September 2019 - Linux-stable-mirror

[nacked] fat-add-nobarrier-to-workaround-the-strange-behavior-of-device.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: fat: add nobarrier to workaround the strange behavior of device has been removed from the -mm tree. Its filename was fat-add-nobarrier-to-workaround-the-strange-behavior-of-device.patch This patch was dropped because it was nacked ------------------------------------------------------ From: OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp> Subject: fat: add nobarrier to workaround the strange behavior of device There was a report of strange behavior of device with recent blkdev_issue_flush() position change. The following is simplified usbmon trace: 4203 9.160230 host -> 1.25.1 USBMS 95 SCSI: Synchronize Cache(10) LUN: 0x00 (LBA: 0x00000000, Len: 0) 4206 9.164911 1.25.1 -> host USBMS 77 SCSI: Response LUN: 0x00 (Synchronize Cache(10)) (Good) 4207 9.323927 host -> 1.25.1 USBMS 95 SCSI: Read(10) LUN: 0x00 (LBA: 0x00279950, Len: 240) 4212 9.327138 1.25.1 -> host USBMS 77 SCSI: Response LUN: 0x00 (Read(10)) (Good) [...] 7323 10.202167 host -> 1.25.1 USBMS 95 SCSI: Synchronize Cache(10) LUN: 0x00 (LBA: 0x00000000, Len: 0) 7326 10.432266 1.25.1 -> host USBMS 77 SCSI: Response LUN: 0x00 (Synchronize Cache(10)) (Good) 7327 10.769092 host -> 1.25.1 USBMS 95 SCSI: Test Unit Ready LUN: 0x00 7330 10.769192 1.25.1 -> host USBMS 77 SCSI: Response LUN: 0x00 (Test Unit Ready) (Good) 7335 12.849093 host -> 1.25.1 USBMS 95 SCSI: Test Unit Ready LUN: 0x00 7338 12.849206 1.25.1 -> host USBMS 77 SCSI: Response LUN: 0x00 (Test Unit Ready) (Check Condition) 7339 12.849209 host -> 1.25.1 USBMS 95 SCSI: Request Sense LUN: 0x00 If "Synchronize Cache" command issued then there is idle time, the device stop to process further commands, and behave as like no media. (it returns NOT_READY [MEDIUM NOT PRESENT] for SENSE command, and this happened on Kindle) [just a guess, the device is trying to detect the "safe-unplug" operation of Windows or such?] To work around those devices and provide flexibility, this adds "barrier"/"nobarrier" mount options to fat driver. Link: http://lkml.kernel.org/r/87woh5pyqh.fsf@mail.parknet.co.jp Signed-off-by: OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp> Cc: Christoph Hellwig <hch(a)lst.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/fat/fat.h | 1 + fs/fat/file.c | 8 ++++++-- fs/fat/inode.c | 22 +++++++++++++++++----- 3 files changed, 24 insertions(+), 7 deletions(-) --- a/fs/fat/fat.h~fat-add-nobarrier-to-workaround-the-strange-behavior-of-device +++ a/fs/fat/fat.h @@ -51,6 +51,7 @@ struct fat_mount_options { tz_set:1, /* Filesystem timestamps' offset set */ rodir:1, /* allow ATTR_RO for directory */ discard:1, /* Issue discard requests on deletions */ + barrier:1, /* Issue FLUSH command */ dos1xfloppy:1; /* Assume default BPB for DOS 1.x floppies */ }; --- a/fs/fat/file.c~fat-add-nobarrier-to-workaround-the-strange-behavior-of-device +++ a/fs/fat/file.c @@ -194,17 +194,21 @@ static int fat_file_release(struct inode int fat_file_fsync(struct file *filp, loff_t start, loff_t end, int datasync) { struct inode *inode = filp->f_mapping->host; + struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb); int err; err = __generic_file_fsync(filp, start, end, datasync); if (err) return err; - err = sync_mapping_buffers(MSDOS_SB(inode->i_sb)->fat_inode->i_mapping); + err = sync_mapping_buffers(sbi->fat_inode->i_mapping); if (err) return err; - return blkdev_issue_flush(inode->i_sb->s_bdev, GFP_KERNEL, NULL); + if (sbi->options.barrier) + err = blkdev_issue_flush(inode->i_sb->s_bdev, GFP_KERNEL, NULL); + + return err; } --- a/fs/fat/inode.c~fat-add-nobarrier-to-workaround-the-strange-behavior-of-device +++ a/fs/fat/inode.c @@ -1016,6 +1016,8 @@ static int fat_show_options(struct seq_f seq_puts(m, ",nfs=stale_rw"); if (opts->discard) seq_puts(m, ",discard"); + if (!opts->barrier) + seq_puts(m, ",nobarrier"); if (opts->dos1xfloppy) seq_puts(m, ",dos1xfloppy"); @@ -1031,8 +1033,9 @@ enum { Opt_shortname_winnt, Opt_shortname_mixed, Opt_utf8_no, Opt_utf8_yes, Opt_uni_xl_no, Opt_uni_xl_yes, Opt_nonumtail_no, Opt_nonumtail_yes, Opt_obsolete, Opt_flush, Opt_tz_utc, Opt_rodir, Opt_err_cont, - Opt_err_panic, Opt_err_ro, Opt_discard, Opt_nfs, Opt_time_offset, - Opt_nfs_stale_rw, Opt_nfs_nostale_ro, Opt_err, Opt_dos1xfloppy, + Opt_err_panic, Opt_err_ro, Opt_discard, Opt_barrier, Opt_nobarrier, + Opt_nfs, Opt_time_offset, Opt_nfs_stale_rw, Opt_nfs_nostale_ro, + Opt_err, Opt_dos1xfloppy, }; static const match_table_t fat_tokens = { @@ -1062,6 +1065,8 @@ static const match_table_t fat_tokens = {Opt_err_panic, "errors=panic"}, {Opt_err_ro, "errors=remount-ro"}, {Opt_discard, "discard"}, + {Opt_barrier, "barrier"}, + {Opt_nobarrier, "nobarrier"}, {Opt_nfs_stale_rw, "nfs"}, {Opt_nfs_stale_rw, "nfs=stale_rw"}, {Opt_nfs_nostale_ro, "nfs=nostale_ro"}, @@ -1146,6 +1151,7 @@ static int parse_options(struct super_bl opts->numtail = 1; opts->usefree = opts->nocase = 0; opts->tz_set = 0; + opts->barrier = 1; opts->nfs = 0; opts->errors = FAT_ERRORS_RO; *debug = 0; @@ -1269,6 +1275,15 @@ static int parse_options(struct super_bl case Opt_err_ro: opts->errors = FAT_ERRORS_RO; break; + case Opt_discard: + opts->discard = 1; + break; + case Opt_barrier: + opts->barrier = 1; + break; + case Opt_nobarrier: + opts->barrier = 0; + break; case Opt_nfs_stale_rw: opts->nfs = FAT_NFS_STALE_RW; break; @@ -1332,9 +1347,6 @@ static int parse_options(struct super_bl case Opt_rodir: opts->rodir = 1; break; - case Opt_discard: - opts->discard = 1; - break; /* obsolete mount options */ case Opt_obsolete: _ Patches currently in -mm which might be from hirofumi(a)mail.parknet.co.jp are

