November 2023 - Linux-stable-mirror

[PATCH] vmci: prevent speculation leaks by sanitizing event in event_deliver()

by Hagar Gamal Halim Hemdan

Coverity spotted that event_msg is controlled by user-space, event_msg->event_data.event is passed to event_deliver() and used as an index without sanitization. This change ensures that the event index is sanitized to mitigate any possibility of speculative information leaks. Fixes: 1d990201f9bb ("VMCI: event handling implementation") Signed-off-by: Hagar Gamal Halim Hemdan <hagarhem(a)amazon.com> --- drivers/misc/vmw_vmci/vmci_event.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_event.c b/drivers/misc/vmw_vmci/vmci_event.c index 2100297c94ad..a1205bce0b7e 100644 --- a/drivers/misc/vmw_vmci/vmci_event.c +++ b/drivers/misc/vmw_vmci/vmci_event.c @@ -9,6 +9,7 @@ #include <linux/vmw_vmci_api.h> #include <linux/list.h> #include <linux/module.h> +#include <linux/nospec.h> #include <linux/sched.h> #include <linux/slab.h> #include <linux/rculist.h> @@ -86,9 +87,12 @@ static void event_deliver(struct vmci_event_msg *event_msg) { struct vmci_subscription *cur; struct list_head *subscriber_list; + u32 sanitized_event, max_vmci_event; rcu_read_lock(); - subscriber_list = &subscriber_array[event_msg->event_data.event]; + max_vmci_event = ARRAY_SIZE(subscriber_array); + sanitized_event = array_index_nospec(event_msg->event_data.event, max_vmci_event); + subscriber_list = &subscriber_array[sanitized_event]; list_for_each_entry_rcu(cur, subscriber_list, node) { cur->callback(cur->id, &event_msg->event_data, cur->callback_data); -- 2.40.1

1 year, 1 month

2
1
0 0

FAILED: patch "[PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x b022f0c7e404887a7c5229788fc99eff9f9a80d5 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102127-unbeaten-sandlot-da45@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b022f0c7e404887a7c5229788fc99eff9f9a80d5 Mon Sep 17 00:00:00 2001 From: Francis Laniel <flaniel(a)linux.microsoft.com> Date: Fri, 20 Oct 2023 13:42:49 +0300 Subject: [PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols When a kprobe is attached to a function that's name is not unique (is static and shares the name with other functions in the kernel), the kprobe is attached to the first function it finds. This is a bug as the function that it is attaching to is not necessarily the one that the user wants to attach to. Instead of blindly picking a function to attach to what is ambiguous, error with EADDRNOTAVAIL to let the user know that this function is not unique, and that the user must use another unique function with an address offset to get to the function they want to attach to. Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c… Cc: stable(a)vger.kernel.org Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer") Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org> Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com> Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel… Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index 3d7a180a8427..a8fef6ab0872 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c @@ -705,6 +705,25 @@ static struct notifier_block trace_kprobe_module_nb = { .priority = 1 /* Invoked after kprobe module callback */ }; +static int count_symbols(void *data, unsigned long unused) +{ + unsigned int *count = data; + + (*count)++; + + return 0; +} + +static unsigned int number_of_same_symbols(char *func_name) +{ + unsigned int count; + + count = 0; + kallsyms_on_each_match_symbol(count_symbols, func_name, &count); + + return count; +} + static int __trace_kprobe_create(int argc, const char *argv[]) { /* @@ -836,6 +855,31 @@ static int __trace_kprobe_create(int argc, const char *argv[]) } } + if (symbol && !strchr(symbol, ':')) { + unsigned int count; + + count = number_of_same_symbols(symbol); + if (count > 1) { + /* + * Users should use ADDR to remove the ambiguity of + * using KSYM only. + */ + trace_probe_log_err(0, NON_UNIQ_SYMBOL); + ret = -EADDRNOTAVAIL; + + goto error; + } else if (count == 0) { + /* + * We can return ENOENT earlier than when register the + * kprobe. + */ + trace_probe_log_err(0, BAD_PROBE_ADDR); + ret = -ENOENT; + + goto error; + } + } + trace_probe_log_set_index(0); if (event) { ret = traceprobe_parse_event_name(&event, &group, gbuf, @@ -1695,6 +1739,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk) } #ifdef CONFIG_PERF_EVENTS + /* create a trace_kprobe, but don't add it to global lists */ struct trace_event_call * create_local_trace_kprobe(char *func, void *addr, unsigned long offs, @@ -1705,6 +1750,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs, int ret; char *event; + if (func) { + unsigned int count; + + count = number_of_same_symbols(func); + if (count > 1) + /* + * Users should use addr to remove the ambiguity of + * using func only. + */ + return ERR_PTR(-EADDRNOTAVAIL); + else if (count == 0) + /* + * We can return ENOENT earlier than when register the + * kprobe. + */ + return ERR_PTR(-ENOENT); + } + /* * local trace_kprobes are not added to dyn_event, so they are never * searched in find_trace_kprobe(). Therefore, there is no concern of diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h index 02b432ae7513..850d9ecb6765 100644 --- a/kernel/trace/trace_probe.h +++ b/kernel/trace/trace_probe.h @@ -450,6 +450,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call, C(BAD_MAXACT, "Invalid maxactive number"), \ C(MAXACT_TOO_BIG, "Maxactive is too big"), \ C(BAD_PROBE_ADDR, "Invalid probed address or symbol"), \ + C(NON_UNIQ_SYMBOL, "The symbol is not unique"), \ C(BAD_RETPROBE, "Retprobe address must be an function entry"), \ C(NO_TRACEPOINT, "Tracepoint is not found"), \ C(BAD_ADDR_SUFFIX, "Invalid probed address suffix"), \

