April 2021 - Linux-stable-mirror

patch "usb: gadget: dummy_hcd: fix gpf in gadget_setup" added to usb-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: gadget: dummy_hcd: fix gpf in gadget_setup to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the usb-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From 4a5d797a9f9c4f18585544237216d7812686a71f Mon Sep 17 00:00:00 2001 From: Anirudh Rayabharam <mail(a)anirudhrb.com> Date: Mon, 19 Apr 2021 09:07:08 +0530 Subject: usb: gadget: dummy_hcd: fix gpf in gadget_setup Fix a general protection fault reported by syzbot due to a race between gadget_setup() and gadget_unbind() in raw_gadget. The gadget core is supposed to guarantee that there won't be any more callbacks to the gadget driver once the driver's unbind routine is called. That guarantee is enforced in usb_gadget_remove_driver as follows: usb_gadget_disconnect(udc->gadget); if (udc->gadget->irq) synchronize_irq(udc->gadget->irq); udc->driver->unbind(udc->gadget); usb_gadget_udc_stop(udc); usb_gadget_disconnect turns off the pullup resistor, telling the host that the gadget is no longer connected and preventing the transmission of any more USB packets. Any packets that have already been received are sure to processed by the UDC driver's interrupt handler by the time synchronize_irq returns. But this doesn't work with dummy_hcd, because dummy_hcd doesn't use interrupts; it uses a timer instead. It does have code to emulate the effect of synchronize_irq, but that code doesn't get invoked at the right time -- it currently runs in usb_gadget_udc_stop, after the unbind callback instead of before. Indeed, there's no way for usb_gadget_remove_driver to invoke this code before the unbind callback. To fix this, move the synchronize_irq() emulation code to dummy_pullup so that it runs before unbind. Also, add a comment explaining why it is necessary to have it there. Reported-by: syzbot+eb4674092e6cc8d9e0bd(a)syzkaller.appspotmail.com Suggested-by: Alan Stern <stern(a)rowland.harvard.edu> Acked-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Anirudh Rayabharam <mail(a)anirudhrb.com> Link: https://lore.kernel.org/r/20210419033713.3021-1-mail@anirudhrb.com Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/gadget/udc/dummy_hcd.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c index ce24d4f28f2a..7db773c87379 100644 --- a/drivers/usb/gadget/udc/dummy_hcd.c +++ b/drivers/usb/gadget/udc/dummy_hcd.c @@ -903,6 +903,21 @@ static int dummy_pullup(struct usb_gadget *_gadget, int value) spin_lock_irqsave(&dum->lock, flags); dum->pullup = (value != 0); set_link_state(dum_hcd); + if (value == 0) { + /* + * Emulate synchronize_irq(): wait for callbacks to finish. + * This seems to be the best place to emulate the call to + * synchronize_irq() that's in usb_gadget_remove_driver(). + * Doing it in dummy_udc_stop() would be too late since it + * is called after the unbind callback and unbind shouldn't + * be invoked until all the other callbacks are finished. + */ + while (dum->callback_usage > 0) { + spin_unlock_irqrestore(&dum->lock, flags); + usleep_range(1000, 2000); + spin_lock_irqsave(&dum->lock, flags); + } + } spin_unlock_irqrestore(&dum->lock, flags); usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); @@ -1004,14 +1019,6 @@ static int dummy_udc_stop(struct usb_gadget *g) spin_lock_irq(&dum->lock); dum->ints_enabled = 0; stop_activity(dum); - - /* emulate synchronize_irq(): wait for callbacks to finish */ - while (dum->callback_usage > 0) { - spin_unlock_irq(&dum->lock); - usleep_range(1000, 2000); - spin_lock_irq(&dum->lock); - } - dum->driver = NULL; spin_unlock_irq(&dum->lock); -- 2.31.1

