-commit-747668dbc061-usb-storage-set-virt_boundary_mask-to-avoid-sg-overflows.patch
usb-ldusb-fix-ring-buffer-locking.patch
usb-ldusb-fix-control-message-timeout.patch
usb-xhci-fix-immediate-data-transfer-endianness.patch
usb-xhci-fix-__le32-__le64-accessors-in-debugfs-code.patch
usb-serial-whiteheat-fix-potential-slab-corruption.patch
usb-serial-whiteheat-fix-line-speed-endianness.patch
xhci-fix-use-after-free-regression-in-xhci-clear-hub-tt-implementation.patch
scsi-qla2xxx-fix-partial-flash-write-of-mbi.patch
scsi-target-cxgbit-fix-cxgbit_fw4_ack.patch
hid-i2c-hid-add-trekstor-primebook-c11b-to-descriptor-override.patch
hid-fix-assumption-that-devices-have-inputs.patch
hid-fix-error-message-in-hid_open_report.patch
hid-logitech-hidpp-split-g920_get_config.patch
hid-logitech-hidpp-rework-device-validation.patch
hid-logitech-hidpp-do-all-ff-cleanup-in-hidpp_ff_destroy.patch
um-ubd-entrust-re-queue-to-the-upper-layers.patch
s390-unwind-fix-mixing-regs-and-sp.patch
s390-cmm-fix-information-leak-in-cmm_timeout_handler.patch
s390-idle-fix-cpu-idle-time-calculation.patch
arc-perf-accommodate-big-endian-cpu.patch
ib-hfi1-avoid-excessive-retry-for-tid-rdma-read-request.patch
arm64-ensure-vm_write-vm_shared-ptes-are-clean-by-default.patch
arm64-cpufeature-enable-qualcomm-falkor-kryo-errata-1003.patch
virtio_ring-fix-stalls-for-packed-rings.patch
rtlwifi-rtl_pci-fix-problem-of-too-small-skb-len.patch
rtlwifi-fix-potential-overflow-on-p2p-code.patch
kvm-vmx-svm-always-run-with-efer.nxe-1-when-shadow-paging-is-active.patch
dmaengine-qcom-bam_dma-fix-resource-leak.patch
dmaengine-tegra210-adma-fix-transfer-failure.patch
dmaengine-imx-sdma-fix-size-check-for-sdma-script_number.patch
dmaengine-cppi41-fix-cppi41_dma_prep_slave_sg-when-idle.patch
drm-amdgpu-gmc10-properly-set-bank_select-and-fragment_size.patch
drm-i915-fix-pch-reference-clock-for-fdi-on-hsw-bdw.patch
drm-amdgpu-gfx10-update-gfx-golden-settings.patch
drm-amdgpu-powerplay-vega10-allow-undervolting-in-p7.patch
drm-amdgpu-fix-sdma-hang-when-performing-vkexample-test.patch
nfs-fix-an-rcu-lock-leak-in-nfs4_refresh_delegation_stateid.patch
io_uring-ensure-we-clear-io_kiocb-result-before-each-issue.patch
iommu-vt-d-fix-panic-after-kexec-p-for-kdump.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test
✅ xfstests: xfs
✅ selinux-policy: serge-testsuite
✅ storage: software RAID testing
🚧 ✅ Storage blktests
Host 2:
✅ Boot test
✅ Podman system integration test (as root)
✅ Podman system integration test (as user)
✅ LTP lite
✅ Loopdev Sanity
✅ jvm test suite
✅ AMTU (Abstract Machine Test Utility)
✅ LTP: openposix test suite
✅ Ethernet drivers sanity
✅ Networking socket: fuzz
✅ audit: audit testsuite test
✅ httpd: mod_ssl smoke sanity
✅ iotop: sanity
✅ tuned: tune-processes-through-perf
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ Usex - version 1.9-29
✅ storage: SCSI VPD
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ storage: dm/common
ppc64le:
Host 1:
✅ Boot test
✅ xfstests: xfs
✅ selinux-policy: serge-testsuite
✅ storage: software RAID testing
🚧 ✅ Storage blktests
Host 2:
✅ Boot test
✅ Podman system integration test (as root)
✅ Podman system integration test (as user)
✅ LTP lite
✅ Loopdev Sanity
✅ jvm test suite
✅ AMTU (Abstract Machine Test Utility)
✅ LTP: openposix test suite
✅ Ethernet drivers sanity
✅ Networking socket: fuzz
✅ audit: audit testsuite test
✅ httpd: mod_ssl smoke sanity
✅ iotop: sanity
✅ tuned: tune-processes-through-perf
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ Usex - version 1.9-29
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ storage: dm/common
x86_64:
Host 1:
✅ Boot test