1 year, 1 month

2
3
0 0

FAILED: patch "[PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x b022f0c7e404887a7c5229788fc99eff9f9a80d5 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102135-shuffle-blank-783e@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b022f0c7e404887a7c5229788fc99eff9f9a80d5 Mon Sep 17 00:00:00 2001 From: Francis Laniel <flaniel(a)linux.microsoft.com> Date: Fri, 20 Oct 2023 13:42:49 +0300 Subject: [PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols When a kprobe is attached to a function that's name is not unique (is static and shares the name with other functions in the kernel), the kprobe is attached to the first function it finds. This is a bug as the function that it is attaching to is not necessarily the one that the user wants to attach to. Instead of blindly picking a function to attach to what is ambiguous, error with EADDRNOTAVAIL to let the user know that this function is not unique, and that the user must use another unique function with an address offset to get to the function they want to attach to. Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c… Cc: stable(a)vger.kernel.org Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer") Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org> Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com> Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel… Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index 3d7a180a8427..a8fef6ab0872 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c @@ -705,6 +705,25 @@ static struct notifier_block trace_kprobe_module_nb = { .priority = 1 /* Invoked after kprobe module callback */ }; +static int count_symbols(void *data, unsigned long unused) +{ + unsigned int *count = data; + + (*count)++; + + return 0; +} + +static unsigned int number_of_same_symbols(char *func_name) +{ + unsigned int count; + + count = 0; + kallsyms_on_each_match_symbol(count_symbols, func_name, &count); + + return count; +} + static int __trace_kprobe_create(int argc, const char *argv[]) { /* @@ -836,6 +855,31 @@ static int __trace_kprobe_create(int argc, const char *argv[]) } } + if (symbol && !strchr(symbol, ':')) { + unsigned int count; + + count = number_of_same_symbols(symbol); + if (count > 1) { + /* + * Users should use ADDR to remove the ambiguity of + * using KSYM only. + */ + trace_probe_log_err(0, NON_UNIQ_SYMBOL); + ret = -EADDRNOTAVAIL; + + goto error; + } else if (count == 0) { + /* + * We can return ENOENT earlier than when register the + * kprobe. + */ + trace_probe_log_err(0, BAD_PROBE_ADDR); + ret = -ENOENT; + + goto error; + } + } + trace_probe_log_set_index(0); if (event) { ret = traceprobe_parse_event_name(&event, &group, gbuf, @@ -1695,6 +1739,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk) } #ifdef CONFIG_PERF_EVENTS + /* create a trace_kprobe, but don't add it to global lists */ struct trace_event_call * create_local_trace_kprobe(char *func, void *addr, unsigned long offs, @@ -1705,6 +1750,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs, int ret; char *event; + if (func) { + unsigned int count; + + count = number_of_same_symbols(func); + if (count > 1) + /* + * Users should use addr to remove the ambiguity of + * using func only. + */ + return ERR_PTR(-EADDRNOTAVAIL); + else if (count == 0) + /* + * We can return ENOENT earlier than when register the + * kprobe. + */ + return ERR_PTR(-ENOENT); + } + /* * local trace_kprobes are not added to dyn_event, so they are never * searched in find_trace_kprobe(). Therefore, there is no concern of diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h index 02b432ae7513..850d9ecb6765 100644 --- a/kernel/trace/trace_probe.h +++ b/kernel/trace/trace_probe.h @@ -450,6 +450,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call, C(BAD_MAXACT, "Invalid maxactive number"), \ C(MAXACT_TOO_BIG, "Maxactive is too big"), \ C(BAD_PROBE_ADDR, "Invalid probed address or symbol"), \ + C(NON_UNIQ_SYMBOL, "The symbol is not unique"), \ C(BAD_RETPROBE, "Retprobe address must be an function entry"), \ C(NO_TRACEPOINT, "Tracepoint is not found"), \ C(BAD_ADDR_SUFFIX, "Invalid probed address suffix"), \

