May 2022 - Linux-stable-mirror

[PATCH 5.10] Revert "drm/i915/opregion: check port number bounds for SWSCI display power state"

by Greg Thelen

This reverts commit b84857c06ef9e72d09fadafdbb3ce9af64af954f. 5.10 stable contains 2 identical commits: 1. commit eb7bf11e8ef1 ("drm/i915/opregion: check port number bounds for SWSCI display power state") 2. commit b84857c06ef9 ("drm/i915/opregion: check port number bounds for SWSCI display power state") Both commits add separate checks for the same condition. Revert the 2nd redundant check to match upstream, which only has one check. Signed-off-by: Greg Thelen <gthelen(a)google.com> --- drivers/gpu/drm/i915/display/intel_opregion.c | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/drivers/gpu/drm/i915/display/intel_opregion.c b/drivers/gpu/drm/i915/display/intel_opregion.c index 6d083b98f6ae..abff2d6cedd1 100644 --- a/drivers/gpu/drm/i915/display/intel_opregion.c +++ b/drivers/gpu/drm/i915/display/intel_opregion.c @@ -376,21 +376,6 @@ int intel_opregion_notify_encoder(struct intel_encoder *intel_encoder, return -EINVAL; } - /* - * The port numbering and mapping here is bizarre. The now-obsolete - * swsci spec supports ports numbered [0..4]. Port E is handled as a - * special case, but port F and beyond are not. The functionality is - * supposed to be obsolete for new platforms. Just bail out if the port - * number is out of bounds after mapping. - */ - if (port > 4) { - drm_dbg_kms(&dev_priv->drm, - "[ENCODER:%d:%s] port %c (index %u) out of bounds for display power state notification\n", - intel_encoder->base.base.id, intel_encoder->base.name, - port_name(intel_encoder->port), port); - return -EINVAL; - } - if (!enable) parm |= 4 << 8; -- 2.36.0.550.gb090851708-goog

2 years, 7 months

2
1
0 0

FAILED: patch "[PATCH] mm/kfence: reset PG_slab and memcg_data before freeing" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2839b0999c20c9f6bf353849c69370e121e2fa1a Mon Sep 17 00:00:00 2001 From: Hyeonggon Yoo <42.hyeyoo(a)gmail.com> Date: Mon, 9 May 2022 17:34:29 -0700 Subject: [PATCH] mm/kfence: reset PG_slab and memcg_data before freeing __kfence_pool When kfence fails to initialize kfence pool, it frees the pool. But it does not reset memcg_data and PG_slab flag. Below is a BUG because of this. Let's fix it by resetting memcg_data and PG_slab flag before free. [ 0.089149] BUG: Bad page state in process swapper/0 pfn:3d8e06 [ 0.089149] page:ffffea46cf638180 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3d8e06 [ 0.089150] memcg:ffffffff94a475d1 [ 0.089150] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 0.089151] raw: 0017ffffc0000200 ffffea46cf638188 ffffea46cf638188 0000000000000000 [ 0.089152] raw: 0000000000000000 0000000000000000 00000000ffffffff ffffffff94a475d1 [ 0.089152] page dumped because: page still charged to cgroup [ 0.089153] Modules linked in: [ 0.089153] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B W 5.18.0-rc1+ #965 [ 0.089154] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 0.089154] Call Trace: [ 0.089155] <TASK> [ 0.089155] dump_stack_lvl+0x49/0x5f [ 0.089157] dump_stack+0x10/0x12 [ 0.089158] bad_page.cold+0x63/0x94 [ 0.089159] check_free_page_bad+0x66/0x70 [ 0.089160] __free_pages_ok+0x423/0x530 [ 0.089161] __free_pages_core+0x8e/0xa0 [ 0.089162] memblock_free_pages+0x10/0x12 [ 0.089164] memblock_free_late+0x8f/0xb9 [ 0.089165] kfence_init+0x68/0x92 [ 0.089166] start_kernel+0x789/0x992 [ 0.089167] x86_64_start_reservations+0x24/0x26 [ 0.089168] x86_64_start_kernel+0xa9/0xaf [ 0.089170] secondary_startup_64_no_verify+0xd5/0xdb [ 0.089171] </TASK> Link: https://lkml.kernel.org/r/YnPG3pQrqfcgOlVa@hyeyoo Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Fixes: 8f0b36497303 ("mm: kfence: fix objcgs vector allocation") Signed-off-by: Hyeonggon Yoo <42.hyeyoo(a)gmail.com> Reviewed-by: Marco Elver <elver(a)google.com> Reviewed-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Alexander Potapenko <glider(a)google.com> Cc: Dmitry Vyukov <dvyukov(a)google.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/kfence/core.c b/mm/kfence/core.c index 9b2b5f56f4ae..11a954763be9 100644 --- a/mm/kfence/core.c +++ b/mm/kfence/core.c @@ -621,6 +621,16 @@ static bool __init kfence_init_pool_early(void) * fails for the first page, and therefore expect addr==__kfence_pool in * most failure cases. */ + for (char *p = (char *)addr; p < __kfence_pool + KFENCE_POOL_SIZE; p += PAGE_SIZE) { + struct slab *slab = virt_to_slab(p); + + if (!slab) + continue; +#ifdef CONFIG_MEMCG + slab->memcg_data = 0; +#endif + __folio_clear_slab(slab_folio(slab)); + } memblock_free_late(__pa(addr), KFENCE_POOL_SIZE - (addr - (unsigned long)__kfence_pool)); __kfence_pool = NULL; return false;

