March 2021 - Linux-stable-mirror

FAILED: patch "[PATCH] usbip: fix vhci_hcd attach_store() races leading to gpf" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 718ad9693e3656120064b715fe931f43a6201e67 Mon Sep 17 00:00:00 2001 From: Shuah Khan <skhan(a)linuxfoundation.org> Date: Sun, 7 Mar 2021 20:53:30 -0700 Subject: [PATCH] usbip: fix vhci_hcd attach_store() races leading to gpf attach_store() is invoked when user requests import (attach) a device from usbip host. Attach and detach are governed by local state and shared state - Shared state (usbip device status) - Device status is used to manage the attach and detach operations on import-able devices. - Local state (tcp_socket, rx and tx thread task_struct ptrs) A valid tcp_socket controls rx and tx thread operations while the device is in exported state. - Device has to be in the right state to be attached and detached. Attach sequence includes validating the socket and creating receive (rx) and transmit (tx) threads to talk to the host to get access to the imported device. rx and tx threads depends on local and shared state to be correct and in sync. Detach sequence shuts the socket down and stops the rx and tx threads. Detach sequence relies on local and shared states to be in sync. There are races in updating the local and shared status in the current attach sequence resulting in crashes. These stem from starting rx and tx threads before local and global state is updated correctly to be in sync. 1. Doesn't handle kthread_create() error and saves invalid ptr in local state that drives rx and tx threads. 2. Updates tcp_socket and sockfd, starts stub_rx and stub_tx threads before updating usbip_device status to VDEV_ST_NOTASSIGNED. This opens up a race condition between the threads, port connect, and detach handling. Fix the above problems: - Stop using kthread_get_run() macro to create/start threads. - Create threads and get task struct reference. - Add kthread_create() failure handling and bail out. - Hold vhci and usbip_device locks to update local and shared states after creating rx and tx threads. - Update usbip_device status to VDEV_ST_NOTASSIGNED. - Update usbip_device tcp_socket, sockfd, tcp_rx, and tcp_tx - Start threads after usbip_device (tcp_socket, sockfd, tcp_rx, tcp_tx, and status) is complete. Credit goes to syzbot and Tetsuo Handa for finding and root-causing the kthread_get_run() improper error handling problem and others. This is hard problem to find and debug since the races aren't seen in a normal case. Fuzzing forces the race window to be small enough for the kthread_get_run() error path bug and starting threads before updating the local and shared state bug in the attach sequence. - Update usbip_device tcp_rx and tcp_tx pointers holding vhci and usbip_device locks. Tested with syzbot reproducer: - https://syzkaller.appspot.com/text?tag=ReproC&x=14801034d00000 Fixes: 9720b4bc76a83807 ("staging/usbip: convert to kthread") Cc: stable(a)vger.kernel.org Reported-by: syzbot <syzbot+a93fba6d384346a761e3(a)syzkaller.appspotmail.com> Reported-by: syzbot <syzbot+bf1a360e305ee719e364(a)syzkaller.appspotmail.com> Reported-by: syzbot <syzbot+95ce4b142579611ef0a9(a)syzkaller.appspotmail.com> Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> Link: https://lore.kernel.org/r/bb434bd5d7a64fbec38b5ecfb838a6baef6eb12b.16151712… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c index 1e1ae9bd06ab..c4b4256e5dad 100644 --- a/drivers/usb/usbip/vhci_sysfs.c +++ b/drivers/usb/usbip/vhci_sysfs.c @@ -312,6 +312,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, struct vhci *vhci; int err; unsigned long flags; + struct task_struct *tcp_rx = NULL; + struct task_struct *tcp_tx = NULL; /* * @rhport: port number of vhci_hcd @@ -360,9 +362,24 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, return -EINVAL; } - /* now need lock until setting vdev status as used */ + /* create threads before locking */ + tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx"); + if (IS_ERR(tcp_rx)) { + sockfd_put(socket); + return -EINVAL; + } + tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx"); + if (IS_ERR(tcp_tx)) { + kthread_stop(tcp_rx); + sockfd_put(socket); + return -EINVAL; + } + + /* get task structs now */ + get_task_struct(tcp_rx); + get_task_struct(tcp_tx); - /* begin a lock */ + /* now begin lock until setting vdev status set */ spin_lock_irqsave(&vhci->lock, flags); spin_lock(&vdev->ud.lock); @@ -372,6 +389,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, spin_unlock_irqrestore(&vhci->lock, flags); sockfd_put(socket); + kthread_stop_put(tcp_rx); + kthread_stop_put(tcp_tx); dev_err(dev, "port %d already used\n", rhport); /* @@ -390,6 +409,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, vdev->speed = speed; vdev->ud.sockfd = sockfd; vdev->ud.tcp_socket = socket; + vdev->ud.tcp_rx = tcp_rx; + vdev->ud.tcp_tx = tcp_tx; vdev->ud.status = VDEV_ST_NOTASSIGNED; usbip_kcov_handle_init(&vdev->ud); @@ -397,8 +418,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, spin_unlock_irqrestore(&vhci->lock, flags); /* end the lock */ - vdev->ud.tcp_rx = kthread_get_run(vhci_rx_loop, &vdev->ud, "vhci_rx"); - vdev->ud.tcp_tx = kthread_get_run(vhci_tx_loop, &vdev->ud, "vhci_tx"); + wake_up_process(vdev->ud.tcp_rx); + wake_up_process(vdev->ud.tcp_tx); rh_port_connect(vdev, speed);