5 years, 2 months

1
0
0 0

[PATCH v3] tpm: only set efi_tpm_final_log_size after successful event log parsing

by Jerry Snitselaar

If __calc_tpm2_event_size fails to parse an event it will return 0, resulting tpm2_calc_event_log_size returning -1. Currently there is no check of this return value, and efi_tpm_final_log_size can end up being set to this negative value resulting in a panic like the the one given below. Also __calc_tpm2_event_size returns a size of 0 when it fails to parse an event, so update function documentation to reflect this. [ 0.774340] BUG: unable to handle page fault for address: ffffbc8fc00866ad [ 0.774788] #PF: supervisor read access in kernel mode [ 0.774788] #PF: error_code(0x0000) - not-present page [ 0.774788] PGD 107d36067 P4D 107d36067 PUD 107d37067 PMD 107d38067 PTE 0 [ 0.774788] Oops: 0000 [#1] SMP PTI [ 0.774788] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.3.0-0.rc2.1.elrdy.x86_64 #1 [ 0.774788] Hardware name: LENOVO 20HGS22D0W/20HGS22D0W, BIOS N1WET51W (1.30 ) 09/14/2018 [ 0.774788] RIP: 0010:memcpy_erms+0x6/0x10 [ 0.774788] Code: 90 90 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe [ 0.774788] RSP: 0000:ffffbc8fc0073b30 EFLAGS: 00010286 [ 0.774788] RAX: ffff9b1fc7c5b367 RBX: ffff9b1fc8390000 RCX: ffffffffffffe962 [ 0.774788] RDX: ffffffffffffe962 RSI: ffffbc8fc00866ad RDI: ffff9b1fc7c5b367 [ 0.774788] RBP: ffff9b1c10ca7018 R08: ffffbc8fc0085fff R09: 8000000000000063 [ 0.774788] R10: 0000000000001000 R11: 000fffffffe00000 R12: 0000000000003367 [ 0.774788] R13: ffff9b1fcc47c010 R14: ffffbc8fc0085000 R15: 0000000000000002 [ 0.774788] FS: 0000000000000000(0000) GS:ffff9b1fce200000(0000) knlGS:0000000000000000 [ 0.774788] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.774788] CR2: ffffbc8fc00866ad CR3: 000000029f60a001 CR4: 00000000003606f0 [ 0.774788] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 0.774788] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 0.774788] Call Trace: [ 0.774788] tpm_read_log_efi+0x156/0x1a0 [ 0.774788] tpm_bios_log_setup+0xc8/0x190 [ 0.774788] tpm_chip_register+0x50/0x1c0 [ 0.774788] tpm_tis_core_init.cold.9+0x28c/0x466 [ 0.774788] tpm_tis_plat_probe+0xcc/0xea [ 0.774788] platform_drv_probe+0x35/0x80 [ 0.774788] really_probe+0xef/0x390 [ 0.774788] driver_probe_device+0xb4/0x100 [ 0.774788] device_driver_attach+0x4f/0x60 [ 0.774788] __driver_attach+0x86/0x140 [ 0.774788] ? device_driver_attach+0x60/0x60 [ 0.774788] bus_for_each_dev+0x76/0xc0 [ 0.774788] ? klist_add_tail+0x3b/0x70 [ 0.774788] bus_add_driver+0x14a/0x1e0 [ 0.774788] ? tpm_init+0xea/0xea [ 0.774788] ? do_early_param+0x8e/0x8e [ 0.774788] driver_register+0x6b/0xb0 [ 0.774788] ? tpm_init+0xea/0xea [ 0.774788] init_tis+0x86/0xd8 [ 0.774788] ? do_early_param+0x8e/0x8e [ 0.774788] ? driver_register+0x94/0xb0 [ 0.774788] do_one_initcall+0x46/0x1e4 [ 0.774788] ? do_early_param+0x8e/0x8e [ 0.774788] kernel_init_freeable+0x199/0x242 [ 0.774788] ? rest_init+0xaa/0xaa [ 0.774788] kernel_init+0xa/0x106 [ 0.774788] ret_from_fork+0x35/0x40 [ 0.774788] Modules linked in: [ 0.774788] CR2: ffffbc8fc00866ad [ 0.774788] ---[ end trace 42930799f8d6eaea ]--- [ 0.774788] RIP: 0010:memcpy_erms+0x6/0x10 [ 0.774788] Code: 90 90 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe [ 0.774788] RSP: 0000:ffffbc8fc0073b30 EFLAGS: 00010286 [ 0.774788] RAX: ffff9b1fc7c5b367 RBX: ffff9b1fc8390000 RCX: ffffffffffffe962 [ 0.774788] RDX: ffffffffffffe962 RSI: ffffbc8fc00866ad RDI: ffff9b1fc7c5b367 [ 0.774788] RBP: ffff9b1c10ca7018 R08: ffffbc8fc0085fff R09: 8000000000000063 [ 0.774788] R10: 0000000000001000 R11: 000fffffffe00000 R12: 0000000000003367 [ 0.774788] R13: ffff9b1fcc47c010 R14: ffffbc8fc0085000 R15: 0000000000000002 [ 0.774788] FS: 0000000000000000(0000) GS:ffff9b1fce200000(0000) knlGS:0000000000000000 [ 0.774788] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.774788] CR2: ffffbc8fc00866ad CR3: 000000029f60a001 CR4: 00000000003606f0 [ 0.774788] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 0.774788] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 0.774788] Kernel panic - not syncing: Fatal exception [ 0.774788] Kernel Offset: 0x1d000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 0.774788] ---[ end Kernel panic - not syncing: Fatal exception ]--- The root cause of the issue that caused the failure of event parsing in this case is resolved by Peter Jone's patchset dealing with large event logs where crossing over a page boundary causes the page with the event count to be unmapped. Fixes: c46f3405692de ("tpm: Reserve the TPM final events table") Cc: linux-efi(a)vger.kernel.org Cc: linux-integrity(a)vger.kernel.org Cc: stable(a)vger.kernel.org Cc: Matthew Garrett <mjg59(a)google.com> Cc: Ard Biesheuvel <ard.biesheuvel(a)linaro.org> Cc: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> Signed-off-by: Jerry Snitselaar <jsnitsel(a)redhat.com> --- v3: rebase on top of Peter Jone's patchset v2: added FW_BUG to pr_err, and renamed label to out_calc. Updated doc comment for __calc_tpm2_event_size. drivers/firmware/efi/tpm.c | 9 ++++++++- include/linux/tpm_eventlog.h | 2 +- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c index b9ae5c6f9b9c..703469c1ab8e 100644 --- a/drivers/firmware/efi/tpm.c +++ b/drivers/firmware/efi/tpm.c @@ -85,11 +85,18 @@ int __init efi_tpm_eventlog_init(void) final_tbl->nr_events, log_tbl->log); } + + if (tbl_size < 0) { + pr_err(FW_BUG "Failed to parse event in TPM Final Events Log\n"); + goto out_calc; + } + memblock_reserve((unsigned long)final_tbl, tbl_size + sizeof(*final_tbl)); - early_memunmap(final_tbl, sizeof(*final_tbl)); efi_tpm_final_log_size = tbl_size; +out_calc: + early_memunmap(final_tbl, sizeof(*final_tbl)); out: early_memunmap(log_tbl, sizeof(*log_tbl)); return ret; diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h index 12584b69a3f3..2dfdd63ac034 100644 --- a/include/linux/tpm_eventlog.h +++ b/include/linux/tpm_eventlog.h @@ -152,7 +152,7 @@ struct tcg_algorithm_info { * total. Once we've done this we know the offset of the data length field, * and can calculate the total size of the event. * - * Return: size of the event on success, <0 on failure + * Return: size of the event on success, 0 on failure */ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, -- 2.23.0

