From: Sherry Sun <sherry.sun(a)nxp.com>
[ Upstream commit fcb10ee27fb91b25b68d7745db9817ecea9f1038 ]
We should be very careful about the register values that will be used
for division or modulo operations, althrough the possibility that the
UARTBAUD register value is zero is very low, but we had better to deal
with the "bad data" of hardware in advance to avoid division or modulo
by zero leading to undefined kernel behavior.
Signed-off-by: Sherry Sun <sherry.sun(a)nxp.com>
Link: https://lore.kernel.org/r/20210427021226.27468-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/tty/serial/fsl_lpuart.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 5b6093dc3ff2..a4c1797e30d7 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1766,6 +1766,9 @@ lpuart32_console_get_options(struct lpuart_port *sport, int *baud,
bd = lpuart32_read(sport->port.membase + UARTBAUD);
bd &= UARTBAUD_SBR_MASK;
+ if (!bd)
+ return;
+
sbr = bd;
uartclk = clk_get_rate(sport->clk);
/*
--
2.30.2
From: Sherry Sun <sherry.sun(a)nxp.com>
[ Upstream commit fcb10ee27fb91b25b68d7745db9817ecea9f1038 ]
We should be very careful about the register values that will be used
for division or modulo operations, althrough the possibility that the
UARTBAUD register value is zero is very low, but we had better to deal
with the "bad data" of hardware in advance to avoid division or modulo
by zero leading to undefined kernel behavior.
Signed-off-by: Sherry Sun <sherry.sun(a)nxp.com>
Link: https://lore.kernel.org/r/20210427021226.27468-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/tty/serial/fsl_lpuart.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index cebebdcd091c..3d5fe53988e5 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1998,6 +1998,9 @@ lpuart32_console_get_options(struct lpuart_port *sport, int *baud,
bd = lpuart32_read(&sport->port, UARTBAUD);
bd &= UARTBAUD_SBR_MASK;
+ if (!bd)
+ return;
+
sbr = bd;
uartclk = clk_get_rate(sport->clk);
/*
--
2.30.2
From: Sherry Sun <sherry.sun(a)nxp.com>
[ Upstream commit fcb10ee27fb91b25b68d7745db9817ecea9f1038 ]
We should be very careful about the register values that will be used
for division or modulo operations, althrough the possibility that the
UARTBAUD register value is zero is very low, but we had better to deal
with the "bad data" of hardware in advance to avoid division or modulo
by zero leading to undefined kernel behavior.
Signed-off-by: Sherry Sun <sherry.sun(a)nxp.com>
Link: https://lore.kernel.org/r/20210427021226.27468-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/tty/serial/fsl_lpuart.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 1544a7cc76ff..1319f3dd5b70 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1681,6 +1681,9 @@ lpuart32_console_get_options(struct lpuart_port *sport, int *baud,
bd = lpuart32_read(sport->port.membase + UARTBAUD);
bd &= UARTBAUD_SBR_MASK;
+ if (!bd)
+ return;
+
sbr = bd;
uartclk = clk_get_rate(sport->clk);
/*
--
2.30.2
The patch titled
Subject: shm: skip shm_destroy if task IPC namespace was changed
has been added to the -mm tree. Its filename is
shm-skip-shm_destroy-if-task-ipc-namespace-was-changed.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/shm-skip-shm_destroy-if-task-ipc-…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/shm-skip-shm_destroy-if-task-ipc-…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Alexander Mikhalitsyn <alexander.mikhalitsyn(a)virtuozzo.com>
Subject: shm: skip shm_destroy if task IPC namespace was changed
Patch series "shm: omit forced shm destroy if task IPC namespace was changed".
Task IPC namespace shm's has shm_rmid_forced feature which is per IPC
namespace and controlled by kernel.shm_rmid_forced sysctl. When feature
is turned on, then during task exit (and unshare(CLONE_NEWIPC)) all
sysvshm's will be destroyed by exit_shm(struct task_struct *task)
function.
But there is a problem if task was changed IPC namespace since shmget()
call. In such situation exit_shm() function will try to call
shm_destroy(<new_ipc_namespace_ptr>, <sysvshmem_from_old_ipc_namespace>)
which leads to the situation when sysvshm object still attached to old IPC
namespace but freed; later during old IPC namespace cleanup we will try to
free such sysvshm object for the second time and will get the problem :)
First patch solves this problem by postponing shm_destroy to the moment
when IPC namespace cleanup will be called. Second patch is useful to
prevent (or easy catch) such bugs in the future by adding corresponding
WARNings.
This patch (of 2):
Task may change IPC namespace by doing setns() but sysvshm objects remains
at the origin IPC namespace (=IPC namespace where task was when shmget()
was called). Let's skip forced shm destroy in such case because we can't
determine IPC namespace by shm only. These problematic sysvshm's will be
destroyed on ipc namespace cleanup.
Link: https://lkml.kernel.org/r/20210706132259.71740-1-alexander.mikhalitsyn@virt…
Link: https://lkml.kernel.org/r/20210706132259.71740-2-alexander.mikhalitsyn@virt…
Fixes: ab602f79915 ("shm: make exit_shm work proportional to task activity")
Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn(a)virtuozzo.com>
Cc: Milton Miller <miltonm(a)bga.com>
Cc: Jack Miller <millerjo(a)us.ibm.com>
Cc: Pavel Tikhomirov <ptikhomirov(a)virtuozzo.com>
Cc: Alexander Mikhalitsyn <alexander(a)mihalicyn.com>
Cc: Manfred Spraul <manfred(a)colorfullife.com>
Cc: Davidlohr Bueso <dave(a)stgolabs.net>
Cc: "Eric W. Biederman" <ebiederm(a)xmission.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
ipc/shm.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/ipc/shm.c~shm-skip-shm_destroy-if-task-ipc-namespace-was-changed
+++ a/ipc/shm.c
@@ -173,6 +173,14 @@ static inline struct shmid_kernel *shm_o
return container_of(ipcp, struct shmid_kernel, shm_perm);
}
+static inline bool is_shm_in_ns(struct ipc_namespace *ns, struct shmid_kernel *shp)
+{
+ int idx = ipcid_to_idx(shp->shm_perm.id);
+ struct shmid_kernel *tshp = shm_obtain_object(ns, idx);
+
+ return !IS_ERR(tshp) && tshp == shp;
+}
+
/*
* shm_lock_(check_) routines are called in the paths where the rwsem
* is not necessarily held.
@@ -415,7 +423,7 @@ void exit_shm(struct task_struct *task)
list_for_each_entry_safe(shp, n, &task->sysvshm.shm_clist, shm_clist) {
shp->shm_creator = NULL;
- if (shm_may_destroy(ns, shp)) {
+ if (is_shm_in_ns(ns, shp) && shm_may_destroy(ns, shp)) {
shm_lock_by_ptr(shp);
shm_destroy(ns, shp);
}
_
Patches currently in -mm which might be from alexander.mikhalitsyn(a)virtuozzo.com are
shm-skip-shm_destroy-if-task-ipc-namespace-was-changed.patch
ipc-warn-if-trying-to-remove-ipc-object-which-is-absent.patch