3 years, 8 months

1
0
0 0

Linux 5.10.32

by Greg Kroah-Hartman

I'm announcing the release of the 5.10.32 kernel. All users of the 5.10 kernel series must upgrade. The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arc/kernel/signal.c | 4 arch/arm/boot/dts/omap4.dtsi | 5 arch/arm/boot/dts/omap44xx-clocks.dtsi | 8 arch/arm/boot/dts/omap5.dtsi | 5 arch/arm/mach-footbridge/cats-pci.c | 4 arch/arm/mach-footbridge/ebsa285-pci.c | 4 arch/arm/mach-footbridge/netwinder-pci.c | 2 arch/arm/mach-footbridge/personal-pci.c | 5 arch/arm/mach-keystone/keystone.c | 4 arch/arm/mach-omap1/ams-delta-fiq-handler.S | 1 arch/arm/mach-omap2/board-generic.c | 2 arch/arm/mach-omap2/sr_device.c | 2 arch/arm/mm/pmsa-v7.c | 4 arch/arm/mm/pmsa-v8.c | 4 arch/arm/probes/uprobes/core.c | 4 arch/arm64/Kconfig | 6 arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-lts.dts | 4 arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi | 2 arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts | 4 arch/arm64/include/asm/alternative.h | 8 arch/arm64/include/asm/word-at-a-time.h | 10 arch/arm64/kernel/entry.S | 10 arch/ia64/configs/generic_defconfig | 2 arch/riscv/Kconfig | 2 arch/x86/kernel/setup.c | 5 arch/x86/kvm/vmx/nested.c | 42 +-- arch/x86/kvm/vmx/vmx.c | 78 ++--- arch/x86/kvm/vmx/vmx.h | 25 + drivers/dma/dmaengine.c | 1 drivers/dma/dw/Kconfig | 2 drivers/dma/idxd/device.c | 35 +- drivers/dma/idxd/idxd.h | 1 drivers/dma/idxd/irq.c | 4 drivers/dma/idxd/sysfs.c | 19 - drivers/dma/plx_dma.c | 18 - drivers/gpio/gpiolib-sysfs.c | 8 drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 4 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 4 drivers/gpu/drm/xen/xen_drm_front.c | 6 drivers/hid/wacom_wac.c | 6 drivers/input/keyboard/nspire-keypad.c | 56 ++-- drivers/input/serio/i8042-x86ia64io.h | 1 drivers/input/touchscreen/s6sy761.c | 4 drivers/md/dm-verity-fec.c | 11 drivers/md/dm-verity-fec.h | 1 drivers/mtd/nand/raw/mtk_nand.c | 4 drivers/net/dsa/mv88e6xxx/chip.c | 30 -- drivers/net/ethernet/amd/pcnet32.c | 5 drivers/net/ethernet/cadence/macb_main.c | 2 drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c | 102 ------- drivers/net/ethernet/davicom/dm9000.c | 6 drivers/net/ethernet/ibm/ibmvnic.c | 14 - drivers/net/ethernet/intel/i40e/i40e_main.c | 6 drivers/net/ethernet/intel/ice/ice_dcb.c | 4 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 5 drivers/net/ethernet/mellanox/mlx5/core/en/port.c | 23 - drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 3 drivers/net/ethernet/realtek/r8169_main.c | 18 - drivers/net/phy/marvell.c | 33 ++ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 7 drivers/net/wireless/virt_wifi.c | 5 drivers/nvdimm/region_devs.c | 9 drivers/scsi/libsas/sas_ata.c | 9 drivers/scsi/scsi_transport_srp.c | 2 drivers/vfio/pci/vfio_pci.c | 4 fs/readdir.c | 6 include/linux/marvell_phy.h | 5 include/linux/netfilter_arp/arp_tables.h | 5 include/linux/netfilter_bridge/ebtables.h | 5 include/uapi/linux/idxd.h | 4 kernel/bpf/verifier.c | 138 ++++++---- kernel/locking/lockdep.c | 3 lib/Kconfig.debug | 6 mm/ptdump.c | 2 net/bridge/netfilter/ebtable_broute.c | 8 net/bridge/netfilter/ebtable_filter.c | 8 net/bridge/netfilter/ebtable_nat.c | 8 net/bridge/netfilter/ebtables.c | 30 +- net/core/dev.c | 3 net/core/neighbour.c | 2 net/ethtool/pause.c | 8 net/ieee802154/nl802154.c | 41 ++ net/ipv4/netfilter/arp_tables.c | 9 net/ipv4/netfilter/arptable_filter.c | 10 net/ipv4/sysctl_net_ipv4.c | 16 - net/ipv6/ip6_tunnel.c | 10 net/ipv6/sit.c | 4 net/mac80211/cfg.c | 4 net/netfilter/nf_conntrack_standalone.c | 1 net/netfilter/nf_flow_table_offload.c | 6 net/netfilter/nft_limit.c | 4 net/sctp/socket.c | 13 net/xfrm/xfrm_output.c | 13 sound/soc/codecs/max98373-i2c.c | 1 sound/soc/codecs/max98373-sdw.c | 1 sound/soc/codecs/max98373.c | 2 sound/soc/fsl/fsl_esai.c | 8 tools/include/uapi/asm/errno.h | 2 tools/lib/bpf/xsk.c | 5 101 files changed, 679 insertions(+), 443 deletions(-) A. Cody Schuffelen (1): virt_wifi: Return micros for BSS TSF values Alexander Aring (11): net: ieee802154: stop dump llsec keys for monitors net: ieee802154: forbid monitor for add llsec key net: ieee802154: forbid monitor for del llsec key net: ieee802154: stop dump llsec devs for monitors net: ieee802154: forbid monitor for add llsec dev net: ieee802154: forbid monitor for del llsec dev net: ieee802154: stop dump llsec devkeys for monitors net: ieee802154: forbid monitor for add llsec devkey net: ieee802154: forbid monitor for del llsec devkey net: ieee802154: stop dump llsec seclevels for monitors net: ieee802154: forbid monitor for add llsec seclevel Alexander Shiyan (1): ASoC: fsl_esai: Fix TDM slot setup for I2S mode Andre Przywara (1): arm64: dts: allwinner: Fix SD card CD GPIO for SOPine systems Andy Shevchenko (1): dmaengine: dw: Make it dependent to HAS_IOMEM Arnd Bergmann (3): ARM: keystone: fix integer overflow warning ARM: omap1: fix building with clang IAS Input: i8042 - fix Pegatron C15B ID entry Aya Levin (1): net/mlx5e: Fix setting of RS FEC mode Caleb Connolly (1): Input: s6sy761 - fix coordinate read bit shift Catalin Marinas (1): arm64: mte: Ensure TIF_MTE_ASYNC_FAULT is set atomically Christian A. Ehrhardt (1): vfio/pci: Add missing range check in vfio_pci_mmap Christophe JAILLET (1): net: davicom: Fix regulator not turned off on failed probe Christophe Leroy (1): mm: ptdump: fix