March 2021 - Linux-stable-mirror

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.228 release. There are 59 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.228-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.228-rc1 Marc Kleine-Budde <mkl(a)pengutronix.de> can: peak_usb: Revert "can: peak_usb: add forgotten supported devices" Jan Kara <jack(a)suse.cz> ext4: add reclaim checks to xattr code Markus Theil <markus.theil(a)tu-ilmenau.de> mac80211: fix double free in ibss_leave Eric Dumazet <edumazet(a)google.com> net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() Eric Dumazet <edumazet(a)google.com> net: sched: validate stab values Martin Willi <martin(a)strongswan.org> can: dev: Move device back to init netns on owning netns delete Thomas Gleixner <tglx(a)linutronix.de> locking/mutex: Fix non debug version of mutex_lock_io_nested() Jia-Ju Bai <baijiaju1990(a)gmail.com> scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() Jia-Ju Bai <baijiaju1990(a)gmail.com> scsi: qedi: Fix error return code of qedi_alloc_global_queues() Adrian Hunter <adrian.hunter(a)intel.com> perf auxtrace: Fix auxtrace queue conflict Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> ACPI: scan: Use unique number for instance_no Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: scan: Rearrange memory allocation in acpi_device_add() Potnuri Bharat Teja <bharat(a)chelsio.com> RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server Aya Levin <ayal(a)nvidia.com> net/mlx5e: Fix error path for ethtool set-priv-flag Pavel Tatashin <pasha.tatashin(a)soleen.com> arm64: kdump: update ppos when reading elfcorehdr Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm: fix shutdown hook in case GPU components failed to bind Corentin Labbe <clabbe(a)baylibre.com> net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes Johan Hovold <johan(a)kernel.org> net: cdc-phonet: fix data-interface release on probe failure Johannes Berg <johannes.berg(a)intel.com> mac80211: fix rate mask reset Torin Cooper-Bennun <torin(a)maxiluxsystems.com> can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning Tong Zhang <ztong0001(a)gmail.com> can: c_can: move runtime PM enable/disable to c_can_platform Tong Zhang <ztong0001(a)gmail.com> can: c_can_pci: c_can_pci_remove(): fix use-after-free Stephane Grosjean <s.grosjean(a)peak-system.com> can: peak_usb: add forgotten supported devices Dylan Hung <dylan_hung(a)aspeedtech.com> ftgmac100: Restart MAC HW once Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template Dinghao Liu <dinghao.liu(a)zju.edu.cn> e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 Vitaly Lifshits <vitaly.lifshits(a)intel.com> e1000e: add rtnl_lock() to e1000_reset_task Florian Fainelli <f.fainelli(a)gmail.com> net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port Eric Dumazet <edumazet(a)google.com> macvlan: macvlan_count_rx() needs to be aware of preemption Georgi Valkov <gvalkov(a)abv.bg> libbpf: Fix INSTALL flag order Grygorii Strashko <grygorii.strashko(a)ti.com> bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD Mikulas Patocka <mpatocka(a)redhat.com> dm ioctl: fix out of bounds array access when no devices Claudiu Beznea <claudiu.beznea(a)microchip.com> ARM: dts: at91-sama5d27_som1: fix phy address to 7 Horia Geantă <horia.geanta(a)nxp.com> arm64: dts: ls1043a: mark crypto engine dma coherent Horia Geantă <horia.geanta(a)nxp.com> arm64: dts: ls1012a: mark crypto engine dma coherent Horia Geantă <horia.geanta(a)nxp.com> arm64: dts: ls1046a: mark crypto engine dma coherent Phillip Lougher <phillip(a)squashfs.org.uk> squashfs: fix xattr id and id lookup sanity checks Sean Nyekjaer <sean(a)geanix.com> squashfs: fix inode lookup sanity checks Sergei Trofimovich <slyfox(a)gentoo.org> ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign Sergei Trofimovich <slyfox(a)gentoo.org> ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls J. Bruce Fields <bfields(a)redhat.com> nfs: we don't support removing system.nfs4_acl Christian König <christian.koenig(a)amd.com> drm/radeon: fix AGP dependency Peter Zijlstra <peterz(a)infradead.org> u64_stats,lockdep: Fix u64_stats_init() vs lockdep Rob Gardner <rob.gardner(a)oracle.com> sparc64: Fix opcode filtering in handling of no fault loads Tong Zhang <ztong0001(a)gmail.com> atm: idt77252: fix null-ptr-dereference Tong Zhang <ztong0001(a)gmail.com> atm: uPD98402: fix incorrect allocation Jia-Ju Bai <baijiaju1990(a)gmail.com> net: wan: fix error return code of uhdlc_init() Jia-Ju Bai <baijiaju1990(a)gmail.com> net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() Frank Sorenson <sorenson(a)redhat.com> NFS: Correct size calculation for create reply length Timo Rothenpieler <timo(a)rothenpieler.org> nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default Yang Li <yang.lee(a)linux.alibaba.com> gpiolib: acpi: Add missing IRQF_ONESHOT Denis Efremov <efremov(a)linux.com> sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count Jia-Ju Bai <baijiaju1990(a)gmail.com> net: tehuti: fix error return code in bdx_probe() Dinghao Liu <dinghao.liu(a)zju.edu.cn> ixgbe: Fix memleak in ixgbe_configure_clsu32 Hayes Wang <hayeswang(a)realtek.com> Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" Tong Zhang <ztong0001(a)gmail.com> atm: lanai: dont run lanai_dev_close if not open Tong Zhang <ztong0001(a)gmail.com> atm: eni: dont release is never initialized Michael Ellerman <mpe(a)ellerman.id.au> powerpc/4xx: Fix build errors from mfdcr() Heiko Thiery <heiko.thiery(a)gmail.com> net: fec: ptp: avoid register access when ipg clock is disabled ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/at91-sama5d27_som1.dtsi | 4 +- arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi | 1 + arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi | 1 + arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi | 1 + arch/arm64/kernel/crash_dump.c | 2 + arch/ia64/include/asm/syscall.h | 2 +- arch/ia64/kernel/ptrace.c | 24 ++++-- arch/powerpc/include/asm/dcr-native.h | 8 +- arch/sparc/kernel/traps_64.c | 13 ++-- drivers/acpi/internal.h | 6 +- drivers/acpi/scan.c | 88 +++++++++++++--------- drivers/atm/eni.c | 3 +- drivers/atm/idt77105.c | 4 +- drivers/atm/lanai.c | 5 +- drivers/atm/uPD98402.c | 2 +- drivers/bus/omap_l3_noc.c | 4 +- drivers/gpio/gpiolib-acpi.c | 2 +- drivers/gpu/drm/Kconfig | 1 + drivers/gpu/drm/msm/msm_drv.c | 4 + drivers/infiniband/hw/cxgb4/cm.c | 4 +- drivers/md/dm-ioctl.c | 2 +- drivers/net/can/c_can/c_can.c | 24 +----- drivers/net/can/c_can/c_can_pci.c | 3 +- drivers/net/can/c_can/c_can_platform.c | 6 +- drivers/net/can/dev.c | 1 + drivers/net/can/m_can/m_can.c | 3 - drivers/net/dsa/bcm_sf2.c | 6 +- drivers/net/ethernet/faraday/ftgmac100.c | 1 + drivers/net/ethernet/freescale/fec_ptp.c | 7 ++ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 4 +- drivers/net/ethernet/intel/e1000e/82571.c | 2 + drivers/net/ethernet/intel/e1000e/netdev.c | 6 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 +- .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 6 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 + drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 + drivers/net/ethernet/sun/niu.c | 2 - drivers/net/ethernet/tehuti/tehuti.c | 1 + drivers/net/usb/cdc-phonet.c | 2 + drivers/net/usb/r8152.c | 35 ++------- drivers/net/wan/fsl_ucc_hdlc.c | 8 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 8 +- drivers/scsi/qedi/qedi_main.c | 1 + fs/ext4/xattr.c | 4 + fs/nfs/Kconfig | 2 +- fs/nfs/nfs3xdr.c | 3 +- fs/nfs/nfs4proc.c | 3 + fs/squashfs/export.c | 8 +- fs/squashfs/id.c | 6 +- fs/squashfs/squashfs_fs.h | 1 + fs/squashfs/xattr_id.c | 6 +- include/acpi/acpi_bus.h | 1 + include/linux/if_macvlan.h | 3 +- include/linux/mutex.h | 2 +- include/linux/u64_stats_sync.h | 7 +- include/net/red.h | 10 ++- include/net/rtnetlink.h | 2 + net/core/dev.c | 2 +- net/mac80211/cfg.c | 4 +- net/mac80211/ibss.c | 2 + net/qrtr/qrtr.c | 5 ++ net/sched/sch_choke.c | 7 +- net/sched/sch_gred.c | 2 +- net/sched/sch_red.c | 7 +- net/sched/sch_sfq.c | 2 +- tools/lib/bpf/Makefile | 2 +- tools/perf/util/auxtrace.c | 4 - 68 files changed, 249 insertions(+), 168 deletions(-)

