From: Roman Penyaev <rpenyaev(a)suse.de>
Subject: epoll: fix possible lost wakeup on epoll_ctl() path
This fixes possible lost wakeup introduced by commit a218cc491420.
Originally modifications to ep->wq were serialized by ep->wq.lock, but in
the a218cc491420 new rw lock was introduced in order to relax fd event
path, i.e. callers of ep_poll_callback() function.
After the change ep_modify and ep_insert (both are called on epoll_ctl()
path) were switched to ep->lock, but ep_poll (epoll_wait) was using
ep->wq.lock on wqueue list modification.
The bug doesn't lead to any wqueue list corruptions, because wake up path
and list modifications were serialized by ep->wq.lock internally, but
actual waitqueue_active() check prior wake_up() call can be reordered with
modifications of ep ready list, thus wake up can be lost.
And yes, can be healed by explicit smp_mb():
list_add_tail(&epi->rdlink, &ep->rdllist);
smp_mb();
if (waitqueue_active(&ep->wq))
wake_up(&ep->wp);
But let's make it simple, thus current patch replaces ep->wq.lock with the
ep->lock for wqueue modifications, thus wake up path always observes
activeness of the wqueue correcty.
Link: http://lkml.kernel.org/r/20200214170211.561524-1-rpenyaev@suse.de
Fixes: a218cc491420 ("epoll: use rwlock in order to reduce ep_poll_callback() contention")
References: https://bugzilla.kernel.org/show_bug.cgi?id=205933
Signed-off-by: Roman Penyaev <rpenyaev(a)suse.de>
Reported-by: Max Neunhoeffer <max(a)arangodb.com>
Bisected-by: Max Neunhoeffer <max(a)arangodb.com>
Tested-by: Max Neunhoeffer <max(a)arangodb.com>
Cc: Jakub Kicinski <kuba(a)kernel.org>
Cc: Christopher Kohlhoff <chris.kohlhoff(a)clearpool.io>
Cc: Davidlohr Bueso <dbueso(a)suse.de>
Cc: Jason Baron <jbaron(a)akamai.com>
Cc: Jes Sorensen <jes.sorensen(a)gmail.com>
Cc: <stable(a)vger.kernel.org> [5.1+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/eventpoll.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/eventpoll.c~epoll-fix-possible-lost-wakeup-on-epoll_ctl-path
+++ a/fs/eventpoll.c
@@ -1854,9 +1854,9 @@ fetch_events:
waiter = true;
init_waitqueue_entry(&wait, current);
- spin_lock_irq(&ep->wq.lock);
+ write_lock_irq(&ep->lock);
__add_wait_queue_exclusive(&ep->wq, &wait);
- spin_unlock_irq(&ep->wq.lock);
+ write_unlock_irq(&ep->lock);
}
for (;;) {
@@ -1904,9 +1904,9 @@ send_events:
goto fetch_events;
if (waiter) {
- spin_lock_irq(&ep->wq.lock);
+ write_lock_irq(&ep->lock);
__remove_wait_queue(&ep->wq, &wait);
- spin_unlock_irq(&ep->wq.lock);
+ write_unlock_irq(&ep->lock);
}
return res;
_
From: Michal Hocko <mhocko(a)suse.com>
Subject: mm: do not allow MADV_PAGEOUT for CoW pages
Jann has brought up a very interesting point [1]. While shared pages are
excluded from MADV_PAGEOUT normally, CoW pages can be easily reclaimed
that way. This can lead to all sorts of hard to debug problems. E.g.
performance problems outlined by Daniel [2].
There are runtime environments where there is a substantial memory shared
among security domains via CoW memory and a easy to reclaim way of that
memory, which MADV_{COLD,PAGEOUT} offers, can lead to either performance
degradation in for the parent process which might be more privileged or
even open side channel attacks.
The feasibility of the latter is not really clear to me TBH but there is
no real reason for exposure at this stage. It seems there is no real use
case to depend on reclaiming CoW memory via madvise at this stage so it is
much easier to simply disallow it and this is what this patch does. Put
it simply MADV_{PAGEOUT,COLD} can operate only on the exclusively owned
memory which is a straightforward semantic.
[1] http://lkml.kernel.org/r/CAG48ez0G3JkMq61gUmyQAaCq=_TwHbi1XKzWRooxZkv08PQKu…
[2] http://lkml.kernel.org/r/CAKOZueua_v8jHCpmEtTB6f3i9e2YnmX4mqdYVWhV4E=Z-n+zR…
Link: http://lkml.kernel.org/r/20200312082248.GS23944@dhcp22.suse.cz
Fixes: 9c276cc65a58 ("mm: introduce MADV_COLD")
Signed-off-by: Michal Hocko <mhocko(a)suse.com>
Reported-by: Jann Horn <jannh(a)google.com>
Acked-by: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Minchan Kim <minchan(a)kernel.org>
Cc: Daniel Colascione <dancol(a)google.com>
Cc: Dave Hansen <dave.hansen(a)intel.com>
Cc: "Joel Fernandes (Google)" <joel(a)joelfernandes.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/madvise.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/mm/madvise.c~mm-do-not-allow-madv_pageout-for-cow-pages
+++ a/mm/madvise.c
@@ -335,12 +335,14 @@ static int madvise_cold_or_pageout_pte_r
}
page = pmd_page(orig_pmd);
+
+ /* Do not interfere with other mappings of this page */
+ if (page_mapcount(page) != 1)
+ goto huge_unlock;
+
if (next - addr != HPAGE_PMD_SIZE) {
int err;
- if (page_mapcount(page) != 1)
- goto huge_unlock;
-
get_page(page);
spin_unlock(ptl);
lock_page(page);
@@ -426,6 +428,10 @@ regular_page:
continue;
}
+ /* Do not interfere with other mappings of this page */
+ if (page_mapcount(page) != 1)
+ continue;
+
VM_BUG_ON_PAGE(PageTransCompound(page), page);
if (pte_young(ptent)) {
_
From: Chris Down <chris(a)chrisdown.name>
Subject: mm, memcg: throttle allocators based on ancestral memory.high
Prior to this commit, we only directly check the affected cgroup's
memory.high against its usage. However, it's possible that we are being
reclaimed as a result of hitting an ancestor memory.high and should be
penalised based on that, instead.
