August 2020 - Linux-stable-mirror

[PATCH AUTOSEL 4.19 01/31] drm/tilcdc: fix leak & null ref in panel_connector_get_modes

by Sasha Levin

From: Tomi Valkeinen <tomi.valkeinen(a)ti.com> [ Upstream commit 3f9c1c872cc97875ddc8d63bc9fe6ee13652b933 ] If videomode_from_timings() returns true, the mode allocated with drm_mode_create will be leaked. Also, the return value of drm_mode_create() is never checked, and thus could cause NULL deref. Fix these two issues. Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ti.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200429104234.18910-1-tomi.v… Reviewed-by: Jyri Sarha <jsarha(a)ti.com> Acked-by: Sam Ravnborg <sam(a)ravnborg.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/tilcdc/tilcdc_panel.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c index a1acab39d87f4..096a33f12c615 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c @@ -150,12 +150,16 @@ static int panel_connector_get_modes(struct drm_connector *connector) int i; for (i = 0; i < timings->num_timings; i++) { - struct drm_display_mode *mode = drm_mode_create(dev); + struct drm_display_mode *mode; struct videomode vm; if (videomode_from_timings(timings, &vm, i)) break; + mode = drm_mode_create(dev); + if (!mode) + break; + drm_display_mode_from_videomode(&vm, mode); mode->type = DRM_MODE_TYPE_DRIVER; -- 2.25.1

4 years, 5 months

1
30
0 0

[PATCH AUTOSEL 5.4 01/45] drm/tilcdc: fix leak & null ref in panel_connector_get_modes

by Sasha Levin

From: Tomi Valkeinen <tomi.valkeinen(a)ti.com> [ Upstream commit 3f9c1c872cc97875ddc8d63bc9fe6ee13652b933 ] If videomode_from_timings() returns true, the mode allocated with drm_mode_create will be leaked. Also, the return value of drm_mode_create() is never checked, and thus could cause NULL deref. Fix these two issues. Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ti.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200429104234.18910-1-tomi.v… Reviewed-by: Jyri Sarha <jsarha(a)ti.com> Acked-by: Sam Ravnborg <sam(a)ravnborg.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/tilcdc/tilcdc_panel.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c index 5584e656b8575..8c4fd1aa4c2db 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c @@ -143,12 +143,16 @@ static int panel_connector_get_modes(struct drm_connector *connector) int i; for (i = 0; i < timings->num_timings; i++) { - struct drm_display_mode *mode = drm_mode_create(dev); + struct drm_display_mode *mode; struct videomode vm; if (videomode_from_timings(timings, &vm, i)) break; + mode = drm_mode_create(dev); + if (!mode) + break; + drm_display_mode_from_videomode(&vm, mode); mode->type = DRM_MODE_TYPE_DRIVER; -- 2.25.1

4 years, 5 months

1
44
0 0

[PATCH AUTOSEL 5.8 01/64] drm/tilcdc: fix leak & null ref in panel_connector_get_modes

by Sasha Levin

From: Tomi Valkeinen <tomi.valkeinen(a)ti.com> [ Upstream commit 3f9c1c872cc97875ddc8d63bc9fe6ee13652b933 ] If videomode_from_timings() returns true, the mode allocated with drm_mode_create will be leaked. Also, the return value of drm_mode_create() is never checked, and thus could cause NULL deref. Fix these two issues. Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ti.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200429104234.18910-1-tomi.v… Reviewed-by: Jyri Sarha <jsarha(a)ti.com> Acked-by: Sam Ravnborg <sam(a)ravnborg.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/tilcdc/tilcdc_panel.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c index 12823d60c4e89..4be53768f0146 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c @@ -139,12 +139,16 @@ static int panel_connector_get_modes(struct drm_connector *connector) int i; for (i = 0; i < timings->num_timings; i++) { - struct drm_display_mode *mode = drm_mode_create(dev); + struct drm_display_mode *mode; struct videomode vm; if (videomode_from_timings(timings, &vm, i)) break; + mode = drm_mode_create(dev); + if (!mode) + break; + drm_display_mode_from_videomode(&vm, mode); mode->type = DRM_MODE_TYPE_DRIVER; -- 2.25.1