4 years, 1 month

4
62
0 0

[PATCH 4.9 00/53] 4.9.264-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.264 release. There are 53 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.264-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.264-rc1 Markus Theil <markus.theil(a)tu-ilmenau.de> mac80211: fix double free in ibss_leave Eric Dumazet <edumazet(a)google.com> net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() Eric Dumazet <edumazet(a)google.com> net: sched: validate stab values Martin Willi <martin(a)strongswan.org> can: dev: Move device back to init netns on owning netns delete Mike Galbraith <efault(a)gmx.de> futex: Handle transient "ownerless" rtmutex state correctly Mateusz Nosek <mateusznosek0(a)gmail.com> futex: Fix incorrect should_fail_futex() handling Yang Tao <yang.tao172(a)zte.com.cn> futex: Prevent robust futex exit race Will Deacon <will.deacon(a)arm.com> arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP Will Deacon <will.deacon(a)arm.com> locking/futex: Allow low-level atomic operations to return -EAGAIN Peter Zijlstra <peterz(a)infradead.org> futex: Fix (possible) missed wakeup Thomas Gleixner <tglx(a)linutronix.de> futex: Handle early deadlock return correctly Peter Zijlstra <peterz(a)infradead.org> futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock() Thomas Gleixner <tglx(a)linutronix.de> futex: Avoid freeing an active timer Peter Zijlstra <peterz(a)infradead.org> futex: Drop hb->lock before enqueueing on the rtmutex Peter Zijlstra <peterz(a)infradead.org> futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock() Peter Zijlstra <peterz(a)infradead.org> futex,rt_mutex: Introduce rt_mutex_init_waiter() Peter Zijlstra <peterz(a)infradead.org> futex: Use smp_store_release() in mark_wake_futex() Matthew Wilcox <willy(a)linux.intel.com> idr: add ida_is_empty Adrian Hunter <adrian.hunter(a)intel.com> perf auxtrace: Fix auxtrace queue conflict Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> ACPI: scan: Use unique number for instance_no Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: scan: Rearrange memory allocation in acpi_device_add() Potnuri Bharat Teja <bharat(a)chelsio.com> RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server Johan Hovold <johan(a)kernel.org> net: cdc-phonet: fix data-interface release on probe failure Johannes Berg <johannes.berg(a)intel.com> mac80211: fix rate mask reset Torin Cooper-Bennun <torin(a)maxiluxsystems.com> can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning Tong Zhang <ztong0001(a)gmail.com> can: c_can: move runtime PM enable/disable to c_can_platform Tong Zhang <ztong0001(a)gmail.com> can: c_can_pci: c_can_pci_remove(): fix use-after-free Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template Dinghao Liu <dinghao.liu(a)zju.edu.cn> e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 Vitaly Lifshits <vitaly.lifshits(a)intel.com> e1000e: add rtnl_lock() to e1000_reset_task Florian Fainelli <f.fainelli(a)gmail.com> net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port Eric Dumazet <edumazet(a)google.com> macvlan: macvlan_count_rx() needs to be aware of preemption Grygorii Strashko <grygorii.strashko(a)ti.com> bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD Horia Geantă <horia.geanta(a)nxp.com> arm64: dts: ls1043a: mark crypto engine dma coherent Phillip Lougher <phillip(a)squashfs.org.uk> squashfs: fix xattr id and id lookup sanity checks Sean Nyekjaer <sean(a)geanix.com> squashfs: fix inode lookup sanity checks Borislav Petkov <bp(a)suse.de> x86/tlb: Flush global mappings when KAISER is disabled Sergei Trofimovich <slyfox(a)gentoo.org> ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign Sergei Trofimovich <slyfox(a)gentoo.org> ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls J. Bruce Fields <bfields(a)redhat.com> nfs: we don't support removing system.nfs4_acl Peter Zijlstra <peterz(a)infradead.org> u64_stats,lockdep: Fix u64_stats_init() vs lockdep Tong Zhang <ztong0001(a)gmail.com> atm: idt77252: fix null-ptr-dereference Tong Zhang <ztong0001(a)gmail.com> atm: uPD98402: fix incorrect allocation Jia-Ju Bai <baijiaju1990(a)gmail.com> net: wan: fix error return code of uhdlc_init() Frank Sorenson <sorenson(a)redhat.com> NFS: Correct size calculation for create reply length Timo Rothenpieler <timo(a)rothenpieler.org> nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default Denis Efremov <efremov(a)linux.com> sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count Jia-Ju Bai <baijiaju1990(a)gmail.com> net: tehuti: fix error return code in bdx_probe() Dinghao Liu <dinghao.liu(a)zju.edu.cn> ixgbe: Fix memleak in ixgbe_configure_clsu32 Tong Zhang <ztong0001(a)gmail.com> atm: lanai: dont run lanai_dev_close if not open Tong Zhang <ztong0001(a)gmail.com> atm: eni: dont release is never initialized Michael Ellerman <mpe(a)ellerman.id.au> powerpc/4xx: Fix build errors from mfdcr() Heiko Thiery <heiko.thiery(a)gmail.com> net: fec: ptp: avoid register access when ipg clock is disabled ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi | 1 + arch/arm64/include/asm/futex.h | 59 ++-- arch/ia64/include/asm/syscall.h | 2 +- arch/ia64/kernel/ptrace.c | 24 +- arch/powerpc/include/asm/dcr-native.h | 8 +- arch/x86/include/asm/tlbflush.h | 11 +- drivers/acpi/internal.h | 6 +- drivers/acpi/scan.c | 88 +++-- drivers/atm/eni.c | 3 +- drivers/atm/idt77105.c | 4 +- drivers/atm/lanai.c | 5 +- drivers/atm/uPD98402.c | 2 +- drivers/bus/omap_l3_noc.c | 4 +- drivers/infiniband/hw/cxgb4/cm.c | 4 +- drivers/net/can/c_can/c_can.c | 24 +- drivers/net/can/c_can/c_can_pci.c | 3 +- drivers/net/can/c_can/c_can_platform.c | 6 +- drivers/net/can/dev.c | 1 + drivers/net/can/m_can/m_can.c | 3 - drivers/net/dsa/bcm_sf2.c | 6 +- drivers/net/ethernet/freescale/fec_ptp.c | 7 + drivers/net/ethernet/intel/e1000e/82571.c | 2 + drivers/net/ethernet/intel/e1000e/netdev.c | 6 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 + drivers/net/ethernet/sun/niu.c | 2 - drivers/net/ethernet/tehuti/tehuti.c | 1 + drivers/net/usb/cdc-phonet.c | 2 + drivers/net/wan/fsl_ucc_hdlc.c | 8 +- drivers/usb/gadget/function/f_hid.c | 6 +- drivers/usb/gadget/function/f_printer.c | 6 +- fs/nfs/Kconfig | 2 +- fs/nfs/nfs3xdr.c | 3 +- fs/nfs/nfs4proc.c | 3 + fs/squashfs/export.c | 8 +- fs/squashfs/id.c | 6 +- fs/squashfs/squashfs_fs.h | 1 + fs/squashfs/xattr_id.c | 6 +- include/acpi/acpi_bus.h | 1 + include/linux/idr.h | 5 + include/linux/if_macvlan.h | 3 +- include/linux/u64_stats_sync.h | 7 +- include/net/red.h | 10 +- include/net/rtnetlink.h | 2 + kernel/futex.c | 393 ++++++++++++++------- kernel/locking/rtmutex.c | 106 ++++-- kernel/locking/rtmutex_common.h | 5 +- net/core/dev.c | 2 +- net/mac80211/cfg.c | 4 +- net/mac80211/ibss.c | 2 + net/qrtr/qrtr.c | 5 + net/sched/sch_choke.c | 7 +- net/sched/sch_gred.c | 2 +- net/sched/sch_red.c | 7 +- net/sched/sch_sfq.c | 2 +- tools/perf/util/auxtrace.c | 4 - 57 files changed, 607 insertions(+), 306 deletions(-)

