June 2019 - Linux-stable-mirror

[PATCH v2] drm/panfrost: Make sure a BO is only unmapped when appropriate

by Boris Brezillon

mmu_ops->unmap() will fail when called on a BO that has not been previously mapped, and the error path in panfrost_ioctl_create_bo() can call drm_gem_object_put_unlocked() (which in turn calls panfrost_mmu_unmap()) on a BO that has not been mapped yet. Keep track of the mapped/unmapped state to avoid such issues. Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") Cc: <stable(a)vger.kernel.org> Signed-off-by: Boris Brezillon <boris.brezillon(a)collabora.com> --- Changes in v2: * Check is_mapped val in the caller and add WARN_ON() in the mmu code (suggested by Tomeu) --- drivers/gpu/drm/panfrost/panfrost_gem.c | 3 ++- drivers/gpu/drm/panfrost/panfrost_gem.h | 1 + drivers/gpu/drm/panfrost/panfrost_mmu.c | 8 ++++++++ 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.c b/drivers/gpu/drm/panfrost/panfrost_gem.c index 886875ae31d3..b46416be5a54 100644 --- a/drivers/gpu/drm/panfrost/panfrost_gem.c +++ b/drivers/gpu/drm/panfrost/panfrost_gem.c @@ -19,7 +19,8 @@ static void panfrost_gem_free_object(struct drm_gem_object *obj) struct panfrost_gem_object *bo = to_panfrost_bo(obj); struct panfrost_device *pfdev = obj->dev->dev_private; - panfrost_mmu_unmap(bo); + if (bo->is_mapped) + panfrost_mmu_unmap(bo); spin_lock(&pfdev->mm_lock); drm_mm_remove_node(&bo->node); diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.h b/drivers/gpu/drm/panfrost/panfrost_gem.h index 045000eb5fcf..6dbcaba020fc 100644 --- a/drivers/gpu/drm/panfrost/panfrost_gem.h +++ b/drivers/gpu/drm/panfrost/panfrost_gem.h @@ -11,6 +11,7 @@ struct panfrost_gem_object { struct drm_gem_shmem_object base; struct drm_mm_node node; + bool is_mapped; }; static inline diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c index 762b1bd2a8c2..92ac995dd9c6 100644 --- a/drivers/gpu/drm/panfrost/panfrost_mmu.c +++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c @@ -156,6 +156,9 @@ int panfrost_mmu_map(struct panfrost_gem_object *bo) struct sg_table *sgt; int ret; + if (WARN_ON(bo->is_mapped)) + return 0; + sgt = drm_gem_shmem_get_pages_sgt(obj); if (WARN_ON(IS_ERR(sgt))) return PTR_ERR(sgt); @@ -189,6 +192,7 @@ int panfrost_mmu_map(struct panfrost_gem_object *bo) pm_runtime_mark_last_busy(pfdev->dev); pm_runtime_put_autosuspend(pfdev->dev); + bo->is_mapped = true; return 0; } @@ -203,6 +207,9 @@ void panfrost_mmu_unmap(struct panfrost_gem_object *bo) size_t unmapped_len = 0; int ret; + if (WARN_ON(!bo->is_mapped)) + return; + dev_dbg(pfdev->dev, "unmap: iova=%llx, len=%zx", iova, len); ret = pm_runtime_get_sync(pfdev->dev); @@ -230,6 +237,7 @@ void panfrost_mmu_unmap(struct panfrost_gem_object *bo) pm_runtime_mark_last_busy(pfdev->dev); pm_runtime_put_autosuspend(pfdev->dev); + bo->is_mapped = false; } static void mmu_tlb_inv_context_s1(void *cookie) -- 2.20.1