1 year, 1 month

3
6
0 0

FAILED: patch "[PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x b022f0c7e404887a7c5229788fc99eff9f9a80d5 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102137-mobster-sheath-bfb3@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b022f0c7e404887a7c5229788fc99eff9f9a80d5 Mon Sep 17 00:00:00 2001 From: Francis Laniel <flaniel(a)linux.microsoft.com> Date: Fri, 20 Oct 2023 13:42:49 +0300 Subject: [PATCH] tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols When a kprobe is attached to a function that's name is not unique (is static and shares the name with other functions in the kernel), the kprobe is attached to the first function it finds. This is a bug as the function that it is attaching to is not necessarily the one that the user wants to attach to. Instead of blindly picking a function to attach to what is ambiguous, error with EADDRNOTAVAIL to let the user know that this function is not unique, and that the user must use another unique function with an address offset to get to the function they want to attach to. Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.c… Cc: stable(a)vger.kernel.org Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer") Suggested-by: Masami Hiramatsu <mhiramat(a)kernel.org> Signed-off-by: Francis Laniel <flaniel(a)linux.microsoft.com> Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel… Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index 3d7a180a8427..a8fef6ab0872 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c @@ -705,6 +705,25 @@ static struct notifier_block trace_kprobe_module_nb = { .priority = 1 /* Invoked after kprobe module callback */ }; +static int count_symbols(void *data, unsigned long unused) +{ + unsigned int *count = data; + + (*count)++; + + return 0; +} + +static unsigned int number_of_same_symbols(char *func_name) +{ + unsigned int count; + + count = 0; + kallsyms_on_each_match_symbol(count_symbols, func_name, &count); + + return count; +} + static int __trace_kprobe_create(int argc, const char *argv[]) { /* @@ -836,6 +855,31 @@ static int __trace_kprobe_create(int argc, const char *argv[]) } } + if (symbol && !strchr(symbol, ':')) { + unsigned int count; + + count = number_of_same_symbols(symbol); + if (count > 1) { + /* + * Users should use ADDR to remove the ambiguity of + * using KSYM only. + */ + trace_probe_log_err(0, NON_UNIQ_SYMBOL); + ret = -EADDRNOTAVAIL; + + goto error; + } else if (count == 0) { + /* + * We can return ENOENT earlier than when register the + * kprobe. + */ + trace_probe_log_err(0, BAD_PROBE_ADDR); + ret = -ENOENT; + + goto error; + } + } + trace_probe_log_set_index(0); if (event) { ret = traceprobe_parse_event_name(&event, &group, gbuf, @@ -1695,6 +1739,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk) } #ifdef CONFIG_PERF_EVENTS + /* create a trace_kprobe, but don't add it to global lists */ struct trace_event_call * create_local_trace_kprobe(char *func, void *addr, unsigned long offs, @@ -1705,6 +1750,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs, int ret; char *event; + if (func) { + unsigned int count; + + count = number_of_same_symbols(func); + if (count > 1) + /* + * Users should use addr to remove the ambiguity of + * using func only. + */ + return ERR_PTR(-EADDRNOTAVAIL); + else if (count == 0) + /* + * We can return ENOENT earlier than when register the + * kprobe. + */ + return ERR_PTR(-ENOENT); + } + /* * local trace_kprobes are not added to dyn_event, so they are never * searched in find_trace_kprobe(). Therefore, there is no concern of diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h index 02b432ae7513..850d9ecb6765 100644 --- a/kernel/trace/trace_probe.h +++ b/kernel/trace/trace_probe.h @@ -450,6 +450,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call, C(BAD_MAXACT, "Invalid maxactive number"), \ C(MAXACT_TOO_BIG, "Maxactive is too big"), \ C(BAD_PROBE_ADDR, "Invalid probed address or symbol"), \ + C(NON_UNIQ_SYMBOL, "The symbol is not unique"), \ C(BAD_RETPROBE, "Retprobe address must be an function entry"), \ C(NO_TRACEPOINT, "Tracepoint is not found"), \ C(BAD_ADDR_SUFFIX, "Invalid probed address suffix"), \

1 year, 1 month

3
5
0 0

Building Estimates

by callahanbryson63＠gmail.com

Hi, We provide estimation & quantities takeoff services. We are providing 98-100 accuracy in our estimates and take-offs. Please tell us if you need any estimating services regarding your projects. Send over the plans and mention the exact scope of work and shortly we will get back with a proposal on which our charges and turnaround time will be mentioned You may ask for sample estimates and take-offs. Thanks. Kind Regards Callahan Bryson Dreamland Estimation, LLC

1 year, 1 month

1
0
0 0

ASoC: amd: yc: Fix non-functional mic on ASUS E1504FA

by Malcolm Hart

Like other ASUS models the Asus Vivobook E1504FA requires an entry in the quirk list to enable the internal microphone. Showing with 7 additions and 0 deletions. 7 changes: 7 additions & 0 deletions 7 sound/soc/amd/yc/acp6x-mach.c @@ -283,6 +283,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"), } }, { .driver_data = &acp6x_card, .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), DMI_MATCH(DMI_PRODUCT_NAME, "E1504FA"), } }, { I have this laptop and I have tested this patch successfully. Malcolm