✅ Podman system integration test (as root)
✅ Podman system integration test (as user)
✅ LTP lite
✅ Loopdev Sanity
✅ jvm test suite
✅ AMTU (Abstract Machine Test Utility)
✅ LTP: openposix test suite
✅ Ethernet drivers sanity
✅ Networking socket: fuzz
✅ audit: audit testsuite test
✅ httpd: mod_ssl smoke sanity
✅ iotop: sanity
✅ tuned: tune-processes-through-perf
✅ pciutils: sanity smoke test
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ Usex - version 1.9-29
✅ storage: SCSI VPD
✅ stress: stress-ng
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ storage: dm/common
Host 2:
✅ Boot test
✅ xfstests: xfs
✅ selinux-policy: serge-testsuite
✅ storage: software RAID testing
🚧 ✅ IOMMU boot test
🚧 ✅ Storage blktests
Host 3:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
🚧 ⚡⚡⚡ /kernel/infiniband/env_setup
🚧 ⚡⚡⚡ /kernel/infiniband/sanity
Host 4:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
🚧 ⚡⚡⚡ /kernel/infiniband/env_setup
🚧 ⚡⚡⚡ /kernel/infiniband/sanity
Host 5:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
🚧 ⚡⚡⚡ /kernel/infiniband/env_setup
🚧 ⚡⚡⚡ /kernel/infiniband/sanity
Host 6:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
🚧 ⚡⚡⚡ /kernel/infiniband/env_setup
🚧 ⚡⚡⚡ /kernel/infiniband/sanity
Test sources: https://github.com/CKI-project/tests-beaker
💚 Pull requests are welcome for new tests or improvements to existing tests!
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Testing timeout
---------------
We aim to provide a report within reasonable timeframe. Tests that haven't
finished running are marked with ⏱. Reports for non-upstream kernels have
a Beaker recipe linked to next to each host.
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: fe6f85ca121e9c74e7490fe66b0c5aae38e332c3
Gitweb: https://git.kernel.org/tip/fe6f85ca121e9c74e7490fe66b0c5aae38e332c3
Author: Jan Beulich <jbeulich(a)suse.com>
AuthorDate: Tue, 29 Oct 2019 10:34:19 +01:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Tue, 05 Nov 2019 00:11:00 +01:00
x86/apic/32: Avoid bogus LDR warnings
The removal of the LDR initialization in the bigsmp_32 APIC code unearthed
a problem in setup_local_APIC().
The code checks unconditionally for a mismatch of the logical APIC id by
comparing the early APIC id which was initialized in get_smp_config() with
the actual LDR value in the APIC.
Due to the removal of the bogus LDR initialization the check now can
trigger on bigsmp_32 APIC systems emitting a warning for every booting
CPU. This is of course a false positive because the APIC is not using
logical destination mode.
Restrict the check and the possibly resulting fixup to systems which are
actually using the APIC in logical destination mode.
[ tglx: Massaged changelog and added Cc stable ]
Fixes: bae3a8d3308 ("x86/apic: Do not initialize LDR and DFR for bigsmp")
Signed-off-by: Jan Beulich <jbeulich(a)suse.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/666d8f91-b5a8-1afd-7add-821e72a35f03@suse.com
---
arch/x86/kernel/apic/apic.c | 28 +++++++++++++++-------------
1 file changed, 15 insertions(+), 13 deletions(-)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 9e2dd2b..2b0faf8 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1586,9 +1586,6 @@ static void setup_local_APIC(void)
{
int cpu = smp_processor_id();
unsigned int value;
-#ifdef CONFIG_X86_32
- int logical_apicid, ldr_apicid;
-#endif
if (disable_apic) {
disable_ioapic_support();
@@ -1626,16 +1623,21 @@ static void setup_local_APIC(void)
apic->init_apic_ldr();
#ifdef CONFIG_X86_32
- /*
- * APIC LDR is initialized. If logical_apicid mapping was
- * initialized during get_smp_config(), make sure it matches the
- * actual value.
