Le 11/06/2020 à 13:21, gregkh(a)linuxfoundation.org a écrit :
>
> This is a note to let you know that I've just added the patch titled
>
> crypto: talitos - fix ECB and CBC algs ivsize
>
> to the 4.9-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> crypto-talitos-fix-ecb-and-cbc-algs-ivsize.patch
> and it can be found in the queue-4.9 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
As far as I can see, the faulty commit e1de42fdfc6a ("crypto: talitos -
fix ECB algs ivsize") only removed .ivsize = AES_BLOCK_SIZE at a wrong
place.
The other changes (removal of .ivsize = DES_BLOCK_SIZE and .ivsize =
DES3_EDE_BLOCK_SIZE) are not from the faulty patch.
Christophe
>
>
> From cantona(a)cantona.net Thu Jun 11 12:53:25 2020
> From: Su Kang Yin <cantona(a)cantona.net>
> Date: Thu, 11 Jun 2020 18:07:45 +0800
> Subject: crypto: talitos - fix ECB and CBC algs ivsize
> To: gregkh(a)linuxfoundation.org, linux-crypto(a)vger.kernel.org, christophe.leroy(a)c-s.fr
> Cc: Su Kang Yin <cantona(a)cantona.net>, Herbert Xu <herbert(a)gondor.apana.org.au>, "David S. Miller" <davem(a)davemloft.net>, linux-kernel(a)vger.kernel.org
> Message-ID: <20200611100745.6513-1-cantona(a)cantona.net>
>
> From: Su Kang Yin <cantona(a)cantona.net>
>
> Patch for 4.9 upstream:
>
> commit e1de42fdfc6a ("crypto: talitos - fix ECB algs ivsize")
> wrongly modified CBC algs ivsize instead of ECB aggs ivsize.
>
> This restore the CBC algs original ivsize of removes ECB's ones.
>
> Signed-off-by: Su Kang Yin <cantona(a)cantona.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
> ---
> drivers/crypto/talitos.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> --- a/drivers/crypto/talitos.c
> +++ b/drivers/crypto/talitos.c
> @@ -2636,7 +2636,6 @@ static struct talitos_alg_template drive
> .cra_ablkcipher = {
> .min_keysize = AES_MIN_KEY_SIZE,
> .max_keysize = AES_MAX_KEY_SIZE,
> - .ivsize = AES_BLOCK_SIZE,
> }
> },
> .desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU |
> @@ -2670,6 +2669,7 @@ static struct talitos_alg_template drive
> .cra_ablkcipher = {
> .min_keysize = AES_MIN_KEY_SIZE,
> .max_keysize = AES_MAX_KEY_SIZE,
> + .ivsize = AES_BLOCK_SIZE,
> .setkey = ablkcipher_aes_setkey,
> }
> },
> @@ -2687,7 +2687,6 @@ static struct talitos_alg_template drive
> .cra_ablkcipher = {
> .min_keysize = DES_KEY_SIZE,
> .max_keysize = DES_KEY_SIZE,
> - .ivsize = DES_BLOCK_SIZE,
> }
> },
> .desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU |
> @@ -2720,7 +2719,6 @@ static struct talitos_alg_template drive
> .cra_ablkcipher = {
> .min_keysize = DES3_EDE_KEY_SIZE,
> .max_keysize = DES3_EDE_KEY_SIZE,
> - .ivsize = DES3_EDE_BLOCK_SIZE,
> }
> },
> .desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU |
>
>
> Patches currently in stable-queue which might be from cantona(a)cantona.net are
>
> queue-4.9/crypto-talitos-fix-ecb-and-cbc-algs-ivsize.patch
>
CVE Description:
NVD Site Link: https://nvd.nist.gov/vuln/detail?vulnId=CVE-2019-18885
It was discovered that the btrfs file system in the Linux kernel did not
properly validate metadata, leading to a NULL pointer dereference. An
attacker could use this to specially craft a file system image that, when
mounted, could cause a denial of service (system crash).
[PATCH v4.19.y 1/2]:
Backporting of upsream commit 09ba3bc9dd15:
btrfs: merge btrfs_find_device and find_device
[PATCH v4.19.y 2/2]:
Backporting of upstream commit 62fdaa52a3d0:
btrfs: Detect unbalanced tree with empty leaf before crashing
On NVD site link of "commit 09ba3bc9dd150457c506e4661380a6183af651c1"
was given as the fix for this CVE. But the issue was still reproducible.
So had to apply patch "Commit 62fdaa52a3d00a875da771719b6dc537ca79fce1"
to fix the issue.
From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
commit 1866541492641c02874bf51f9d8712b5510f2c64 upstream
When using RS485 half duplex the Transmitter Complete irq is needed to
determine the moment when the transmitter can be disabled. When using
DMA this irq must only be enabled when DMA has completed to transfer all
data. Otherwise the CPU might busily trigger this irq which is not
properly handled and so the also pending irq for the DMA transfer cannot
trigger.
Cc: <stable(a)vger.kernel.org> # v4.14.x
Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
[Backport to v4.14]
Signed-off-by: Frieder Schrempf <frieder.schrempf(a)kontron.de>
---
When using RS485 with DMA enabled simply transmitting some data on our
i.MX6ULL based boards often freezes the system completely. The higher
the baudrate, the easier it is to reproduce the issue. To test this I
simply used:
stty -F /dev/ttymxc1 speed 115200
while true; do echo TEST > /dev/ttymxc1; done
Without the patch this leads to an almost immediate system freeze,
with the patch applied, everything keeps working as expected.