4 years, 1 month

6
58
0 0

[PATCH v3] mm: page_alloc: ignore init_on_free=1 for debug_pagealloc=1

by Sergei Trofimovich

On !ARCH_SUPPORTS_DEBUG_PAGEALLOC (like ia64) debug_pagealloc=1 implies page_poison=on: if (page_poisoning_enabled() || (!IS_ENABLED(CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC) && debug_pagealloc_enabled())) static_branch_enable(&_page_poisoning_enabled); page_poison=on needs to override init_on_free=1. Before the change it did not work as expected for the following case: - have PAGE_POISONING=y - have page_poison unset - have !ARCH_SUPPORTS_DEBUG_PAGEALLOC arch (like ia64) - have init_on_free=1 - have debug_pagealloc=1 That way we get both keys enabled: - static_branch_enable(&init_on_free); - static_branch_enable(&_page_poisoning_enabled); which leads to poisoned pages returned for __GFP_ZERO pages. After the change we execute only: - static_branch_enable(&_page_poisoning_enabled); and ignore init_on_free=1. Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Fixes: 8db26a3d4735 ("mm, page_poison: use static key more efficiently") Cc: <stable(a)vger.kernel.org> CC: Andrew Morton <akpm(a)linux-foundation.org> CC: linux-mm(a)kvack.org CC: David Hildenbrand <david(a)redhat.com> CC: Andrey Konovalov <andreyknvl(a)gmail.com> Link: https://lkml.org/lkml/2021/3/26/443 Signed-off-by: Sergei Trofimovich <slyfox(a)gentoo.org> --- Change since v2: - Added 'Fixes:' and 'CC: stable@' suggested by Vlastimil and David - Renamed local variable to 'page_poisoning_requested' for consistency suggested by David - Simplified initialization of page_poisoning_requested suggested by David - Added 'Acked-by: Vlastimil' mm/page_alloc.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index cfc72873961d..4bb3cdfc47f8 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -764,32 +764,36 @@ static inline void clear_page_guard(struct zone *zone, struct page *page, */ void init_mem_debugging_and_hardening(void) { + bool page_poisoning_requested = false; + +#ifdef CONFIG_PAGE_POISONING + /* + * Page poisoning is debug page alloc for some arches. If + * either of those options are enabled, enable poisoning. + */ + if (page_poisoning_enabled() || + (!IS_ENABLED(CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC) && + debug_pagealloc_enabled())) { + static_branch_enable(&_page_poisoning_enabled); + page_poisoning_requested = true; + } +#endif + if (_init_on_alloc_enabled_early) { - if (page_poisoning_enabled()) + if (page_poisoning_requested) pr_info("mem auto-init: CONFIG_PAGE_POISONING is on, " "will take precedence over init_on_alloc\n"); else static_branch_enable(&init_on_alloc); } if (_init_on_free_enabled_early) { - if (page_poisoning_enabled()) + if (page_poisoning_requested) pr_info("mem auto-init: CONFIG_PAGE_POISONING is on, " "will take precedence over init_on_free\n"); else static_branch_enable(&init_on_free); } -#ifdef CONFIG_PAGE_POISONING - /* - * Page poisoning is debug page alloc for some arches. If - * either of those options are enabled, enable poisoning. - */ - if (page_poisoning_enabled() || - (!IS_ENABLED(CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC) && - debug_pagealloc_enabled())) - static_branch_enable(&_page_poisoning_enabled); -#endif - #ifdef CONFIG_DEBUG_PAGEALLOC if (!debug_pagealloc_enabled()) return; -- 2.31.1

4 years, 1 month

2
1
0 0

✅ PASS: Test report for kernel 5.11.11-rc2 (stable)