2 years, 7 months

3
2
0 0

[PATCH 5.4 0/2] x86/xen: Make the idle task stacks reliable

by Markus Boehme

Linux v5.7 introduced a couple patches to make walking the stack of the idle tasks reliable when Linux runs as a Xen PV guest. Attached are the backports for the 5.4 LTS, which are of special interest when using the livepatch subsystem. Markus

2 years, 7 months

2
3
0 0

MMIO support for I2C-PIIX4 and SP5100-TCO

by Limonciello, Mario

[Public] Hi, Some users have complained that i2c the controller doesn't work on newer designs. This is because the system can be configured by an OEM to not allow access to the I2C controller registers via legacy methods and instead requires MMIO. Some bug reports collecting this problem (which have had duplicates brought in) https://gitlab.com/CalcProgrammer1/OpenRGB/-/issues/1984 https://bugs.launchpad.net/amd/+bug/1950062 These commits that have landed into 5.18 fix this issue both for i2c-piix4 and for sp5100-tco (which suffers the same fate). Would you take them back to stable 5.15.y and 5.17.y? The series comes back cleanly to both. 27c196c7b73c kernel/resource: Introduce request_mem_region_muxed() 93102cb44978 i2c: piix4: Replace hardcoded memory map size with a #define a3325d225b00 i2c: piix4: Move port I/O region request/release code into functions 0a59a24e14e9 i2c: piix4: Move SMBus controller base address detect into function fbafbd51bff5 i2c: piix4: Move SMBus port selection into function 7c148722d074 i2c: piix4: Add EFCH MMIO support to region request and release 46967bc1ee93 i2c: piix4: Add EFCH MMIO support to SMBus base address detect 381a3083c674 i2c: piix4: Add EFCH MMIO support for SMBus port select 6cf72f41808a i2c: piix4: Enable EFCH MMIO for Family 17h+ abd71a948f7a Watchdog: sp5100_tco: Move timer initialization into function 1f182aca2300 Watchdog: sp5100_tco: Refactor MMIO base address initialization 0578fff4aae5 Watchdog: sp5100_tco: Add initialization using EFCH MMIO 826270373f17 Watchdog: sp5100_tco: Enable Family 17h+ CPUs Thanks,

