March 2022 - Linux-stable-mirror

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.4.182 release. There are 53 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Mar 2022 17:20:16 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.182-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.4.182-rc1 Linus Torvalds <torvalds(a)linux-foundation.org> fget: clarify and improve __fget_files() implementation Miaohe Lin <linmiaohe(a)huawei.com> memblock: use kfree() to release kmalloced memblock regions Karol Herbst <kherbst(a)redhat.com> Revert "drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR" Marc Zyngier <maz(a)kernel.org> gpio: tegra186: Fix chip_data type confusion daniel.starke(a)siemens.com <daniel.starke(a)siemens.com> tty: n_gsm: fix NULL pointer access due to DLCI release daniel.starke(a)siemens.com <daniel.starke(a)siemens.com> tty: n_gsm: fix proper link termination after failed open daniel.starke(a)siemens.com <daniel.starke(a)siemens.com> tty: n_gsm: fix encoding of control signal octet bit DV Hongyu Xie <xiehongyu1(a)kylinos.cn> xhci: Prevent futile URB re-submissions due to incorrect return value. Puma Hsu <pumahsu(a)google.com> xhci: re-initialize the HC during resume if HCE was set Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> usb: dwc3: gadget: Let the interrupt handler disable bottom halves. Hans de Goede <hdegoede(a)redhat.com> usb: dwc3: pci: Fix Bay Trail phy GPIO mappings Daniele Palmas <dnlplm(a)gmail.com> USB: serial: option: add Telit LE910R1 compositions Slark Xiao <slark_xiao(a)163.com> USB: serial: option: add support for DW5829e Steven Rostedt (Google) <rostedt(a)goodmis.org> tracefs: Set the group ownership in apply_options() not parse_options() Szymon Heidrich <szymon.heidrich(a)gmail.com> USB: gadget: validate endpoint index for xilinx udc Daehwan Jung <dh10.jung(a)samsung.com> usb: gadget: rndis: add spinlock for rndis response list Dmytro Bagrii <dimich.dmb(a)gmail.com> Revert "USB: serial: ch341: add new Product ID for CH341A" Sergey Shtylyov <s.shtylyov(a)omp.ru> ata: pata_hpt37x: disable primary channel on HPT371 Miaoqian Lin <linmq006(a)gmail.com> iio: Fix error handling for PM Cosmin Tanislav <demonsingur(a)gmail.com> iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> iio: adc: men_z188_adc: Fix a resource leak in an error handling path Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Have traceon and traceoff trigger honor the instance Bart Van Assche <bvanassche(a)acm.org> RDMA/ib_srp: Fix a deadlock ChenXiaoSong <chenxiaosong2(a)huawei.com> configfs: fix a race in configfs_{,un}register_subsystem() Zhou Qingyang <zhou1615(a)umn.edu> spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() Ariel Levkovich <lariel(a)nvidia.com> net/mlx5: Fix wrong limitation of metadata match on ecpf Maor Gottlieb <maorg(a)nvidia.com> net/mlx5: Fix possible deadlock on rule deletion Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: fix memory leak during stateful obj update Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() Christophe Leroy <christophe.leroy(a)csgroup.eu> net: Force inlining of checksum functions in net/checksum.h Xiaoke Wang <xkernel.wang(a)foxmail.com> net: ll_temac: check the return value of devm_kmalloc() Gal Pressman <gal(a)nvidia.com> net/mlx5e: Fix wrong return value on ioctl EEPROM query failure Maxime Ripard <maxime(a)cerno.tech> drm/edid: Always set RGB444 Paul Blakey <paulb(a)nvidia.com> openvswitch: Fix setting ipv6 fields causing hw csum failure Tao Liu <thomas.liu(a)ucloud.cn> gso: do not skip outer ip header in case of ipip and net_failover Dan Carpenter <dan.carpenter(a)oracle.com> tipc: Fix end of loop tests for list_for_each_entry() Eric Dumazet <edumazet(a)google.com> net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends Felix Maurer <fmaurer(a)redhat.com> bpf: Do not try bpf_msg_push_data with len 0 Alexey Bayduraev <alexey.v.bayduraev(a)linux.intel.com> perf data: Fix double free in perf_session__delete() Xin Long <lucien.xin(a)gmail.com> ping: remove pr_err from ping_lookup Heiner Kallweit <hkallweit1(a)gmail.com> lan743x: fix deadlock in lan743x_phy_link_status_change() Jens Wiklander <jens.wiklander(a)linaro.org> optee: use driver internal tee_context for some rpc Jens Wiklander <jens.wiklander(a)linaro.org> tee: export teedev_open() and teedev_close_context() Brian Geffon <bgeffon(a)google.com> x86/fpu: Correct pkru/xstate inconsistency Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables_offload: incorrect flow offload action array size Oliver Neukum <oneukum(a)suse.com> USB: zaurus: support another broken Zaurus Oliver Neukum <oneukum(a)suse.com> sr9700: sanity check for packet length Evan Quan <evan.quan(a)amd.com> drm/amdgpu: disable MMHUB PG for Picasso Helge Deller <deller(a)gmx.de> parisc/unaligned: Fix ldw() and stw() unalignment handlers Helge Deller <deller(a)gmx.de> parisc/unaligned: Fix fldd and fstd unaligned handlers on 32-bit kernel Stefano Garzarella <sgarzare(a)redhat.com> vhost/vsock: don't check owner in vhost_vsock_stop() while releasing Siarhei Volkau <lis8215(a)gmail.com> clk: jz4725b: fix mmc0 clock gating Zhang Qiao <zhangqiao22(a)huawei.com> cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug ------------- Diffstat: Makefile | 4 +- arch/parisc/kernel/unaligned.c | 14 ++--- arch/x86/include/asm/fpu/internal.h | 13 ++-- arch/x86/kernel/process_32.c | 6 +- arch/x86/kernel/process_64.c | 6 +- drivers/ata/pata_hpt37x.c | 14 +++++ drivers/clk/ingenic/jz4725b-cgu.c | 3 +- drivers/gpio/gpio-tegra186.c | 14 +++-- drivers/gpu/drm/amd/amdgpu/soc15.c | 5 +- drivers/gpu/drm/drm_edid.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 37 +++++------ drivers/iio/accel/bmc150-accel-core.c | 5 +- drivers/iio/accel/kxcjk-1013.c | 5 +- drivers/iio/accel/mma9551.c | 5 +- drivers/iio/accel/mma9553.c | 5 +- drivers/iio/adc/ad7124.c | 2 +- drivers/iio/adc/men_z188_adc.c | 9 ++- drivers/iio/gyro/bmg160_core.c | 5 +- drivers/iio/imu/kmx61.c | 5 +- drivers/iio/magnetometer/bmc150_magn.c | 5 +- drivers/infiniband/ulp/srp/ib_srp.c | 6 +- .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 4 -- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 12 +--- .../ethernet/netronome/nfp/flower/tunnel_conf.c | 4 +- drivers/net/ethernet/xilinx/ll_temac_main.c | 2 + drivers/net/usb/cdc_ether.c | 12 ++++ drivers/net/usb/sr9700.c | 2 +- drivers/net/usb/zaurus.c | 12 ++++ drivers/spi/spi-zynq-qspi.c | 3 + drivers/tee/optee/core.c | 8 +++ drivers/tee/optee/optee_private.h | 2 + drivers/tee/optee/rpc.c | 8 ++- drivers/tee/tee_core.c | 6 +- drivers/tty/n_gsm.c | 11 +++- drivers/usb/dwc3/dwc3-pci.c | 4 +- drivers/usb/dwc3/gadget.c | 2 + drivers/usb/gadget/function/rndis.c | 8 +++ drivers/usb/gadget/function/rndis.h | 1 + drivers/usb/gadget/udc/udc-xilinx.c | 6 ++ drivers/usb/host/xhci.c | 28 ++++++--- drivers/usb/serial/ch341.c | 1 - drivers/usb/serial/option.c | 12 ++++ drivers/vhost/vsock.c | 21 ++++--- fs/configfs/dir.c | 14 +++++ fs/file.c | 73 +++++++++++++++++----- fs/tracefs/inode.c | 5 +- include/linux/tee_drv.h | 14 +++++ include/net/checksum.h | 46 ++++++++------ include/net/netfilter/nf_tables.h | 2 +- include/net/netfilter/nf_tables_offload.h | 2 - kernel/cgroup/cpuset.c | 2 + kernel/trace/trace_events_trigger.c | 52 +++++++++++++-- mm/memblock.c | 10 ++- net/core/filter.c | 3 + net/core/skbuff.c | 4 +- net/ipv4/af_inet.c | 5 +- net/ipv4/ping.c | 1 - net/ipv6/ip6_offload.c | 2 + net/netfilter/nf_tables_api.c | 13 ++-- net/netfilter/nf_tables_offload.c | 3 +- net/netfilter/nft_dup_netdev.c | 6 ++ net/netfilter/nft_fwd_netdev.c | 6 ++ net/netfilter/nft_immediate.c | 12 +++- net/openvswitch/actions.c | 46 +++++++++++--- net/tipc/name_table.c | 2 +- net/tipc/socket.c | 2 +- tools/perf/util/data.c | 7 +-- 69 files changed, 495 insertions(+), 180 deletions(-)