4 years, 5 months

1
63
0 0

[patch 001/163] mm/memory.c: avoid access flag update TLB flush for retried page fault

by Andrew Morton

From: Yang Shi <yang.shi(a)linux.alibaba.com> Subject: mm/memory.c: avoid access flag update TLB flush for retried page fault Recently we found regression when running will_it_scale/page_fault3 test on ARM64. Over 70% down for the multi processes cases and over 20% down for the multi threads cases. It turns out the regression is caused by commit 89b15332af7c0312a41e50846819ca6613b58b4c ("mm: drop mmap_sem before calling balance_dirty_pages() in write fault"). The test mmaps a memory size file then write to the mapping, this would make all memory dirty and trigger dirty pages throttle, that upstream commit would release mmap_sem then retry the page fault. The retried page fault would see correct PTEs installed by the first try then update dirty bit and clear read-only bit and flush TLBs for ARM. The regression is caused by the excessive TLB flush. It is fine on x86 since x86 doesn't clear read-only bit so there is no need to flush TLB for this case. The page fault would be retried due to: 1. Waiting for page readahead 2. Waiting for page swapped in 3. Waiting for dirty pages throttling The first two cases don't have PTEs set up at all, so the retried page fault would install the PTEs, so they don't reach there. But the #3 case usually has PTEs installed, the retried page fault would reach the dirty bit and read-only bit update. But it seems not necessary to modify those bits again for #3 since they should be already set by the first page fault try. Of course the parallel page fault may set up PTEs, but we just need care about write fault. If the parallel page fault setup a writable and dirty PTE then the retried fault doesn't need do anything extra. If the parallel page fault setup a clean read-only PTE, the retried fault should just call do_wp_page() then return as the below code snippet shows: if (vmf->flags & FAULT_FLAG_WRITE) { if (!pte_write(entry)) return do_wp_page(vmf); } With this fix the test result get back to normal. [yang.shi(a)linux.alibaba.com: incorporate comment from Will Deacon, update commit log per discussion] Link: http://lkml.kernel.org/r/1594848990-55657-1-git-send-email-yang.shi@linux.a… Link: http://lkml.kernel.org/r/1594148072-91273-1-git-send-email-yang.shi@linux.a… Signed-off-by: Yang Shi <yang.shi(a)linux.alibaba.com> Reported-by: Xu Yu <xuyu(a)linux.alibaba.com> Debugged-by: Xu Yu <xuyu(a)linux.alibaba.com> Tested-by: Xu Yu <xuyu(a)linux.alibaba.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Hillf Danton <hdanton(a)sina.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Will Deacon <will.deacon(a)arm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memory.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/mm/memory.c~mm-avoid-access-flag-update-tlb-flush-for-retried-page-fault +++ a/mm/memory.c @@ -4241,8 +4241,14 @@ static vm_fault_t handle_pte_fault(struc if (vmf->flags & FAULT_FLAG_WRITE) { if (!pte_write(entry)) return do_wp_page(vmf); - entry = pte_mkdirty(entry); } + + if (vmf->flags & FAULT_FLAG_TRIED) + goto unlock; + + if (vmf->flags & FAULT_FLAG_WRITE) + entry = pte_mkdirty(entry); + entry = pte_mkyoung(entry); if (ptep_set_access_flags(vmf->vma, vmf->address, vmf->pte, entry, vmf->flags & FAULT_FLAG_WRITE)) { _