by CKI Project

Hello, We ran automated tests on a recent commit from this kernel tree: Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Commit: f288f3edc688 - Linux 5.11.11-rc2 The results of these automated tests are provided below. Overall result: PASSED Merge: OK Compile: OK Tests: OK All kernel binaries, config files, and logs are available for download here: https://arr-cki-prod-datawarehouse-public.s3.amazonaws.com/index.html?prefi… Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Compile testing --------------- We compiled the kernel for 4 architectures: aarch64: make options: make -j30 INSTALL_MOD_STRIP=1 targz-pkg ppc64le: make options: make -j30 INSTALL_MOD_STRIP=1 targz-pkg s390x: make options: make -j30 INSTALL_MOD_STRIP=1 targz-pkg x86_64: make options: make -j30 INSTALL_MOD_STRIP=1 targz-pkg Hardware testing ---------------- We booted each kernel and ran the following tests: aarch64: Host 1: ✅ Boot test ✅ ACPI table test ✅ ACPI enabled test ✅ LTP ✅ CIFS Connectathon ✅ POSIX pjd-fstest suites ✅ Loopdev Sanity ✅ jvm - jcstress tests ✅ Memory: fork_mem ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Networking bridge: sanity ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking: igmp conformance test ✅ Networking route: pmtu ✅ Networking route_func - local ✅ Networking route_func - forward ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking cki netfilter test ✅ Networking tunnel: geneve basic test ✅ Networking tunnel: gre basic ✅ L2TP basic test ✅ Networking tunnel: vxlan basic ✅ Networking ipsec: basic netns - transport ✅ Networking ipsec: basic netns - tunnel ✅ Libkcapi AF_ALG test ✅ pciutils: update pci ids test ✅ ALSA PCM loopback test ✅ ALSA Control (mixer) Userspace Element test ✅ storage: SCSI VPD ✅ trace: ftrace/tracer 🚧 ✅ i2c: i2cdetect sanity 🚧 ✅ Firmware test suite 🚧 ✅ Memory function: kaslr 🚧 ✅ audit: audit testsuite test Host 2: ✅ Boot test ✅ xfstests - ext4 ✅ xfstests - xfs ✅ selinux-policy: serge-testsuite ✅ storage: software RAID testing ✅ Storage: swraid mdadm raid_module test 🚧 ✅ xfstests - btrfs 🚧 ✅ IPMI driver test 🚧 ✅ IPMItool loop stress test 🚧 ✅ Storage blktests 🚧 ✅ Storage block - filesystem fio test 🚧 ✅ Storage block - queue scheduler test 🚧 ✅ Storage nvme - tcp 🚧 ✅ Storage: lvm device-mapper test 🚧 ❌ stress: stress-ng ppc64le: Host 1: ✅ Boot test ✅ xfstests - ext4 ✅ xfstests - xfs ✅ selinux-policy: serge-testsuite ✅ storage: software RAID testing ✅ Storage: swraid mdadm raid_module test 🚧 ✅ xfstests - btrfs 🚧 ✅ IPMI driver test 🚧 ✅ IPMItool loop stress test 🚧 ✅ Storage blktests 🚧 ✅ Storage block - filesystem fio test 🚧 ✅ Storage block - queue scheduler test 🚧 ✅ Storage nvme - tcp 🚧 ✅ Storage: lvm device-mapper test Host 2: ✅ Boot test ✅ LTP ✅ CIFS Connectathon ✅ POSIX pjd-fstest suites ✅ Loopdev Sanity ✅ jvm - jcstress tests ✅ Memory: fork_mem ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Networking bridge: sanity ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking route: pmtu ✅ Networking route_func - local ✅ Networking route_func - forward ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking cki netfilter test ✅ Networking tunnel: geneve basic test ✅ Networking tunnel: gre basic ✅ L2TP basic test ✅ Networking tunnel: vxlan basic ✅ Networking ipsec: basic netns - tunnel ✅ Libkcapi AF_ALG test ✅ pciutils: update pci ids test ✅ ALSA PCM loopback test ✅ ALSA Control (mixer) Userspace Element test ✅ trace: ftrace/tracer 🚧 ✅ Memory function: kaslr 🚧 ✅ audit: audit testsuite test s390x: Host 1: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ⚡⚡⚡ Boot test ⚡⚡⚡ LTP ⚡⚡⚡ CIFS Connectathon ⚡⚡⚡ POSIX pjd-fstest suites ⚡⚡⚡ Loopdev Sanity ⚡⚡⚡ jvm - jcstress tests ⚡⚡⚡ Memory: fork_mem ⚡⚡⚡ Memory function: memfd_create ⚡⚡⚡ AMTU (Abstract Machine Test Utility) ⚡⚡⚡ Networking bridge: sanity ⚡⚡⚡ Ethernet drivers sanity ⚡⚡⚡ Networking route: pmtu ⚡⚡⚡ Networking route_func - local ⚡⚡⚡ Networking route_func - forward ⚡⚡⚡ Networking TCP: keepalive test ⚡⚡⚡ Networking UDP: socket ⚡⚡⚡ Networking cki netfilter test ⚡⚡⚡ Networking tunnel: geneve basic test ⚡⚡⚡ Networking tunnel: gre basic ⚡⚡⚡ L2TP basic test ⚡⚡⚡ Networking tunnel: vxlan basic ⚡⚡⚡ Networking ipsec: basic netns - transport ⚡⚡⚡ Networking ipsec: basic netns - tunnel ⚡⚡⚡ Libkcapi AF_ALG test ⚡⚡⚡ trace: ftrace/tracer 🚧 ⚡⚡⚡ Memory function: kaslr 🚧 ⚡⚡⚡ audit: audit testsuite test Host 2: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ⚡⚡⚡ Boot test ⚡⚡⚡ selinux-policy: serge-testsuite ⚡⚡⚡ Storage: swraid mdadm raid_module test 🚧 ⚡⚡⚡ Storage blktests 🚧 ⚡⚡⚡ Storage nvme - tcp 🚧 ⚡⚡⚡ stress: stress-ng Host 3: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ⚡⚡⚡ Boot test ⚡⚡⚡ LTP ⚡⚡⚡ CIFS Connectathon ⚡⚡⚡ POSIX pjd-fstest suites ⚡⚡⚡ Loopdev Sanity ⚡⚡⚡ jvm - jcstress tests ⚡⚡⚡ Memory: fork_mem ⚡⚡⚡ Memory function: memfd_create ⚡⚡⚡ AMTU (Abstract Machine Test Utility) ⚡⚡⚡ Networking bridge: sanity ⚡⚡⚡ Ethernet drivers sanity ⚡⚡⚡ Networking route: pmtu ⚡⚡⚡ Networking route_func - local ⚡⚡⚡ Networking route_func - forward ⚡⚡⚡ Networking TCP: keepalive test ⚡⚡⚡ Networking UDP: socket ⚡⚡⚡ Networking cki netfilter test ⚡⚡⚡ Networking tunnel: geneve basic test ⚡⚡⚡ Networking tunnel: gre basic ⚡⚡⚡ L2TP basic test ⚡⚡⚡ Networking tunnel: vxlan basic ⚡⚡⚡ Networking ipsec: basic netns - transport ⚡⚡⚡ Networking ipsec: basic netns - tunnel ⚡⚡⚡ Libkcapi AF_ALG test ⚡⚡⚡ trace: ftrace/tracer 🚧 ⚡⚡⚡ Memory function: kaslr 🚧 ⚡⚡⚡ audit: audit testsuite test Host 4: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ⚡⚡⚡ Boot test ⚡⚡⚡ selinux-policy: serge-testsuite ⚡⚡⚡ Storage: swraid mdadm raid_module test 🚧 ⚡⚡⚡ Storage blktests 🚧 ⚡⚡⚡ Storage nvme - tcp 🚧 ⚡⚡⚡ stress: stress-ng x86_64: Host 1: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ⚡⚡⚡ Boot test ⚡⚡⚡ xfstests - ext4 ⚡⚡⚡ xfstests - xfs ⚡⚡⚡ xfstests - nfsv4.2 ⚡⚡⚡ selinux-policy: serge-testsuite ⚡⚡⚡ storage: software RAID testing ⚡⚡⚡ Storage: swraid mdadm raid_module test 🚧 ⚡⚡⚡ CPU: Idle Test 🚧 ⚡⚡⚡ xfstests - btrfs 🚧 ⚡⚡⚡ xfstests - cifsv3.11 🚧 ⚡⚡⚡ IPMI driver test 🚧 ⚡⚡⚡ IPMItool loop stress test 🚧 ⚡⚡⚡ power-management: cpupower/sanity test 🚧 ⚡⚡⚡ Storage blktests 🚧 ⚡⚡⚡ Storage block - filesystem fio test 🚧 ⚡⚡⚡ Storage block - queue scheduler test 🚧 ⚡⚡⚡ Storage nvme - tcp 🚧 ⚡⚡⚡ Storage: lvm device-mapper test 🚧 ⚡⚡⚡ stress: stress-ng Host 2: ✅ Boot test ✅ ACPI table test ✅ LTP ✅ CIFS Connectathon ✅ POSIX pjd-fstest suites ✅ Loopdev Sanity ✅ jvm - jcstress tests ✅ Memory: fork_mem ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Networking bridge: sanity ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking: igmp conformance test ✅ Networking route: pmtu ✅ Networking route_func - local ✅ Networking route_func - forward ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking cki netfilter test ✅ Networking tunnel: geneve basic test ✅ Networking tunnel: gre basic ✅ L2TP basic test ✅ Networking tunnel: vxlan basic ✅ Networking ipsec: basic netns - transport ✅ Networking ipsec: basic netns - tunnel ✅ Libkcapi AF_ALG test ✅ pciutils: sanity smoke test ✅ pciutils: update pci ids test ✅ ALSA PCM loopback test ✅ ALSA Control (mixer) Userspace Element test ✅ storage: SCSI VPD ✅ trace: ftrace/tracer 🚧 ✅ i2c: i2cdetect sanity 🚧 ✅ Firmware test suite 🚧 ❌ Memory function: kaslr 🚧 ✅ audit: audit testsuite test Host 3: ✅ Boot test ✅ xfstests - ext4 ✅ xfstests - xfs ✅ xfstests - nfsv4.2 ✅ selinux-policy: serge-testsuite ✅ storage: software RAID testing ✅ Storage: swraid mdadm raid_module test 🚧 ✅ CPU: Idle Test 🚧 ❌ xfstests - btrfs 🚧 ✅ xfstests - cifsv3.11 🚧 ✅ IPMI driver test 🚧 ✅ IPMItool loop stress test 🚧 ✅ Storage blktests 🚧 ✅ Storage block - filesystem fio test 🚧 ✅ Storage block - queue scheduler test 🚧 ✅ Storage nvme - tcp 🚧 ✅ Storage: lvm device-mapper test 🚧 ✅ stress: stress-ng Test sources: https://gitlab.com/cki-project/kernel-tests 💚 Pull requests are welcome for new tests or improvements to existing tests! Aborted tests ------------- Tests that didn't complete running successfully are marked with ⚡⚡⚡. If this was caused by an infrastructure issue, we try to mark that explicitly in the report. Waived tests ------------ If the test run included waived tests, they are marked with 🚧. Such tests are executed but their results are not taken into account. Tests are waived when their results are not reliable enough, e.g. when they're just introduced or are being fixed. Testing timeout --------------- We aim to provide a report within reasonable timeframe. Tests that haven't finished running yet are marked with ⏱.