This patch changes memory.high overage throttling to use the largest
overage in its ancestors when considering how many penalty jiffies to
charge. This makes sure that we penalise poorly behaving cgroups in the
same way regardless of at what level of the hierarchy memory.high was
breached.
Link: http://lkml.kernel.org/r/8cd132f84bd7e16cdb8fde3378cdbf05ba00d387.158403614…
Fixes: 0e4b01df8659 ("mm, memcg: throttle allocators when failing reclaim over memory.high")
Signed-off-by: Chris Down <chris(a)chrisdown.name>
Reported-by: Johannes Weiner <hannes(a)cmpxchg.org>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Tejun Heo <tj(a)kernel.org>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Nathan Chancellor <natechancellor(a)gmail.com>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: <stable(a)vger.kernel.org> [5.4.x+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 93 ++++++++++++++++++++++++++++------------------
1 file changed, 58 insertions(+), 35 deletions(-)
--- a/mm/memcontrol.c~mm-memcg-throttle-allocators-based-on-ancestral-memoryhigh
+++ a/mm/memcontrol.c
@@ -2297,28 +2297,41 @@ static void high_work_func(struct work_s
#define MEMCG_DELAY_SCALING_SHIFT 14
/*
- * Scheduled by try_charge() to be executed from the userland return path
- * and reclaims memory over the high limit.
+ * Get the number of jiffies that we should penalise a mischievous cgroup which
+ * is exceeding its memory.high by checking both it and its ancestors.
*/
-void mem_cgroup_handle_over_high(void)
+static unsigned long calculate_high_delay(struct mem_cgroup *memcg,
+ unsigned int nr_pages)
{
- unsigned long usage, high, clamped_high;
- unsigned long pflags;
- unsigned long penalty_jiffies, overage;
- unsigned int nr_pages = current->memcg_nr_pages_over_high;
- struct mem_cgroup *memcg;
+ unsigned long penalty_jiffies;
+ u64 max_overage = 0;
- if (likely(!nr_pages))
- return;
+ do {
+ unsigned long usage, high;
+ u64 overage;
+
+ usage = page_counter_read(&memcg->memory);
+ high = READ_ONCE(memcg->high);
+
+ /*
+ * Prevent division by 0 in overage calculation by acting as if
+ * it was a threshold of 1 page
+ */
+ high = max(high, 1UL);
+
+ overage = usage - high;
+ overage <<= MEMCG_DELAY_PRECISION_SHIFT;
+ overage = div64_u64(overage, high);
+
+ if (overage > max_overage)
+ max_overage = overage;
+ } while ((memcg = parent_mem_cgroup(memcg)) &&
+ !mem_cgroup_is_root(memcg));
- memcg = get_mem_cgroup_from_mm(current->mm);
- reclaim_high(memcg, nr_pages, GFP_KERNEL);
- current->memcg_nr_pages_over_high = 0;
+ if (!max_overage)
+ return 0;
/*
- * memory.high is breached and reclaim is unable to keep up. Throttle
- * allocators proactively to slow down excessive growth.
- *
* We use overage compared to memory.high to calculate the number of
* jiffies to sleep (penalty_jiffies). Ideally this value should be
* fairly lenient on small overages, and increasingly harsh when the
@@ -2326,24 +2339,9 @@ void mem_cgroup_handle_over_high(void)
* its crazy behaviour, so we exponentially increase the delay based on
* overage amount.
*/
-
- usage = page_counter_read(&memcg->memory);
- high = READ_ONCE(memcg->high);
-
- if (usage <= high)
- goto out;
-
- /*
- * Prevent division by 0 in overage calculation by acting as if it was a
- * threshold of 1 page
- */
- clamped_high = max(high, 1UL);
-
- overage = div64_u64((u64)(usage - high) << MEMCG_DELAY_PRECISION_SHIFT,
- clamped_high);
-
- penalty_jiffies = ((u64)overage * overage * HZ)
- >> (MEMCG_DELAY_PRECISION_SHIFT + MEMCG_DELAY_SCALING_SHIFT);
+ penalty_jiffies = max_overage * max_overage * HZ;
+ penalty_jiffies >>= MEMCG_DELAY_PRECISION_SHIFT;
+ penalty_jiffies >>= MEMCG_DELAY_SCALING_SHIFT;
/*
* Factor in the task's own contribution to the overage, such that four
@@ -2360,7 +2358,32 @@ void mem_cgroup_handle_over_high(void)
* application moving forwards and also permit diagnostics, albeit
* extremely slowly.
*/
- penalty_jiffies = min(penalty_jiffies, MEMCG_MAX_HIGH_DELAY_JIFFIES);
+ return min(penalty_jiffies, MEMCG_MAX_HIGH_DELAY_JIFFIES);
+}
+
+/*
+ * Scheduled by try_charge() to be executed from the userland return path
+ * and reclaims memory over the high limit.
+ */
+void mem_cgroup_handle_over_high(void)
+{
+ unsigned long penalty_jiffies;
+ unsigned long pflags;
+ unsigned int nr_pages = current->memcg_nr_pages_over_high;
+ struct mem_cgroup *memcg;
+
+ if (likely(!nr_pages))
+ return;
+
+ memcg = get_mem_cgroup_from_mm(current->mm);
+ reclaim_high(memcg, nr_pages, GFP_KERNEL);
+ current->memcg_nr_pages_over_high = 0;
+
+ /*
+ * memory.high is breached and reclaim is unable to keep up. Throttle
+ * allocators proactively to slow down excessive growth.