1 year, 1 month

5
8
0 0

Re: bcache: kernel NULL pointer dereference since 6.1.39

by Thorsten Leemhuis

On 23.11.23 14:53, Stefan Förster wrote: > > starting with kernel 6.1.39, we see the following error message with > heavy I/O loads. We needed to revert Thx for the report. I assume that problem still occurs with the latest 6.1.y kernel? > https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… FWIW, that is mainline commit 028ddcac477b69 ("bcache: Remove unnecessary NULL point check in node allocations") [v6.5-rc1]. Did a quick check and noticed a fix for that change was recently mainlined as f72f4312d43883 ("bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce()") [v6.7-rc2-post]: https://lore.kernel.org/all/20231118163852.9692-1-colyli@suse.de/ It is expected to soon be interegrated into a 6.1.y kernel. But maybe it's something else. I CCed the involved people, they might know. Ciao, Thorsten > to make sure the systems don't suddenly get stuck. > > 1. Kernel 6.6.2-arch1-1 on Dell Latitude: > > [16816.214942] BUG: kernel NULL pointer dereference, address: > 0000000000000080 > [16816.214948] #PF: supervisor read access in kernel mode > [16816.214951] #PF: error_code(0x0000) - not-present page > [16816.214953] PGD 0 P4D 0 [16816.214956] Oops: 0000 [#1] PREEMPT SMP NOPTI > [16816.214960] CPU: 7 PID: 83416 Comm: bcache_gc Tainted: P > OE 6.6.2-arch1-1 #1 11215f9ba7ddfb51644674a5b2ced71612c62fe9 > [16816.214964] Hardware name: Dell Inc. Latitude 5431/06F77M, BIOS > 1.17.0 09/21/2023 > [16816.214965] RIP: 0010:btree_node_free+0xf/0x160 [bcache] > [16816.214999] Code: 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 > 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 53 48 89 fb 0f 1f 44 00 > 00 <48> 8b 83 80 00 00 00 48 8d ab 90 00 00 00 48 39 98 60 c3 00 00 75 > [16816.215001] RSP: 0018:ffffc90021777af8 EFLAGS: 00010207 > [16816.215004] RAX: 0000000000000001 RBX: 0000000000000000 RCX: > ffff888515ce0670 > [16816.215006] RDX: 0000000000000000 RSI: ffff888515ce0680 RDI: > 0000000000000000 > [16816.215007] RBP: ffffc90021777bf0 R08: ffff88819476d9e0 R09: > 00000000013ffde8 > [16816.215009] R10: 0000000000000000 R11: ffffc9000061b000 R12: > ffffc90021777e40 > [16816.215010] R13: ffffc90021777bf0 R14: ffffc90021777bd8 R15: > ffff88819476c000 > [16816.215011] FS: 0000000000000000(0000) GS:ffff88886fdc0000(0000) > knlGS:0000000000000000 > [16816.215013] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [16816.215015] CR2: 0000000000000080 CR3: 0000000294a20000 CR4: > 0000000000f50ee0 > [16816.215017] PKRU: 55555554 > [16816.215018] Call Trace: > [16816.215021] <TASK> > [16816.215024] ? __die+0x23/0x70 > [16816.215030] ? page_fault_oops+0x171/0x4e0 > [16816.215035] ? __pfx_bch_ptr_bad+0x10/0x10 [bcache > 33eebe64448bb81d5f2a10179a48eb0a5bdb25a6] > [16816.215059] ? exc_page_fault+0x7f/0x180 > [16816.215065] ? asm_exc_page_fault+0x26/0x30 > [16816.215070] ? btree_node_free+0xf/0x160 [bcache > 33eebe64448bb81d5f2a10179a48eb0a5bdb25a6] > [16816.215095] ? btree_node_free+0xa3/0x160 [bcache > 33eebe64448bb81d5f2a10179a48eb0a5bdb25a6] > [16816.215118] btree_gc_coalesce+0x2a7/0x890 [bcache > 33eebe64448bb81d5f2a10179a48eb0a5bdb25a6] > [16816.215144] ? bch_extent_bad+0x81/0x190 [bcache > 33eebe64448bb81d5f2a10179a48eb0a5bdb25a6] > [16816.215172] btree_gc_recurse+0x130/0x390 [bcache > 33eebe64448bb81d5f2a10179a48eb0a5bdb25a6] > [16816.215197] ? btree_gc_mark_node+0x72/0x240 [bcache > 33eebe64448bb81d5f2a10179a48eb0a5bdb25a6] > [16816.215221] bch_btree_gc+0x4b6/0x620 [bcache > 33eebe64448bb81d5f2a10179a48eb0a5bdb25a6] > [16816.215246] ? __pfx_autoremove_wake_function+0x10/0x10 > [16816.215250] ? __pfx_bch_gc_thread+0x10/0x10 [bcache > 33eebe64448bb81d5f2a10179a48eb0a5bdb25a6] > [16816.215272] bch_gc_thread+0x139/0x190 [bcache > 33eebe64448bb81d5f2a10179a48eb0a5bdb25a6] > [16816.215295] ? __pfx_autoremove_wake_function+0x10/0x10 > [16816.215298] kthread+0xe5/0x120 > [16816.215302] ? __pfx_kthread+0x10/0x10 > [16816.215306] ret_from_fork+0x31/0x50 > [16816.215309] ? __pfx_kthread+0x10/0x10 > [16816.215312] ret_from_fork_asm+0x1b/0x30 > [16816.215318] </TASK> > [16816.215319] Modules linked in: bcache tun ccm rfcomm snd_seq_dummy > snd_hrtimer snd_seq nvidia(POE) typec_displayport cmac algif_hash > algif_skcipher af_alg bnep hid_sensor_custom hid_sensor_hub > intel_ishtp_hid snd_hda_codec_hdmi snd_sof_pci_intel_tgl > snd_sof_intel_hda_common soundwire_intel snd_sof_intel_hda_mlink > soundwire_cadence snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp > snd_sof snd_sof_utils intel_uncore_frequency > intel_uncore_frequency_common snd_ctl_led snd_soc_hdac_hda r8153_ecm > snd_hda_ext_core iwlmvm cdc_ether snd_soc_acpi_intel_match usbnet > snd_soc_acpi soundwire_generic_allocation soundwire_bus snd_soc_core > x86_pkg_temp_thermal snd_compress snd_hda_codec_realtek intel_powerclamp > ac97_bus snd_hda_codec_generic dell_rbtn coretemp btusb > snd_pcm_dmaengine snd_usb_audio mac80211 btrtl snd_hda_intel kvm_intel > btintel snd_intel_dspcfg snd_intel_sdw_acpi snd_usbmidi_lib btbcm > dell_laptop snd_ump btmtk libarc4 snd_hda_codec uvcvideo kvm snd_rawmidi > bluetooth snd_hda_core videobuf2_vmalloc hid_multitouch iwlwifi > [16816.215367] dell_wmi snd_hwdep iTCO_wdt snd_seq_device uvc > nls_iso8859_1 videobuf2_memops dell_smbios intel_pmc_bxt mei_hdcp > mei_pxp spi_nor snd_pcm processor_thermal_device_pci r8152 > videobuf2_v4l2 dell_wmi_sysman irqbypass intel_rapl_msr dcdbas vfat > iTCO_vendor_support fat rapl intel_cstate intel_uncore psmouse pcspkr > dell_wmi_ddv firmware_attributes_class ledtrig_audio videobuf2_common > ucsi_acpi dell_wmi_descriptor processor_thermal_device mousedev > ecdh_generic snd_timer mii joydev mtd wmi_bmof e1000e cfg80211 > processor_thermal_rfim mei_me intel_lpss_pci i2c_i801 snd > processor_thermal_mbox typec_ucsi intel_ish_ipc intel_lpss mei soundcore > i2c_smbus processor_thermal_rapl rfkill thunderbolt typec idma64 > intel_ishtp roles intel_rapl_common igen6_edac i2c_hid_acpi > int3403_thermal i2c_hid int340x_thermal_zone intel_hid int3400_thermal > acpi_thermal_rel sparse_keymap acpi_tad acpi_pad mac_hid vboxnetflt(OE) > vboxnetadp(OE) vboxdrv(OE) v4l2loopback(OE) videodev mc i2c_dev > crypto_user fuse loop ip_tables x_tables ext4 > [16816.215420] crc32c_generic crc16 mbcache jbd2 dm_crypt cbc > encrypted_keys trusted asn1_encoder tee usbhid i915 dm_mod > crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni i2c_algo_bit > polyval_generic serio_raw rtsx_pci_sdmmc drm_buddy gf128mul atkbd > ghash_clmulni_intel ttm mmc_core sha512_ssse3 libps2 vivaldi_fmap > intel_gtt aesni_intel nvme crypto_simd drm_display_helper video > nvme_core cryptd spi_intel_pci rtsx_pci spi_intel i8042 xhci_pci cec > nvme_common xhci_pci_renesas serio wmi > [16816.215451] CR2: 0000000000000080 > [16816.215453] ---[ end trace 0000000000000000 ]--- > [16816.215455] RIP: 0010:btree_node_free+0xf/0x160 [bcache] > [16816.215478] Code: 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 > 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 53 48 89 fb 0f 1f 44 00 > 00 <48> 8b 83 80 00 00 00 48 8d ab 90 00 00 00 48 39 98 60 c3 00 00 75 > [16816.215480] RSP: 0018:ffffc90021777af8 EFLAGS: 00010207 > [16816.215481] RAX: 0000000000000001 RBX: 0000000000000000 RCX: > ffff888515ce0670 > [16816.215483] RDX: 0000000000000000 RSI: ffff888515ce0680 RDI: > 0000000000000000 > [16816.215484] RBP: ffffc90021777bf0 R08: ffff88819476d9e0 R09: > 00000000013ffde8 > [16816.215486] R10: 0000000000000000 R11: ffffc9000061b000 R12: > ffffc90021777e40 > [16816.215487] R13: ffffc90021777bf0 R14: ffffc90021777bd8 R15: > ffff88819476c000 > [16816.215488] FS: 0000000000000000(0000) GS:ffff88886fdc0000(0000) > knlGS:0000000000000000 > [16816.215490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [16816.215492] CR2: 0000000000000080 CR3: 0000000294a20000 CR4: > 0000000000f50ee0 > [16816.215493] PKRU: 55555554 > [16816.215494] note: bcache_gc[83416] exited with irqs disabled > > 2. Kernel 6.1.55 (Debian 6.1.0-13) on HPE Gen11: > > [60654.670443] BUG: kernel NULL pointer dereference, address: > 0000000000000080 > [60654.677474] #PF: supervisor read access in kernel mode > [60654.682651] #PF: error_code(0x0000) - not-present page > [60654.687825] PGD 0 [60654.689852] Oops: 0000 [#1] PREEMPT SMP NOPTI > [60654.694240] CPU: 16 PID: 146330 Comm: bcache_gc Tainted: G > W 6.1.0-13-amd64 #1 Debian 6.1.55-1 > [60654.704399] Hardware name: HPE ProLiant DL380 Gen11/ProLiant DL380 > Gen11, BIOS 1.48 10/19/2023 > [60654.713071] RIP: 0010:btree_node_free+0xf/0x160 [bcache] > [60654.718437] Code: ff 48 89 d8 5b 5d 41 5c 41 5d c3 cc cc cc cc 66 66 > 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 55 53 48 89 fb 0f 1f 44 00 > 00 <48> 8b 83 80 00 00 00 48 39 98 70 c3 00 00 0f 84 34 01 00 00 48 8d > [60654.737342] RSP: 0018:ff77daed34cc3b18 EFLAGS: 00010207 > [60654.742604] RAX: 0000000080000000 RBX: 0000000000000000 RCX: > 0000000000000000 > [60654.749790] RDX: 0000000000000001 RSI: ff2971b8de800690 RDI: > 0000000000000000 > [60654.756975] RBP: ff77daed34cc3c10 R08: ff2971d852dc65e0 R09: > ff2971b8de800000 > [60654.764536] R10: 0000000000000000 R11: ff77daed34a4d000 R12: > ff77daed34cc3e60 > [60654.771987] R13: ff77daed34cc3c10 R14: ff77daed34cc3c00 R15: > ff2971d851096400 > [60654.779410] FS: 