3 years, 10 months

1
0
0 0

FAILED: patch "[PATCH] usb: dwc3: qcom: Add missing DWC3 OF node refcount decrement" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 1cffb1c66499a9db9a735473778abf8427d16287 Mon Sep 17 00:00:00 2001 From: Serge Semin <Sergey.Semin(a)baikalelectronics.ru> Date: Fri, 12 Feb 2021 23:55:19 +0300 Subject: [PATCH] usb: dwc3: qcom: Add missing DWC3 OF node refcount decrement of_get_child_by_name() increments the reference counter of the OF node it managed to find. So after the code is done using the device node, the refcount must be decremented. Add missing of_node_put() invocation then to the dwc3_qcom_of_register_core() method, since DWC3 OF node is being used only there. Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") Signed-off-by: Serge Semin <Sergey.Semin(a)baikalelectronics.ru> Link: https://lore.kernel.org/r/20210212205521.14280-1-Sergey.Semin@baikalelectro… Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c index 730e8d6a2aa6..fcaf04483ad0 100644 --- a/drivers/usb/dwc3/dwc3-qcom.c +++ b/drivers/usb/dwc3/dwc3-qcom.c @@ -653,16 +653,19 @@ static int dwc3_qcom_of_register_core(struct platform_device *pdev) ret = of_platform_populate(np, NULL, NULL, dev); if (ret) { dev_err(dev, "failed to register dwc3 core - %d\n", ret); - return ret; + goto node_put; } qcom->dwc3 = of_find_device_by_node(dwc3_np); if (!qcom->dwc3) { + ret = -ENODEV; dev_err(dev, "failed to get dwc3 platform device\n"); - return -ENODEV; } - return 0; +node_put: + of_node_put(dwc3_np); + + return ret; } static struct platform_device *

3 years, 10 months

1
0
0 0

[linux-stable-rc CI] Test report for 5.4.106-rc1 /x86

by hulkrobot＠huawei.com

Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Branch: linux-5.4.y Arch: x86 Version: 5.4.106-rc1 Commit: 2bcbae06b8fb9030973ee996e1b8ed43f3bfd4ab Compiler: gcc version 7.3.0 (GCC) -------------------------------------------------------------------- All testcases PASSED. -------------------------------------------------------------------- Testcase Result Summary: total_num: 4693 succeed_num: 4693 failed_num: 0 timeout_num: 0 -------------------------------------------------------------------- Tested-by: Hulk Robot <hulkrobot(a)huawei.com>

3 years, 10 months

1
0
0 0

[linux-stable-rc CI] Test report for 5.10.24-rc1 /arm64

by hulkrobot＠huawei.com

Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Branch: linux-5.10.y Arch: arm64 Version: 5.10.24-rc1 Commit: 7496dbd02b27316275e097a4e52cebcd2ca5a5c0 Compiler: gcc version 7.3.0 (GCC) -------------------------------------------------------------------- Failed cases : ltp test_robind29 ltp test_robind30 ltp test_robind31 ltp test_robind32 ltp test_robind33 ltp test_robind34 ltp test_robind36 ltp test_robind37 -------------------------------------------------------------------- Testcase Result Summary: total_num: 4693 succeed_num: 4685 failed_num: 8 timeout_num: 0 -------------------------------------------------------------------- Tested-by: Hulk Robot <hulkrobot(a)huawei.com>

3 years, 10 months

1
0
0 0

Re: [PATCH] ALSA: hda/realtek: apply pin quirk for XiaomiNotebook Pro

by Takashi Iwai

On Sat, 13 Mar 2021 01:40:51 +0100, Xiaoliang Yu wrote: > > Built-in microphone and combojack on Xiaomi Notebook Pro (1d72:1701) needs > to be fixed, the existing quirk for Dell works well on that machine. > > Signed-off-by: Xiaoliang Yu <yxl_22(a)outlook.com> This can't be applied after your previous patch for Redmibook Air. Please rebase and resubmit. thanks, Takashi

3 years, 10 months

1
0
0 0

Re: [PATCH] ALSA: hda/realtek: Apply headset-mic quirks for Xiaomi Redmibook Air

by Takashi Iwai

On Sat, 13 Mar 2021 00:54:53 +0100, Xiaoliang Yu wrote: > > There is another fix for headset-mic problem on Redmibook (1d72:1602), > it also works on Redmibook Air (1d72:1947), which has the same issue. > > Signed-off-by: Xiaoliang Yu <yxl_22(a)outlook.com> Thanks, applied. Takashi