+ */
+ penalty_jiffies = calculate_high_delay(memcg, nr_pages);
/*
* Don't sleep if the amount of jiffies this memcg owes us is so low
_
From: Chris Down <chris(a)chrisdown.name>
Subject: mm, memcg: fix corruption on 64-bit divisor in memory.high throttling
0e4b01df8659 had a bunch of fixups to use the right division method.
However, it seems that after all that it still wasn't right -- div_u64
takes a 32-bit divisor.
The headroom is still large (2^32 pages), so on mundane systems you won't
hit this, but this should definitely be fixed.
Link: http://lkml.kernel.org/r/80780887060514967d414b3cd91f9a316a16ab98.158403614…
Fixes: 0e4b01df8659 ("mm, memcg: throttle allocators when failing reclaim over memory.high")
Signed-off-by: Chris Down <chris(a)chrisdown.name>
Reported-by: Johannes Weiner <hannes(a)cmpxchg.org>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Tejun Heo <tj(a)kernel.org>
Cc: Roman Gushchin <guro(a)fb.com>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Nathan Chancellor <natechancellor(a)gmail.com>
Cc: <stable(a)vger.kernel.org> [5.4.x+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/memcontrol.c~mm-memcg-fix-corruption-on-64-bit-divisor-in-memoryhigh-throttling
+++ a/mm/memcontrol.c
@@ -2339,7 +2339,7 @@ void mem_cgroup_handle_over_high(void)
*/
clamped_high = max(high, 1UL);
- overage = div_u64((u64)(usage - high) << MEMCG_DELAY_PRECISION_SHIFT,
+ overage = div64_u64((u64)(usage - high) << MEMCG_DELAY_PRECISION_SHIFT,
clamped_high);
penalty_jiffies = ((u64)overage * overage * HZ)
_
From: Chunguang Xu <brookxu(a)tencent.com>
Subject: memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event
An eventfd monitors multiple memory thresholds of the cgroup, closes them,
the kernel deletes all events related to this eventfd. Before all events
are deleted, another eventfd monitors the memory threshold of this cgroup,
leading to a crash:
[135.675108] BUG: kernel NULL pointer dereference, address: 0000000000000004
[135.675350] #PF: supervisor write access in kernel mode
[135.675579] #PF: error_code(0x0002) - not-present page
[135.675816] PGD 800000033058e067 P4D 800000033058e067 PUD 3355ce067 PMD 0
[135.676080] Oops: 0002 [#1] SMP PTI
[135.676332] CPU: 2 PID: 14012 Comm: kworker/2:6 Kdump: loaded Not tainted 5.6.0-rc4 #3
[135.676610] Hardware name: LENOVO 20AWS01K00/20AWS01K00, BIOS GLET70WW (2.24 ) 05/21/2014
[135.676909] Workqueue: events memcg_event_remove
[135.677192] RIP: 0010:__mem_cgroup_usage_unregister_event+0xb3/0x190
[135.677825] RSP: 0018:ffffb47e01c4fe18 EFLAGS: 00010202
[135.678186] RAX: 0000000000000001 RBX: ffff8bb223a8a000 RCX: 0000000000000001
[135.678548] RDX: 0000000000000001 RSI: ffff8bb22fb83540 RDI: 0000000000000001
[135.678912] RBP: ffffb47e01c4fe48 R08: 0000000000000000 R09: 0000000000000010
[135.679287] R10: 000000000000000c R11: 071c71c71c71c71c R12: ffff8bb226aba880
[135.679670] R13: ffff8bb223a8a480 R14: 0000000000000000 R15: 0000000000000000
[135.680066] FS: 0000000000000000(0000) GS:ffff8bb242680000(0000) knlGS:0000000000000000
[135.680475] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[135.680894] CR2: 0000000000000004 CR3: 000000032c29c003 CR4: 00000000001606e0
[135.681325] Call Trace:
[135.681763]� memcg_event_remove+0x32/0x90
[135.682209]� process_one_work+0x172/0x380
[135.682657]� worker_thread+0x49/0x3f0
[135.683111]� kthread+0xf8/0x130
[135.683570]� ? max_active_store+0x80/0x80
[135.684034]� ? kthread_bind+0x10/0x10
[135.684506]� ret_from_fork+0x35/0x40
[135.689733] CR2: 0000000000000004
We can reproduce this problem in the following ways:
1. We create a new cgroup subdirectory and a new eventfd, and then we
monitor multiple memory thresholds of the cgroup through this eventfd.
2. closing this eventfd, and __mem_cgroup_usage_unregister_event ()
will be called multiple times to delete all events related to this
eventfd.
The first time __mem_cgroup_usage_unregister_event() is called, the kernel
will clear all items related to this eventfd in thresholds-> primary.Since
there is currently only one eventfd, thresholds-> primary becomes empty,
so the kernel will set thresholds-> primary and hresholds-> spare to NULL.
If at this time, the user creates a new eventfd and monitor the memory
threshold of this cgroup, kernel will re-initialize thresholds-> primary.
Then when __mem_cgroup_usage_unregister_event () is called for the second
time, because thresholds-> primary is not empty, the system will access
thresholds-> spare, but thresholds-> spare is NULL, which will trigger a
crash.
In general, the longer it takes to delete all events related to this
eventfd, the easier it is to trigger this problem.
The solution is to check whether the thresholds associated with the
eventfd has been cleared when deleting the event. If so, we do nothing.