- */
- logical_apicid = early_per_cpu(x86_cpu_to_logical_apicid, cpu);
- ldr_apicid = GET_APIC_LOGICAL_ID(apic_read(APIC_LDR));
- WARN_ON(logical_apicid != BAD_APICID && logical_apicid != ldr_apicid);
- /* always use the value from LDR */
- early_per_cpu(x86_cpu_to_logical_apicid, cpu) = ldr_apicid;
+ if (apic->dest_logical) {
+ int logical_apicid, ldr_apicid;
+
+ /*
+ * APIC LDR is initialized. If logical_apicid mapping was
+ * initialized during get_smp_config(), make sure it matches
+ * the actual value.
+ */
+ logical_apicid = early_per_cpu(x86_cpu_to_logical_apicid, cpu);
+ ldr_apicid = GET_APIC_LOGICAL_ID(apic_read(APIC_LDR));
+ if (logical_apicid != BAD_APICID)
+ WARN_ON(logical_apicid != ldr_apicid);
+ /* Always use the value from LDR. */
+ early_per_cpu(x86_cpu_to_logical_apicid, cpu) = ldr_apicid;
+ }
#endif
/*
In do_hres(), we currently use whether the return value of __arch_get_
hw_counter() is negative to indicate fallback, but MIPS returns 0 when
clock_mode is invalid.
It is sure that MIPS has a bug when clock_mode is invalid and should
return ULL_MAX as ARM64 does (Vincenzo has already submitted a patch).
But at the time we found another bug: currently update_vsyscall() and
update_vsyscall_tz() rely on __arch_use_vsyscall() to update the vdso
data, which causes __cvdso_clock_getres() and some other functions get
wrong results when clock_mode is invalid. So, in this patch we update
vdso data unconditionally.
Fixes: 44f57d788e7deecb50 ("timekeeping: Provide a generic update_vsyscall() implementation")
Cc: stable(a)vger.kernel.org
Cc: Arnd Bergmann <arnd(a)arndb.de>
Cc: Paul Burton <paul.burton(a)mips.com>
Cc: linux-mips(a)vger.kernel.org
Cc: linux-arm-kernel(a)lists.infradead.org
Signed-off-by: Huacai Chen <chenhc(a)lemote.com>
---
kernel/time/vsyscall.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/kernel/time/vsyscall.c b/kernel/time/vsyscall.c
index 4bc37ac..5ee0f77 100644
--- a/kernel/time/vsyscall.c
+++ b/kernel/time/vsyscall.c
@@ -110,8 +110,7 @@ void update_vsyscall(struct timekeeper *tk)
nsec = nsec + tk->wall_to_monotonic.tv_nsec;
vdso_ts->sec += __iter_div_u64_rem(nsec, NSEC_PER_SEC, &vdso_ts->nsec);
- if (__arch_use_vsyscall(vdata))
- update_vdso_data(vdata, tk);
+ update_vdso_data(vdata, tk);
__arch_update_vsyscall(vdata, tk);
@@ -124,10 +123,8 @@ void update_vsyscall_tz(void)
{
struct vdso_data *vdata = __arch_get_k_vdso_data();
- if (__arch_use_vsyscall(vdata)) {
- vdata[CS_HRES_COARSE].tz_minuteswest = sys_tz.tz_minuteswest;
- vdata[CS_HRES_COARSE].tz_dsttime = sys_tz.tz_dsttime;
- }
+ vdata[CS_HRES_COARSE].tz_minuteswest = sys_tz.tz_minuteswest;
+ vdata[CS_HRES_COARSE].tz_dsttime = sys_tz.tz_dsttime;
__arch_sync_vdso_data(vdata);
}
--
2.7.0
This is a note to let you know that I've just added the patch titled
coresight: etm4x: Fix input validation for sysfs.
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the char-misc-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 2fe6899e36aa174abefd017887f9cfe0cb60c43a Mon Sep 17 00:00:00 2001
From: Mike Leach <mike.leach(a)linaro.org>
Date: Mon, 4 Nov 2019 11:12:42 -0700
Subject: coresight: etm4x: Fix input validation for sysfs.