4 years, 1 month

1
0
0 0

[PATCH] drm: DON'T require each CRTC to have a unique primary plane

by Paul Cercueil

The ingenic-drm driver has two mutually exclusive primary planes already; so the fact that a CRTC must have one and only one primary plane is an invalid assumption. Fixes: 96962e3de725 ("drm: require each CRTC to have a unique primary plane") Cc: <stable(a)vger.kernel.org> # 5.11 Signed-off-by: Paul Cercueil <paul(a)crapouillou.net> --- drivers/gpu/drm/drm_mode_config.c | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c index 37b4b9f0e468..d86621c41047 100644 --- a/drivers/gpu/drm/drm_mode_config.c +++ b/drivers/gpu/drm/drm_mode_config.c @@ -626,9 +626,7 @@ void drm_mode_config_validate(struct drm_device *dev) { struct drm_encoder *encoder; struct drm_crtc *crtc; - struct drm_plane *plane; u32 primary_with_crtc = 0, cursor_with_crtc = 0; - unsigned int num_primary = 0; if (!drm_core_check_feature(dev, DRIVER_MODESET)) return; @@ -676,13 +674,4 @@ void drm_mode_config_validate(struct drm_device *dev) cursor_with_crtc |= drm_plane_mask(crtc->cursor); } } - - drm_for_each_plane(plane, dev) { - if (plane->type == DRM_PLANE_TYPE_PRIMARY) - num_primary++; - } - - WARN(num_primary != dev->mode_config.num_crtc, - "Must have as many primary planes as there are CRTCs, but have %u primary planes and %u CRTCs", - num_primary, dev->mode_config.num_crtc); } -- 2.30.2