2 years, 10 months

8
60
0 0

[PATCH v4 1/2] drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX

by Brian Norris

If the display is not enable()d, then we aren't holding a runtime PM reference here. Thus, it's easy to accidentally cause a hang, if user space is poking around at /dev/drm_dp_aux0 at the "wrong" time. Let's get a runtime PM reference, and check that we "see" the panel. Don't force any panel power-up, etc., because that can be intrusive, and that's not what other drivers do (see drivers/gpu/drm/bridge/ti-sn65dsi86.c and drivers/gpu/drm/bridge/parade-ps8640.c.) Fixes: 0d97ad03f422 ("drm/bridge: analogix_dp: Remove duplicated code") Cc: <stable(a)vger.kernel.org> Cc: Tomeu Vizoso <tomeu.vizoso(a)collabora.com> Signed-off-by: Brian Norris <briannorris(a)chromium.org> Reviewed-by: Douglas Anderson <dianders(a)chromium.org> --- Changes in v4: - Add Doug's Reviewed-by Changes in v3: - Avoid panel power-up; just check for HPD state, and let the rest happen "as-is" (e.g., time out, if the caller hasn't prepared things properly) Changes in v2: - Fix spelling in Subject - DRM_DEV_ERROR() -> drm_err() - Propagate errors from un-analogix_dp_prepare_panel() drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c index b7d2e4449cfa..16be279aed2c 100644 --- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c @@ -1632,8 +1632,19 @@ static ssize_t analogix_dpaux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg) { struct analogix_dp_device *dp = to_dp(aux); + int ret; + + pm_runtime_get_sync(dp->dev); + + ret = analogix_dp_detect_hpd(dp); + if (ret) + goto out; - return analogix_dp_transfer(dp, msg); + ret = analogix_dp_transfer(dp, msg); +out: + pm_runtime_put(dp->dev); + + return ret; } struct analogix_dp_device * -- 2.35.1.574.g5d30c73bfb-goog

2 years, 10 months

1
0
0 0

Good Day,

by Mrs. Mimi Aminu

-- I'm Mrs. Mimi Aminu, how are you doing hope you are in good health, the Board director try to reach you on phone several times Meanwhile, your number was not connecting. before he ask me to send you an email to hear from you if you are fine. hoping to hear from you soonest. Thanks Mrs. Mimi Aminu, Sincerely. Dr. Irene Lam.

2 years, 10 months

1
0
0 0

patch "staging: gdm724x: fix use after free in gdm_lte_rx()" added to staging-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: gdm724x: fix use after free in gdm_lte_rx() to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From fc7f750dc9d102c1ed7bbe4591f991e770c99033 Mon Sep 17 00:00:00 2001 From: Dan Carpenter <dan.carpenter(a)oracle.com> Date: Mon, 28 Feb 2022 10:43:31 +0300 Subject: staging: gdm724x: fix use after free in gdm_lte_rx() The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len. Fixes: 61e121047645 ("staging: gdm7240: adding LTE USB driver") Cc: stable <stable(a)vger.kernel.org> Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/20220228074331.GA13685@kili Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/gdm724x/gdm_lte.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c index 493ed4821515..0d8d8fed283d 100644 --- a/drivers/staging/gdm724x/gdm_lte.c +++ b/drivers/staging/gdm724x/gdm_lte.c @@ -76,14 +76,15 @@ static void tx_complete(void *arg) static int gdm_lte_rx(struct sk_buff *skb, struct nic *nic, int nic_type) { - int ret; + int ret, len; + len = skb->len + ETH_HLEN; ret = netif_rx_ni(skb); if (ret == NET_RX_DROP) { nic->stats.rx_dropped++; } else { nic->stats.rx_packets++; - nic->stats.rx_bytes += skb->len + ETH_HLEN; + nic->stats.rx_bytes += len; } return 0; -- 2.35.1