A number of issues are fixed relating to sysfs input validation:-
1) bb_ctrl_store() - incorrect compare of bit select field to absolute
value. Reworked per ETMv4 specification.
2) seq_event_store() - incorrect mask value - register has two
event values.
3) cyc_threshold_store() - must mask with max before checking min
otherwise wrapped values can set illegal value below min.
4) res_ctrl_store() - update to mask off all res0 bits.
Reviewed-by: Leo Yan <leo.yan(a)linaro.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier(a)linaro.org>
Signed-off-by: Mike Leach <mike.leach(a)linaro.org>
Fixes: a77de2637c9eb ("coresight: etm4x: moving sysFS entries to a dedicated file")
Cc: stable <stable(a)vger.kernel.org> # 4.9+
Signed-off-by: Mathieu Poirier <mathieu.poirier(a)linaro.org>
Link: https://lore.kernel.org/r/20191104181251.26732-6-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
.../coresight/coresight-etm4x-sysfs.c | 21 ++++++++++++-------
1 file changed, 13 insertions(+), 8 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
index b6984be0c515..cc8156318018 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
@@ -652,10 +652,13 @@ static ssize_t cyc_threshold_store(struct device *dev,
if (kstrtoul(buf, 16, &val))
return -EINVAL;
+
+ /* mask off max threshold before checking min value */
+ val &= ETM_CYC_THRESHOLD_MASK;
if (val < drvdata->ccitmin)
return -EINVAL;
- config->ccctlr = val & ETM_CYC_THRESHOLD_MASK;
+ config->ccctlr = val;
return size;
}
static DEVICE_ATTR_RW(cyc_threshold);
@@ -686,14 +689,16 @@ static ssize_t bb_ctrl_store(struct device *dev,
return -EINVAL;
if (!drvdata->nr_addr_cmp)
return -EINVAL;
+
/*
- * Bit[7:0] selects which address range comparator is used for
- * branch broadcast control.
+ * Bit[8] controls include(1) / exclude(0), bits[0-7] select
+ * individual range comparators. If include then at least 1
+ * range must be selected.
*/
- if (BMVAL(val, 0, 7) > drvdata->nr_addr_cmp)
+ if ((val & BIT(8)) && (BMVAL(val, 0, 7) == 0))
return -EINVAL;
- config->bb_ctrl = val;
+ config->bb_ctrl = val & GENMASK(8, 0);
return size;
}
static DEVICE_ATTR_RW(bb_ctrl);
@@ -1324,8 +1329,8 @@ static ssize_t seq_event_store(struct device *dev,
spin_lock(&drvdata->spinlock);
idx = config->seq_idx;
- /* RST, bits[7:0] */
- config->seq_ctrl[idx] = val & 0xFF;
+ /* Seq control has two masks B[15:8] F[7:0] */
+ config->seq_ctrl[idx] = val & 0xFFFF;
spin_unlock(&drvdata->spinlock);
return size;
}
@@ -1580,7 +1585,7 @@ static ssize_t res_ctrl_store(struct device *dev,
if (idx % 2 != 0)
/* PAIRINV, bit[21] */
val &= ~BIT(21);
- config->res_ctrl[idx] = val;
+ config->res_ctrl[idx] = val & GENMASK(21, 0);
spin_unlock(&drvdata->spinlock);
return size;
}
--
2.23.0
The patch below does not apply to the 5.3-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e2995b95a914bbc6b5352be27d5d5f33ec802d2c Mon Sep 17 00:00:00 2001
From: Justin Song <flyingecar(a)gmail.com>
Date: Thu, 24 Oct 2019 12:27:14 +0200
Subject: [PATCH] ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB
Interface
This patch adds native DSD support for Gustard U16/X26 USB Interface.
Tested using VID and fp->dsd_raw method.