5 years, 2 months

3
2
0 0

[PATCH v2 1/2] efi+tpm: Don't access event->count when it isn't mapped.

by Jarkko Sakkinen

From: Peter Jones <pjones(a)redhat.com> Some machines generate a lot of event log entries. When we're iterating over them, the code removes the old mapping and adds a new one, so once we cross the page boundary we're unmapping the page with the count on it. Hilarity ensues. This patch keeps the info from the header in local variables so we don't need to access that page again or keep track of if it's mapped. Fixes: 44038bc514a2 ("tpm: Abstract crypto agile event size calculations") Cc: linux-efi(a)vger.kernel.org Cc: linux-integrity(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Peter Jones <pjones(a)redhat.com> Tested-by: Lyude Paul <lyude(a)redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> Acked-by: Matthew Garrett <mjg59(a)google.com> Acked-by: Ard Biesheuvel <ard.biesheuvel(a)linaro.org> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> --- include/linux/tpm_eventlog.h | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h index 63238c84dc0b..12584b69a3f3 100644 --- a/include/linux/tpm_eventlog.h +++ b/include/linux/tpm_eventlog.h @@ -170,6 +170,7 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, u16 halg; int i; int j; + u32 count, event_type; marker = event; marker_start = marker; @@ -190,16 +191,22 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, } event = (struct tcg_pcr_event2_head *)mapping; + /* + * the loop below will unmap these fields if the log is larger than + * one page, so save them here for reference. + */ + count = READ_ONCE(event->count); + event_type = READ_ONCE(event->event_type); efispecid = (struct tcg_efi_specid_event_head *)event_header->event; /* Check if event is malformed. */ - if (event->count > efispecid->num_algs) { + if (count > efispecid->num_algs) { size = 0; goto out; } - for (i = 0; i < event->count; i++) { + for (i = 0; i < count; i++) { halg_size = sizeof(event->digests[i].alg_id); /* Map the digest's algorithm identifier */ @@ -256,8 +263,9 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, + event_field->event_size; size = marker - marker_start; - if ((event->event_type == 0) && (event_field->event_size == 0)) + if (event_type == 0 && event_field->event_size == 0) size = 0; + out: if (do_mapping) TPM_MEMUNMAP(mapping, mapping_size); -- 2.20.1

5 years, 2 months

3
7
0 0

[PATCH v2 3/3] genirq/irqdomain: Detect type race in irq_create_fwspec_mapping()

by Sverdlin, Alexander (Nokia - DE/Ulm)

From: Alexander Sverdlin <alexander.sverdlin(a)nokia.com> irq_create_fwspec_mapping() can race with itself during IRQ trigger type configuration. Possible scenarios include: - Mapping exists, two irq_create_fwspec_mapping() running in parallel do not detect type mismatch, IRQ remains configured with one of the different trigger types randomly - Second call to irq_create_fwspec_mapping() sees existing mapping just created by first call, but earlier irqd_set_trigger_type() call races with later irqd_set_trigger_type() => totally undetected, IRQ type is being set randomly to either one or another type Introduce helper function to detect parallel changes to IRQ type. Cc: stable(a)vger.kernel.org Signed-off-by: Alexander Sverdlin <alexander.sverdlin(a)nokia.com> --- kernel/irq/irqdomain.c | 66 +++++++++++++++++++++++++++++--------------------- 1 file changed, 38 insertions(+), 28 deletions(-) diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c index ad62c08..4ff4073 100644 --- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -764,10 +764,45 @@ static void of_phandle_args_to_fwspec(struct device_node *np, const u32 *args, fwspec->param[i] = args[i]; } +/* Detect races during IRQ type setting */ +static int irq_set_trigger_type_locked(unsigned int virq, unsigned int type, + irq_hw_number_t hwirq, + const struct irq_fwspec *fwspec) +{ + struct irq_data *irq_data; + int ret = 0; + + mutex_lock(&irq_domain_mutex); + /* + * If the trigger type is not specified or matches the current trigger + * type then we are done. + */ + if (type == IRQ_TYPE_NONE || type == irq_get_trigger_type(virq)) + goto unlock; + + /* If the trigger type has not been set yet, then set it now */ + if (irq_get_trigger_type(virq) != IRQ_TYPE_NONE) { + pr_warn("type mismatch, failed to map hwirq-%lu for %s!\n", + hwirq, of_node_full_name(to_of_node(fwspec->fwnode))); + ret = -EINVAL; + goto unlock; + } + + irq_data = irq_get_irq_data(virq); + if (!irq_data) { + ret = -ENOENT; + goto unlock; + } + irqd_set_trigger_type(irq_data, type); + +unlock: + mutex_unlock(&irq_domain_mutex); + return ret; +} + unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec) { struct irq_domain *domain; - struct irq_data *irq_data; irq_hw_number_t hwirq; unsigned int type = IRQ_TYPE_NONE; int virq; @@ -802,29 +837,8 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec) */ virq = irq_find_mapping(domain, hwirq); if (virq) { - /* - * If the trigger type is not specified or matches the - * current trigger type then we are done so return the - * interrupt number. - */ - if (type == IRQ_TYPE_NONE || type == irq_get_trigger_type(virq)) - return virq; - - /* - * If the trigger type has not been set yet, then set - * it now and return the interrupt number. - */ - if (irq_get_trigger_type(virq) == IRQ_TYPE_NONE) { - irq_data = irq_get_irq_data(virq); - if (!irq_data) - return 0; - - irqd_set_trigger_type(irq_data, type); + if (!irq_set_trigger_type_locked(virq, type, hwirq, fwspec)) return virq; - } - - pr_warn("type mismatch, failed to map hwirq-%lu for %s!\n", - hwirq, of_node_full_name(to_of_node(fwspec->fwnode))); return 0; } @@ -839,8 +853,7 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec) return virq; } - irq_data = irq_get_irq_data(virq); - if (!irq_data) { + if (irq_set_trigger_type_locked(virq, type, hwirq, fwspec)) { if (irq_domain_is_hierarchy(domain)) irq_domain_free_irqs(virq, 1); else @@ -848,9 +861,6 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec) return 0; } - /* Store trigger type */ - irqd_set_trigger_type(irq_data, type); - return virq; } EXPORT_SYMBOL_GPL(irq_create_fwspec_mapping);