4 years, 5 months

3
5
0 0

[PATCH 4.19 00/56] 4.19.137-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.137 release. There are 56 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 05 Aug 2020 12:18:33 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.137-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.137-rc1 Thomas Gleixner <tglx(a)linutronix.de> x86/i8259: Use printk_deferred() to prevent deadlock Wanpeng Li <wanpengli(a)tencent.com> KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled Andrea Righi <andrea.righi(a)canonical.com> xen-netfront: fix potential deadlock in xennet_remove() Navid Emamdoost <navid.emamdoost(a)gmail.com> cxgb4: add missing release on skb in uld_send() Josh Poimboeuf <jpoimboe(a)redhat.com> x86/unwind/orc: Fix ORC for newly forked tasks Raviteja Narayanam <raviteja.narayanam(a)xilinx.com> Revert "i2c: cadence: Fix the hold bit setting" Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> net: ethernet: ravb: exit if re-initialization fails in tx timeout Liam Beguin <liambeguin(a)gmail.com> parisc: add support for cmpxchg on u8 pointers Navid Emamdoost <navid.emamdoost(a)gmail.com> nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame Laurence Oberman <loberman(a)redhat.com> qed: Disable "MFW indication via attention" SPAM every 5 minutes Geert Uytterhoeven <geert(a)linux-m68k.org> usb: hso: Fix debug compile warning on sparc32 Xin Xiong <xiongx18(a)fudan.edu.cn> net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq Wang Hai <wanghai38(a)huawei.com> net: gemini: Fix missing clk_disable_unprepare() in error path of gemini_ethernet_port_probe() Alain Michaud <alainm(a)chromium.org> Bluetooth: fix kernel oops in store_pending_adv_report Robin Murphy <robin.murphy(a)arm.com> arm64: csum: Fix handling of bad packets Sami Tolvanen <samitolvanen(a)google.com> arm64/alternatives: move length validation inside the subsection Remi Pommarel <repk(a)triplefau.lt> mac80211: mesh: Free pending skb when destroying a mpath Remi Pommarel <repk(a)triplefau.lt> mac80211: mesh: Free ie data when leaving mesh Andrii Nakryiko <andriin(a)fb.com> bpf: Fix map leak in HASH_OF_MAPS map Thomas Falcon <tlfalcon(a)linux.ibm.com> ibmvnic: Fix IRQ mapping disposal in error path Ido Schimmel <idosch(a)mellanox.com> mlxsw: core: Free EMAD transactions using kfree_rcu() Ido Schimmel <idosch(a)mellanox.com> mlxsw: core: Increase scope of RCU read-side critical section Jakub Kicinski <kuba(a)kernel.org> mlx4: disable device on shutdown Johan Hovold <johan(a)kernel.org> net: lan78xx: fix transfer-buffer memory leak Johan Hovold <johan(a)kernel.org> net: lan78xx: add missing endpoint sanity check Eran Ben Elisha <eranbe(a)mellanox.com> net/mlx5: Verify Hardware supports requested ptp function on a given pin Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de> sh: Fix validation of system call number Tanner Love <tannerlove(a)google.com> selftests/net: psock_fanout: fix clang issues for target arch PowerPC Tanner Love <tannerlove(a)google.com> selftests/net: rxtimestamp: fix clang issues for target arch PowerPC Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Fix crash when the hold queue is used. YueHaibing <yuehaibing(a)huawei.com> net/x25: Fix null-ptr-deref in x25_disconnect Xiyu Yang <xiyuyang19(a)fudan.edu.cn> net/x25: Fix x25_neigh refcnt leak when x25 disconnect Rik van Riel <riel(a)surriel.com> xfs: fix missed wakeup on l_flush_wait Peilin Ye <yepeilin.cs(a)gmail.com> rds: Prevent kernel-infoleak in rds_notify_queue_get() Linus Torvalds <torvalds(a)linux-foundation.org> random32: remove net_rand_state from the latent entropy gcc plugin Willy Tarreau <w(a)1wt.eu> random: fix circular include dependency on arm64 after addition of percpu.h Steve Cohen <cohens(a)codeaurora.org> drm: hold gem reference until object is no longer accessed Peilin Ye <yepeilin.cs(a)gmail.com> drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() Alex Deucher <alexander.deucher(a)amd.com> Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers" Grygorii