build failure Ciara Loftus (1): libbpf: Fix potential NULL pointer dereference Claudiu Beznea (1): net: macb: fix the restore of cmp registers Colin Ian King (1): ice: Fix potential infinite loop when using u8 loop counter Dan Carpenter (1): dmaengine: plx_dma: add a missing put_device() on error path Daniel Borkmann (6): bpf: Use correct permission flag for mixed signed bounds arithmetic bpf: Ensure off_reg has no mixed signed bounds for all types bpf: Move off_reg into sanitize_ptr_alu bpf: Rework ptr_limit into alu_limit and add common error path bpf: Improve verifier error messages for users bpf: Move sanitize_val_alu out of op switch Dave Jiang (5): dmaengine: idxd: Fix clobbering of SWERR overflow bit on writeback dmaengine: idxd: fix delta_rec and crc size field for completion record dmaengine: idxd: fix opcap sysfs attribute output dmaengine: idxd: fix wq size store permission state dmaengine: idxd: fix wq cleanup of WQCFG registers Eric Dumazet (2): netfilter: nft_limit: avoid possible divide error in nft_limit_init gro: ensure frag0 meets IP header alignment Fabian Vogt (1): Input: nspire-keypad - enable interrupts only when opened Florian Westphal (2): netfilter: bridge: add pre_exit hooks for ebtable unregistration netfilter: arp_tables: add pre_exit hook for table unregister Fredrik Strupe (1): ARM: 9071/1: uprobes: Don't hook on thumb instructions Greg Kroah-Hartman (1): Linux 5.10.32 Guenter Roeck (1): pcnet32: Use pci_resource_len to validate PCI resource Hauke Mehrtens (1): mtd: rawnand: mtk: Fix WAITRDY break condition and timeout Heiner Kallweit (2): r8169: tweak max read request size for newer chips also in jumbo mtu mode r8169: don't advertise pause in jumbo mode Hristo Venev (2): net: sit: Unregister catch-all devices net: ip6_tunnel: Unregister catch-all devices Jaegeuk Kim (1): dm verity fec: fix misaligned RS roots IO Jakub Kicinski (1): ethtool: pause: make sure we init driver stats Jason Xing (1): i40e: fix the panic when running bpf in xdpdrv mode Jernej Skrabec (1): arm64: dts: allwinner: h6: beelink-gs1: Remove ext. 32 kHz osc reference Jiri Kosina (1): iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd() John Paul Adrian Glaubitz (1): ia64: tools: remove inclusion of ia64-specific version of errno.h header Jolly Shah (1): scsi: libsas: Reset num_scatter if libata marks qc as NODATA Jonathon Reinhart (1): net: Make tcp_allowed_congestion_control readonly in non-init netns Julian Braha (1): lib: fix kconfig dependency on ARCH_WANT_FRAME_POINTERS Kefeng Wang (1): riscv: Fix spelling mistake "SPARSEMEM" to "SPARSMEM" Lijun Pan (3): ibmvnic: avoid calling napi_disable() twice ibmvnic: remove duplicate napi_schedule call in do_reset function ibmvnic: remove duplicate napi_schedule call in open function Linus Torvalds (1): readdir: make sure to verify directory entry for legacy interfaces too Lv Yunlong (2): dmaengine: Fix a double free in dma_async_device_register gpu/xen: Fix a use after free in xen_drm_drv_init Martin Wilck (1): scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state Matt Chen (1): iwlwifi: add support for Qu with AX201 device Matti Vaittinen (1): gpio: sysfs: Obey valid_mask Nathan Chancellor (1): arm64: alternatives: Move length validation in alternative_{insn, endif} Or Cohen (1): net/sctp: fix race condition in sctp_destroy_sock Pablo Neira Ayuso (2): netfilter: flowtable: fix NAT IPv6 offload mangling netfilter: conntrack: do not print icmpv6 as unknown via /proc Pali Rohár (1): net: phy: marvell: fix detection of PHY on Topaz switches Peter Collingbourne (1): arm64: fix inline asm in load_unaligned_zeropad() Ping Cheng (1): HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices Rafael J. Wysocki (1): ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade() Randy Dunlap (1): ia64: remove duplicate entries in generic_defconfig Reiji Watanabe (1): KVM: VMX: Don't use vcpu->run->internal.ndata as an array index Rob Clark (1): drm/msm: Fix a5xx/a6xx timestamps Russell King (1): ARM: footbridge: fix PCI interrupt mapping Ryan Lee (2): ASoC: max98373: Changed amp shutdown register as volatile ASoC: max98373: Added 30ms turn on/off time delay Sean Christopherson (1): KVM: VMX: Convert vcpu_vmx.exit_reason to a union Seevalamuthu Mariappan (1): mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN Tetsuo Handa (1): lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message Tong Zhu (1): neighbour: Disregard DEAD dst in neigh_update Tony Lindgren (4): ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race ARM: dts: Fix moving mmc devices with aliases for omap4 & 5 ARM: OMAP2+: Fix warning for omap_init_time_of() ARM: OMAP2+: Fix uninitialized sr_inst Vaibhav Jain (1): libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC Vinay Kumar Yadav (4): ch_ktls: Fix kernel panic ch_ktls: fix device connection close ch_ktls: tcb close causes tls connection failure ch_ktls: do not send snd_una update to TCB in middle Vladimir Murzin (1): ARM: 9069/1: NOMMU: Fix conversion for_each_membock() to for_each_mem_range() Wang Qing (1): arc: kernel: Return -EFAULT if copy_to_user() fails Xin Long (1): xfrm: BEET mode doesn't support fragments for inner packets Yongxin Liu (1): ixgbe: fix unbalanced device enable/disable in suspend/resume wenxu (1): net/mlx5e: fix ingress_ifindex check in mlx5e_flower_parse_meta