Signed-off-by: Justin Song <flyingecar(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/CA+9XP1ipsFn+r3bCBKRinQv-JrJ+EHOGBdZWZoMwxFv0R8Y1…
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index fbfde996fee7..0bbe1201a6ac 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1657,6 +1657,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
case 0x23ba: /* Playback Designs */
case 0x25ce: /* Mytek devices */
case 0x278b: /* Rotel? */
+ case 0x292b: /* Gustard/Ess based devices */
case 0x2ab6: /* T+A devices */
case 0x3842: /* EVGA */
case 0xc502: /* HiBy devices */
stable-rc 4.14 for architectures arm64, arm, x86_64 and i386 builds
failed due to below error,
net/ipv6/addrconf.c: In function 'addrconf_init':
net/ipv6/addrconf.c:6593:22: error: 'blackhole_netdev' undeclared
(first use in this function); did you mean 'alloc_netdev'?
bdev = ipv6_add_dev(blackhole_netdev);
^~~~~~~~~~~~~~~~
alloc_netdev
net/ipv6/addrconf.c:6593:22: note: each undeclared identifier is
reported only once for each function it appears in
net/ipv6/addrconf.c: In function 'addrconf_cleanup':
net/ipv6/addrconf.c:6667:18: error: 'blackhole_netdev' undeclared
(first use in this function); did you mean 'alloc_netdev'?
addrconf_ifdown(blackhole_netdev, 2);
^~~~~~~~~~~~~~~~
alloc_netdev
Build link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-4.14/…
- Naresh
We hit a regression while rolling out 5.2 internally where we were
hitting the following panic
kernel BUG at mm/page-writeback.c:2659!
RIP: 0010:clear_page_dirty_for_io+0xe6/0x1f0
Call Trace:
__process_pages_contig+0x25a/0x350
? extent_clear_unlock_delalloc+0x43/0x70
submit_compressed_extents+0x359/0x4d0
normal_work_helper+0x15a/0x330
process_one_work+0x1f5/0x3f0
worker_thread+0x2d/0x3d0
? rescuer_thread+0x340/0x340
kthread+0x111/0x130
? kthread_create_on_node+0x60/0x60
ret_from_fork+0x1f/0x30
this is happening because the page is not locked when doing
clear_page_dirty_for_io. Looking at the core dump it was because our
async_extent had a ram_size of 24576 but our async_chunk range only
spanned 20480, so we had a whole extra page in our ram_size for our
async_extent.
This happened because we try not to compress pages outside of our
i_size, however a cleanup patch changed us to do
actual_end = min_t(u64, i_size_read(inode), end + 1);
which is problematic because i_size_read() can evaluate to different
values in between checking and assigning. So either a expanding
truncate or a fallocate could increase our i_size while we're doing
writeout and actual_end would end up being past the range we have
locked.
I confirmed this was what was happening by installing a debug kernel
that had
actual_end = min_t(u64, i_size_read(inode), end + 1);
if (actual_end > end + 1) {
printk(KERN_ERR "WE GOT FUCKED\n");
actual_end = end + 1;
}
and installing it onto 500 boxes of the tier that had been seeing the
problem regularly. Last night I got my debug message and no panic,
confirming what I expected.
Fixes: 62b37622718c ("btrfs: Remove isize local variable in compress_file_range")
cc: stable(a)vger.kernel.org
Signed-off-by: Josef Bacik <josef(a)toxicpanda.com>
---
fs/btrfs/inode.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 2eb1d7249f83..9a483d1f61f8 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -474,6 +474,7 @@ static noinline int compress_file_range(struct async_chunk *async_chunk)
u64 start = async_chunk->start;
u64 end = async_chunk->end;
u64 actual_end;
+ loff_t i_size = i_size_read(inode);
int ret = 0;
struct page **pages = NULL;
unsigned long nr_pages;
@@ -488,7 +489,13 @@ static noinline int compress_file_range(struct async_chunk *async_chunk)
inode_should_defrag(BTRFS_I(inode), start, end, end - start + 1,
SZ_16K);
- actual_end = min_t(u64, i_size_read(inode), end + 1);
+ /*
+ * We need to save i_size before now because it could change in between
+ * us evaluating the size and assigning it. This is because we lock and
+ * unlock the page in truncate and fallocate, and then modify the i_size
+ * later on.
+ */
+ actual_end = min_t(u64, i_size, end + 1);
again:
will_compress = 0;
nr_pages = (end >> PAGE_SHIFT) - (start >> PAGE_SHIFT) + 1;
--
2.21.0