2 years, 10 months

1
0
0 0

[PATCH AUTOSEL 4.9 1/6] net-sysfs: add check for netdevice being present to speed_show

by Sasha Levin

From: suresh kumar <suresh2514(a)gmail.com> [ Upstream commit 4224cfd7fb6523f7a9d1c8bb91bb5df1e38eb624 ] When bringing down the netdevice or system shutdown, a panic can be triggered while accessing the sysfs path because the device is already removed. [ 755.549084] mlx5_core 0000:12:00.1: Shutdown was called [ 756.404455] mlx5_core 0000:12:00.0: Shutdown was called ... [ 757.937260] BUG: unable to handle kernel NULL pointer dereference at (null) [ 758.031397] IP: [<ffffffff8ee11acb>] dma_pool_alloc+0x1ab/0x280 crash> bt ... PID: 12649 TASK: ffff8924108f2100 CPU: 1 COMMAND: "amsd" ... #9 [ffff89240e1a38b0] page_fault at ffffffff8f38c778 [exception RIP: dma_pool_alloc+0x1ab] RIP: ffffffff8ee11acb RSP: ffff89240e1a3968 RFLAGS: 00010046 RAX: 0000000000000246 RBX: ffff89243d874100 RCX: 0000000000001000 RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff89243d874090 RBP: ffff89240e1a39c0 R8: 000000000001f080 R9: ffff8905ffc03c00 R10: ffffffffc04680d4 R11: ffffffff8edde9fd R12: 00000000000080d0 R13: ffff89243d874090 R14: ffff89243d874080 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #10 [ffff89240e1a39c8] mlx5_alloc_cmd_msg at ffffffffc04680f3 [mlx5_core] #11 [ffff89240e1a3a18] cmd_exec at ffffffffc046ad62 [mlx5_core] #12 [ffff89240e1a3ab8] mlx5_cmd_exec at ffffffffc046b4fb [mlx5_core] #13 [ffff89240e1a3ae8] mlx5_core_access_reg at ffffffffc0475434 [mlx5_core] #14 [ffff89240e1a3b40] mlx5e_get_fec_caps at ffffffffc04a7348 [mlx5_core] #15 [ffff89240e1a3bb0] get_fec_supported_advertised at ffffffffc04992bf [mlx5_core] #16 [ffff89240e1a3c08] mlx5e_get_link_ksettings at ffffffffc049ab36 [mlx5_core] #17 [ffff89240e1a3ce8] __ethtool_get_link_ksettings at ffffffff8f25db46 #18 [ffff89240e1a3d48] speed_show at ffffffff8f277208 #19 [ffff89240e1a3dd8] dev_attr_show at ffffffff8f0b70e3 #20 [ffff89240e1a3df8] sysfs_kf_seq_show at ffffffff8eedbedf #21 [ffff89240e1a3e18] kernfs_seq_show at ffffffff8eeda596 #22 [ffff89240e1a3e28] seq_read at ffffffff8ee76d10 #23 [ffff89240e1a3e98] kernfs_fop_read at ffffffff8eedaef5 #24 [ffff89240e1a3ed8] vfs_read at ffffffff8ee4e3ff #25 [ffff89240e1a3f08] sys_read at ffffffff8ee4f27f #26 [ffff89240e1a3f50] system_call_fastpath at ffffffff8f395f92 crash> net_device.state ffff89443b0c0000 state = 0x5 (__LINK_STATE_START| __LINK_STATE_NOCARRIER) To prevent this scenario, we also make sure that the netdevice is present. Signed-off-by: suresh kumar <suresh2514(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/core/net-sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 3fb5d8ecc8499..e42df58b88766 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -198,7 +198,7 @@ static ssize_t speed_show(struct device *dev, if (!rtnl_trylock()) return restart_syscall(); - if (netif_running(netdev)) { + if (netif_running(netdev) && netif_device_present(netdev)) { struct ethtool_link_ksettings cmd; if (!__ethtool_get_link_ksettings(netdev, &cmd)) -- 2.34.1

