These two bug are here:
list_for_each_entry_safe_continue(w, n, list,
power_list);
list_for_each_entry_safe_continue(w, n, list,
power_list);
After the list_for_each_entry_safe_continue() exits, the list iterator
will always be a bogus pointer which point to an invalid struct objdect
containing HEAD member. The funciton poniter 'w->event' will be a
invalid value which can lead to a control-flow hijack if the 'w' can be
controlled.
The original intention was to break the outer list_for_each_entry_safe()
loop if w->event is NULL, but forgot to *break* switch statement first.
So just add a break to fix the bug.
Cc: stable(a)vger.kernel.org
Fixes: 163cac061c973 ("ASoC: Factor out DAPM sequence execution")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
---
sound/soc/soc-dapm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index b06c5682445c..2a5a64d21856 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1686,9 +1686,11 @@ static void dapm_seq_run(struct snd_soc_card *card,
switch (w->id) {
case snd_soc_dapm_pre:
- if (!w->event)
+ if (!w->event) {
list_for_each_entry_safe_continue(w, n, list,
power_list);
+ break;
+ }
if (event == SND_SOC_DAPM_STREAM_START)
ret = w->event(w,
@@ -1699,9 +1701,11 @@ static void dapm_seq_run(struct snd_soc_card *card,
break;
case snd_soc_dapm_post:
- if (!w->event)
+ if (!w->event) {
list_for_each_entry_safe_continue(w, n, list,
power_list);
+ break;
+ }
if (event == SND_SOC_DAPM_STREAM_START)
ret = w->event(w,
--
2.17.1
The patch titled
Subject: mm/kmemleak: Reset tag when compare object pointer
has been added to the -mm tree. Its filename is
mm-kmemleak-reset-tag-when-compare-object-pointer.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-kmemleak-reset-tag-when-compar…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-kmemleak-reset-tag-when-compar…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Kuan-Ying Lee <Kuan-Ying.Lee(a)mediatek.com>
Subject: mm/kmemleak: Reset tag when compare object pointer
When we use HW-tag based kasan and enable vmalloc support, we hit
the following bug. It is due to comparison between tagged object
and non-tagged pointer.
We need to reset the kasan tag when we need to compare tagged object
and non-tagged pointer.
[ 7.690429][T400001] init: kmemleak: [name:kmemleak&]Scan area larger than object 0xffffffe77076f440
[ 7.691762][T400001] init: CPU: 4 PID: 1 Comm: init Tainted: G S W 5.15.25-android13-0-g5cacf919c2bc #1
[ 7.693218][T400001] init: Hardware name: MT6983(ENG) (DT)
[ 7.693983][T400001] init: Call trace:
[ 7.694508][T400001] init: dump_backtrace.cfi_jt+0x0/0x8
[ 7.695272][T400001] init: dump_stack_lvl+0xac/0x120
[ 7.695985][T400001] init: add_scan_area+0xc4/0x244
[ 7.696685][T400001] init: kmemleak_scan_area+0x40/0x9c
[ 7.697428][T400001] init: layout_and_allocate+0x1e8/0x288
[ 7.698211][T400001] init: load_module+0x2c8/0xf00
[ 7.698895][T400001] init: __se_sys_finit_module+0x190/0x1d0
[ 7.699701][T400001] init: __arm64_sys_finit_module+0x20/0x30
[ 7.700517][T400001] init: invoke_syscall+0x60/0x170
[ 7.701225][T400001] init: el0_svc_common+0xc8/0x114
[ 7.701933][T400001] init: do_el0_svc+0x28/0xa0
[ 7.702580][T400001] init: el0_svc+0x60/0xf8
[ 7.703196][T400001] init: el0t_64_sync_handler+0x88/0xec
[ 7.703964][T400001] init: el0t_64_sync+0x1b4/0x1b8
[ 7.704658][T400001] init: kmemleak: [name:kmemleak&]Object 0xf5ffffe77076b000 (size 32768):
[ 7.705824][T400001] init: kmemleak: [name:kmemleak&] comm "init", pid 1, jiffies 4294894197
[ 7.707002][T400001] init: kmemleak: [name:kmemleak&] min_count = 0
[ 7.707886][T400001] init: kmemleak: [name:kmemleak&] count = 0
[ 7.708718][T400001] init: kmemleak: [name:kmemleak&] flags = 0x1
[ 7.709574][T400001] init: kmemleak: [name:kmemleak&] checksum = 0
[ 7.710440][T400001] init: kmemleak: [name:kmemleak&] backtrace:
[ 7.711284][T400001] init: module_alloc+0x9c/0x120
[ 7.712015][T400001] init: move_module+0x34/0x19c
[ 7.712735][T400001] init: layout_and_allocate+0x1c4/0x288
[ 7.713561][T400001] init: load_module+0x2c8/0xf00
[ 7.714291][T400001] init: __se_sys_finit_module+0x190/0x1d0
[ 7.715142][T400001] init: __arm64_sys_finit_module+0x20/0x30
[ 7.716004][T400001] init: invoke_syscall+0x60/0x170
[ 7.716758][T400001] init: el0_svc_common+0xc8/0x114
[ 7.717512][T400001] init: do_el0_svc+0x28/0xa0
[ 7.718207][T400001] init: el0_svc+0x60/0xf8
[ 7.718869][T400001] init: el0t_64_sync_handler+0x88/0xec
[ 7.719683][T400001] init: el0t_64_sync+0x1b4/0x1b8
Link: https://lkml.kernel.org/r/20220318034051.30687-1-Kuan-Ying.Lee@mediatek.com
Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee(a)mediatek.com>
Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Matthias Brugger <matthias.bgg(a)gmail.com>
Cc: Chinwen Chang <chinwen.chang(a)mediatek.com>
Cc: Nicholas Tang <nicholas.tang(a)mediatek.com>