0000000000000000(0000) GS:ff2971f7bf400000(0000) > knlGS:0000000000000000 > [60654.787784] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [60654.793794] CR2: 0000000000000080 CR3: 0000000150610002 CR4: > 0000000000771ee0 > [60654.801203] DR0: 0000000000000000 DR1: 0000000000000000 DR2: > 0000000000000000 > [60654.808609] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: > 0000000000000400 > [60654.816009] PKRU: 55555554 > [60654.818949] Call Trace: > [60654.821623] <TASK> > [60654.823950] ? __die_body.cold+0x1a/0x1f > [60654.828110] ? page_fault_oops+0xd2/0x2b0 > [60654.832352] ? exc_page_fault+0x70/0x170 > [60654.836505] ? asm_exc_page_fault+0x22/0x30 > [60654.840922] ? btree_node_free+0xf/0x160 [bcache] > [60654.845863] ? up_write+0x32/0x60 > [60654.849396] btree_gc_coalesce+0x2aa/0x890 [bcache] > [60654.854512] ? bch_extent_bad+0x70/0x170 [bcache] > [60654.859452] btree_gc_recurse+0x130/0x390 [bcache] > [60654.864475] ? btree_gc_mark_node+0x72/0x230 [bcache] > [60654.869758] bch_btree_gc+0x5da/0x600 [bcache] > [60654.874428] ? cpuusage_read+0x10/0x10 > [60654.878390] ? bch_btree_gc+0x600/0x600 [bcache] > [60654.883232] bch_gc_thread+0x135/0x180 [bcache] > [60654.887986] ? cpuusage_read+0x10/0x10 > [60654.891944] kthread+0xe6/0x110 > [60654.895290] ? kthread_complete_and_exit+0x20/0x20 > [60654.900296] ret_from_fork+0x1f/0x30 > [60654.904079] </TASK> > [60654.906455] Modules linked in: bonding tls cfg80211 rfkill > intel_rapl_msr intel_rapl_common intel_uncore_frequency > intel_uncore_frequency_common i10nm_edac nfit binfmt_misc libnvdimm > x86_pkg_temp_thermal intel_powerclamp ipt_REJECT nf_reject_ipv4 coretemp > xt_comment nft_compat nf_tables nfnetlink nls_ascii nls_cp437 kvm_intel > vfat ipmi_ssif fat kvm irqbypass ghash_clmulni_intel sha512_ssse3 > sha512_generic aesni_intel crypto_simd cryptd mgag200 drm_shmem_helper > pmt_telemetry pmt_crashlog rapl intel_cstate acpi_ipmi evdev intel_sdsi > pmt_class idxd hpwdt mei_me isst_if_mbox_pci isst_if_mmio drm_kms_helper > intel_uncore pcspkr isst_if_common mei watchdog hpilo i2c_algo_bit > ipmi_si idxd_bus acpi_tad intel_vsec sg acpi_power_meter button > ipmi_devintf ipmi_msghandler loop fuse efi_pstore drm configfs efivarfs > ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2 btrfs blake2b_generic > xor raid6_pq zstd_compress libcrc32c crc32c_generic ses enclosure bcache > sd_mod scsi_transport_sas dm_mod nvme > [60654.906508] nvme_core xhci_pci t10_pi megaraid_sas ehci_pci xhci_hcd > ehci_hcd crc64_rocksoft crc64 tg3 crc_t10dif scsi_mod usbcore > crct10dif_generic crc32_pclmul crc32c_intel crct10dif_pclmul libphy > scsi_common usb_common crct10dif_common wmi > [60655.017712] CR2: 0000000000000080 > [60655.021262] ---[ end trace 0000000000000000 ]--- > [60655.173744] RIP: 0010:btree_node_free+0xf/0x160 [bcache] > [60655.179337] Code: ff 48 89 d8 5b 5d 41 5c 41 5d c3 cc cc cc cc 66 66 > 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 55 53 48 89 fb 0f 1f 44 00 > 00 <48> 8b 83 80 00 00 00 48 39 98 70 c3 00 00 0f 84 34 01 00 00 48 8d > [60655.198649] RSP: 0018:ff77daed34cc3b18 EFLAGS: 00010207 > [60655.204121] RAX: 0000000080000000 RBX: 0000000000000000 RCX: > 0000000000000000 > [60655.211515] RDX: 0000000000000001 RSI: ff2971b8de800690 RDI: > 0000000000000000 > [60655.218908] RBP: ff77daed34cc3c10 R08: ff2971d852dc65e0 R09: > ff2971b8de800000 > [60655.226302] R10: 0000000000000000 R11: ff77daed34a4d000 R12: > ff77daed34cc3e60 > [60655.233696] R13: ff77daed34cc3c10 R14: ff77daed34cc3c00 R15: > ff2971d851096400 > [60655.241086] FS: 0000000000000000(0000) GS:ff2971f7bf400000(0000) > knlGS:0000000000000000 > [60655.249438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [60655.255432] CR2: 0000000000000080 CR3: 0000000150610002 CR4: > 0000000000771ee0 > [60655.262825] DR0: 0000000000000000 DR1: 0000000000000000 DR2: > 0000000000000000 > [60655.270218] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: > 0000000000000400 > [60655.277607] PKRU: 55555554 > [60655.280543] note: bcache_gc[146330] exited with irqs disabled > > Reproducer for us: > > dd if=/dev/zero of=loop0 bs=1M count=1024 > dd if=/dev/zero of=loop1 bs=1M count=10240 > losetup loop0 loop0 > losetup loop1 loop1 > make-bcache -C /dev/loop0 -B /dev/loop1 --writeback > mkfs.ext4 /dev/bcache0 > mount /dev/bcache0 /mnt > > Then run fio with: > > [global] > bs=4k > ioengine=libaio > iodepth=4 > size=8g > direct=1 > runtime=60 > directory=/mnt > filename=ssd.test.file > > [seq-write] > rw=write > stonewall > > [rand-write] > rw=randwrite > stonewall > > [seq-read] > rw=read > stonewall > > [rand-read] > rw=randread > stonewall > > > Cheers, > Stefan