2 years, 10 months

1
5
0 0

[PATCH AUTOSEL 4.14 1/7] net-sysfs: add check for netdevice being present to speed_show

by Sasha Levin

From: suresh kumar <suresh2514(a)gmail.com> [ Upstream commit 4224cfd7fb6523f7a9d1c8bb91bb5df1e38eb624 ] When bringing down the netdevice or system shutdown, a panic can be triggered while accessing the sysfs path because the device is already removed. [ 755.549084] mlx5_core 0000:12:00.1: Shutdown was called [ 756.404455] mlx5_core 0000:12:00.0: Shutdown was called ... [ 757.937260] BUG: unable to handle kernel NULL pointer dereference at (null) [ 758.031397] IP: [<ffffffff8ee11acb>] dma_pool_alloc+0x1ab/0x280 crash> bt ... PID: 12649 TASK: ffff8924108f2100 CPU: 1 COMMAND: "amsd" ... #9 [ffff89240e1a38b0] page_fault at ffffffff8f38c778 [exception RIP: dma_pool_alloc+0x1ab] RIP: ffffffff8ee11acb RSP: ffff89240e1a3968 RFLAGS: 00010046 RAX: 0000000000000246 RBX: ffff89243d874100 RCX: 0000000000001000 RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff89243d874090 RBP: ffff89240e1a39c0 R8: 000000000001f080 R9: ffff8905ffc03c00 R10: ffffffffc04680d4 R11: ffffffff8edde9fd R12: 00000000000080d0 R13: ffff89243d874090 R14: ffff89243d874080 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #10 [ffff89240e1a39c8] mlx5_alloc_cmd_msg at ffffffffc04680f3 [mlx5_core] #11 [ffff89240e1a3a18] cmd_exec at ffffffffc046ad62 [mlx5_core] #12 [ffff89240e1a3ab8] mlx5_cmd_exec at ffffffffc046b4fb [mlx5_core] #13 [ffff89240e1a3ae8] mlx5_core_access_reg at ffffffffc0475434 [mlx5_core] #14 [ffff89240e1a3b40] mlx5e_get_fec_caps at ffffffffc04a7348 [mlx5_core] #15 [ffff89240e1a3bb0] get_fec_supported_advertised at ffffffffc04992bf [mlx5_core] #16 [ffff89240e1a3c08] mlx5e_get_link_ksettings at ffffffffc049ab36 [mlx5_core] #17 [ffff89240e1a3ce8] __ethtool_get_link_ksettings at ffffffff8f25db46 #18 [ffff89240e1a3d48] speed_show at ffffffff8f277208 #19 [ffff89240e1a3dd8] dev_attr_show at ffffffff8f0b70e3 #20 [ffff89240e1a3df8] sysfs_kf_seq_show at ffffffff8eedbedf #21 [ffff89240e1a3e18] kernfs_seq_show at ffffffff8eeda596 #22 [ffff89240e1a3e28] seq_read at ffffffff8ee76d10 #23 [ffff89240e1a3e98] kernfs_fop_read at ffffffff8eedaef5 #24 [ffff89240e1a3ed8] vfs_read at ffffffff8ee4e3ff #25 [ffff89240e1a3f08] sys_read at ffffffff8ee4f27f #26 [ffff89240e1a3f50] system_call_fastpath at ffffffff8f395f92 crash> net_device.state ffff89443b0c0000 state = 0x5 (__LINK_STATE_START| __LINK_STATE_NOCARRIER) To prevent this scenario, we also make sure that the netdevice is present. Signed-off-by: suresh kumar <suresh2514(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/core/net-sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 7d8c6ba5cbd22..5ff47c5bc453e 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -202,7 +202,7 @@ static ssize_t speed_show(struct device *dev, if (!rtnl_trylock()) return restart_syscall(); - if (netif_running(netdev)) { + if (netif_running(netdev) && netif_device_present(netdev)) { struct ethtool_link_ksettings cmd; if (!__ethtool_get_link_ksettings(netdev, &cmd)) -- 2.34.1

2 years, 10 months

1
6
0 0

[PATCH AUTOSEL 4.19 1/7] net-sysfs: add check for netdevice being present to speed_show