5 years, 2 months

1
0
0 0

[PATCH v2 2/3] genirq/irqdomain: Re-check mapping after associate in irq_create_mapping()

by Sverdlin, Alexander (Nokia - DE/Ulm)

From: Alexander Sverdlin <alexander.sverdlin(a)nokia.com> If two irq_create_mapping() calls perform a mapping of the same hwirq on two CPU cores in parallel they both will get 0 from irq_find_mapping(), both will allocate unique virq using irq_domain_alloc_descs() and both will finally irq_domain_associate() it. Giving different virq numbers to their callers. In practice the first caller is usually an interrupt controller driver and the seconds is some device requesting the interrupt providede by the above interrupt controller. In this case either the interrupt controller driver configures virq which is not the one being "associated" with hwirq, or the "slave" device requests the virq which is never being triggered. Reported-by: Krzysztof Adamski <krzysztof.adamski(a)nokia.com> Reported-by: Tomasz Bachorski <tomasz.bachorski(a)nokia.com> Reported-by: Wojciech Kosnikowski <wojciech.kosnikowski(a)nokia.com> Cc: stable(a)vger.kernel.org Signed-off-by: Alexander Sverdlin <alexander.sverdlin(a)nokia.com> --- kernel/irq/irqdomain.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c index ccbb048..ad62c08 100644 --- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -661,6 +661,7 @@ unsigned int irq_create_mapping(struct irq_domain *domain, { struct device_node *of_node; int virq; + int ret; pr_debug("irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq); @@ -675,13 +676,6 @@ unsigned int irq_create_mapping(struct irq_domain *domain, of_node = irq_domain_get_of_node(domain); - /* Check if mapping already exists */ - virq = irq_find_mapping(domain, hwirq); - if (virq) { - pr_debug("-> existing mapping on virq %d\n", virq); - return virq; - } - /* Allocate a virtual interrupt number */ virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node), NULL); if (virq <= 0) { @@ -689,8 +683,11 @@ unsigned int irq_create_mapping(struct irq_domain *domain, return 0; } - if (irq_domain_associate(domain, virq, hwirq)) { + ret = irq_domain_associate(domain, virq, hwirq); + if (ret) { irq_free_desc(virq); + if (ret == -EEXIST) + return irq_find_mapping(domain, hwirq); return 0; } -- 2.4.6

5 years, 2 months

1
0
0 0

[PATCH v2 1/3] genirq/irqdomain: Check for existing mapping in irq_domain_associate()

by Sverdlin, Alexander (Nokia - DE/Ulm)

From: Alexander Sverdlin <alexander.sverdlin(a)nokia.com> irq_domain_associate() is the only place where irq_find_mapping() can be used reliably (under irq_domain_mutex) to make a decision if the mapping shall be created or not. Other calls to irq_find_mapping() (not under any lock) cannot be used for this purpose and lead to race conditions in particular inside irq_create_mapping(). Give the callers of irq_domain_associate() an ability to detect existing domain reliably by examining the return value. Reported-by: Krzysztof Adamski <krzysztof.adamski(a)nokia.com> Reported-by: Tomasz Bachorski <tomasz.bachorski(a)nokia.com> Reported-by: Wojciech Kosnikowski <wojciech.kosnikowski(a)nokia.com> Cc: stable(a)vger.kernel.org Signed-off-by: Alexander Sverdlin <alexander.sverdlin(a)nokia.com> --- kernel/irq/irqdomain.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c index 132672b..ccbb048 100644 --- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -545,6 +545,15 @@ int irq_domain_associate(struct irq_domain *domain, unsigned int virq, return -EINVAL; mutex_lock(&irq_domain_mutex); + + /* Check if mapping already exists */ + if (irq_find_mapping(domain, hwirq)) { + mutex_unlock(&irq_domain_mutex); + pr_debug("%s: conflicting mapping for hwirq 0x%x\n", + domain->name, (int)hwirq); + return -EEXIST; + } + irq_data->hwirq = hwirq; irq_data->domain = domain; if (domain->ops->map) { -- 2.4.6