3 years, 8 months

2
2
0 0

Linux 5.4.114

by Greg Kroah-Hartman

I'm announcing the release of the 5.4.114 kernel. All users of the 5.4 kernel series must upgrade. The updated 5.4.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arc/kernel/signal.c | 4 arch/arm/boot/dts/omap4.dtsi | 5 arch/arm/boot/dts/omap44xx-clocks.dtsi | 8 arch/arm/boot/dts/omap5.dtsi | 5 arch/arm/mach-footbridge/cats-pci.c | 4 arch/arm/mach-footbridge/ebsa285-pci.c | 4 arch/arm/mach-footbridge/netwinder-pci.c | 2 arch/arm/mach-footbridge/personal-pci.c | 5 arch/arm/mach-keystone/keystone.c | 4 arch/arm/mach-omap1/ams-delta-fiq-handler.S | 1 arch/arm/probes/uprobes/core.c | 4 arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-lts.dts | 4 arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi | 2 arch/arm64/include/asm/alternative.h | 8 arch/arm64/include/asm/word-at-a-time.h | 10 - arch/riscv/Kconfig | 2 drivers/dma/dw/Kconfig | 2 drivers/gpio/gpiolib-sysfs.c | 8 drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 4 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 4 drivers/hid/wacom_wac.c | 6 drivers/input/keyboard/nspire-keypad.c | 56 +++--- drivers/input/serio/i8042-x86ia64io.h | 1 drivers/input/touchscreen/s6sy761.c | 4 drivers/md/dm-verity-fec.c | 11 - drivers/md/dm-verity-fec.h | 1 drivers/net/dsa/mv88e6xxx/chip.c | 30 +-- drivers/net/ethernet/amd/pcnet32.c | 5 drivers/net/ethernet/cadence/macb_main.c | 2 drivers/net/ethernet/davicom/dm9000.c | 6 drivers/net/ethernet/ibm/ibmvnic.c | 14 - drivers/net/ethernet/intel/i40e/i40e_main.c | 6 drivers/net/ethernet/realtek/r8169_main.c | 141 +++++----------- drivers/net/phy/marvell.c | 29 ++- drivers/net/wireless/virt_wifi.c | 5 drivers/nvdimm/region_devs.c | 9 - drivers/scsi/libsas/sas_ata.c | 9 - drivers/scsi/qla2xxx/qla_dbg.c | 2 drivers/scsi/qla2xxx/qla_def.h | 40 ++++ drivers/scsi/qla2xxx/qla_fw.h | 2 drivers/scsi/qla2xxx/qla_gbl.h | 3 drivers/scsi/qla2xxx/qla_gs.c | 44 ++-- drivers/scsi/qla2xxx/qla_init.c | 133 ++++++++------- drivers/scsi/qla2xxx/qla_inline.h | 36 ++++ drivers/scsi/qla2xxx/qla_iocb.c | 53 ++++-- drivers/scsi/qla2xxx/qla_mbx.c | 11 - drivers/scsi/qla2xxx/qla_os.c | 19 +- drivers/scsi/qla2xxx/qla_target.c | 11 - drivers/scsi/scsi_transport_srp.c | 2 drivers/vfio/pci/vfio_pci.c | 4 fs/readdir.c | 6 include/linux/marvell_phy.h | 5 include/linux/netfilter_arp/arp_tables.h | 5 include/linux/netfilter_bridge/ebtables.h | 5 kernel/locking/lockdep.c | 3 net/bridge/netfilter/ebtable_broute.c | 8 net/bridge/netfilter/ebtable_filter.c | 8 net/bridge/netfilter/ebtable_nat.c | 8 net/bridge/netfilter/ebtables.c | 30 +++ net/core/dev.c | 3 net/core/neighbour.c | 2 net/ieee802154/nl802154.c | 41 ++++ net/ipv4/netfilter/arp_tables.c | 9 - net/ipv4/netfilter/arptable_filter.c | 10 + net/ipv6/ip6_tunnel.c | 10 + net/ipv6/sit.c | 4 net/mac80211/cfg.c | 4 net/netfilter/nf_conntrack_standalone.c | 1 net/netfilter/nft_limit.c | 4 net/sctp/socket.c | 13 - sound/soc/codecs/max98373.c | 2 sound/soc/fsl/fsl_esai.c | 8 73 files changed, 617 insertions(+), 359 deletions(-) A. Cody Schuffelen (1): virt_wifi: Return micros for BSS TSF values Alexander Aring (11): net: ieee802154: stop dump llsec keys for monitors net: ieee802154: forbid monitor for add llsec key net: ieee802154: forbid monitor for del llsec key net: ieee802154: stop dump llsec devs for monitors net: ieee802154: forbid monitor for add llsec dev net: ieee802154: forbid monitor for del llsec dev net: ieee802154: stop dump llsec devkeys for monitors net: ieee802154: forbid monitor for add llsec devkey net: ieee802154: forbid monitor for del llsec devkey net: ieee802154: stop dump llsec seclevels for monitors net: ieee802154: forbid monitor for add llsec seclevel Alexander Shiyan (1): ASoC: fsl_esai: Fix TDM slot setup for I2S mode Andre Przywara (1): arm64: dts: allwinner: Fix SD card CD GPIO for SOPine systems Andy Shevchenko (1): dmaengine: dw: Make it dependent to HAS_IOMEM Arnd Bergmann (3): ARM: keystone: fix integer overflow warning ARM: omap1: fix building with clang IAS Input: i8042 - fix Pegatron C15B ID entry Arun Easi (1): scsi: qla2xxx: Fix device connect issues in P2P configuration Caleb Connolly (1): Input: s6sy761 - fix coordinate read bit shift Christian A. Ehrhardt (1): vfio/pci: Add missing range check in vfio_pci_mmap Christophe JAILLET (1): net: davicom: Fix regulator not turned off on failed probe Claudiu Beznea (1): net: macb: fix the restore of cmp registers Eric Dumazet (2): netfilter: nft_limit: avoid possible divide error in nft_limit_init gro: ensure frag0 meets IP header alignment Fabian Vogt (1): Input: nspire-keypad - enable interrupts only when opened Florian Westphal (2): netfilter: bridge: add pre_exit hooks for ebtable unregistration netfilter: arp_tables: add pre_exit hook for table unregister Fredrik Strupe (1): ARM: 9071/1: uprobes: Don't hook on thumb instructions Greg Kroah-Hartman (1): Linux 5.4.114 Guenter Roeck (1): pcnet32: Use pci_resource_len to validate PCI resource Heiner Kallweit (6): r8169: remove fiddling with the PCIe max read request size r8169: simplify setting PCI_EXP_DEVCTL_NOSNOOP_EN r8169: fix performance regression related to PCIe max read request size r8169: improve rtl_jumbo_config r8169: tweak max read request size for newer chips also in jumbo mtu mode r8169: don't advertise pause in jumbo mode Hristo Venev (2): net: sit: Unregister catch-all devices net: ip6_tunnel: Unregister catch-all devices Jaegeuk Kim (1): dm verity fec: fix misaligned RS roots IO Jason Xing (1): i40e: fix the panic when running bpf in xdpdrv mode Jolly Shah (1): scsi: libsas: Reset num_scatter if libata marks qc as NODATA Kefeng Wang (1): riscv: Fix spelling mistake "SPARSEMEM" to "SPARSMEM" Lijun Pan (3): ibmvnic: avoid calling napi_disable() twice ibmvnic: remove duplicate napi_schedule call in do_reset function ibmvnic: remove duplicate napi_schedule call in open function Linus Torvalds (1): readdir: make sure to verify directory entry for legacy interfaces too Martin Wilck (1): scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state Matti Vaittinen (1): gpio: sysfs: Obey valid_mask Michael Hernandez (1): scsi: qla2xxx: Dual FCP-NVMe target port support Nathan Chancellor (1): arm64: alternatives: Move length validation in alternative_{insn, endif} Or Cohen (1): net/sctp: fix race condition in sctp_destroy_sock Pablo Neira Ayuso (1): netfilter: conntrack: do not print icmpv6 as unknown via /proc Pali Rohár (1): net: phy: marvell: fix detection of PHY on Topaz switches Peter Collingbourne (1): arm64: fix inline asm in load_unaligned_zeropad() Ping Cheng (1): HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices Quinn Tran (3): scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure scsi: qla2xxx: Fix stuck login session using prli_pend_timer scsi: qla2xxx: Fix fabric scan hang Rob Clark (1): drm/msm: Fix a5xx/a6xx timestamps Russell King (1): ARM: footbridge: fix PCI interrupt mapping Ryan Lee (1): ASoC: max98373: Added 30ms turn on/off time delay Sasha Levin (2): Revert "scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure" Revert "scsi: qla2xxx: Fix stuck login session using prli_pend_timer" Seevalamuthu Mariappan (1): mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN Shyam Sundar (1): scsi: qla2xxx: Add a shadow variable to hold disc_state history of fcport Tetsuo Handa (1): lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message Tong Zhu (1): neighbour: Disregard DEAD dst in neigh_update Tony Lindgren (2): ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race ARM: dts: Fix moving mmc devices with aliases for omap4 & 5 Vaibhav Jain (1): libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC Wang Qing (1): arc: kernel: Return -EFAULT if copy_to_user() fails