by Sasha Levin

From: suresh kumar <suresh2514(a)gmail.com> [ Upstream commit 4224cfd7fb6523f7a9d1c8bb91bb5df1e38eb624 ] When bringing down the netdevice or system shutdown, a panic can be triggered while accessing the sysfs path because the device is already removed. [ 755.549084] mlx5_core 0000:12:00.1: Shutdown was called [ 756.404455] mlx5_core 0000:12:00.0: Shutdown was called ... [ 757.937260] BUG: unable to handle kernel NULL pointer dereference at (null) [ 758.031397] IP: [<ffffffff8ee11acb>] dma_pool_alloc+0x1ab/0x280 crash> bt ... PID: 12649 TASK: ffff8924108f2100 CPU: 1 COMMAND: "amsd" ... #9 [ffff89240e1a38b0] page_fault at ffffffff8f38c778 [exception RIP: dma_pool_alloc+0x1ab] RIP: ffffffff8ee11acb RSP: ffff89240e1a3968 RFLAGS: 00010046 RAX: 0000000000000246 RBX: ffff89243d874100 RCX: 0000000000001000 RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff89243d874090 RBP: ffff89240e1a39c0 R8: 000000000001f080 R9: ffff8905ffc03c00 R10: ffffffffc04680d4 R11: ffffffff8edde9fd R12: 00000000000080d0 R13: ffff89243d874090 R14: ffff89243d874080 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #10 [ffff89240e1a39c8] mlx5_alloc_cmd_msg at ffffffffc04680f3 [mlx5_core] #11 [ffff89240e1a3a18] cmd_exec at ffffffffc046ad62 [mlx5_core] #12 [ffff89240e1a3ab8] mlx5_cmd_exec at ffffffffc046b4fb [mlx5_core] #13 [ffff89240e1a3ae8] mlx5_core_access_reg at ffffffffc0475434 [mlx5_core] #14 [ffff89240e1a3b40] mlx5e_get_fec_caps at ffffffffc04a7348 [mlx5_core] #15 [ffff89240e1a3bb0] get_fec_supported_advertised at ffffffffc04992bf [mlx5_core] #16 [ffff89240e1a3c08] mlx5e_get_link_ksettings at ffffffffc049ab36 [mlx5_core] #17 [ffff89240e1a3ce8] __ethtool_get_link_ksettings at ffffffff8f25db46 #18 [ffff89240e1a3d48] speed_show at ffffffff8f277208 #19 [ffff89240e1a3dd8] dev_attr_show at ffffffff8f0b70e3 #20 [ffff89240e1a3df8] sysfs_kf_seq_show at ffffffff8eedbedf #21 [ffff89240e1a3e18] kernfs_seq_show at ffffffff8eeda596 #22 [ffff89240e1a3e28] seq_read at ffffffff8ee76d10 #23 [ffff89240e1a3e98] kernfs_fop_read at ffffffff8eedaef5 #24 [ffff89240e1a3ed8] vfs_read at ffffffff8ee4e3ff #25 [ffff89240e1a3f08] sys_read at ffffffff8ee4f27f #26 [ffff89240e1a3f50] system_call_fastpath at ffffffff8f395f92 crash> net_device.state ffff89443b0c0000 state = 0x5 (__LINK_STATE_START| __LINK_STATE_NOCARRIER) To prevent this scenario, we also make sure that the netdevice is present. Signed-off-by: suresh kumar <suresh2514(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/core/net-sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index e5dc04cb55992..7a11b2d90975d 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -203,7 +203,7 @@ static ssize_t speed_show(struct device *dev, if (!rtnl_trylock()) return restart_syscall(); - if (netif_running(netdev)) { + if (netif_running(netdev) && netif_device_present(netdev)) { struct ethtool_link_ksettings cmd; if (!__ethtool_get_link_ksettings(netdev, &cmd)) -- 2.34.1

2 years, 10 months

1
6
0 0

[PATCH AUTOSEL 5.4 01/11] selftests/bpf: Add test for bpf_timer overwriting crash