[akpm(a)linux-foundation.org: fix comment, per Kirill]
Link: http://lkml.kernel.org/r/077a6f67-aefa-4591-efec-f2f3af2b0b02@gmail.com
Fixes: 907860ed381a ("cgroups: make cftype.unregister_event() void-returning")
Signed-off-by: Chunguang Xu <brookxu(a)tencent.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memcontrol.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/mm/memcontrol.c~memcg-fix-null-pointer-dereference-in-__mem_cgroup_usage_unregister_event
+++ a/mm/memcontrol.c
@@ -4027,7 +4027,7 @@ static void __mem_cgroup_usage_unregiste
struct mem_cgroup_thresholds *thresholds;
struct mem_cgroup_threshold_ary *new;
unsigned long usage;
- int i, j, size;
+ int i, j, size, entries;
mutex_lock(&memcg->thresholds_lock);
@@ -4047,14 +4047,20 @@ static void __mem_cgroup_usage_unregiste
__mem_cgroup_threshold(memcg, type == _MEMSWAP);
/* Calculate new number of threshold */
- size = 0;
+ size = entries = 0;
for (i = 0; i < thresholds->primary->size; i++) {
if (thresholds->primary->entries[i].eventfd != eventfd)
size++;
+ else
+ entries++;
}
new = thresholds->spare;
+ /* If no items related to eventfd have been cleared, nothing to do */
+ if (!entries)
+ goto unlock;
+
/* Set thresholds array to NULL if we don't have thresholds */
if (!size) {
kfree(new);
_
This fixes a deadlock in the tracer when tracing a multi-threaded
application that calls execve while more than one thread are running.
I observed that when running strace on the gcc test suite, it always
blocks after a while, when expect calls execve, because other threads
have to be terminated. They send ptrace events, but the strace is no
longer able to respond, since it is blocked in vm_access.
The deadlock is always happening when strace needs to access the
tracees process mmap, while another thread in the tracee starts to
execve a child process, but that cannot continue until the
PTRACE_EVENT_EXIT is handled and the WIFEXITED event is received:
strace D 0 30614 30584 0x00000000
Call Trace:
__schedule+0x3ce/0x6e0
schedule+0x5c/0xd0
schedule_preempt_disabled+0x15/0x20
__mutex_lock.isra.13+0x1ec/0x520
__mutex_lock_killable_slowpath+0x13/0x20
mutex_lock_killable+0x28/0x30
mm_access+0x27/0xa0
process_vm_rw_core.isra.3+0xff/0x550
process_vm_rw+0xdd/0xf0
__x64_sys_process_vm_readv+0x31/0x40
do_syscall_64+0x64/0x220
entry_SYSCALL_64_after_hwframe+0x44/0xa9
expect D 0 31933 30876 0x80004003
Call Trace:
__schedule+0x3ce/0x6e0
schedule+0x5c/0xd0
flush_old_exec+0xc4/0x770
load_elf_binary+0x35a/0x16c0
search_binary_handler+0x97/0x1d0
__do_execve_file.isra.40+0x5d4/0x8a0
__x64_sys_execve+0x49/0x60
do_syscall_64+0x64/0x220
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The proposed solution is to have a second mutex that is
used in mm_access, so it is allowed to continue while the
dying threads are not yet terminated.
I also took the opportunity to improve the documentation
of prepare_creds, which is obviously out of sync.
Signed-off-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
---
Documentation/security/credentials.rst | 18 ++++++------
fs/exec.c | 9 ++++++
include/linux/binfmts.h | 6 +++-
include/linux/sched/signal.h | 1 +
init/init_task.c | 1 +
kernel/cred.c | 2 +-
kernel/fork.c | 5 ++--
mm/process_vm_access.c | 2 +-
tools/testing/selftests/ptrace/Makefile | 4 +--
tools/testing/selftests/ptrace/vmaccess.c | 46 +++++++++++++++++++++++++++++++
10 files changed, 79 insertions(+), 15 deletions(-)
create mode 100644 tools/testing/selftests/ptrace/vmaccess.c
v2: adds a test case which passes when this patch is applied.
diff --git a/Documentation/security/credentials.rst b/Documentation/security/credentials.rst
index 282e79f..c98e0a8 100644
--- a/Documentation/security/credentials.rst
+++ b/Documentation/security/credentials.rst
@@ -437,9 +437,13 @@ new set of credentials by calling::
struct cred *prepare_creds(void);
-this locks current->cred_replace_mutex and then allocates and constructs a
-duplicate of the current process's credentials, returning with the mutex still
-held if successful. It returns NULL if not successful (out of memory).
+this allocates and constructs a duplicate of the current process's credentials.
+It returns NULL if not successful (out of memory).
+
+If called from __do_execve_file, the mutex current->signal->cred_guard_mutex
+is acquired before this function gets called, and the mutex
+current->signal->cred_change_mutex is acquired later, while the credentials
+and the process mmap are actually changed.
The mutex prevents ``ptrace()`` from altering the ptrace state of a process
while security checks on credentials construction and changing is taking place
@@ -466,9 +470,8 @@ by calling::
This will alter various aspects of the credentials and the process, giving the
LSM a chance to do likewise, then it will use ``rcu_assign_pointer()`` to
-actually commit the new credentials to ``current->cred``, it will release
-``current->cred_replace_mutex`` to allow ``ptrace()`` to take place, and it
-will notify the scheduler and others of the changes.
+actually commit the new credentials to ``current->cred``, and it will notify
+the scheduler and others of the changes.
This function is guaranteed to return 0, so that it can be tail-called at the
end of such functions as ``sys_setresuid()``.
@@ -486,8 +489,7 @@ invoked::
void abort_creds(struct cred *new);
-This releases the lock on ``current->cred_replace_mutex`` that
-``prepare_creds()`` got and then releases the new credentials.
+This releases the new credentials.
A typical credentials alteration function would look something like this::
diff --git a/fs/exec.c b/fs/exec.c
index 74d88da..a6884e4 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1266,6 +1266,12 @@ int flush_old_exec(struct linux_binprm * bprm)
if (retval)
goto out;
+ retval = mutex_lock_killable(¤t->signal->cred_change_mutex);
+ if (retval)
+ goto out;
+
+ bprm->called_flush_old_exec = 1;
+
/*
* Must be called _before_ exec_mmap() as bprm->mm is
* not visibile until then. This also enables the update
@@ -1420,6 +1426,8 @@ static void free_bprm(struct linux_binprm *bprm)
{
free_arg_pages(bprm);
if (bprm->cred) {
+ if (bprm->called_flush_old_exec)
+ mutex_unlock(¤t->signal->cred_change_mutex);
mutex_unlock(¤t->signal->cred_guard_mutex);
abort_creds(bprm->cred);
}
@@ -1469,6 +1477,7 @@ void install_exec_creds(struct linux_binprm *bprm)
* credentials; any time after this it may be unlocked.