3 years, 8 months

2
2
0 0

patch "usb: dwc3: gadget: Fix START_TRANSFER link state check" added to usb-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: dwc3: gadget: Fix START_TRANSFER link state check to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the usb-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. >From c560e76319a94a3b9285bc426c609903408e4826 Mon Sep 17 00:00:00 2001 From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Date: Mon, 19 Apr 2021 19:11:12 -0700 Subject: usb: dwc3: gadget: Fix START_TRANSFER link state check The START_TRANSFER command needs to be executed while in ON/U0 link state (with an exception during register initialization). Don't use dwc->link_state to check this since the driver only tracks the link state when the link state change interrupt is enabled. Check the link state from DSTS register instead. Note that often the host already brings the device out of low power before it sends/requests the next transfer. So, the user won't see any issue when the device starts transfer then. This issue is more noticeable in cases when the device delays starting transfer, which can happen during delayed control status after the host put the device in low power. Fixes: 799e9dc82968 ("usb: dwc3: gadget: conditionally disable Link State change events") Cc: <stable(a)vger.kernel.org> Acked-by: Felipe Balbi <balbi(a)kernel.org> Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/bcefaa9ecbc3e1936858c0baa14de6612960e909.16188842… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/dwc3/gadget.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 6227641f2d31..1a632a3faf7f 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -308,13 +308,12 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd, } if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) { - int needs_wakeup; + int link_state; - needs_wakeup = (dwc->link_state == DWC3_LINK_STATE_U1 || - dwc->link_state == DWC3_LINK_STATE_U2 || - dwc->link_state == DWC3_LINK_STATE_U3); - - if (unlikely(needs_wakeup)) { + link_state = dwc3_gadget_get_link_state(dwc); + if (link_state == DWC3_LINK_STATE_U1 || + link_state == DWC3_LINK_STATE_U2 || + link_state == DWC3_LINK_STATE_U3) { ret = __dwc3_gadget_wakeup(dwc); dev_WARN_ONCE(dwc->dev, ret, "wakeup failed --> %d\n", ret); @@ -1989,6 +1988,8 @@ static int __dwc3_gadget_wakeup(struct dwc3 *dwc) case DWC3_LINK_STATE_RESET: case DWC3_LINK_STATE_RX_DET: /* in HS, means Early Suspend */ case DWC3_LINK_STATE_U3: /* in HS, means SUSPEND */ + case DWC3_LINK_STATE_U2: /* in HS, means Sleep (L1) */ + case DWC3_LINK_STATE_U1: case DWC3_LINK_STATE_RESUME: break; default: -- 2.31.1