Cc: Yee Lee <yee.lee(a)mediatek.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/kmemleak.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/mm/kmemleak.c~mm-kmemleak-reset-tag-when-compare-object-pointer
+++ a/mm/kmemleak.c
@@ -796,6 +796,8 @@ static void add_scan_area(unsigned long
unsigned long flags;
struct kmemleak_object *object;
struct kmemleak_scan_area *area = NULL;
+ unsigned long untagged_ptr;
+ unsigned long untagged_objp;
object = find_and_get_object(ptr, 1);
if (!object) {
@@ -804,6 +806,9 @@ static void add_scan_area(unsigned long
return;
}
+ untagged_ptr = (unsigned long)kasan_reset_tag((void *)ptr);
+ untagged_objp = (unsigned long)kasan_reset_tag((void *)object->pointer);
+
if (scan_area_cache)
area = kmem_cache_alloc(scan_area_cache, gfp_kmemleak_mask(gfp));
@@ -815,8 +820,8 @@ static void add_scan_area(unsigned long
goto out_unlock;
}
if (size == SIZE_MAX) {
- size = object->pointer + object->size - ptr;
- } else if (ptr + size > object->pointer + object->size) {
+ size = untagged_objp + object->size - untagged_ptr;
+ } else if (untagged_ptr + size > untagged_objp + object->size) {
kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr);
dump_object_info(object);
kmem_cache_free(scan_area_cache, area);
_
Patches currently in -mm which might be from Kuan-Ying.Lee(a)mediatek.com are
mm-kmemleak-reset-tag-when-compare-object-pointer.patch
Hi,
commit 92833e8b5db6c209e9311ac8c6a44d3bf1856659 breaks the
build of sch_* modules in stable.
I already have:
#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 20, 0)
qdisc_destroy(cl->leaf.q);
#else
qdisc_put(cl->leaf.q);
#endif
But this makes it more tricky… or can I “just” change this
to KERNEL_VERSION(4, 19, 221) ?
Nevertheless, renaming functions isn’t something I’d expect
to happen in stable. At least add a #define or so redirecting
from the old/stable name…
bye,
//mirabilos
--
Infrastrukturexperte • tarent solutions GmbH
Am Dickobskreuz 10, D-53121 Bonn • http://www.tarent.de/
Telephon +49 228 54881-393 • Fax: +49 228 54881-235
HRB AG Bonn 5168 • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg
****************************************************
/⁀\ The UTF-8 Ribbon
╲ ╱ Campaign against Mit dem tarent-Newsletter nichts mehr verpassen:
╳ HTML eMail! Also, https://www.tarent.de/newsletter
╱ ╲ header encryption!
****************************************************
The patch titled
Subject: mm,hwpoison: unmap poisoned page before invalidation
has been added to the -mm tree. Its filename is
mmhwpoison-unmap-poisoned-page-before-invalidation.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mmhwpoison-unmap-poisoned-page-be…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mmhwpoison-unmap-poisoned-page-be…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Rik van Riel <riel(a)surriel.com>
Subject: mm,hwpoison: unmap poisoned page before invalidation
In some cases it appears the invalidation of a hwpoisoned page fails
because the page is still mapped in another process. This can cause a
program to be continuously restarted and die when it page faults on the
page that was not invalidated. Avoid that problem by unmapping the
hwpoisoned page when we find it.
Another issue is that sometimes we end up oopsing in finish_fault, if the
code tries to do something with the now-NULL vmf->page. I did not hit
this error when submitting the previous patch because there are several
opportunities for alloc_set_pte to bail out before accessing vmf->page,
and that apparently happened on those systems, and most of the time on
other systems, too.
However, across several million systems that error does occur a handful of
times a day. It can be avoided by returning VM_FAULT_NOPAGE which will
cause do_read_fault to return before calling finish_fault.
Link: https://lkml.kernel.org/r/20220325161428.5068d97e@imladris.surriel.com
Fixes: e53ac7374e64 ("mm: invalidate hwpoison page cache page in fault path")
Reviewed-by: Miaohe Lin <linmiaohe(a)huawei.com>
Tested-by: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: Mel Gorman <mgorman(a)suse.de>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/mm/memory.c~mmhwpoison-unmap-poisoned-page-before-invalidation
+++ a/mm/memory.c
@@ -3918,14 +3918,18 @@ static vm_fault_t __do_fault(struct vm_f
return ret;
if (unlikely(PageHWPoison(vmf->page))) {
+ struct page *page = vmf->page;
vm_fault_t poisonret = VM_FAULT_HWPOISON;
if (ret & VM_FAULT_LOCKED) {
+ if (page_mapped(page))
+ unmap_mapping_pages(page_mapping(page),
+ page->index, 1, false);
/* Retry if a clean page was removed from the cache. */
- if (invalidate_inode_page(vmf->page))
- poisonret = 0;
- unlock_page(vmf->page);
+ if (invalidate_inode_page(page))
+ poisonret = VM_FAULT_NOPAGE;
+ unlock_page(page);
}
- put_page(vmf->page);
+ put_page(page);
vmf->page = NULL;
return poisonret;
}
_
Patches currently in -mm which might be from riel(a)surriel.com are
mmhwpoison-unmap-poisoned-page-before-invalidation.patch