*/
security_bprm_committed_creds(bprm);
+ mutex_unlock(¤t->signal->cred_change_mutex);
mutex_unlock(¤t->signal->cred_guard_mutex);
}
EXPORT_SYMBOL(install_exec_creds);
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index b40fc63..2e1318b 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -44,7 +44,11 @@ struct linux_binprm {
* exec has happened. Used to sanitize execution environment
* and to set AT_SECURE auxv for glibc.
*/
- secureexec:1;
+ secureexec:1,
+ /*
+ * Set by flush_old_exec, when the cred_change_mutex is taken.
+ */
+ called_flush_old_exec:1;
#ifdef __alpha__
unsigned int taso:1;
#endif
diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
index 8805025..37eeabe 100644
--- a/include/linux/sched/signal.h
+++ b/include/linux/sched/signal.h
@@ -225,6 +225,7 @@ struct signal_struct {
struct mutex cred_guard_mutex; /* guard against foreign influences on
* credential calculations
* (notably. ptrace) */
+ struct mutex cred_change_mutex; /* guard against credentials change */
} __randomize_layout;
/*
diff --git a/init/init_task.c b/init/init_task.c
index 9e5cbe5..6cd9a0f 100644
--- a/init/init_task.c
+++ b/init/init_task.c
@@ -26,6 +26,7 @@
.multiprocess = HLIST_HEAD_INIT,
.rlim = INIT_RLIMITS,
.cred_guard_mutex = __MUTEX_INITIALIZER(init_signals.cred_guard_mutex),
+ .cred_change_mutex = __MUTEX_INITIALIZER(init_signals.cred_change_mutex),
#ifdef CONFIG_POSIX_TIMERS
.posix_timers = LIST_HEAD_INIT(init_signals.posix_timers),
.cputimer = {
diff --git a/kernel/cred.c b/kernel/cred.c
index 809a985..e4c78de 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -676,7 +676,7 @@ void __init cred_init(void)
*
* Returns the new credentials or NULL if out of memory.
*
- * Does not take, and does not return holding current->cred_replace_mutex.
+ * Does not take, and does not return holding ->cred_guard_mutex.
*/
struct cred *prepare_kernel_cred(struct task_struct *daemon)
{
diff --git a/kernel/fork.c b/kernel/fork.c
index 0808095..0395154 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1224,7 +1224,7 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
struct mm_struct *mm;
int err;
- err = mutex_lock_killable(&task->signal->cred_guard_mutex);
+ err = mutex_lock_killable(&task->signal->cred_change_mutex);
if (err)
return ERR_PTR(err);
@@ -1234,7 +1234,7 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
mmput(mm);
mm = ERR_PTR(-EACCES);
}
- mutex_unlock(&task->signal->cred_guard_mutex);
+ mutex_unlock(&task->signal->cred_change_mutex);
return mm;
}
@@ -1594,6 +1594,7 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
sig->oom_score_adj_min = current->signal->oom_score_adj_min;
mutex_init(&sig->cred_guard_mutex);
+ mutex_init(&sig->cred_change_mutex);
return 0;
}
diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
index 357aa7b..b3e6eb5 100644
--- a/mm/process_vm_access.c
+++ b/mm/process_vm_access.c
@@ -204,7 +204,7 @@ static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
if (!mm || IS_ERR(mm)) {
rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
/*
- * Explicitly map EACCES to EPERM as EPERM is a more a
+ * Explicitly map EACCES to EPERM as EPERM is a more
* appropriate error code for process_vw_readv/writev
*/
if (rc == -EACCES)
diff --git a/tools/testing/selftests/ptrace/Makefile b/tools/testing/selftests/ptrace/Makefile
index c0b7f89..2f1f532 100644
--- a/tools/testing/selftests/ptrace/Makefile
+++ b/tools/testing/selftests/ptrace/Makefile
@@ -1,6 +1,6 @@
# SPDX-License-Identifier: GPL-2.0-only
-CFLAGS += -iquote../../../../include/uapi -Wall
+CFLAGS += -std=c99 -pthread -iquote../../../../include/uapi -Wall
-TEST_GEN_PROGS := get_syscall_info peeksiginfo
+TEST_GEN_PROGS := get_syscall_info peeksiginfo vmaccess
include ../lib.mk
diff --git a/tools/testing/selftests/ptrace/vmaccess.c b/tools/testing/selftests/ptrace/vmaccess.c
new file mode 100644
index 0000000..ef08c9f
--- /dev/null
+++ b/tools/testing/selftests/ptrace/vmaccess.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Copyright (c) 2020 Bernd Edlinger <bernd.edlinger(a)hotmail.de>
+ * All rights reserved.
+ *
+ * Check whether /proc/$pid/mem can be accessed without causing deadlocks
+ * when de_thread is blocked with ->cred_guard_mutex held.
+ */
+
+#include "../kselftest_harness.h"
+#include <stdio.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <signal.h>
+#include <unistd.h>
+#include <sys/ptrace.h>
+
+static void *thread(void *arg)
+{
+ ptrace(PTRACE_TRACEME, 0, 0, 0);
+ return NULL;
+}
+
+TEST(vmaccess)
+{
+ int f, pid = fork();
+ char mm[64];
+
+ if (!pid) {
+ pthread_t pt;
+ pthread_create(&pt, NULL, thread, NULL);
+ pthread_join(pt, NULL);
+ execlp("true", "true", NULL);
+ }
+
+ sleep(1);
+ sprintf(mm, "/proc/%d/mem", pid);
+ f = open(mm, O_RDONLY);
+ ASSERT_LE(0, f)
+ close(f);
+ /* this is not fixed! ptrace(PTRACE_ATTACH, pid, 0,0); */
+ f = kill(pid, SIGCONT);
+ ASSERT_EQ(0, f);
+}
+
+TEST_HARNESS_MAIN
--
1.9.1
Hi,
we now have a script that identifies patches in stable releases which were
later fixed upstream, but the fix was not applied to the respective stable
releases. We identify such patches based on Fixes: tags in the upstream
kernel.