2 years, 7 months

2
3
0 0

Re: [PATCH 1/3] floppy: use a statically allocated error counter

by Denis Efremov

Hi, On 5/8/22 13:37, Willy Tarreau wrote: > Interrupt handler bad_flp_intr() may cause a UAF on the recently freed > request just to increment the error count. There's no point keeping > that one in the request anyway, and since the interrupt handler uses > a static pointer to the error which cannot be kept in sync with the > pending request, better make it use a static error counter that's > reset for each new request. This reset now happens when entering > redo_fd_request() for a new request via set_next_request(). > > One initial concern about a single error counter was that errors on > one floppy drive could be reported on another one, but this problem > is not real given that the driver uses a single drive at a time, as > that PC-compatible controllers also have this limitation by using > shared signals. As such the error count is always for the "current" > drive. > > Reported-by: Minh Yuan <yuanmingbuaa(a)gmail.com> > Suggested-by: Linus Torvalds <torvalds(a)linuxfoundation.org> > Tested-by: Denis Efremov <efremov(a)linux.com> > Signed-off-by: Willy Tarreau <w(a)1wt.eu> Could you please take this patch (only this one) to the stable trees? commit f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 upstream. The patch applies cleanly to 5.17, 5.15, 5.10 kernels. I'll send a backport for 5.4 and older kernels. Thanks, Denis > --- > drivers/block/floppy.c | 18 ++++++++---------- > 1 file changed, 8 insertions(+), 10 deletions(-) > > diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c > index d5b9ff9bcbb2..015841f50f4e 100644 > --- a/drivers/block/floppy.c > +++ b/drivers/block/floppy.c > @@ -509,8 +509,8 @@ static unsigned long fdc_busy; > static DECLARE_WAIT_QUEUE_HEAD(fdc_wait); > static DECLARE_WAIT_QUEUE_HEAD(command_done); > > -/* Errors during formatting are counted here. */ > -static int format_errors; > +/* errors encountered on the current (or last) request */ > +static int floppy_errors; > > /* Format request descriptor. */ > static struct format_descr format_req; > @@ -530,7 +530,6 @@ static struct format_descr format_req; > static char *floppy_track_buffer; > static int max_buffer_sectors; > > -static int *errors; > typedef void (*done_f)(int); > static const struct cont_t { > void (*interrupt)(void); > @@ -1455,7 +1454,7 @@ static int interpret_errors(void) > if (drive_params[current_drive].flags & FTD_MSG) > DPRINT("Over/Underrun - retrying\n"); > bad = 0; > - } else if (*errors >= drive_params[current_drive].max_errors.reporting) { > + } else if (floppy_errors >= drive_params[current_drive].max_errors.reporting) { > print_errors(); > } > if (reply_buffer[ST2] & ST2_WC || reply_buffer[ST2] & ST2_BC) > @@ -2095,7 +2094,7 @@ static void bad_flp_intr(void) > if (!next_valid_format(current_drive)) > return; > } > - err_count = ++(*errors); > + err_count = ++floppy_errors; > INFBOUND(write_errors[current_drive].badness, err_count); > if (err_count > drive_params[current_drive].max_errors.abort) > cont->done(0); > @@ -2241,9 +2240,8 @@ static int do_format(int drive, struct format_descr *tmp_format_req) > return -EINVAL; > } > format_req = *tmp_format_req; > - format_errors = 0; > cont = &format_cont; > - errors = &format_errors; > + floppy_errors = 0; > ret = wait_til_done(redo_format, true); > if (ret == -EINTR) > return -EINTR; > @@ -2759,10 +2757,11 @@ static int set_next_request(void) > current_req = list_first_entry_or_null(&floppy_reqs, struct request, > queuelist); > if (current_req) { > - current_req->error_count = 0; > + floppy_errors = 0; > list_del_init(&current_req->queuelist); > + return 1; > } > - return current_req != NULL; > + return 0; > } > > /* Starts or continues processing request. Will automatically unlock the > @@ -2821,7 +2820,6 @@ static void redo_fd_request(void) > _floppy = floppy_type + drive_params[current_drive].autodetect[drive_state[current_drive].probed_format]; > } else > probing = 0; > - errors = &(current_req->error_count); > tmp = make_raw_rw_request(); > if (tmp < 2) { > request_done(tmp);

2 years, 7 months

2
1
0 0

Cherry-pick patch request for 5.15-stable

by Jens Axboe

Hi, Can you cherrypick: commit e74ead135bc4459f7d40b1f8edab1333a28b54e8 Author: Pavel Begunkov <asml.silence(a)gmail.com> Date: Sun Oct 17 00:07:08 2021 +0100 io_uring: arm poll for non-nowait files into 5.15-stable? It should apply cleanly. Thanks, -- Jens Axboe