3 years, 10 months

1
0
0 0

nvme: ns_head vs namespace mismatch fixes

by Anton Eidelman

Please, apply the following two upstream commits (attached) (in this order): d567572906d9 nvme: unlink head after removing last namespace ac262508daa8 nvme: release namespace head reference on error TO: v5.4, v5.5, v5.6, v5.7 These commits are present in v5.8 and apply cleanly to the above. Reason: These fix a potential crash or malfunction when an nvme namespace is deleted and then a new namespace with the same nsid is created before the old ns_head for this nsid is gone. The first commit prevents the new namespace from being matched by nvme_init_ns_head() with the old ns_head causing ID mismatch and consequently a failure to initialize the new namespace. The second commit prevents ns_head refcount imbalance in case nvme_init_ns_head() detects an ID mismatch, and consequently a potential crash later. -- *Lightbits Labs** *Lead the cloud-native data center transformation by delivering *scalable *and *efficient *software defined storage that is *easy *to consume. *This message is sent in confidence for the addressee only. It may contain legally privileged information. The contents are not to be disclosed to anyone other than the addressee. Unauthorized recipients are requested to preserve this confidentiality, advise the sender immediately of any error in transmission and delete the email from their systems.*

3 years, 10 months

2
1
0 0

nvme: ns_head vs namespace mismatch fixes

by Anton Eidelman

Please, apply the following two upstream commits (attached) (in this order): d567572906d9 nvme: unlink head after removing last namespace ac262508daa8 nvme: release namespace head reference on error TO: v5.4, v5.5, v5.6, v5.7 These commits are present in v5.8 and apply cleanly to the above. Reason: These fix a potential crash or malfunction when an nvme namespace is deleted and then a new namespace with the same nsid is created before the old ns_head for this nsid is gone. The first commit prevents the new namespace from being matched by nvme_init_ns_head() with the old ns_head causing ID mismatch and consequently a failure to initialize the new namespace. The second commit prevents ns_head refcount imbalance in case nvme_init_ns_head() detects ID mismatch, and consequently a crash later. -- *Lightbits Labs** *Lead the cloud-native data center transformation by delivering *scalable *and *efficient *software defined storage that is *easy *to consume. *This message is sent in confidence for the addressee only. It may contain legally privileged information. The contents are not to be disclosed to anyone other than the addressee. Unauthorized recipients are requested to preserve this confidentiality, advise the sender immediately of any error in transmission and delete the email from their systems.*

3 years, 10 months

3
2
0 0

[patch 23/29] mm, hwpoison: do not lock page again when me_huge_page() successfully recovers

by Andrew Morton

From: Naoya Horiguchi <naoya.horiguchi(a)nec.com> Subject: mm, hwpoison: do not lock page again when me_huge_page() successfully recovers Currently me_huge_page() temporary unlocks page to perform some actions then locks it again later. My testcase (which calls hard-offline on some tail page in a hugetlb, then accesses the address of the hugetlb range) showed that page allocation code detects this page lock on buddy page and printed out "BUG: Bad page state" message. check_new_page_bad() does not consider a page with __PG_HWPOISON as bad page, so this flag works as kind of filter, but this filtering doesn't work in this case because the "bad page" is not the actual hwpoisoned page. This patch suggests to drop the 2nd page lock to fix the issue. Link: https://lkml.kernel.org/r/20210304064437.962442-1-nao.horiguchi@gmail.com Fixes: commit 78bb920344b8 ("mm: hwpoison: dissolve in-use hugepage in unrecoverable memory error") Signed-off-by: Naoya Horiguchi <naoya.horiguchi(a)nec.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Tony Luck <tony.luck(a)intel.com> Cc: "Aneesh Kumar K.V" <aneesh.kumar(a)linux.vnet.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/memory-failure.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/mm/memory-failure.c~mm-hwpoison-do-not-lock-page-again-when-me_huge_page-successfully-recovers +++ a/mm/memory-failure.c @@ -834,7 +834,6 @@ static int me_huge_page(struct page *p, page_ref_inc(p); res = MF_RECOVERED; } - lock_page(hpage); } return res; @@ -1290,7 +1289,8 @@ static int memory_failure_hugetlb(unsign res = identify_page_state(pfn, p, page_flags); out: - unlock_page(head); + if (PageLocked(head)) + unlock_page(head); return res; } _

3 years, 10 months

3
2
0 0

[linux-stable-rc CI] Test report for 5.10.24-rc1 /x86

by hulkrobot＠huawei.com

Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Branch: linux-5.10.y Arch: x86 Version: 5.10.24-rc1 Commit: 7496dbd02b27316275e097a4e52cebcd2ca5a5c0 Compiler: gcc version 7.3.0 (GCC) -------------------------------------------------------------------- All testcases PASSED. -------------------------------------------------------------------- Testcase Result Summary: total_num: 4693 succeed_num: 4693 failed_num: 0 timeout_num: 0 -------------------------------------------------------------------- Tested-by: Hulk Robot <hulkrobot(a)huawei.com>

3 years, 10 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2021