Example: Upstream commit c54c7374ff4 ("drm/dp_mst: Skip validating ports
during destruction, just ref") was applied to v4.4.y as commit 05d994f68019.
It was later reverted upstream with commit 9765635b307, but the revert has
(at least not yet) found its way into v4.4.y.
This is an easy example, where the revert should (or at least I think it
should) be applied to v4.4.y (and possibly to later kernels - I didn't check).
A more tricky patch is commit 3ef240eaff36 ("futex: Prevent exit livelock")
in v5.4.y, which was later fixed upstream with commit 51bfb1d11d6 ("futex:
Fix kernel-doc notation warning"). I am not entirely sure what to do with
that, given that it only fixes documentation (though that may of course also
be valuable).
How should we handle this ? Would it be ok to send half-automated requests
to the stable mailing list, for example with basic test results ?
Thanks,
Guenter
.kick method not set in rproc_ops will result in:
8<--- cut here ---
Unable to handle kernel NULL pointer dereference
in rproc_virtio_notify, after firmware loading.
refuse to register an rproc-induced virtio device if no kick method was
defined for rproc.
Signed-off-by: Nikita Shubin <NShubin(a)topcon.com>
Fixes: 7a186941626d19f668b08108db158379b32e6e02 ("remoteproc: remove the single rpmsg vdev limitation")
Cc: stable(a)vger.kernel.org
---
drivers/remoteproc/remoteproc_virtio.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/remoteproc/remoteproc_virtio.c b/drivers/remoteproc/remoteproc_virtio.c
index 8c07cb2ca8ba..31a62a0b470e 100644
--- a/drivers/remoteproc/remoteproc_virtio.c
+++ b/drivers/remoteproc/remoteproc_virtio.c
@@ -334,6 +334,13 @@ int rproc_add_virtio_dev(struct rproc_vdev *rvdev, int id)
struct rproc_mem_entry *mem;
int ret;
+ if (rproc->ops->kick == NULL) {
+ ret = -EINVAL;
+ dev_err(dev, ".kick method not defined for %s",
+ rproc->name);
+ goto out;
+ }
+
/* Try to find dedicated vdev buffer carveout */
mem = rproc_find_carveout_by_name(rproc, "vdev%dbuffer", rvdev->index);
if (mem) {
--
2.24.1
Since commit 8df9ffb888c ("can: make use of preallocated can_ml_priv for per
device struct can_dev_rcv_lists") the device specific CAN receive filter lists
are stored in netdev_priv() and dev->ml_priv points to these filters.
In the bug report Syzkaller enslaved a vxcan1 CAN device and accessed the
bonding device with a PF_CAN socket which lead to a crash due to an access of
an unhandled bond_dev->ml_priv pointer.
Deny to enslave CAN devices by the bonding driver as the resulting bond_dev
pretends to be a CAN device by copying dev->type without really being one.
Reported-by: syzbot+c3ea30e1e2485573f953(a)syzkaller.appspotmail.com
Fixes: 8df9ffb888c ("can: make use of preallocated can_ml_priv for per
device struct can_dev_rcv_lists")
Cc: linux-stable <stable(a)vger.kernel.org> # >= v5.4
Signed-off-by: Oliver Hartkopp <socketcan(a)hartkopp.net>
---
drivers/net/bonding/bond_main.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 48d5ec770b94..4b781a7dfd96 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1475,6 +1475,18 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
return -EPERM;
}
+ /* CAN network devices hold device specific filter lists in
+ * netdev_priv() where dev->ml_priv sets a reference to.
+ * As bonding assumes to have some ethernet-like device it doesn't
+ * take care about these CAN specific filter lists today.
+ * So we deny the enslaving of CAN interfaces here.
+ */
+ if (slave_dev->type == ARPHRD_CAN) {
+ NL_SET_ERR_MSG(extack, "CAN devices can not be enslaved");
+ slave_err(bond_dev, slave_dev, "no bonding on CAN devices\n");
+ return -EINVAL;
+ }
+
/* set bonding device ether type by slave - bonding netdevices are
* created with ether_setup, so when the slave type is not ARPHRD_ETHER
* there is a need to override some of the type dependent attribs/funcs.