5 years, 2 months

1
0
0 0

[tip: timers/core] tick: broadcast-hrtimer: Fix a race in bc_set_next

by tip-bot2 for Balasubramani Vivekanandan

The following commit has been merged into the timers/core branch of tip: Commit-ID: b9023b91dd020ad7e093baa5122b6968c48cc9e0 Gitweb: https://git.kernel.org/tip/b9023b91dd020ad7e093baa5122b6968c48cc9e0 Author: Balasubramani Vivekanandan <balasubramani_vivekanandan(a)mentor.com> AuthorDate: Thu, 26 Sep 2019 15:51:01 +02:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Fri, 27 Sep 2019 14:45:55 +02:00 tick: broadcast-hrtimer: Fix a race in bc_set_next When a cpu requests broadcasting, before starting the tick broadcast hrtimer, bc_set_next() checks if the timer callback (bc_handler) is active using hrtimer_try_to_cancel(). But hrtimer_try_to_cancel() does not provide the required synchronization when the callback is active on other core. The callback could have already executed tick_handle_oneshot_broadcast() and could have also returned. But still there is a small time window where the hrtimer_try_to_cancel() returns -1. In that case bc_set_next() returns without doing anything, but the next_event of the tick broadcast clock device is already set to a timeout value. In the race condition diagram below, CPU #1 is running the timer callback and CPU #2 is entering idle state and so calls bc_set_next(). In the worst case, the next_event will contain an expiry time, but the hrtimer will not be started which happens when the racing callback returns HRTIMER_NORESTART. The hrtimer might never recover if all further requests from the CPUs to subscribe to tick broadcast have timeout greater than the next_event of tick broadcast clock device. This leads to cascading of failures and finally noticed as rcu stall warnings Here is a depiction of the race condition CPU #1 (Running timer callback) CPU #2 (Enter idle and subscribe to tick broadcast) --------------------- --------------------- __run_hrtimer() tick_broadcast_enter() bc_handler() __tick_broadcast_oneshot_control() tick_handle_oneshot_broadcast() raw_spin_lock(&tick_broadcast_lock); dev->next_event = KTIME_MAX; //wait for tick_broadcast_lock //next_event for tick broadcast clock set to KTIME_MAX since no other cores subscribed to tick broadcasting raw_spin_unlock(&tick_broadcast_lock); if (dev->next_event == KTIME_MAX) return HRTIMER_NORESTART // callback function exits without restarting the hrtimer //tick_broadcast_lock acquired raw_spin_lock(&tick_broadcast_lock); tick_broadcast_set_event() clockevents_program_event() dev->next_event = expires; bc_set_next() hrtimer_try_to_cancel() //returns -1 since the timer callback is active. Exits without restarting the timer cpu_base->running = NULL; The comment that hrtimer cannot be armed from within the callback is wrong. It is fine to start the hrtimer from within the callback. Also it is safe to start the hrtimer from the enter/exit idle code while the broadcast handler is active. The enter/exit idle code and the broadcast handler are synchronized using tick_broadcast_lock. So there is no need for the existing try to cancel logic. All this can be removed which will eliminate the race condition as well. Fixes: 5d1638acb9f6 ("tick: Introduce hrtimer based broadcast") Originally-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Balasubramani Vivekanandan <balasubramani_vivekanandan(a)mentor.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/20190926135101.12102-2-balasubramani_vivekanandan… --- kernel/time/tick-broadcast-hrtimer.c | 62 ++++++++++++--------------- 1 file changed, 29 insertions(+), 33 deletions(-) diff --git a/kernel/time/tick-broadcast-hrtimer.c b/kernel/time/tick-broadcast-hrtimer.c index c1f5bb5..b5a65e2 100644 --- a/kernel/time/tick-broadcast-hrtimer.c +++ b/kernel/time/tick-broadcast-hrtimer.c @@ -42,39 +42,39 @@ static int bc_shutdown(struct clock_event_device *evt) */ static int bc_set_next(ktime_t expires, struct clock_event_device *bc) { - int bc_moved; /* - * We try to cancel the timer first. If the callback is on - * flight on some other cpu then we let it handle it. If we - * were able to cancel the timer nothing can rearm it as we - * own broadcast_lock. + * This is called either from enter/exit idle code or from the + * broadcast handler. In all cases tick_broadcast_lock is held. * - * However we can also be called from the event handler of - * ce_broadcast_hrtimer itself when it expires. We cannot - * restart the timer because we are in the callback, but we - * can set the expiry time and let the callback return - * HRTIMER_RESTART. + * hrtimer_cancel() cannot be called here neither from the + * broadcast handler nor from the enter/exit idle code. The idle + * code can run into the problem described in bc_shutdown() and the + * broadcast handler cannot wait for itself to complete for obvious + * reasons. * - * Since we are in the idle loop at this point and because - * hrtimer_{start/cancel} functions call into tracing, - * calls to these functions must be bound within RCU_NONIDLE. + * Each caller tries to arm the hrtimer on its own CPU, but if the + * hrtimer callbback function is currently running, then + * hrtimer_start() cannot move it and the timer stays on the CPU on + * which it is assigned at the moment. + * + * As this can be called from idle code, the hrtimer_start() + * invocation has to be wrapped with RCU_NONIDLE() as + * hrtimer_start() can call into tracing. */ - RCU_NONIDLE( - { - bc_moved = hrtimer_try_to_cancel(&bctimer) >= 0; - if (bc_moved) { - hrtimer_start(&bctimer, expires, - HRTIMER_MODE_ABS_PINNED_HARD); - } - } - ); - - if (bc_moved) { - /* Bind the "device" to the cpu */ - bc->bound_on = smp_processor_id(); - } else if (bc->bound_on == smp_processor_id()) { - hrtimer_set_expires(&bctimer, expires); - } + RCU_NONIDLE( { + hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED_HARD); + /* + * The core tick broadcast mode expects bc->bound_on to be set + * correctly to prevent a CPU which has the broadcast hrtimer + * armed from going deep idle. + * + * As tick_broadcast_lock is held, nothing can change the cpu + * base which was just established in hrtimer_start() above. So + * the below access is safe even without holding the hrtimer + * base lock. + */ + bc->bound_on = bctimer.base->cpu_base->cpu; + } ); return 0; } @@ -100,10 +100,6 @@ static enum hrtimer_restart bc_handler(struct hrtimer *t) { ce_broadcast_hrtimer.event_handler(&ce_broadcast_hrtimer); - if (clockevent_state_oneshot(&ce_broadcast_hrtimer)) - if (ce_broadcast_hrtimer.next_event != KTIME_MAX) - return HRTIMER_RESTART; - return HRTIMER_NORESTART; }