1 year, 1 month

4
11
0 0

FAILED: patch "[PATCH] prctl: Disable prctl(PR_SET_MDWE) on parisc" failed to apply to 6.5-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.5-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.5.y git checkout FETCH_HEAD git cherry-pick -x 793838138c157d4c49f4fb744b170747e3dabf58 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023112456-linked-nape-bf19@gregkh' --subject-prefix 'PATCH 6.5.y' HEAD^.. Possible dependencies: 793838138c15 ("prctl: Disable prctl(PR_SET_MDWE) on parisc") 24e41bf8a6b4 ("mm: add a NO_INHERIT flag to the PR_SET_MDWE prctl") 0da668333fb0 ("mm: make PR_MDWE_REFUSE_EXEC_GAIN an unsigned long") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 793838138c157d4c49f4fb744b170747e3dabf58 Mon Sep 17 00:00:00 2001 From: Helge Deller <deller(a)gmx.de> Date: Sat, 18 Nov 2023 19:33:35 +0100 Subject: [PATCH] prctl: Disable prctl(PR_SET_MDWE) on parisc systemd-254 tries to use prctl(PR_SET_MDWE) for it's MemoryDenyWriteExecute functionality, but fails on parisc which still needs executable stacks in certain combinations of gcc/glibc/kernel. Disable prctl(PR_SET_MDWE) by returning -EINVAL for now on parisc, until userspace has catched up. Signed-off-by: Helge Deller <deller(a)gmx.de> Co-developed-by: Linus Torvalds <torvalds(a)linux-foundation.org> Reported-by: Sam James <sam(a)gentoo.org> Closes: https://github.com/systemd/systemd/issues/29775 Tested-by: Sam James <sam(a)gentoo.org> Link: https://lore.kernel.org/all/875y2jro9a.fsf@gentoo.org/ Cc: <stable(a)vger.kernel.org> # v6.3+ diff --git a/kernel/sys.c b/kernel/sys.c index 420d9cb9cc8e..e219fcfa112d 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -2394,6 +2394,10 @@ static inline int prctl_set_mdwe(unsigned long bits, unsigned long arg3, if (bits & PR_MDWE_NO_INHERIT && !(bits & PR_MDWE_REFUSE_EXEC_GAIN)) return -EINVAL; + /* PARISC cannot allow mdwe as it needs writable stacks */ + if (IS_ENABLED(CONFIG_PARISC)) + return -EINVAL; + current_bits = get_current_mdwe(); if (current_bits && current_bits != bits) return -EPERM; /* Cannot unset the flags */