--
2.20.1
Hello,
We ran automated tests on a recent commit from this kernel tree:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: 0651ac20bf88 - ipv4: ensure rcu_read_lock() in cipso_v4_error()
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: OK
Tests: FAILED
All kernel binaries, config files, and logs are available for download here:
https://cki-artifacts.s3.us-east-2.amazonaws.com/index.html?prefix=dataware…
One or more kernel tests failed:
ppc64le:
❌ LTP
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Compile testing
---------------
We compiled the kernel for 4 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
s390x:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test
✅ xfstests - ext4
✅ xfstests - xfs
✅ selinux-policy: serge-testsuite
✅ lvm thinp sanity
✅ storage: software RAID testing
🚧 ✅ Storage blktests
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
✅ LTP
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking socket: fuzz
✅ Networking sctp-auth: sockopts test
✅ Networking: igmp conformance test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - transport
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ Usex - version 1.9-29
✅ storage: SCSI VPD
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ⚡⚡⚡ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ storage: dm/common
ppc64le:
Host 1:
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
❌ LTP
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking socket: fuzz
✅ Networking sctp-auth: sockopts test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ Usex - version 1.9-29
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ❌ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ storage: dm/common
Host 2:
✅ Boot test
✅ xfstests - ext4
✅ xfstests - xfs
✅ selinux-policy: serge-testsuite
✅ lvm thinp sanity
✅ storage: software RAID testing
🚧 ✅ IPMI driver test
🚧 ✅ IPMItool loop stress test
🚧 ✅ Storage blktests
s390x:
Host 1:
✅ Boot test
✅ selinux-policy: serge-testsuite
🚧 ✅ Storage blktests
Host 2:
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking sctp-auth: sockopts test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - transport
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ❌ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ storage: dm/common
x86_64:
Host 1:
✅ Boot test
✅ Storage SAN device stress - megaraid_sas
Host 2:
✅ Boot test
✅ Storage SAN device stress - mpt3sas driver
Host 3:
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
✅ LTP
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking socket: fuzz
✅ Networking sctp-auth: sockopts test
✅ Networking: igmp conformance test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - transport
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ pciutils: sanity smoke test
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ Usex - version 1.9-29
✅ storage: SCSI VPD
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ❌ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ storage: dm/common
Host 4:
✅ Boot test
✅ xfstests - ext4
✅ xfstests - xfs
✅ selinux-policy: serge-testsuite
✅ lvm thinp sanity
✅ storage: software RAID testing
✅ stress: stress-ng
🚧 ✅ IOMMU boot test
🚧 ✅ IPMI driver test
🚧 ✅ IPMItool loop stress test
🚧 ✅ Storage blktests
Test sources: https://github.com/CKI-project/tests-beaker
💚 Pull requests are welcome for new tests or improvements to existing tests!
Aborted tests
-------------
Tests that didn't complete running successfully are marked with ⚡⚡⚡.
If this was caused by an infrastructure issue, we try to mark that
explicitly in the report.
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Testing timeout
---------------
We aim to provide a report within reasonable timeframe. Tests that haven't
finished running yet are marked with ⏱.
This is the start of the stable review cycle for the 4.4.217 release.
There are 93 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 21 Mar 2020 12:37:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.217-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.217-rc1
Matteo Croce <mcroce(a)redhat.com>
ipv4: ensure rcu_read_lock() in cipso_v4_error()
Jann Horn <jannh(a)google.com>
mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
Kees Cook <keescook(a)chromium.org>
ARM: 8958/1: rename missed uaccess .fixup section
Florian Fainelli <f.fainelli(a)gmail.com>
ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
Qian Cai <cai(a)lca.pw>
jbd2: fix data races at struct journal_head
Linus Torvalds <torvalds(a)linux-foundation.org>
signal: avoid double atomic counter increments for user accounting
Marek Vasut <marex(a)denx.de>
net: ks8851-ml: Fix IRQ handling and locking
Kim Phillips <kim.phillips(a)amd.com>
perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't schedule OGM for disabled interface
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid free/alloc race when handling OGM buffer
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Only read OGM tvlv_len after buffer len check
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Reduce tt_global hash refcnt only for removed entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Reduce tt_local hash refcnt only for removed entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Reduce claim hash refcnt only for removed entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Prevent duplicated tvlv handler
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Prevent duplicated global TT entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Prevent duplicated nc_node entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Prevent duplicated gateway_node entry
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Avoid storing non-TT-sync flags on singular entries too
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix debugfs path for renamed softif
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix debugfs path for renamed hardif
Marek Lindner <mareklindner(a)neomailbox.ch>
batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Fix TT sync flags for intermediate TT responses
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid race in TT TVLV allocator helper
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix skbuff rcsum on packet reroute
Matthias Schiffer <mschiffer(a)universe-factory.net>
batman-adv: update data pointers after skb_cow()
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix internal interface indices types
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: fix TT sync flag inconsistencies
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix rx packet/bytes stats on local ARP reply
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Fix transmission of final, 16th fragment
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix double free during fragment merge error
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Add missing refcnt for last_candidate
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix speedy join in gateway client mode
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Free last_bonding_candidate on release of orig_node
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix reference leak in batadv_find_router
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix non-atomic bla_claim::backbone_gw access
Simon Wunderlich <sw(a)simonwunderlich.de>
batman-adv: lock crc access in bridge loop avoidance
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix orig_node_vlan leak on orig_node_release