6 years, 1 month

2
1
0 0

[PATCH 2/2] xhci: detect USB 3.2 capable host controllers correctly

by Mathias Nyman

USB 3.2 capability in a host can be detected from the xHCI Supported Protocol Capability major and minor revision fields. If major is 0x3 and minor 0x20 then the host is USB 3.2 capable. For USB 3.2 capable hosts set the root hub lane count to 2. The Major Revision and Minor Revision fields contain a BCD version number. The value of the Major Revision field is JJh and the value of the Minor Revision field is MNh for version JJ.M.N, where JJ = major revision number, M - minor version number, N = sub-minor version number, e.g. version 3.1 is represented with a value of 0310h. Also fix the extra whitespace printed out when announcing regular SuperSpeed hosts. Cc: <stable(a)vger.kernel.org> # v4.18+ Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 78a2a93..3f79f35 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -5065,16 +5065,26 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) } else { /* * Some 3.1 hosts return sbrn 0x30, use xhci supported protocol - * minor revision instead of sbrn + * minor revision instead of sbrn. Minor revision is a two digit + * BCD containing minor and sub-minor numbers, only show minor. */ - minor_rev = xhci->usb3_rhub.min_rev; - if (minor_rev) { + minor_rev = xhci->usb3_rhub.min_rev / 0x10; + + switch (minor_rev) { + case 2: + hcd->speed = HCD_USB32; + hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS; + hcd->self.root_hub->rx_lanes = 2; + hcd->self.root_hub->tx_lanes = 2; + break; + case 1: hcd->speed = HCD_USB31; hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS; + break; } - xhci_info(xhci, "Host supports USB 3.%x %s SuperSpeed\n", + xhci_info(xhci, "Host supports USB 3.%x %sSuperSpeed\n", minor_rev, - minor_rev ? "Enhanced" : ""); + minor_rev ? "Enhanced " : ""); xhci->usb3_rhub.hcd = hcd; /* xHCI private pointer was set in xhci_pci_probe for the second -- 2.7.4

6 years, 1 month

1
0
0 0

[PATCH 1/2] usb: xhci: Don't try to recover an endpoint if port is in error state.

by Mathias Nyman

A USB3 device needs to be reset and re-enumarated if the port it connects to goes to a error state, with link state inactive. There is no use in trying to recover failed transactions by resetting endpoints at this stage. Tests show that in rare cases, after multiple endpoint resets of a roothub port the whole host controller might stop completely. Several retries to recover from transaction error can happen as it can take a long time before the hub thread discovers the USB3 port error and inactive link. We can't reliably detect the port error from slot or endpoint context due to a limitation in xhci, see xhci specs section 4.8.3: "There are several cases where the EP State field in the Output Endpoint Context may not reflect the current state of an endpoint" and "Software should maintain an accurate value for EP State, by tracking it with an internal variable that is driven by Events and Doorbell accesses" Same appears to be true for slot state. set a flag to the corresponding slot if a USB3 roothub port link goes inactive to prevent both queueing new URBs and resetting endpoints. Reported-by: Rapolu Chiranjeevi <chiranjeevi.rapolu(a)intel.com> Tested-by: Rapolu Chiranjeevi <chiranjeevi.rapolu(a)intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci-ring.c | 15 ++++++++++++++- drivers/usb/host/xhci.c | 5 +++++ drivers/usb/host/xhci.h | 9 +++++++++ 3 files changed, 28 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index feffceb..121782e 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1612,8 +1612,13 @@ static void handle_port_status(struct xhci_hcd *xhci, usb_hcd_resume_root_hub(hcd); } - if (hcd->speed >= HCD_USB3 && (portsc & PORT_PLS_MASK) == XDEV_INACTIVE) + if (hcd->speed >= HCD_USB3 && + (portsc & PORT_PLS_MASK) == XDEV_INACTIVE) { + slot_id = xhci_find_slot_id_by_port(hcd, xhci, hcd_portnum + 1); + if (slot_id && xhci->devs[slot_id]) + xhci->devs[slot_id]->flags |= VDEV_PORT_ERROR; bus_state->port_remote_wakeup &= ~(1 << hcd_portnum); + } if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_RESUME) { xhci_dbg(xhci, "port resume event for port %d\n", port_id); @@ -1801,6 +1806,14 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci, { struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index]; struct xhci_command *command; + + /* + * Avoid resetting endpoint if link is inactive. Can cause host hang. + * Device will be reset soon to recover the link so don't do anything + */ + if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR) + return; + command = xhci_alloc_command(xhci, false, GFP_ATOMIC); if (!command) return; diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 20db378..78a2a93 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1466,6 +1466,10 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag xhci_dbg(xhci, "urb submitted during PCI suspend\n"); return -ESHUTDOWN; } + if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR) { + xhci_dbg(xhci, "Can't queue urb, port error, link inactive\n"); + return -ENODEV; + } if (usb_endpoint_xfer_isoc(&urb->ep->desc)) num_tds = urb->number_of_packets; @@ -3754,6 +3758,7 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd, } /* If necessary, update the number of active TTs on this root port */ xhci_update_tt_active_eps(xhci, virt_dev, old_active_eps); + virt_dev->flags = 0; ret = 0; command_cleanup: diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h index 7f8b950..92e764c 100644 --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -1010,6 +1010,15 @@ struct xhci_virt_device { u8 real_port; struct xhci_interval_bw_table *bw_table; struct xhci_tt_bw_info *tt_info; + /* + * flags for state tracking based on events and issued commands. + * Software can not rely on states from output contexts because of + * latency between events and xHC updating output context values. + * See xhci 1.1 section 4.8.3 for more details + */ + unsigned long flags; +#define VDEV_PORT_ERROR BIT(0) /* Port error, link inactive */ + /* The current max exit latency for the enabled USB3 link states. */ u16 current_mel; /* Used for the debugfs interfaces. */ -- 2.7.4