4 years, 1 month

4
16
0 0

[PATCH v2] mm: fix race by making init_zero_pfn() early_initcall

by Ilya Lipnitskiy

There are code paths that rely on zero_pfn to be fully initialized before core_initcall. For example, wq_sysfs_init() is a core_initcall function that eventually results in a call to kernel_execve, which causes a page fault with a subsequent mmput. If zero_pfn is not initialized by then it may not get cleaned up properly and result in an error: BUG: Bad rss-counter state mm:(ptrval) type:MM_ANONPAGES val:1 Here is an analysis of the race as seen on a MIPS device. On this particular MT7621 device (Ubiquiti ER-X), zero_pfn is PFN 0 until initialized, at which point it becomes PFN 5120: 1. wq_sysfs_init calls into kobject_uevent_env at core_initcall: [<80340dc8>] kobject_uevent_env+0x7e4/0x7ec [<8033f8b8>] kset_register+0x68/0x88 [<803cf824>] bus_register+0xdc/0x34c [<803cfac8>] subsys_virtual_register+0x34/0x78 [<8086afb0>] wq_sysfs_init+0x1c/0x4c [<80001648>] do_one_initcall+0x50/0x1a8 [<8086503c>] kernel_init_freeable+0x230/0x2c8 [<8066bca0>] kernel_init+0x10/0x100 [<80003038>] ret_from_kernel_thread+0x14/0x1c 2. kobject_uevent_env() calls call_usermodehelper_exec() which executes kernel_execve asynchronously. 3. Memory allocations in kernel_execve cause a page fault, bumping the MM reference counter: [<8015adb4>] add_mm_counter_fast+0xb4/0xc0 [<80160d58>] handle_mm_fault+0x6e4/0xea0 [<80158aa4>] __get_user_pages.part.78+0x190/0x37c [<8015992c>] __get_user_pages_remote+0x128/0x360 [<801a6d9c>] get_arg_page+0x34/0xa0 [<801a7394>] copy_string_kernel+0x194/0x2a4 [<801a880c>] kernel_execve+0x11c/0x298 [<800420f4>] call_usermodehelper_exec_async+0x114/0x194 4. In case zero_pfn has not been initialized yet, zap_pte_range does not decrement the MM_ANONPAGES RSS counter and the BUG message is triggered shortly afterwards when __mmdrop checks the ref counters: [<800285e8>] __mmdrop+0x98/0x1d0 [<801a6de8>] free_bprm+0x44/0x118 [<801a86a8>] kernel_execve+0x160/0x1d8 [<800420f4>] call_usermodehelper_exec_async+0x114/0x194 [<80003198>] ret_from_kernel_thread+0x14/0x1c To avoid races such as described above, initialize init_zero_pfn at early_initcall level. Depending on the architecture, ZERO_PAGE is either constant or gets initialized even earlier, at paging_init, so there is no issue with initializing zero_pfn earlier. ML discussion: https://lore.kernel.org/lkml/CALCv0x2YqOXEAy2Q=hafjhHCtTHVodChv1qpM=niAXOpq… Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy(a)gmail.com> Cc: "Eric W. Biederman" <ebiederm(a)xmission.com> Cc: stable(a)vger.kernel.org --- mm/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memory.c b/mm/memory.c index 46ef306375bd..a8bbc4fc121f 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -166,7 +166,7 @@ static int __init init_zero_pfn(void) zero_pfn = page_to_pfn(ZERO_PAGE(0)); return 0; } -core_initcall(init_zero_pfn); +early_initcall(init_zero_pfn); void mm_trace_rss_stat(struct mm_struct *mm, int member, long count) { -- 2.31.0

4 years, 1 month

2
2
0 0

[PATCH v7 RESEND] MIPS: force use FR=0 or FRE for FPXX binaries

by YunQiang Su

The MIPS FPU may have 3 mode: FR=0: MIPS I style, all of the FPR are single. FR=1: all 32 FPR can be double. FRE: redirecting the rw of odd-FPR to the upper 32bit of even-double FPR. The binary may have 3 mode: FP32: can only work with FR=0 and FRE mode FPXX: can work with all of FR=0/FR=1/FRE mode. FP64: can only work with FR=1 mode Some binary, for example the output of golang, may be mark as FPXX, while in fact they are FP32. It is caused by the bug of design and linker: Object produced by pure Go has no FP annotation while in fact they are FP32; if we link them with the C module which marked as FPXX, the result will be marked as FPXX. If these fake-FPXX binaries is executed in FR=1 mode, some problem will happen. In Golang, now we add the FP32 annotation, so the future golang programs won't have this problem. While for the existing binaries, we need a kernel workaround. Currently, FR=1 mode is used for all FPXX binary, it makes some wrong behivour of the binaries. Since FPXX binary can work with both FR=1 and FR=0, we force it to use FR=0 or FRE (for R6 CPU). Reference: https://web.archive.org/web/20180828210612/https://dmz-portal.mips.com/wiki… https://go-review.googlesource.com/c/go/+/239217 https://go-review.googlesource.com/c/go/+/237058 Signed-off-by: YunQiang Su <yunqiang.su(a)cipunited.com> Cc: stable(a)vger.kernel.org # 4.19+ --- v6->v7: Use FRE mode for pre-R6 binaries on R6 CPU. v5->v6: Rollback to V3, aka remove config option. v4->v5: Fix CONFIG_MIPS_O32_FPXX_USE_FR0 usage: if -> ifdef v3->v4: introduce a config option: CONFIG_MIPS_O32_FPXX_USE_FR0 v2->v3: commit message: add Signed-off-by and Cc to stable. v1->v2: Fix bad commit message: in fact, we are switching to FR=0 arch/mips/kernel/elf.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c index 7b045d2a0b51..4d4db619544b 100644 --- a/arch/mips/kernel/elf.c +++ b/arch/mips/kernel/elf.c @@ -232,11 +232,16 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, void *_interp_ehdr, * that inherently require the hybrid FP mode. * - If FR1 and FRDEFAULT is true, that means we hit the any-abi or * fpxx case. This is because, in any-ABI (or no-ABI) we have no FPU - * instructions so we don't care about the mode. We will simply use - * the one preferred by the hardware. In fpxx case, that ABI can - * handle both FR=1 and FR=0, so, again, we simply choose the one - * preferred by the hardware. Next, if we only use single-precision - * FPU instructions, and the default ABI FPU mode is not good + * instructions so we don't care about the mode. + * In fpxx case, that ABI can handle all of FR=1/FR=0/FRE mode. + * Here, we need to use FR=0/FRE mode instead of FR=1, because some binaries + * may be mark as FPXX by mistake due to bugs of design and linker: + * The object produced by pure Go has no FP annotation, + * then is treated as any-ABI by linker, although in fact they are FP32; + * if any-ABI object is linked with FPXX object, the result will be mark as FPXX. + * Then the problem happens: run FP32 binaries in FR=1 mode. + * - If we only use single-precision FPU instructions, + * and the default ABI FPU mode is not good * (ie single + any ABI combination), we set again the FPU mode to the * one is preferred by the hardware. Next, if we know that the code * will only use single-precision instructions, shown by single being @@ -248,8 +253,9 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, void *_interp_ehdr, */ if (prog_req.fre && !prog_req.frdefault && !prog_req.fr1) state->overall_fp_mode = FP_FRE; - else if ((prog_req.fr1 && prog_req.frdefault) || - (prog_req.single && !prog_req.frdefault)) + else if (prog_req.fr1 && prog_req.frdefault) + state->overall_fp_mode = cpu_has_mips_r6 ? FP_FRE : FP_FR0; + else if (prog_req.single && !prog_req.frdefault) /* Make sure 64-bit MIPS III/IV/64R1 will not pick FR1 */ state->overall_fp_mode = ((raw_current_cpu_data.fpu_id & MIPS_FPIR_F64) && cpu_has_mips_r2_r6) ? -- 2.20.1