by Sasha Levin

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> [ Upstream commit a7e75016a0753c24d6c995bc02501ae35368e333 ] Add a test that validates that timer value is not overwritten when doing a copy_map_value call in the kernel. Without the prior fix, this test triggers a crash. Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Link: https://lore.kernel.org/bpf/20220209070324.1093182-3-memxor@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- .../selftests/bpf/prog_tests/timer_crash.c | 32 +++++++++++ .../testing/selftests/bpf/progs/timer_crash.c | 54 +++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c create mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c diff --git a/tools/testing/selftests/bpf/prog_tests/timer_crash.c b/tools/testing/selftests/bpf/prog_tests/timer_crash.c new file mode 100644 index 0000000000000..f74b82305da8c --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/timer_crash.c @@ -0,0 +1,32 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <test_progs.h> +#include "timer_crash.skel.h" + +enum { + MODE_ARRAY, + MODE_HASH, +}; + +static void test_timer_crash_mode(int mode) +{ + struct timer_crash *skel; + + skel = timer_crash__open_and_load(); + if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load")) + return; + skel->bss->pid = getpid(); + skel->bss->crash_map = mode; + if (!ASSERT_OK(timer_crash__attach(skel), "timer_crash__attach")) + goto end; + usleep(1); +end: + timer_crash__destroy(skel); +} + +void test_timer_crash(void) +{ + if (test__start_subtest("array")) + test_timer_crash_mode(MODE_ARRAY); + if (test__start_subtest("hash")) + test_timer_crash_mode(MODE_HASH); +} diff --git a/tools/testing/selftests/bpf/progs/timer_crash.c b/tools/testing/selftests/bpf/progs/timer_crash.c new file mode 100644 index 0000000000000..f8f7944e70dae --- /dev/null +++ b/tools/testing/selftests/bpf/progs/timer_crash.c @@ -0,0 +1,54 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <vmlinux.h> +#include <bpf/bpf_tracing.h> +#include <bpf/bpf_helpers.h> + +struct map_elem { + struct bpf_timer timer; + struct bpf_spin_lock lock; +}; + +struct { + __uint(type, BPF_MAP_TYPE_ARRAY); + __uint(max_entries, 1); + __type(key, int); + __type(value, struct map_elem); +} amap SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, 1); + __type(key, int); + __type(value, struct map_elem); +} hmap SEC(".maps"); + +int pid = 0; +int crash_map = 0; /* 0 for amap, 1 for hmap */ + +SEC("fentry/do_nanosleep") +int sys_enter(void *ctx) +{ + struct map_elem *e, value = {}; + void *map = crash_map ? (void *)&hmap : (void *)&amap; + + if (bpf_get_current_task_btf()->tgid != pid) + return 0; + + *(void **)&value = (void *)0xdeadcaf3; + + bpf_map_update_elem(map, &(int){0}, &value, 0); + /* For array map, doing bpf_map_update_elem will do a + * check_and_free_timer_in_array, which will trigger the crash if timer + * pointer was overwritten, for hmap we need to use bpf_timer_cancel. + */ + if (crash_map == 1) { + e = bpf_map_lookup_elem(map, &(int){0}); + if (!e) + return 0; + bpf_timer_cancel(&e->timer); + } + return 0; +} + +char _license[] SEC("license") = "GPL"; -- 2.34.1

2 years, 10 months

2
11
0 0

[PATCH AUTOSEL 5.10 01/14] selftests/bpf: Add test for bpf_timer overwriting crash

by Sasha Levin

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> [ Upstream commit a7e75016a0753c24d6c995bc02501ae35368e333 ] Add a test that validates that timer value is not overwritten when doing a copy_map_value call in the kernel. Without the prior fix, this test triggers a crash. Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Link: https://lore.kernel.org/bpf/20220209070324.1093182-3-memxor@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- .../selftests/bpf/prog_tests/timer_crash.c | 32 +++++++++++ .../testing/selftests/bpf/progs/timer_crash.c | 54 +++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c create mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c diff --git a/tools/testing/selftests/bpf/prog_tests/timer_crash.c b/tools/testing/selftests/bpf/prog_tests/timer_crash.c new file mode 100644 index 0000000000000..f74b82305da8c --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/timer_crash.c @@ -0,0 +1,32 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <test_progs.h> +#include "timer_crash.skel.h" + +enum { + MODE_ARRAY, + MODE_HASH, +}; + +static void test_timer_crash_mode(int mode) +{ + struct timer_crash *skel; + + skel = timer_crash__open_and_load(); + if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load")) + return; + skel->bss->pid = getpid(); + skel->bss->crash_map = mode; + if (!ASSERT_OK(timer_crash__attach(skel), "timer_crash__attach")) + goto end; + usleep(1); +end: + timer_crash__destroy(skel); +} + +void test_timer_crash(void) +{ + if (test__start_subtest("array")) + test_timer_crash_mode(MODE_ARRAY); + if (test__start_subtest("hash")) + test_timer_crash_mode(MODE_HASH); +} diff --git a/tools/testing/selftests/bpf/progs/timer_crash.c b/tools/testing/selftests/bpf/progs/timer_crash.c new file mode 100644 index 0000000000000..f8f7944e70dae --- /dev/null +++ b/tools/testing/selftests/bpf/progs/timer_crash.c @@ -0,0 +1,54 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <vmlinux.h> +#include <bpf/bpf_tracing.h> +#include <bpf/bpf_helpers.h> + +struct map_elem { + struct bpf_timer timer; + struct bpf_spin_lock lock; +}; + +struct { + __uint(type, BPF_MAP_TYPE_ARRAY); + __uint(max_entries, 1); + __type(key, int); + __type(value, struct map_elem); +} amap SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, 1); + __type(key, int); + __type(value, struct map_elem); +} hmap SEC(".maps"); + +int pid = 0; +int crash_map = 0; /* 0 for amap, 1 for hmap */ + +SEC("fentry/do_nanosleep") +int sys_enter(void *ctx) +{ + struct map_elem *e, value = {}; + void *map = crash_map ? (void *)&hmap : (void *)&amap; + + if (bpf_get_current_task_btf()->tgid != pid) + return 0; + + *(void **)&value = (void *)0xdeadcaf3; + + bpf_map_update_elem(map, &(int){0}, &value, 0); + /* For array map, doing bpf_map_update_elem will do a + * check_and_free_timer_in_array, which will trigger the crash if timer + * pointer was overwritten, for hmap we need to use bpf_timer_cancel. + */ + if (crash_map == 1) { + e = bpf_map_lookup_elem(map, &(int){0}); + if (!e) + return 0; + bpf_timer_cancel(&e->timer); + } + return 0; +} + +char _license[] SEC("license") = "GPL"; -- 2.34.1