1 year, 1 month

5
6
0 0

[PATCH] drm/atomic-helpers: Invoke end_fb_access while owning plane state

by Thomas Zimmermann

Invoke drm_plane_helper_funcs.end_fb_access before drm_atomic_helper_commit_hw_done(). The latter function hands over ownership of the plane state to the following commit, which might free it. Releasing resources in end_fb_access then operates on undefined state. This bug has been observed with non-blocking commits when they are being queued up quickly. Here is an example stack trace from the bug report. The plane state has been free'd already, so the pages for drm_gem_fb_vunmap() are gone. Unable to handle kernel paging request at virtual address 0000000100000049 [...] drm_gem_fb_vunmap+0x18/0x74 drm_gem_end_shadow_fb_access+0x1c/0x2c drm_atomic_helper_cleanup_planes+0x58/0xd8 drm_atomic_helper_commit_tail+0x90/0xa0 commit_tail+0x15c/0x188 commit_work+0x14/0x20 For aborted commits, it is still ok to run end_fb_access as part of the plane's cleanup. Add a test to drm_atomic_helper_cleanup_planes(). Reported-by: Alyssa Ross <hi(a)alyssa.is> Closes: https://lore.kernel.org/dri-devel/87leazm0ya.fsf@alyssa.is/ Suggested-by: Daniel Vetter <daniel(a)ffwll.ch> Fixes: 94d879eaf7fb ("drm/atomic-helper: Add {begin,end}_fb_access to plane helpers") Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: <stable(a)vger.kernel.org> # v6.2+ --- drivers/gpu/drm/drm_atomic_helper.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index c3f677130def0..08d0511405e90 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -2784,6 +2784,17 @@ void drm_atomic_helper_commit_planes(struct drm_device *dev, funcs->atomic_flush(crtc, old_state); } + + /* + * Signal end of framebuffer access here before hw_done. After hw_done, + * a later commit might have already released the plane state. + */ + for_each_oldnew_plane_in_state(old_state, plane, old_plane_state, new_plane_state, i) { + const struct drm_plane_helper_funcs *funcs = plane->helper_private; + + if (funcs->end_fb_access) + funcs->end_fb_access(plane, new_plane_state); + } } EXPORT_SYMBOL(drm_atomic_helper_commit_planes); @@ -2924,6 +2935,12 @@ void drm_atomic_helper_cleanup_planes(struct drm_device *dev, for_each_oldnew_plane_in_state(old_state, plane, old_plane_state, new_plane_state, i) { const struct drm_plane_helper_funcs *funcs = plane->helper_private; + /* + * Only clean up here if we're aborting the commit. + */ + if (new_plane_state == plane->state) + continue; + if (funcs->end_fb_access) funcs->end_fb_access(plane, new_plane_state); } -- 2.42.1

1 year, 1 month

2
2
0 0

[PATCH v2 01/32] fbdev/acornfb: Fix name of fb_ops initializer macro

by Thomas Zimmermann

Fix build by using the correct name for the initializer macro for struct fb_ops. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Fixes: 9037afde8b9d ("fbdev/acornfb: Use fbdev I/O helpers") Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: Sam Ravnborg <sam(a)ravnborg.org> Cc: Helge Deller <deller(a)gmx.de> Cc: Javier Martinez Canillas <javierm(a)redhat.com> Cc: Arnd Bergmann <arnd(a)arndb.de> Cc: <stable(a)vger.kernel.org> # v6.6+ Reviewed-by: Javier Martinez Canillas <javierm(a)redhat.com> --- drivers/video/fbdev/acornfb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/acornfb.c b/drivers/video/fbdev/acornfb.c index 163d2c9f951c3..f0600f6ca2548 100644 --- a/drivers/video/fbdev/acornfb.c +++ b/drivers/video/fbdev/acornfb.c @@ -605,7 +605,7 @@ acornfb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) static const struct fb_ops acornfb_ops = { .owner = THIS_MODULE, - FB_IOMEM_DEFAULT_OPS, + FB_DEFAULT_IOMEM_OPS, .fb_check_var = acornfb_check_var, .fb_set_par = acornfb_set_par, .fb_setcolreg = acornfb_setcolreg, -- 2.43.0

1 year, 1 month

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror November 2023