6 years, 1 month

1
0
0 0

[PATCH 1/4] drm/i915: Don't clobber M/N values during fastset check

by Ville Syrjala

From: Ville Syrjälä <ville.syrjala(a)linux.intel.com> We're now calling intel_pipe_config_compare(..., true) uncoditionally which means we're always going clobber the calculated M/N values with the old values if the fuzzy M/N check passes. That causes problems because the fuzzy check allows for a huge difference in the values. I'm actually tempted to just make the M/N checks exact, but that might prevent fastboot from kicking in when people want it. So for now let's overwrite the computed values with the old values only if decide to skip the modeset. Cc: stable(a)vger.kernel.org Cc: Blubberbub(a)protonmail.com Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Blubberbub(a)protonmail.com Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110782 Fixes: d19f958db23c ("drm/i915: Enable fastset for non-boot modesets.") Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> --- drivers/gpu/drm/i915/intel_display.c | 35 +++++++++++++++++++++------- 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index 1b1ddb48ca7a..73b3e92b7ed5 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -12299,9 +12299,6 @@ intel_compare_link_m_n(const struct intel_link_m_n *m_n, m2_n2->gmch_m, m2_n2->gmch_n, !adjust) && intel_compare_m_n(m_n->link_m, m_n->link_n, m2_n2->link_m, m2_n2->link_n, !adjust)) { - if (adjust) - *m2_n2 = *m_n; - return true; } @@ -13433,6 +13430,32 @@ static int calc_watermark_data(struct intel_atomic_state *state) return 0; } +static void intel_crtc_check_fastset(struct intel_crtc_state *old_crtc_state, + struct intel_crtc_state *new_crtc_state) +{ + struct drm_i915_private *dev_priv = + to_i915(new_crtc_state->base.crtc->dev); + + if (!intel_pipe_config_compare(dev_priv, old_crtc_state, + new_crtc_state, true)) + return; + + new_crtc_state->base.mode_changed = false; + new_crtc_state->update_pipe = true; + + /* + * If we're not doing the full modeset we want to + * keep the current M/N values as they may be + * sufficiently different to the computed values + * to cause problems. + * + * FIXME: should really copy more fuzzy state here + */ + new_crtc_state->fdi_m_n = old_crtc_state->fdi_m_n; + new_crtc_state->dp_m_n = old_crtc_state->dp_m_n; + new_crtc_state->dp_m2_n2 = old_crtc_state->dp_m2_n2; +} + /** * intel_atomic_check - validate state object * @dev: drm device @@ -13474,11 +13497,7 @@ static int intel_atomic_check(struct drm_device *dev, if (ret) goto fail; - if (intel_pipe_config_compare(dev_priv, old_crtc_state, - new_crtc_state, true)) { - new_crtc_state->base.mode_changed = false; - new_crtc_state->update_pipe = true; - } + intel_crtc_check_fastset(old_crtc_state, new_crtc_state); if (needs_modeset(&new_crtc_state->base)) any_ms = true; -- 2.21.0