4 years, 1 month

6
10
0 0

[PATCH 4/4] usbip: synchronize event handler with sysfs code paths

by Shuah Khan

Fuzzing uncovered race condition between sysfs code paths in usbip drivers. Device connect/disconnect code paths initiated through sysfs interface are prone to races if disconnect happens during connect and vice versa. Use sysfs_lock to synchronize event handler with sysfs paths in usbip drivers. Reported-and-tested-by: syzbot+a93fba6d384346a761e3(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> --- drivers/usb/usbip/usbip_event.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c index 5d88917c9631..086ca76dd053 100644 --- a/drivers/usb/usbip/usbip_event.c +++ b/drivers/usb/usbip/usbip_event.c @@ -70,6 +70,7 @@ static void event_handler(struct work_struct *work) while ((ud = get_event()) != NULL) { usbip_dbg_eh("pending event %lx\n", ud->event); + mutex_lock(&ud->sysfs_lock); /* * NOTE: shutdown must come first. * Shutdown the device. @@ -90,6 +91,7 @@ static void event_handler(struct work_struct *work) ud->eh_ops.unusable(ud); unset_event(ud, USBIP_EH_UNUSABLE); } + mutex_unlock(&ud->sysfs_lock); wake_up(&ud->eh_waitq); } -- 2.27.0

4 years, 1 month

1
0
0 0

[PATCH 3/4] usbip: vudc synchronize sysfs code paths

by Shuah Khan

Fuzzing uncovered race condition between sysfs code paths in usbip drivers. Device connect/disconnect code paths initiated through sysfs interface are prone to races if disconnect happens during connect and vice versa. Use sysfs_lock to protect sysfs paths in vudc. Reported-and-tested-by: syzbot+a93fba6d384346a761e3(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> --- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_sysfs.c | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/drivers/usb/usbip/vudc_dev.c b/drivers/usb/usbip/vudc_dev.c index c8eeabdd9b56..2bc428f2e261 100644 --- a/drivers/usb/usbip/vudc_dev.c +++ b/drivers/usb/usbip/vudc_dev.c @@ -572,6 +572,7 @@ static int init_vudc_hw(struct vudc *udc) init_waitqueue_head(&udc->tx_waitq); spin_lock_init(&ud->lock); + mutex_init(&ud->sysfs_lock); ud->status = SDEV_ST_AVAILABLE; ud->side = USBIP_VUDC; diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c index 7383a543c6d1..f7633ee655a1 100644 --- a/drivers/usb/usbip/vudc_sysfs.c +++ b/drivers/usb/usbip/vudc_sysfs.c @@ -112,6 +112,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, dev_err(dev, "no device"); return -ENODEV; } + mutex_lock(&udc->ud.sysfs_lock); spin_lock_irqsave(&udc->lock, flags); /* Don't export what we don't have */ if (!udc->driver || !udc->pullup) { @@ -187,6 +188,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, wake_up_process(udc->ud.tcp_rx); wake_up_process(udc->ud.tcp_tx); + + mutex_unlock(&udc->ud.sysfs_lock); return count; } else { @@ -207,6 +210,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, } spin_unlock_irqrestore(&udc->lock, flags); + mutex_unlock(&udc->ud.sysfs_lock); return count; @@ -216,6 +220,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, spin_unlock_irq(&udc->ud.lock); unlock: spin_unlock_irqrestore(&udc->lock, flags); + mutex_unlock(&udc->ud.sysfs_lock); return ret; } -- 2.27.0

4 years, 1 month

1
0
0 0

[PATCH 2/4] usbip: stub-dev synchronize sysfs code paths

by Shuah Khan

Fuzzing uncovered race condition between sysfs code paths in usbip drivers. Device connect/disconnect code paths initiated through sysfs interface are prone to races if disconnect happens during connect and vice versa. Use sysfs_lock to protect sysfs paths in stub-dev. Reported-and-tested-by: syzbot+a93fba6d384346a761e3(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> --- drivers/usb/usbip/stub_dev.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c index 8f1de1fbbeed..d8d3892e5a69 100644 --- a/drivers/usb/usbip/stub_dev.c +++ b/drivers/usb/usbip/stub_dev.c @@ -63,6 +63,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a dev_info(dev, "stub up\n"); + mutex_lock(&sdev->ud.sysfs_lock); spin_lock_irq(&sdev->ud.lock); if (sdev->ud.status != SDEV_ST_AVAILABLE) { @@ -87,13 +88,13 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx"); if (IS_ERR(tcp_rx)) { sockfd_put(socket); - return -EINVAL; + goto unlock_mutex; } tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx"); if (IS_ERR(tcp_tx)) { kthread_stop(tcp_rx); sockfd_put(socket); - return -EINVAL; + goto unlock_mutex; } /* get task structs now */ @@ -112,6 +113,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a wake_up_process(sdev->ud.tcp_rx); wake_up_process(sdev->ud.tcp_tx); + mutex_unlock(&sdev->ud.sysfs_lock); + } else { dev_info(dev, "stub down\n"); @@ -122,6 +125,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a spin_unlock_irq(&sdev->ud.lock); usbip_event_add(&sdev->ud, SDEV_EVENT_DOWN); + mutex_unlock(&sdev->ud.sysfs_lock); } return count; @@ -130,6 +134,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a sockfd_put(socket); err: spin_unlock_irq(&sdev->ud.lock); +unlock_mutex: + mutex_unlock(&sdev->ud.sysfs_lock); return -EINVAL; } static DEVICE_ATTR_WO(usbip_sockfd); @@ -270,6 +276,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev) sdev->ud.side = USBIP_STUB; sdev->ud.status = SDEV_ST_AVAILABLE; spin_lock_init(&sdev->ud.lock); + mutex_init(&sdev->ud.sysfs_lock); sdev->ud.tcp_socket = NULL; sdev->ud.sockfd = -1; -- 2.27.0

4 years, 1 month

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2021