5 years, 2 months

1
0
0 0

Please backport 79c92ca42b5a ("mac80211: handle deauthentication/disassociation from TDLS peer") to 4.9

by Salvatore Bonaccorso

Hi 79c92ca42b5a ("mac80211: handle deauthentication/disassociation from TDLS peer") was backported to various stable versions, back to 4.14, but not 4.9, because there is a conflict making it not applying cleanly to 4.9. Ben has done the work for 3.16, which got applied 3.16.74. Attached the backport for 4.9 for review, adjusting the context to make it apply on top of 4.9.194. Regards, Salvatore >From 8e2d380a76d8cbf241390e4dfca634a1b97a89b7 Mon Sep 17 00:00:00 2001 From: Yu Wang <yyuwang(a)codeaurora.org> Date: Fri, 10 May 2019 17:04:52 +0800 Subject: [PATCH] mac80211: handle deauthentication/disassociation from TDLS peer commit 79c92ca42b5a3e0ea172ea2ce8df8e125af237da upstream. When receiving a deauthentication/disassociation frame from a TDLS peer, a station should not disconnect the current AP, but only disable the current TDLS link if it's enabled. Without this change, a TDLS issue can be reproduced by following the steps as below: 1. STA-1 and STA-2 are connected to AP, bidirection traffic is running between STA-1 and STA-2. 2. Set up TDLS link between STA-1 and STA-2, stay for a while, then teardown TDLS link. 3. Repeat step #2 and monitor the connection between STA and AP. During the test, one STA may send a deauthentication/disassociation frame to another, after TDLS teardown, with reason code 6/7, which means: Class 2/3 frame received from nonassociated STA. On receive this frame, the receiver STA will disconnect the current AP and then reconnect. It's not a expected behavior, purpose of this frame should be disabling the TDLS link, not the link with AP. Signed-off-by: Yu Wang <yyuwang(a)codeaurora.org> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> [Salvatore Bonaccorso: Backported to 4.9: adjust context] Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> --- net/mac80211/ieee80211_i.h | 3 +++ net/mac80211/mlme.c | 12 +++++++++++- net/mac80211/tdls.c | 23 +++++++++++++++++++++++ 3 files changed, 37 insertions(+), 1 deletion(-) diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index 6708de10a3e5..0b0de3030e0d 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -2123,6 +2123,9 @@ void ieee80211_tdls_cancel_channel_switch(struct wiphy *wiphy, const u8 *addr); void ieee80211_teardown_tdls_peers(struct ieee80211_sub_if_data *sdata); void ieee80211_tdls_chsw_work(struct work_struct *wk); +void ieee80211_tdls_handle_disconnect(struct ieee80211_sub_if_data *sdata, + const u8 *peer, u16 reason); +const char *ieee80211_get_reason_code_string(u16 reason_code); extern const struct ethtool_ops ieee80211_ethtool_ops; diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index f462f026fc6a..c8409d6e2b88 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -2755,7 +2755,7 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata, #define case_WLAN(type) \ case WLAN_REASON_##type: return #type -static const char *ieee80211_get_reason_code_string(u16 reason_code) +const char *ieee80211_get_reason_code_string(u16 reason_code) { switch (reason_code) { case_WLAN(UNSPECIFIED); @@ -2820,6 +2820,11 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, if (len < 24 + 2) return; + if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) { + ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code); + return; + } + if (ifmgd->associated && ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) { const u8 *bssid = ifmgd->associated->bssid; @@ -2869,6 +2874,11 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata, reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code); + if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) { + ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code); + return; + } + sdata_info(sdata, "disassociated from %pM (Reason: %u)\n", mgmt->sa, reason_code); diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c index c64ae68ae4f8..863f92c08701 100644 --- a/net/mac80211/tdls.c +++ b/net/mac80211/tdls.c @@ -2001,3 +2001,26 @@ void ieee80211_tdls_chsw_work(struct work_struct *wk) } rtnl_unlock(); } + +void ieee80211_tdls_handle_disconnect(struct ieee80211_sub_if_data *sdata, + const u8 *peer, u16 reason) +{ + struct ieee80211_sta *sta; + + rcu_read_lock(); + sta = ieee80211_find_sta(&sdata->vif, peer); + if (!sta || !sta->tdls) { + rcu_read_unlock(); + return; + } + rcu_read_unlock(); + + tdls_dbg(sdata, "disconnected from TDLS peer %pM (Reason: %u=%s)\n", + peer, reason, + ieee80211_get_reason_code_string(reason)); + + ieee80211_tdls_oper_request(&sdata->vif, peer, + NL80211_TDLS_TEARDOWN, + WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE, + GFP_ATOMIC); +} -- 2.23.0