6 years, 1 month

3
3
0 0

[PATCH v2] mmc: core: Prevent processing SDIO IRQs when the card is suspended

by Ulf Hansson

Processing of SDIO IRQs must obviously be prevented while the card is system suspended, otherwise we may end up trying to communicate with an uninitialized SDIO card. Reports throughout the years shows that this is not only a theoretical problem, but a real issue. So, let's finally fix this problem, by keeping track of the state for the card and bail out before processing the SDIO IRQ, in case the card is suspended. Cc: stable(a)vger.kernel.org Reported-by: Douglas Anderson <dianders(a)chromium.org> Tested-by: Douglas Anderson <dianders(a)chromium.org> Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> --- Changes in v2: - Respect error code in mmc_sdio_suspend(), pointed out by Doug. --- drivers/mmc/core/sdio.c | 13 ++++++++++++- drivers/mmc/core/sdio_irq.c | 4 ++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c index d1aa1c7577bb..712a7742765e 100644 --- a/drivers/mmc/core/sdio.c +++ b/drivers/mmc/core/sdio.c @@ -937,6 +937,10 @@ static int mmc_sdio_pre_suspend(struct mmc_host *host) */ static int mmc_sdio_suspend(struct mmc_host *host) { + /* Prevent processing of SDIO IRQs in suspended state. */ + mmc_card_set_suspended(host->card); + cancel_delayed_work_sync(&host->sdio_irq_work); + mmc_claim_host(host); if (mmc_card_keep_power(host) && mmc_card_wake_sdio_irq(host)) @@ -985,13 +989,20 @@ static int mmc_sdio_resume(struct mmc_host *host) err = sdio_enable_4bit_bus(host->card); } - if (!err && host->sdio_irqs) { + if (err) + goto out; + + /* Allow SDIO IRQs to be processed again. */ + mmc_card_clr_suspended(host->card); + + if (host->sdio_irqs) { if (!(host->caps2 & MMC_CAP2_SDIO_IRQ_NOTHREAD)) wake_up_process(host->sdio_irq_thread); else if (host->caps & MMC_CAP_SDIO_IRQ) host->ops->enable_sdio_irq(host, 1); } +out: mmc_release_host(host); host->pm_flags &= ~MMC_PM_KEEP_POWER; diff --git a/drivers/mmc/core/sdio_irq.c b/drivers/mmc/core/sdio_irq.c index 931e6226c0b3..9f54a259a1b3 100644 --- a/drivers/mmc/core/sdio_irq.c +++ b/drivers/mmc/core/sdio_irq.c @@ -34,6 +34,10 @@ static int process_sdio_pending_irqs(struct mmc_host *host) unsigned char pending; struct sdio_func *func; + /* Don't process SDIO IRQs if the card is suspended. */ + if (mmc_card_suspended(card)) + return 0; + /* * Optimization, if there is only 1 function interrupt registered * and we know an IRQ was signaled then call irq handler directly. -- 2.17.1