Strashko <grygorii.strashko(a)ti.com> ARM: percpu.h: fix build error Willy Tarreau <w(a)1wt.eu> random32: update the net random state on interrupt and activity Will Deacon <will(a)kernel.org> ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints Pi-Hsun Shih <pihsun(a)chromium.org> wireless: Use offsetof instead of custom macro. Wang Hai <wanghai38(a)huawei.com> 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work Robert Hancock <hancockrwd(a)gmail.com> PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge Filipe Manana <fdmanana(a)suse.com> Btrfs: fix selftests failure due to uninitialized i_mode in test inodes Xin Long <lucien.xin(a)gmail.com> sctp: implement memory accounting on tx path Qu Wenruo <wqu(a)suse.com> btrfs: inode: Verify inode mode to avoid NULL pointer dereference Navid Emamdoost <navid.emamdoost(a)gmail.com> drm/amd/display: prevent memory leak Navid Emamdoost <navid.emamdoost(a)gmail.com> ath9k: release allocated buffer if timed out Navid Emamdoost <navid.emamdoost(a)gmail.com> ath9k_htc: release allocated buffer if timed out Navid Emamdoost <navid.emamdoost(a)gmail.com> tracing: Have error path in predicate_parse() free its allocated memory Navid Emamdoost <navid.emamdoost(a)gmail.com> drm/amdgpu: fix multiple memory leaks in acp_hw_init Sasha Levin <sashal(a)kernel.org> iio: imu: adis16400: fix memory leak Navid Emamdoost <navid.emamdoost(a)gmail.com> media: rc: prevent memory leak in cx23888_ir_probe Navid Emamdoost <navid.emamdoost(a)gmail.com> crypto: ccp - Release all allocated memory if sha type is invalid ------------- Diffstat: Makefile | 4 +- arch/arm/include/asm/percpu.h | 2 + arch/arm/kernel/hw_breakpoint.c | 27 +++++++-- arch/arm64/include/asm/alternative.h | 4 +- arch/arm64/include/asm/checksum.h | 5 +- arch/parisc/include/asm/cmpxchg.h | 2 + arch/parisc/lib/bitops.c | 12 ++++ arch/sh/kernel/entry-common.S | 6 +- arch/x86/kernel/i8259.c | 2 +- arch/x86/kernel/unwind_orc.c | 8 ++- arch/x86/kvm/lapic.c | 2 +- drivers/char/random.c | 1 + drivers/crypto/ccp/ccp-ops.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 34 ++++++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 9 ++- .../drm/amd/display/dc/dce100/dce100_resource.c | 1 + .../drm/amd/display/dc/dce110/dce110_resource.c | 1 + .../drm/amd/display/dc/dce112/dce112_resource.c | 1 + .../drm/amd/display/dc/dce120/dce120_resource.c | 1 + .../gpu/drm/amd/display/dc/dcn10/dcn10_resource.c | 1 + drivers/gpu/drm/drm_gem.c | 10 ++-- drivers/i2c/busses/i2c-cadence.c | 9 +-- drivers/iio/imu/adis16400_buffer.c | 5 +- drivers/media/pci/cx23885/cx23888-ir.c | 5 +- drivers/net/ethernet/chelsio/cxgb4/sge.c | 1 + drivers/net/ethernet/cortina/gemini.c | 5 +- drivers/net/ethernet/ibm/ibmvnic.c | 2 +- drivers/net/ethernet/mellanox/mlx4/main.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +- .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 23 +++++++- drivers/net/ethernet/mellanox/mlxsw/core.c | 8 ++- drivers/net/ethernet/qlogic/qed/qed_int.c | 3 +- drivers/net/ethernet/renesas/ravb_main.c | 26 ++++++++- drivers/net/usb/hso.c | 5 +- drivers/net/usb/lan78xx.c | 6 ++ drivers/net/wireless/ath/ath9k/htc_hst.c | 3 + drivers/net/wireless/ath/ath9k/wmi.c | 1 + drivers/net/xen-netfront.c | 64 ++++++++++++++-------- drivers/nfc/s3fwrn5/core.c | 1 + drivers/pci/quirks.c | 13 +++++ fs/btrfs/inode.c | 41 +++++++++++--- fs/btrfs/tests/btrfs-tests.c | 8 ++- fs/btrfs/tests/inode-tests.c | 1 + fs/xfs/xfs_log.c | 9 ++- include/linux/random.h | 3 + include/net/xfrm.h | 4 +- include/uapi/linux/wireless.h | 5 +- kernel/bpf/hashtab.c | 12 +++- kernel/time/timer.c | 8 +++ kernel/trace/trace_events_filter.c | 6 +- lib/random32.c | 2 +- net/9p/trans_fd.c | 15 ++++- net/bluetooth/hci_event.c | 26 ++++++--- net/mac80211/cfg.c | 1 + net/mac80211/mesh_pathtbl.c | 1 + net/rds/recv.c | 3 +- net/sctp/socket.c | 10 +++- net/x25/x25_subr.c | 6 ++ tools/testing/selftests/net/psock_fanout.c | 3 +- .../networking/timestamping/rxtimestamp.c | 3 +- 61 files changed, 369 insertions(+), 123 deletions(-)