5 years, 2 months

2
1
0 0

[PATCH 01/15] jbd2: Fix possible overflow in jbd2_log_space_left()

by Jan Kara

When number of free space in the journal is very low, the arithmetic in jbd2_log_space_left() could underflow resulting in very high number of free blocks and thus triggering assertion failure in transaction commit code complaining there's not enough space in the journal: J_ASSERT(journal->j_free > 1); Properly check for the low number of free blocks. CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> --- include/linux/jbd2.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h index df03825ad1a1..b20ef2c0812d 100644 --- a/include/linux/jbd2.h +++ b/include/linux/jbd2.h @@ -1584,7 +1584,7 @@ static inline int jbd2_space_needed(journal_t *journal) static inline unsigned long jbd2_log_space_left(journal_t *journal) { /* Allow for rounding errors */ - unsigned long free = journal->j_free - 32; + long free = journal->j_free - 32; if (journal->j_committing_transaction) { unsigned long committing = atomic_read(&journal-> @@ -1593,7 +1593,7 @@ static inline unsigned long jbd2_log_space_left(journal_t *journal) /* Transaction + control blocks */ free -= committing + (committing >> JBD2_CONTROL_BLOCKS_SHIFT); } - return free; + return max_t(long, free, 0); } /* -- 2.16.4

5 years, 2 months

1
0
0 0

[PATCH 3/3] tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM operations

by Jarkko Sakkinen

From: Vadim Sukhomlinov <sukhomlinov(a)google.com> commit db4d8cb9c9f2af71c4d087817160d866ed572cc9 upstream TPM 2.0 Shutdown involve sending TPM2_Shutdown to TPM chip and disabling future TPM operations. TPM 1.2 behavior was different, future TPM operations weren't disabled, causing rare issues. This patch ensures that future TPM operations are disabled. Fixes: d1bd4a792d39 ("tpm: Issue a TPM2_Shutdown for TPM2 devices.") Cc: stable(a)vger.kernel.org Signed-off-by: Vadim Sukhomlinov <sukhomlinov(a)google.com> [dianders: resolved merge conflicts with mainline] Signed-off-by: Douglas Anderson <dianders(a)chromium.org> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> --- drivers/char/tpm/tpm-chip.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 0eca20c5a80c..ede8c1deca97 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -158,12 +158,15 @@ static int tpm_class_shutdown(struct device *dev) { struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev); + down_write(&chip->ops_sem); if (chip->flags & TPM_CHIP_FLAG_TPM2) { down_write(&chip->ops_sem); tpm2_shutdown(chip, TPM2_SU_CLEAR); chip->ops = NULL; up_write(&chip->ops_sem); } + chip->ops = NULL; + up_write(&chip->ops_sem); return 0; } -- 2.20.1

5 years, 2 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror September 2019