6 years, 1 month

1
0
0 0

[PATCH 22/43] KVM: nVMX: Don't dump VMCS if virtual APIC page can't be mapped

by Paolo Bonzini

From: Sean Christopherson <sean.j.christopherson(a)intel.com> ... as a malicious userspace can run a toy guest to generate invalid virtual-APIC page addresses in L1, i.e. flood the kernel log with error messages. Fixes: 690908104e39d ("KVM: nVMX: allow tests to use bad virtual-APIC page address") Cc: stable(a)vger.kernel.org Cc: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Sean Christopherson <sean.j.christopherson(a)intel.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> --- arch/x86/kvm/vmx/nested.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 9478d8947595..0f4cb473bd36 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -2880,9 +2880,6 @@ static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu) */ vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL, CPU_BASED_TPR_SHADOW); - } else { - printk("bad virtual-APIC page address\n"); - dump_vmcs(); } } -- 1.8.3.1

6 years, 1 month

3
3
0 0

[PATCH] usb: gadget: ether: Fix race between gether_disconnect and rx_submit

by Felipe Balbi

From: Kiruthika Varadarajan <Kiruthika.Varadarajan(a)harman.com> On spin lock release in rx_submit, gether_disconnect get a chance to run, it makes port_usb NULL, rx_submit access NULL port USB, hence null pointer crash. Fixed by releasing the lock in rx_submit after port_usb is used. Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core") Cc: <stable(a)vger.kernel.org> Signed-off-by: Kiruthika Varadarajan <Kiruthika.Varadarajan(a)harman.com> Signed-off-by: Felipe Balbi <felipe.balbi(a)linux.intel.com> --- drivers/usb/gadget/function/u_ether.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c index 737bd77a575d..2929bb47a618 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -186,11 +186,12 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags) out = dev->port_usb->out_ep; else out = NULL; - spin_unlock_irqrestore(&dev->lock, flags); if (!out) + { + spin_unlock_irqrestore(&dev->lock, flags); return -ENOTCONN; - + } /* Padding up to RX_EXTRA handles minor disagreements with host. * Normally we use the USB "terminate on short read" convention; @@ -214,6 +215,7 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags) if (dev->port_usb->is_fixed) size = max_t(size_t, size, dev->port_usb->fixed_out_len); + spin_unlock_irqrestore(&dev->lock, flags); skb = __netdev_alloc_skb(dev->net, size + NET_IP_ALIGN, gfp_flags); if (skb == NULL) { -- 2.22.0

6 years, 1 month

1
0
0 0

Ihre Angebot

by Oliver

Sehr geehrte Damen und Herren, wir haben Ihre Firmenwebseite besucht und wir sind der Meinung, sie sieht ausgezeichnet aus! Wenn Ihnen daran liegt, neue Kunden zu gewinnen, dann haben wir für Sie ein Angebot. Wir verfügen über den neusten, stets aktualisierten Firmenkatalog 2019. In wenigen Augenblicken können Sie die interessanten Branchen / Wirtschaftssektoren aussuchen und die Kontakte exportieren. Alle unsere Kontakte entsprechen den GDPR-Regeln. Wir verfügen nur über Firmenangaben oder Firmenkontaktdaten. -- 1. Firmenadressen 2019 DE 1 Mio. Firmenadressen ( 1 457 620 ) - 190 EUR ( bis zum 18.06.2019 ) 2. Gesamtpaket 2019 DE,AT,CH ( 1 747 921 ) - 240 EUR ( bis zum 18.06.2019 ) 3. Europa 2019 DE, AT, CH, UK, FR, IT, ES ( 8 123 551 ) - 390 EUR ( bis zum 18.06.2019 ) -- Die Verwendungsmöglichkeiten der Datenbanken sind praktisch unbegrenzt und Sie können durch Verwendung der von uns entwickelten Programme des personalisierten Versendens von Angeboten u.ä. mittels E-mailing bzw. Fax effektive und sichere Werbekampagnen damit durchführen. Wir möchten Sie gerne dazu einladen, unsere Webseite zu besuchen: http://www.acdbmarketing.net/?page=catalog Mit freundlichen Grüßen GMC - Team