2 years, 7 months

2
3
0 0

[PATCH for 5.10.y 0/3] Intel igc backports

by Nobuhiro Iwamatsu

Hi, Intel igc ethernet device does not work on 5.10.y due to a problem with the PHY check of igc driver. ``` igc: probe of 0000:03:00.0 failed with error -2 ``` To fix this issue, we'll need three commits that have been fixed in upstream. Best regards, Nobuhiro Sasha Neftin (3): igc: Remove _I_PHY_ID checking igc: Remove phy->type checking igc: Update I226_K device ID drivers/net/ethernet/intel/igc/igc_base.c | 10 +--------- drivers/net/ethernet/intel/igc/igc_hw.h | 1 + drivers/net/ethernet/intel/igc/igc_main.c | 18 +++++------------- drivers/net/ethernet/intel/igc/igc_phy.c | 6 ++---- 4 files changed, 9 insertions(+), 26 deletions(-) -- 2.36.0

2 years, 7 months

1
3
0 0

[PATCH 1/2] ext4: Verify dir block before splitting it

by Jan Kara

Before splitting a directory block verify its directory entries are sane so that the splitting code does not access memory it should not. CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> --- fs/ext4/namei.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index 767b4bfe39c3..2a55f23e4524 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -277,9 +277,9 @@ static struct dx_frame *dx_probe(struct ext4_filename *fname, struct dx_hash_info *hinfo, struct dx_frame *frame); static void dx_release(struct dx_frame *frames); -static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de, - unsigned blocksize, struct dx_hash_info *hinfo, - struct dx_map_entry map[]); +static int dx_make_map(struct inode *dir, struct buffer_head *bh, + struct dx_hash_info *hinfo, + struct dx_map_entry *map_tail); static void dx_sort_map(struct dx_map_entry *map, unsigned count); static struct ext4_dir_entry_2 *dx_move_dirents(struct inode *dir, char *from, char *to, struct dx_map_entry *offsets, @@ -1249,15 +1249,23 @@ static inline int search_dirblock(struct buffer_head *bh, * Create map of hash values, offsets, and sizes, stored at end of block. * Returns number of entries mapped. */ -static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de, - unsigned blocksize, struct dx_hash_info *hinfo, +static int dx_make_map(struct inode *dir, struct buffer_head *bh, + struct dx_hash_info *hinfo, struct dx_map_entry *map_tail) { int count = 0; - char *base = (char *) de; + struct ext4_dir_entry_2 *de = (struct ext4_dir_entry_2 *)bh->b_data; + unsigned int buflen = bh->b_size; + char *base = bh->b_data; struct dx_hash_info h = *hinfo; - while ((char *) de < base + blocksize) { + if (ext4_has_metadata_csum(dir->i_sb)) + buflen -= sizeof(struct ext4_dir_entry_tail); + + while ((char *) de < base + buflen) { + if (ext4_check_dir_entry(dir, NULL, de, bh, base, buflen, + ((char *)de) - base)) + return -EFSCORRUPTED; if (de->name_len && de->inode) { if (ext4_hash_in_dirent(dir)) h.hash = EXT4_DIRENT_HASH(de); @@ -1270,8 +1278,7 @@ static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de, count++; cond_resched(); } - /* XXX: do we need to check rec_len == 0 case? -Chris */ - de = ext4_next_entry(de, blocksize); + de = ext4_next_entry(de, dir->i_sb->s_blocksize); } return count; } @@ -1943,8 +1950,11 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, /* create map in the end of data2 block */ map = (struct dx_map_entry *) (data2 + blocksize); - count = dx_make_map(dir, (struct ext4_dir_entry_2 *) data1, - blocksize, hinfo, map); + count = dx_make_map(dir, *bh, hinfo, map); + if (count < 0) { + err = count; + goto journal_error; + } map -= count; dx_sort_map(map, count); /* Ensure that neither split block is over half full */ -- 2.35.3

2 years, 7 months

2
1
0 0

[PATCH v3 1/5] ext4: fix memory leak in parse_apply_sb_mount_options()