3 years, 8 months

1
0
0 0

[PATCH 121/190] Revert "serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference"

by Greg Kroah-Hartman

This reverts commit 32f47179833b63de72427131169809065db6745e. Commits from @umn.edu addresses have been found to be submitted in "bad faith" to try to test the kernel community's ability to review "known malicious" changes. The result of these submissions can be found in a paper published at the 42nd IEEE Symposium on Security and Privacy entitled, "Open Source Insecurity: Stealthily Introducing Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University of Minnesota) and Kangjie Lu (University of Minnesota). Because of this, all submissions from this group must be reverted from the kernel tree and will need to be re-reviewed again to determine if they actually are a valid fix. Until that work is complete, remove this change to ensure that no problems are being introduced into the codebase. Cc: Aditya Pakki <pakki001(a)umn.edu> Cc: stable <stable(a)vger.kernel.org> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/tty/serial/mvebu-uart.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c index e0c00a1b0763..51b0ecabf2ec 100644 --- a/drivers/tty/serial/mvebu-uart.c +++ b/drivers/tty/serial/mvebu-uart.c @@ -818,9 +818,6 @@ static int mvebu_uart_probe(struct platform_device *pdev) return -EINVAL; } - if (!match) - return -ENODEV; - /* Assume that all UART ports have a DT alias or none has */ id = of_alias_get_id(pdev->dev.of_node, "serial"); if (!pdev->dev.of_node || id < 0) -- 2.31.1

3 years, 8 months

2
1
0 0

+ ovl-fix-reference-counting-in-ovl_mmap-error-path.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: ovl: fix reference counting in ovl_mmap error path has been added to the -mm tree. Its filename is ovl-fix-reference-counting-in-ovl_mmap-error-path.patch This patch should soon appear at https://ozlabs.org/~akpm/mmots/broken-out/ovl-fix-reference-counting-in-ovl… and later at https://ozlabs.org/~akpm/mmotm/broken-out/ovl-fix-reference-counting-in-ovl… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Christian König <christian.koenig(a)amd.com> Subject: ovl: fix reference counting in ovl_mmap error path mmap_region() now calls fput() on the vma->vm_file. Fix this by using vma_set_file() so it doesn't need to be handled manually here any more. Link: https://lkml.kernel.org/r/20210421132012.82354-2-christian.koenig@amd.com Fixes: 1527f926fd04 ("mm: mmap: fix fput in error path v2") Signed-off-by: Christian König <christian.koenig(a)amd.com> Cc: Jan Harkes <jaharkes(a)cs.cmu.edu> Cc: Miklos Szeredi <miklos(a)szeredi.hu> Cc: Jason Gunthorpe <jgg(a)ziepe.ca> Cc: <stable(a)vger.kernel.org> [5.11+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/overlayfs/file.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) --- a/fs/overlayfs/file.c~ovl-fix-reference-counting-in-ovl_mmap-error-path +++ a/fs/overlayfs/file.c @@ -430,20 +430,11 @@ static int ovl_mmap(struct file *file, s if (WARN_ON(file != vma->vm_file)) return -EIO; - vma->vm_file = get_file(realfile); + vma_set_file(vma, realfile); old_cred = ovl_override_creds(file_inode(file)->i_sb); ret = call_mmap(vma->vm_file, vma); revert_creds(old_cred); - - if (ret) { - /* Drop reference count from new vm_file value */ - fput(realfile); - } else { - /* Drop reference count from previous vm_file value */ - fput(file); - } - ovl_file_accessed(file); return ret; _ Patches currently in -mm which might be from christian.koenig(a)amd.com are coda-fix-reference-counting-in-coda_file_mmap-error-path.patch ovl-fix-reference-counting-in-ovl_mmap-error-path.patch

3 years, 8 months

1
0
0 0

+ coda-fix-reference-counting-in-coda_file_mmap-error-path.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: coda: fix reference counting in coda_file_mmap error path has been added to the -mm tree. Its filename is coda-fix-reference-counting-in-coda_file_mmap-error-path.patch This patch should soon appear at https://ozlabs.org/~akpm/mmots/broken-out/coda-fix-reference-counting-in-co… and later at https://ozlabs.org/~akpm/mmotm/broken-out/coda-fix-reference-counting-in-co… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Christian König <christian.koenig(a)amd.com> Subject: coda: fix reference counting in coda_file_mmap error path mmap_region() now calls fput() on the vma->vm_file. So we need to drop the extra reference on the coda file instead of the host file. Link: https://lkml.kernel.org/r/20210421132012.82354-1-christian.koenig@amd.com Fixes: 1527f926fd04 ("mm: mmap: fix fput in error path v2") Signed-off-by: Christian König <christian.koenig(a)amd.com> Cc: Jan Harkes <jaharkes(a)cs.cmu.edu> Cc: Miklos Szeredi <miklos(a)szeredi.hu> Cc: Jason Gunthorpe <jgg(a)ziepe.ca> Cc: <stable(a)vger.kernel.org> [5.11+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/coda/file.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/fs/coda/file.c~coda-fix-reference-counting-in-coda_file_mmap-error-path +++ a/fs/coda/file.c @@ -175,10 +175,10 @@ coda_file_mmap(struct file *coda_file, s ret = call_mmap(vma->vm_file, vma); if (ret) { - /* if call_mmap fails, our caller will put coda_file so we - * should drop the reference to the host_file that we got. + /* if call_mmap fails, our caller will put host_file so we + * should drop the reference to the coda_file that we got. */ - fput(host_file); + fput(coda_file); kfree(cvm_ops); } else { /* here we add redirects for the open/close vm_operations */ _ Patches currently in -mm which might be from christian.koenig(a)amd.com are coda-fix-reference-counting-in-coda_file_mmap-error-path.patch ovl-fix-reference-counting-in-ovl_mmap-error-path.patch