---
drivers/tty/serial/imx.c | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 3f2605edd855..70c737236870 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -538,6 +538,11 @@ static void dma_tx_callback(void *data)
if (!uart_circ_empty(xmit) && !uart_tx_stopped(&sport->port))
imx_dma_tx(sport);
+ else if (sport->port.rs485.flags & SER_RS485_ENABLED) {
+ temp = readl(sport->port.membase + UCR4);
+ temp |= UCR4_TCEN;
+ writel(temp, sport->port.membase + UCR4);
+ }
spin_unlock_irqrestore(&sport->port.lock, flags);
}
@@ -555,6 +560,10 @@ static void imx_dma_tx(struct imx_port *sport)
if (sport->dma_is_txing)
return;
+ temp = readl(sport->port.membase + UCR4);
+ temp &= ~UCR4_TCEN;
+ writel(temp, sport->port.membase + UCR4);
+
sport->tx_bytes = uart_circ_chars_pending(xmit);
if (xmit->tail < xmit->head || xmit->head == 0) {
@@ -617,10 +626,15 @@ static void imx_start_tx(struct uart_port *port)
if (!(port->rs485.flags & SER_RS485_RX_DURING_TX))
imx_stop_rx(port);
- /* enable transmitter and shifter empty irq */
- temp = readl(port->membase + UCR4);
- temp |= UCR4_TCEN;
- writel(temp, port->membase + UCR4);
+ /*
+ * Enable transmitter and shifter empty irq only if DMA is off.
+ * In the DMA case this is done in the tx-callback.
+ */
+ if (!sport->dma_is_enabled) {
+ temp = readl(port->membase + UCR4);
+ temp |= UCR4_TCEN;
+ writel(temp, port->membase + UCR4);
+ }
}
if (!sport->dma_is_enabled) {
--
2.17.1
Hi,
Please apply upstream commit 7b06a6909555 ("igb: improve handling of
disconnected adapters") to v4.4.y and to v4.9.y. It fixes a kernel
panic observed in chromeos-4.4.
Thanks,
Jeff
From: Stefan Agner <stefan(a)agner.ch>
commit ad06fdeeef1cbadf86ebbe510e8079abada8b44e upstream.
Use flat regmap cache to avoid lockdep warning at probe:
[ 0.697285] WARNING: CPU: 0 PID: 1 at kernel/locking/lockdep.c:2755 lockdep_trace_alloc+0x15c/0x160()
[ 0.697449] DEBUG_LOCKS_WARN_ON(irqs_disabled_flags(flags))
The RB-tree regmap cache needs to allocate new space on first writes.
However, allocations in an atomic context (e.g. when a spinlock is held)
are not allowed. The function regmap_write calls map->lock, which
acquires a spinlock in the fast_io case. Since the pwm-fsl-ftm driver
uses MMIO, the regmap bus of type regmap_mmio is being used which has
fast_io set to true.
The MMIO space of the pwm-fsl-ftm driver is reasonable condense, hence
using the much faster flat regmap cache is anyway the better choice.
Signed-off-by: Stefan Agner <stefan(a)agner.ch>
Cc: Mark Brown <broonie(a)kernel.org>
Signed-off-by: Thierry Reding <thierry.reding(a)gmail.com>
Signed-off-by: Krzysztof Kozlowski <krzk(a)kernel.org>
---
Fixes lockdep warning. Apply to v4.4 and newer.
---
drivers/pwm/pwm-fsl-ftm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pwm/pwm-fsl-ftm.c b/drivers/pwm/pwm-fsl-ftm.c
index 7225ac6b3df5..fad968eb75f6 100644
--- a/drivers/pwm/pwm-fsl-ftm.c
+++ b/drivers/pwm/pwm-fsl-ftm.c
@@ -392,7 +392,7 @@ static const struct regmap_config fsl_pwm_regmap_config = {
.max_register = FTM_PWMLOAD,
.volatile_reg = fsl_pwm_volatile_reg,
- .cache_type = REGCACHE_RBTREE,
+ .cache_type = REGCACHE_FLAT,
};
static int fsl_pwm_probe(struct platform_device *pdev)
--
2.17.1
On Wed, Jun 10, 2020 at 01:41:59PM -0700, Jian Cai wrote:
> Hello,
>
> @Nick Desaulniers <ndesaulniers(a)google.com> made a patch
> (51da9dfb7f20911ae4e79e9b412a9c2d4c373d4b) and it was accepted to mainline
> as part of ClangBuiltLinux project to make the kernel compatible with
> Clang's integrated assembler. Please consider cherry picking it back to 5.4
> so that we can use Clang's integrated assembler to assemble ChromeOS' Linux
> kernels.
>
>
> commit 51da9dfb7f20911ae4e79e9b412a9c2d4c373d4b
> Author: Nick Desaulniers <ndesaulniers(a)google.com>
> Date: Thu Jun 4 16:50:49 2020 -0700
>
> elfnote: mark all .note sections SHF_ALLOC
>
Now queued up,t hanks.
greg k-h