6 years, 1 month

1
0
0 0

kernel/workqueue.c:3030 __flush_work+0x2c2/0x2d0

by Naresh Kamboju

Kernel warning while running kernel selftest bpf test_sockmap test case on x86_64 and arm64. The kernel warning log pops up continuously. Linux version 5.1.10-rc2 Steps to reproduce: Boot stable rc 5.1.10-rc2 kernel on x86_64 or arm64 cd selftests/bpf ./test_sockmap [ 37.600406] WARNING: CPU: 3 PID: 57 at /usr/src/kernel/kernel/workqueue.c:3030 __flush_work+0x2c2/0x2d0 [ 37.610034] Modules linked in: x86_pkg_temp_thermal fuse [ 37.615371] CPU: 3 PID: 57 Comm: kworker/3:1 Not tainted 5.1.10-rc2 #1 [ 37.615454] WARNING: CPU: 0 PID: 5 at /usr/src/kernel/kernel/workqueue.c:3030 __flush_work+0x2c2/0x2d0 [ 37.621892] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.0b 07/27/2017 [ 37.621895] Workqueue: events sk_psock_destroy_deferred [ 37.631183] Modules linked in: x86_pkg_temp_thermal fuse [ 37.638654] RIP: 0010:__flush_work+0x2c2/0x2d0 [ 37.638655] Code: c6 00 31 c0 e9 71 ff ff ff 41 8b 0c 24 49 8b 54 24 08 83 e1 08 49 0f ba 2c 24 03 80 c9 f0 e9 d2 fe ff ff 0f 0b e9 50 ff ff ff <0f> 0b 31 c0 e9 47 ff ff ff e8 90 9d fd ff 0f 1f 44 00 00 55 31 f6 [ 37.643879] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.1.10-rc2 #1 [ 37.643880] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.0b 07/27/2017 [ 37.649183] RSP: 0018:ffffb038c1a23ca0 EFLAGS: 00010246 [ 37.653630] Workqueue: events sk_psock_destroy_deferred [ 37.672375] RAX: 0000000000000000 RBX: ffff9e73d9492068 RCX: 0000000000000006 [ 37.672376] RDX: 0000000000000006 RSI: 0000000000000001 RDI: ffff9e73d9492068 [ 37.678805] RIP: 0010:__flush_work+0x2c2/0x2d0 [ 37.678807] Code: c6 00 31 c0 e9 71 ff ff ff 41 8b 0c 24 49 8b 54 24 08 83 e1 08 49 0f ba 2c 24 03 80 c9 f0 e9 d2 fe ff ff 0f 0b e9 50 ff ff ff <0f> 0b 31 c0 e9 47 ff ff ff e8 90 9d fd ff 0f 1f 44 00 00 55 31 f6 [ 37.686274] RBP: ffffb038c1a23d68 R08: 0000000000000000 R09: 0000000000000000 [ 37.686275] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9e73d9492068 [ 37.691494] RSP: 0018:ffffb038c18fbca0 EFLAGS: 00010246 [ 37.696720] R13: 0000000000000001 R14: ffffb038c1a23d98 R15: ffffffff9a490d40 [ 37.696721] FS: 0000000000000000(0000) GS:ffff9e73dfb80000(0000) knlGS:0000000000000000 [ 37.703851] RAX: 0000000000000000 RBX: ffff9e73d9490868 RCX: 0000000000000006 [ 37.703852] RDX: 0000000000000006 RSI: 0000000000000001 RDI: ffff9e73d9490868 [ 37.710976] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.710977] CR2: 00007f38680ca8a0 CR3: 00000002ee614006 CR4: 00000000003606e0 [ 37.715419] RBP: ffffb038c18fbd68 R08: 0000000000000000 R09: 0000000000000000 [ 37.715420] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9e73d9490868 [ 37.734156] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.734157] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.741282] R13: 0000000000000001 R14: ffffb038c18fbd98 R15: ffffffff9a490d40 [ 37.741283] FS: 0000000000000000(0000) GS:ffff9e73dfa00000(0000) knlGS:0000000000000000 [ 37.748405] Call Trace: [ 37.748410] ? work_busy+0xc0/0xc0 [ 37.753621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.753622] CR2: 00007f38680c9788 CR3: 000000045454a004 CR4: 00000000003606f0 [ 37.760746] ? mark_held_locks+0x4d/0x80 [ 37.768823] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.768824] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.775946] ? __cancel_work_timer+0x11a/0x1d0 [ 37.783071] Call Trace: [ 37.783075] ? work_busy+0xc0/0xc0 [ 37.788808] ? cancel_delayed_work_sync+0x13/0x20 [ 37.788810] ? lockdep_hardirqs_on+0xf6/0x190 [ 37.795934] ? mark_held_locks+0x4d/0x80 [ 37.803055] ? __cancel_work_timer+0x11a/0x1d0 [ 37.803057] ? work_busy+0xc0/0xc0 [ 37.810179] ? __cancel_work_timer+0x11a/0x1d0 [ 37.817303] __cancel_work_timer+0x134/0x1d0 [ 37.824453] ? cancel_delayed_work_sync+0x13/0x20 [ 37.824455] ? lockdep_hardirqs_on+0xf6/0x190 [ 37.831579] cancel_delayed_work_sync+0x13/0x20 [ 37.839654] ? __cancel_work_timer+0x11a/0x1d0 [ 37.839657] ? work_busy+0xc0/0xc0 [ 37.842100] strp_done+0x1c/0x50 [ 37.845497] __cancel_work_timer+0x134/0x1d0 [ 37.851242] sk_psock_destroy_deferred+0x34/0x1c0 [ 37.858372] cancel_delayed_work_sync+0x13/0x20 [ 37.862292] process_one_work+0x281/0x610 [ 37.869415] strp_done+0x1c/0x50 [ 37.876540] worker_thread+0x3c/0x3f0 [ 37.880975] sk_psock_destroy_deferred+0x34/0x1c0 [ 37.883419] ? __kthread_parkme+0x61/0x90 [ 37.886819] process_one_work+0x281/0x610 [ 37.891514] kthread+0x12c/0x150 [ 37.895868] worker_thread+0x3c/0x3f0 [ 37.899783] ? process_one_work+0x610/0x610 [ 37.904221] kthread+0x12c/0x150 [ 37.907615] ? kthread_park+0x90/0x90 [ 37.907618] ret_from_fork+0x3a/0x50 [ 37.912052] ? process_one_work+0x610/0x610 [ 37.916355] irq event stamp: 57860 [ 37.921058] ? kthread_park+0x90/0x90 [ 37.921060] ret_from_fork+0x3a/0x50 [ 37.925407] hardirqs last enabled at (57859): [<ffffffff9a4949ba>] __cancel_work_timer+0x11a/0x1d0 [ 37.925409] hardirqs last disabled at (57860): [<ffffffff9a401bab>] trace_hardirqs_off_thunk+0x1a/0x1c [ 37.929944] irq event stamp: 47474 [ 37.934378] softirqs last enabled at (57812): [<ffffffff9add14d5>] release_sock+0x85/0xb0 [ 37.934379] softirqs last disabled at (57810): [<ffffffff9add140a>] __release_sock+0xda/0x120 [ 37.937773] hardirqs last enabled at (47473): [<ffffffff9a4949ba>] __cancel_work_timer+0x11a/0x1d0 [ 37.937775] hardirqs last disabled at (47474): [<ffffffff9a401bab>] trace_hardirqs_off_thunk+0x1a/0x1c [ 37.940998] ---[ end trace ae349dc9a55c8bc8 ]--- [ 37.941056] WARNING: CPU: 3 PID: 57 at /usr/src/kernel/kernel/workqueue.c:3030 __flush_work+0x2c2/0x2d0 [ 37.945263] softirqs last enabled at (47440): [<ffffffff9add14d5>] release_sock+0x85/0xb0 [ 37.945264] softirqs last disabled at (47438): [<ffffffff9add140a>] __release_sock+0xda/0x120 [ 37.949968] Modules linked in: x86_pkg_temp_thermal fuse [ 37.954493] ---[ end trace ae349dc9a55c8bc9 ]--- [ 37.954522] WARNING: CPU: 0 PID: 5 at /usr/src/kernel/kernel/workqueue.c:3030 __flush_work+0x2c2/0x2d0 [...] metadata: git branch: linux-5.1.y git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git git commit: b7eabc3862b8717f2bcc47f3f3830ec575423c8c git describe: v5.1.9-157-gb7eabc3862b8 make_kernelversion: 5.1.10-rc2 kernel-config: http://snapshots.linaro.org/openembedded/lkft/lkft/sumo/intel-corei7-64/lkf… kernel-defconfig: http://snapshots.linaro.org/openembedded/lkft/lkft/sumo/intel-corei7-64/lkf… build-url: https://ci.linaro.org/job/openembedded-lkft-linux-stable-rc-5.1/DISTRO=lkft… build-location: http://snapshots.linaro.org/openembedded/lkft/lkft/sumo/intel-corei7-64/lkf… toolchain: x86_64-linaro-linux 7.% series: lkft email-notification: '' kselftest__url: https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.1.tar.xz kselftest__version: '5.1' kselftest__revision: '5.1' Full test log, https://lkft.validation.linaro.org/scheduler/job/775857#L1114 Best regards Naresh Kamboju