2 years, 10 months

2
14
0 0

[PATCH AUTOSEL 5.15 01/23] selftests/bpf: Add test for bpf_timer overwriting crash

by Sasha Levin

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> [ Upstream commit a7e75016a0753c24d6c995bc02501ae35368e333 ] Add a test that validates that timer value is not overwritten when doing a copy_map_value call in the kernel. Without the prior fix, this test triggers a crash. Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Link: https://lore.kernel.org/bpf/20220209070324.1093182-3-memxor@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- .../selftests/bpf/prog_tests/timer_crash.c | 32 +++++++++++ .../testing/selftests/bpf/progs/timer_crash.c | 54 +++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c create mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c diff --git a/tools/testing/selftests/bpf/prog_tests/timer_crash.c b/tools/testing/selftests/bpf/prog_tests/timer_crash.c new file mode 100644 index 0000000000000..f74b82305da8c --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/timer_crash.c @@ -0,0 +1,32 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <test_progs.h> +#include "timer_crash.skel.h" + +enum { + MODE_ARRAY, + MODE_HASH, +}; + +static void test_timer_crash_mode(int mode) +{ + struct timer_crash *skel; + + skel = timer_crash__open_and_load(); + if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load")) + return; + skel->bss->pid = getpid(); + skel->bss->crash_map = mode; + if (!ASSERT_OK(timer_crash__attach(skel), "timer_crash__attach")) + goto end; + usleep(1); +end: + timer_crash__destroy(skel); +} + +void test_timer_crash(void) +{ + if (test__start_subtest("array")) + test_timer_crash_mode(MODE_ARRAY); + if (test__start_subtest("hash")) + test_timer_crash_mode(MODE_HASH); +} diff --git a/tools/testing/selftests/bpf/progs/timer_crash.c b/tools/testing/selftests/bpf/progs/timer_crash.c new file mode 100644 index 0000000000000..f8f7944e70dae --- /dev/null +++ b/tools/testing/selftests/bpf/progs/timer_crash.c @@ -0,0 +1,54 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <vmlinux.h> +#include <bpf/bpf_tracing.h> +#include <bpf/bpf_helpers.h> + +struct map_elem { + struct bpf_timer timer; + struct bpf_spin_lock lock; +}; + +struct { + __uint(type, BPF_MAP_TYPE_ARRAY); + __uint(max_entries, 1); + __type(key, int); + __type(value, struct map_elem); +} amap SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, 1); + __type(key, int); + __type(value, struct map_elem); +} hmap SEC(".maps"); + +int pid = 0; +int crash_map = 0; /* 0 for amap, 1 for hmap */ + +SEC("fentry/do_nanosleep") +int sys_enter(void *ctx) +{ + struct map_elem *e, value = {}; + void *map = crash_map ? (void *)&hmap : (void *)&amap; + + if (bpf_get_current_task_btf()->tgid != pid) + return 0; + + *(void **)&value = (void *)0xdeadcaf3; + + bpf_map_update_elem(map, &(int){0}, &value, 0); + /* For array map, doing bpf_map_update_elem will do a + * check_and_free_timer_in_array, which will trigger the crash if timer + * pointer was overwritten, for hmap we need to use bpf_timer_cancel. + */ + if (crash_map == 1) { + e = bpf_map_lookup_elem(map, &(int){0}); + if (!e) + return 0; + bpf_timer_cancel(&e->timer); + } + return 0; +} + +char _license[] SEC("license") = "GPL"; -- 2.34.1

2 years, 10 months

2
25
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2022