by Eric Biggers

From: Eric Biggers <ebiggers(a)google.com> If processing the on-disk mount options fails after any memory was allocated in the ext4_fs_context, e.g. s_qf_names, then this memory is leaked. Fix this by calling ext4_fc_free() instead of kfree() directly. Reproducer: mkfs.ext4 -F /dev/vdc tune2fs /dev/vdc -E mount_opts=usrjquota=file echo clear > /sys/kernel/debug/kmemleak mount /dev/vdc /vdc echo scan > /sys/kernel/debug/kmemleak sleep 5 echo scan > /sys/kernel/debug/kmemleak cat /sys/kernel/debug/kmemleak Fixes: 7edfd85b1ffd ("ext4: Completely separate options parsing and sb setup") Cc: stable(a)vger.kernel.org Signed-off-by: Eric Biggers <ebiggers(a)google.com> --- fs/ext4/super.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 1466fbdbc8e34..60fa2f2623e07 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -2625,8 +2625,10 @@ static int parse_apply_sb_mount_options(struct super_block *sb, ret = ext4_apply_options(fc, sb); out_free: - kfree(s_ctx); - kfree(fc); + if (fc) { + ext4_fc_free(fc); + kfree(fc); + } kfree(s_mount_opts); return ret; } -- 2.36.1

2 years, 7 months

3
2
0 0

[PATCH v3] ext4: fix race condition between ext4_write and ext4_convert_inline_data

by Baokun Li

Hulk Robot reported a BUG_ON: ================================================================== EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters kernel BUG at fs/ext4/ext4_jbd2.c:53! invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1 RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline] RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116 [...] Call Trace: ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795 generic_perform_write+0x279/0x3c0 mm/filemap.c:3344 ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270 ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520 do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732 do_iter_write+0x107/0x430 fs/read_write.c:861 vfs_writev fs/read_write.c:934 [inline] do_pwritev+0x1e5/0x380 fs/read_write.c:1031 [...] ================================================================== Above issue may happen as follows: cpu1 cpu2 __________________________|__________________________ do_pwritev vfs_writev do_iter_write ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin vfs_fallocate ext4_fallocate ext4_convert_inline_data ext4_convert_inline_data_nolock ext4_destroy_inline_data_nolock clear EXT4_STATE_MAY_INLINE_DATA ext4_map_blocks ext4_ext_map_blocks ext4_mb_new_blocks ext4_mb_regular_allocator ext4_mb_good_group_nolock ext4_mb_init_group ext4_mb_init_cache ext4_mb_generate_buddy --> error ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_restore_inline_data set EXT4_STATE_MAY_INLINE_DATA ext4_block_write_begin ext4_da_write_end ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_write_inline_data_end handle=NULL ext4_journal_stop(handle) __ext4_journal_stop ext4_put_nojournal(handle) ref_cnt = (unsigned long)handle BUG_ON(ref_cnt == 0) ---> BUG_ON The lock held by ext4_convert_inline_data is xattr_sem, but the lock held by generic_perform_write is i_rwsem. Therefore, the two locks can be concurrent. To solve above issue, we add inode_lock() for ext4_convert_inline_data(). At the same time, move ext4_convert_inline_data() in front of ext4_punch_hole(), remove similar handling from ext4_punch_hole(). Fixes: 0c8d414f163f ("ext4: let fallocate handle inline data correctly") Cc: stable(a)vger.kernel.org Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- V1->V2: Increase the range of the inode_lock. V2->V3: Move the lock outside the ext4_convert_inline_data(). And reorganize ext4_fallocate(). fs/ext4/extents.c | 10 ++++++---- fs/ext4/inode.c | 9 --------- 2 files changed, 6 insertions(+), 13 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index e473fde6b64b..474479ce76e0 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -4693,15 +4693,17 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) FALLOC_FL_INSERT_RANGE)) return -EOPNOTSUPP; + inode_lock(inode); + ret = ext4_convert_inline_data(inode); + inode_unlock(inode); + if (ret) + goto exit; + if (mode & FALLOC_FL_PUNCH_HOLE) { ret = ext4_punch_hole(file, offset, len); goto exit; } - ret = ext4_convert_inline_data(inode); - if (ret) - goto exit; - if (mode & FALLOC_FL_COLLAPSE_RANGE) { ret = ext4_collapse_range(file, offset, len); goto exit; diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 646ece9b3455..4779673d733e 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3967,15 +3967,6 @@ int ext4_punch_hole(struct file *file, loff_t offset, loff_t length) trace_ext4_punch_hole(inode, offset, length, 0); - ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); - if (ext4_has_inline_data(inode)) { - filemap_invalidate_lock(mapping); - ret = ext4_convert_inline_data(inode); - filemap_invalidate_unlock(mapping); - if (ret) - return ret; - } - /* * Write out all dirty pages to avoid race conditions * Then release them. -- 2.31.1

2 years, 7 months

4
4
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror May 2022