6 years, 1 month

1
1
0 0

patch "firmware: improve LSM/IMA security behaviour" added to driver-core-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled firmware: improve LSM/IMA security behaviour to my driver-core git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git in the driver-core-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the driver-core-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 2472d64af2d3561954e2f05365a67692bb852f2a Mon Sep 17 00:00:00 2001 From: Sven Van Asbroeck <thesven73(a)gmail.com> Date: Mon, 17 Jun 2019 14:23:54 -0400 Subject: firmware: improve LSM/IMA security behaviour The firmware loader queries if LSM/IMA permits it to load firmware via the sysfs fallback. Unfortunately, the code does the opposite: it expressly permits sysfs fw loading if security_kernel_load_data( LOADING_FIRMWARE) returns -EACCES. This happens because a zero-on-success return value is cast to a bool that's true on success. Fix the return value handling so we get the correct behaviour. Fixes: 6e852651f28e ("firmware: add call to LSM hook before firmware sysfs fallback") Cc: Stable <stable(a)vger.kernel.org> Cc: Mimi Zohar <zohar(a)linux.vnet.ibm.com> Cc: Kees Cook <keescook(a)chromium.org> To: Luis Chamberlain <mcgrof(a)kernel.org> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: "Rafael J. Wysocki" <rafael(a)kernel.org> Cc: linux-kernel(a)vger.kernel.org Signed-off-by: Sven Van Asbroeck <TheSven73(a)gmail.com> Reviewed-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/base/firmware_loader/fallback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c index b5cd96fd0e77..29becea1910d 100644 --- a/drivers/base/firmware_loader/fallback.c +++ b/drivers/base/firmware_loader/fallback.c @@ -659,7 +659,7 @@ static bool fw_run_sysfs_fallback(enum fw_opt opt_flags) /* Also permit LSMs and IMA to fail firmware sysfs fallback */ ret = security_kernel_load_data(LOADING_FIRMWARE); if (ret < 0) - return ret; + return false; return fw_force_sysfs_fallback(opt_flags); } -- 2.22.0

6 years, 1 month

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror June 2019