3 years, 8 months

1
0
0 0

Bidding invitation

by Pfizer BV

Good Day, I hope this email finds you well. We are pleased to invite you or your company to quote below listed item: Product/Model No: A702TH FYNE PRESSURE REGULATOR Model Number: A702TH Qty. 30 units Important note: Kindly send your quotation to: quote(a)pfizersuppliers.com for immediate approval. Kind Regards, Albert Bourla PFIZER B.V Supply Chain Manager Tel: +31(0)208080 880 ADDRESS: Rivium Westlaan 142, 2909 LD Capelle aan den IJssel, Netherlands

3 years, 8 months

1
0
0 0

[PATCH 0/5] 4.14 backports of fixes for "CoW after fork() issue"

by Suren Baghdasaryan

We received a report that the copy-on-write issue repored by Jann Horn in https://bugs.chromium.org/p/project-zero/issues/detail?id=2045 is still reproducible on 4.14 and 4.19 kernels (the first issue with the reproducer coded in vmsplice.c). I confirmed this and also that the issue was not reproducible with 5.10 kernel. I tracked the fix to the following patch introduced in 5.9 which changes the do_wp_page() logic: 09854ba94c6a 'mm: do_wp_page() simplification' I backported this patch (#2 in the series) along with 2 prerequisite patches (#1 and #4) that keep the backports clean and two followup fixes to the main patch (#3 and #5). I had to skip the following fix: feb889fb40fa 'mm: don't put pinned pages into the swap cache' because it uses page_maybe_dma_pinned() which does not exists in earlier kernels. Because pin_user_pages() does not exist there as well, I *think* we can safely skip this fix on older kernels, but I would appreciate if someone could confirm that claim. The patchset cleanly applies over: stable linux-4.14.y, tag: v4.14.228 Note: 4.14 and 4.19 backports are very similar, so while I backported only to these two versions I think backports for other versions can be done easily. Kirill Tkhai (1): mm: reuse only-pte-mapped KSM page in do_wp_page() Linus Torvalds (2): mm: do_wp_page() simplification mm: fix misplaced unlock_page in do_wp_page() Nadav Amit (1): mm/userfaultfd: fix memory corruption due to writeprotect Shaohua Li (1): userfaultfd: wp: add helper for writeprotect check include/linux/ksm.h | 7 ++++ include/linux/userfaultfd_k.h | 10 ++++++ mm/ksm.c | 30 ++++++++++++++++-- mm/memory.c | 60 ++++++++++++++++------------------- 4 files changed, 73 insertions(+), 34 deletions(-) -- 2.31.0.291.g576ba9dcdaf-goog