4 years, 5 months

4
62
0 0

Re: Base for <linux-stable-rc.git#queue/5.8>

by Sedat Dilek

On Mon, Aug 10, 2020 at 12:01 PM Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> wrote: > > On Mon, Aug 10, 2020 at 12:01:25PM +0200, Greg Kroah-Hartman wrote: > > On Mon, Aug 10, 2020 at 11:52:30AM +0200, Sedat Dilek wrote: > > > [ Hope I have the correct CC for linux-stable ML ] > > > > > > Hi Greg and Sasha, > > > > > > The base for <linux-stable-rc.git#queue/5.8> is Linux v5.7.14 where it > > > should be Linux v5.8. > > > > What exactly do you mean by "#queue/5.8"? > > > > Is that a branch name? Ah, never seen those before, maybe they are > > something that Sasha creates? > > But yes, you are right, it seems to mirror queue/5.7 at the moment, > which isn't correct. > > thanks, [ CC correct stable ML ] Exactly. With <linux-stable-rc.git#queue/5.8> I mean [1]. - Sedat - [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/…

4 years, 5 months

3
11
0 0

[PATCH] drm/i915/display: Fix NV12 sub plane atomic state

by Uma Shankar

From: Abhishek Kumar <abhishek4.kumar(a)intel.com> For NV12 display sub plane is also configured and drivers internally create plane atomic state. Driver copies all of the param of main plane atomic state to sub planer atomic state but in sub plane atomic state crtc is not added ,so when drm atomic state is configured for commit ,fake commit handler is created for sub plane and also state is not cleared when NV12 buffer is not displayed. Fixes: 1f594b209fe1 ("drm/i915: Remove special case slave handling during hw programming") Change-Id: I447b16bf433dfb5b43b2e4cade258fc775aee065 Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Abhishek Kumar <abhishek4.kumar(a)intel.com> Signed-off-by: Uma Shankar <uma.shankar(a)intel.com> --- drivers/gpu/drm/i915/display/intel_display.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c index 522c772a2111..76da2189b01d 100644 --- a/drivers/gpu/drm/i915/display/intel_display.c +++ b/drivers/gpu/drm/i915/display/intel_display.c @@ -12502,6 +12502,7 @@ static int icl_check_nv12_planes(struct intel_crtc_state *crtc_state) struct intel_atomic_state *state = to_intel_atomic_state(crtc_state->uapi.state); struct intel_plane *plane, *linked; struct intel_plane_state *plane_state; + int ret; int i; if (INTEL_GEN(dev_priv) < 11) @@ -12576,6 +12577,11 @@ static int icl_check_nv12_planes(struct intel_crtc_state *crtc_state) linked_state->uapi.src = plane_state->uapi.src; linked_state->uapi.dst = plane_state->uapi.dst; + /* Update Linked plane crtc same as of main plane */ + ret = drm_atomic_set_crtc_for_plane(&linked_state->uapi, plane_state->uapi.crtc); + if(ret) + return ret; + if (icl_is_hdr_plane(dev_priv, plane->id)) { if (linked->id == PLANE_SPRITE5) plane_state->cus_ctl |= PLANE_CUS_PLANE_7; -- 2.26.2