3 years, 8 months

6
25
0 0

[PATCH 1/1] gup: document and work around "COW can break either way" issue

by Suren Baghdasaryan

From: Linus Torvalds <torvalds(a)linux-foundation.org> commit 17839856fd588f4ab6b789f482ed3ffd7c403e1f upstream. Doing a "get_user_pages()" on a copy-on-write page for reading can be ambiguous: the page can be COW'ed at any time afterwards, and the direction of a COW event isn't defined. Yes, whoever writes to it will generally do the COW, but if the thread that did the get_user_pages() unmapped the page before the write (and that could happen due to memory pressure in addition to any outright action), the writer could also just take over the old page instead. End result: the get_user_pages() call might result in a page pointer that is no longer associated with the original VM, and is associated with - and controlled by - another VM having taken it over instead. So when doing a get_user_pages() on a COW mapping, the only really safe thing to do would be to break the COW when getting the page, even when only getting it for reading. At the same time, some users simply don't even care. For example, the perf code wants to look up the page not because it cares about the page, but because the code simply wants to look up the physical address of the access for informational purposes, and doesn't really care about races when a page might be unmapped and remapped elsewhere. This adds logic to force a COW event by setting FOLL_WRITE on any copy-on-write mapping when FOLL_GET (or FOLL_PIN) is used to get a page pointer as a result. The current semantics end up being: - __get_user_pages_fast(): no change. If you don't ask for a write, you won't break COW. You'd better know what you're doing. - get_user_pages_fast(): the fast-case "look it up in the page tables without anything getting mmap_sem" now refuses to follow a read-only page, since it might need COW breaking. Which happens in the slow path - the fast path doesn't know if the memory might be COW or not. - get_user_pages() (including the slow-path fallback for gup_fast()): for a COW mapping, turn on FOLL_WRITE for FOLL_GET/FOLL_PIN, with very similar semantics to FOLL_FORCE. If it turns out that we want finer granularity (ie "only break COW when it might actually matter" - things like the zero page are special and don't need to be broken) we might need to push these semantics deeper into the lookup fault path. So if people care enough, it's possible that we might end up adding a new internal FOLL_BREAK_COW flag to go with the internal FOLL_COW flag we already have for tracking "I had a COW". Alternatively, if it turns out that different callers might want to explicitly control the forced COW break behavior, we might even want to make such a flag visible to the users of get_user_pages() instead of using the above default semantics. But for now, this is mostly commentary on the issue (this commit message being a lot bigger than the patch, and that patch in turn is almost all comments), with that minimal "enable COW breaking early" logic using the existing FOLL_WRITE behavior. [ It might be worth noting that we've always had this ambiguity, and it could arguably be seen as a user-space issue. You only get private COW mappings that could break either way in situations where user space is doing cooperative things (ie fork() before an execve() etc), but it _is_ surprising and very subtle, and fork() is supposed to give you independent address spaces. So let's treat this as a kernel issue and make the semantics of get_user_pages() easier to understand. Note that obviously a true shared mapping will still get a page that can change under us, so this does _not_ mean that get_user_pages() somehow returns any "stable" page ] [surenb: backport notes] Replaced (gup_flags | FOLL_WRITE) with write=1 in gup_pgd_range. Removed FOLL_PIN usage in should_force_cow_break since it's missing in the earlier kernels. Reported-by: Jann Horn <jannh(a)google.com> Tested-by: Christoph Hellwig <hch(a)lst.de> Acked-by: Oleg Nesterov <oleg(a)redhat.com> Acked-by: Kirill Shutemov <kirill(a)shutemov.name> Acked-by: Jan Kara <jack(a)suse.cz> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Matthew Wilcox <willy(a)infradead.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> [surenb: backport to 4.14 kernel] Cc: stable(a)vger.kernel.org # 4.14.x Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> --- mm/gup.c | 44 ++++++++++++++++++++++++++++++++++++++------ mm/huge_memory.c | 7 +++---- 2 files changed, 41 insertions(+), 10 deletions(-) diff --git a/mm/gup.c b/mm/gup.c index 12b9626b1a9e..cfe0a56f8e27 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -61,13 +61,22 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address, } /* - * FOLL_FORCE can write to even unwritable pte's, but only - * after we've gone through a COW cycle and they are dirty. + * FOLL_FORCE or a forced COW break can write even to unwritable pte's, + * but only after we've gone through a COW cycle and they are dirty. */ static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) { - return pte_write(pte) || - ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); + return pte_write(pte) || ((flags & FOLL_COW) && pte_dirty(pte)); +} + +/* + * A (separate) COW fault might break the page the other way and + * get_user_pages() would return the page from what is now the wrong + * VM. So we need to force a COW break at GUP time even for reads. + */ +static inline bool should_force_cow_break(struct vm_area_struct *vma, unsigned int flags) +{ + return is_cow_mapping(vma->vm_flags) && (flags & FOLL_GET); } static struct page *follow_page_pte(struct vm_area_struct *vma, @@ -694,12 +703,18 @@ static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, if (!vma || check_vma_flags(vma, gup_flags)) return i ? : -EFAULT; if (is_vm_hugetlb_page(vma)) { + if (should_force_cow_break(vma, foll_flags)) + foll_flags |= FOLL_WRITE; i = follow_hugetlb_page(mm, vma, pages, vmas, &start, &nr_pages, i, - gup_flags, nonblocking); + foll_flags, nonblocking); continue; } } + + if (should_force_cow_break(vma, foll_flags)) + foll_flags |= FOLL_WRITE; + retry: /* * If we have a pending SIGKILL, don't keep faulting pages and @@ -1796,6 +1811,10 @@ bool gup_fast_permitted(unsigned long start, int nr_pages, int write) /* * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall back to * the regular GUP. It will only return non-negative values. + * + * Careful, careful! COW breaking can go either way, so a non-write + * access can get ambiguous page results. If you call this function without + * 'write' set, you'd better be sure that you're ok with that ambiguity. */ int __get_user_pages_fast(unsigned long start, int nr_pages, int write, struct page **pages) @@ -1823,6 +1842,12 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write, * * We do not adopt an rcu_read_lock(.) here as we also want to * block IPIs that come from THPs splitting. + * + * NOTE! We allow read-only gup_fast() here, but you'd better be + * careful about possible COW pages. You'll get _a_ COW page, but + * not necessarily the one you intended to get depending on what + * COW event happens after this. COW may break the page copy in a + * random direction. */ if (gup_fast_permitted(start, nr_pages, write)) { @@ -1868,9 +1893,16 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write, (void __user *)start, len))) return -EFAULT; + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ if (gup_fast_permitted(start, nr_pages, write)) { local_irq_disable(); - gup_pgd_range(addr, end, write, pages, &nr); + gup_pgd_range(addr, end, 1, pages, &nr); local_irq_enable(); ret = nr; } diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 9dbfa7286c61..513f0cf173ad 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1367,13 +1367,12 @@ int do_huge_pmd_wp_page(struct vm_fault *vmf, pmd_t orig_pmd) } /* - * FOLL_FORCE can write to even unwritable pmd's, but only - * after we've gone through a COW cycle and they are dirty. + * FOLL_FORCE or a forced COW break can write even to unwritable pmd's, + * but only after we've gone through a COW cycle and they are dirty. */ static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags) { - return pmd_write(pmd) || - ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd)); + return pmd_write(pmd) || ((flags & FOLL_COW) && pmd_dirty(pmd)); } struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, -- 2.31.1.498.g6c1eba8ee3d-goog

3 years, 8 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror April 2021