4 years, 5 months

3
2
0 0

Backport request: nfsd: Fix NFSv4 READ on RDMA when using readv

by Timo Rothenpieler

Sorry if this is not the right approach to this, but I'd like to request a backport of 412055398b9e67e07347a936fc4a6adddabe9cf4, "nfsd: Fix NFSv4 READ on RDMA when using readv" to Linux 5.4. The patch applies cleanly and fixes a rare but severe issue with NFS over RDMA, which I just spent several days tracking down to that patch, with major help from linux-nfs/rdma. I have right now manually applied it to my 5.4 Kernel and can confirm it fixes the issue. Thanks, Timo

4 years, 5 months

3
3
0 0

[PATCH 4.19/4.14/4.9/4.4] Smack: fix use-after-free in smk_write_relabel_self()

by Eric Biggers

From: Eric Biggers <ebiggers(a)google.com> commit beb4ee6770a89646659e6a2178538d2b13e2654e upstream. smk_write_relabel_self() frees memory from the task's credentials with no locking, which can easily cause a use-after-free because multiple tasks can share the same credentials structure. Fix this by using prepare_creds() and commit_creds() to correctly modify the task's credentials. Reproducer for "BUG: KASAN: use-after-free in smk_write_relabel_self": #include <fcntl.h> #include <pthread.h> #include <unistd.h> static void *thrproc(void *arg) { int fd = open("/sys/fs/smackfs/relabel-self", O_WRONLY); for (;;) write(fd, "foo", 3); } int main() { pthread_t t; pthread_create(&t, NULL, thrproc, NULL); thrproc(NULL); } Reported-by: syzbot+e6416dabb497a650da40(a)syzkaller.appspotmail.com Fixes: 38416e53936e ("Smack: limited capability for changing process label") Cc: <stable(a)vger.kernel.org> # v4.4+ Signed-off-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com> --- security/smack/smackfs.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index 371ae368da35..10ee51d04492 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -2746,7 +2746,6 @@ static int smk_open_relabel_self(struct inode *inode, struct file *file) static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { - struct task_smack *tsp = current_security(); char *data; int rc; LIST_HEAD(list_tmp); @@ -2771,11 +2770,21 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, kfree(data); if (!rc || (rc == -EINVAL && list_empty(&list_tmp))) { + struct cred *new; + struct task_smack *tsp; + + new = prepare_creds(); + if (!new) { + rc = -ENOMEM; + goto out; + } + tsp = new->security; smk_destroy_label_list(&tsp->smk_relabel); list_splice(&list_tmp, &tsp->smk_relabel); + commit_creds(new); return count; } - +out: smk_destroy_label_list(&list_tmp); return rc; } -- 2.28.0.236.gb10cc79966-goog

4 years, 5 months

2
1
0 0

[PATCH stable 0/4] i40e fixes for stable

by Jesse Brandeburg

These stable fixes were not correctly noted as fixes when originally submitted for 5.2-rc1. We are addressing the internal gap that led to this miss. Please consider these patches for all stable kernels older than 5.2.0, I tried on 4.19 and 3 out of 4 apply cleanly with a cherry pick from Linus' tree, but one of them I had to rebase, so I'm just sending the whole series. If you'd rather I send one at a time in the format specified at option 2) of the stable documentation, please just let me know. Patch 4 depends on patch 1. I tried to follow the stable commit format for each of the individual patches, referencing the upstream commit ID. I also added a "Fixes" to each, trying to assist the automation in knowing how far back to backport. Shortlog: Grzegorz Siwik (1): i40e: Wrong truncation from u16 to u8 Martyna Szapar (2): i40e: Fix of memory leak and integer truncation in i40e_virtchnl.c i40e: Memory leak in i40e_config_iwarp_qvlist Sergey Nemov (1): i40e: add num_vectors checker in iwarp handler .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 51 +++++++++++++------ 1 file changed, 36 insertions(+), 15 deletions(-) -- 2.25.4

4 years, 5 months

2
5
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror August 2020