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Clean up untagged vlan when destroying via rtnl-link
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix ICMP RR ethernet access after skb_linearize
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix use-after-free/double-free of tt_req_node
Florian Westphal <fw(a)strlen.de>
batman-adv: fix skb deref after free
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Avoid duplicate neigh_node additions
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix reference counting of vlan object for tt_local_entry
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Drop reference to netdevice on last reference
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Deactivate TO_BE_ACTIVATED hardif on shutdown
Marek Lindner <mareklindner(a)neomailbox.ch>
batman-adv: init neigh node last seen field
Sven Eckelmann <sven.eckelmann(a)open-mesh.com>
batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix unexpected free of bcast_own on add_if error
Andrew Lunn <andrew(a)lunn.ch>
batman-adv: Avoid endless loop in bat-on-bat netdevice check
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Only put orig_node_vlan list reference when removed
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Only put gw_node list reference when removed
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix invalid read while copying bat_iv.bcast_own
Vladis Dronov <vdronov(a)redhat.com>
efi: Add a sanity check to efivar_store_raw()
Eric Dumazet <edumazet(a)google.com>
ipv6: restrict IPV6_ADDRFORM operation
qize wang <wangqize888888888(a)gmail.com>
mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
Daniel Drake <drake(a)endlessm.com>
iommu/vt-d: Ignore devices with out-of-spec domain number
Zhenzhong Duan <zhenzhong.duan(a)gmail.com>
iommu/vt-d: Fix the wrong printing in RHSA parsing
Jakub Kicinski <kuba(a)kernel.org>
netfilter: cthelper: add missing attribute validation for cthelper
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for channel switch
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for critical protocol indication
Yonghyun Hwang <yonghyun(a)google.com>
iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
Hans de Goede <hdegoede(a)redhat.com>
iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
Vladis Dronov <vdronov(a)redhat.com>
efi: Fix a race and a buffer overflow while reading efivars via sysfs
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
ARC: define __ALIGN_STR and __ALIGN symbols for ARC
Vitaly Kuznetsov <vkuznets(a)redhat.com>
KVM: x86: clear stale x86_emulate_ctxt->intercept value
Al Viro <viro(a)zeniv.linux.org.uk>
gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
Colin Ian King <colin.king(a)canonical.com>
drm/amd/display: remove duplicated assignment to grph_obj_type
Hans de Goede <hdegoede(a)redhat.com>
iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
Jakub Kicinski <kuba(a)kernel.org>
net: fq: add missing attribute validation for orphan mask
Eric Dumazet <edumazet(a)google.com>
bonding/alb: make sure arp header is pulled before accessing it
Eric Dumazet <edumazet(a)google.com>
slip: make slhc_compress() more robust against malicious packets
Jakub Kicinski <kuba(a)kernel.org>
net: fec: validate the new settings in fec_enet_set_coalesce()
Mahesh Bandewar <maheshb(a)google.com>
macvlan: add cond_resched() during multicast processing
Mahesh Bandewar <maheshb(a)google.com>
ipvlan: don't deref eth hdr before checking it's set
Eric Dumazet <edumazet(a)google.com>
ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
Paolo Abeni <pabeni(a)redhat.com>
ipvlan: egress mcast packets are not exceptional
Jiri Wiesner <jwiesner(a)suse.com>
ipvlan: do not add hardware address of master to its unicast filter list
Mahesh Bandewar <maheshb(a)google.com>
ipvlan: add cond_resched_rcu() while processing muticast backlog
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for vendor subcommand
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for SE API
Jakub Kicinski <kuba(a)kernel.org>
team: add missing attribute validation for array index
Jakub Kicinski <kuba(a)kernel.org>
team: add missing attribute validation for port ifindex
Jakub Kicinski <kuba(a)kernel.org>
nl802154: add missing attribute validation for dev_type
Jakub Kicinski <kuba(a)kernel.org>
nl802154: add missing attribute validation
Jakub Kicinski <kuba(a)kernel.org>
fib: add missing attribute validation for tun_id
Vasundhara Volam <vasundhara-v.volam(a)broadcom.com>
bnxt_en: reinitialize IRQs when MTU is modified
Dan Carpenter <dan.carpenter(a)oracle.com>
net: nfc: fix bounds checking bugs on "pipe"
You-Sheng Yang <vicamo.yang(a)canonical.com>
r8152: check disconnect status after long sleep
Petr Malat <oss(a)malat.biz>
NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/linkage.h | 2 +
arch/arm/kernel/vdso.c | 2 +
arch/arm/lib/copy_from_user.S | 2 +-
arch/x86/kernel/cpu/perf_event_amd_uncore.c | 16 +-
arch/x86/kvm/emulate.c | 1 +
drivers/firmware/efi/efivars.c | 32 +++-
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 3 +-
drivers/iommu/dmar.c | 21 ++-
drivers/iommu/intel-iommu.c | 13 +-
drivers/net/bonding/bond_alb.c | 20 +--
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +-
drivers/net/ethernet/freescale/fec_main.c | 6 +-
drivers/net/ethernet/micrel/ks8851_mll.c | 14 +-
drivers/net/ipvlan/ipvlan_core.c | 19 +-
drivers/net/ipvlan/ipvlan_main.c | 5 +-
drivers/net/macvlan.c | 2 +
drivers/net/slip/slhc.c | 14 +-
drivers/net/team/team.c | 2 +
drivers/net/usb/r8152.c | 6 +
drivers/net/wireless/mwifiex/tdls.c | 70 +++++++-
fs/gfs2/inode.c | 2 +-
fs/jbd2/transaction.c | 8 +-
fs/nfs/dir.c | 2 -
include/net/fib_rules.h | 1 +
kernel/signal.c | 23 ++-
mm/slub.c | 9 +
net/batman-adv/bat_iv_ogm.c | 115 +++++++++----
net/batman-adv/bridge_loop_avoidance.c | 152 +++++++++++++---
net/batman-adv/debugfs.c | 40 +++++
net/batman-adv/debugfs.h | 11 ++
net/batman-adv/distributed-arp-table.c | 15 +-
net/batman-adv/fragmentation.c | 14 +-
net/batman-adv/gateway_client.c | 18 +-
net/batman-adv/hard-interface.c | 89 ++++++++--
net/batman-adv/hard-interface.h | 6 +-
net/batman-adv/main.c | 8 +-
net/batman-adv/network-coding.c | 33 ++--
net/batman-adv/originator.c | 26 ++-
net/batman-adv/originator.h | 4 +-
net/batman-adv/routing.c | 111 +++++++++---
net/batman-adv/send.c | 4 +-
net/batman-adv/soft-interface.c | 9 +
net/batman-adv/translation-table.c | 249 ++++++++++++++++++---------
net/batman-adv/types.h | 23 ++-
net/ieee802154/nl_policy.c | 6 +
net/ipv4/cipso_ipv4.c | 7 +-
net/ipv6/ipv6_sockglue.c | 10 +-
net/netfilter/nfnetlink_cthelper.c | 2 +
net/nfc/hci/core.c | 19 +-
net/nfc/netlink.c | 3 +
net/sched/sch_fq.c | 1 +
net/wireless/nl80211.c | 3 +
53 files changed, 963 insertions(+), 318 deletions(-)
This brings the outdated Documentation/security/credentials.rst
back in line with the current implementation, and describes the
purpose of current->signal->exec_update_mutex,
current->signal->exec_guard_mutex and
current->signal->unsafe_execve_in_progress.
Signed-off-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
---
Documentation/security/credentials.rst | 29 +++++++++++++++++++++--------
1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/Documentation/security/credentials.rst b/Documentation/security/credentials.rst
index 282e79f..fe4cd76 100644
--- a/Documentation/security/credentials.rst
+++ b/Documentation/security/credentials.rst
@@ -437,15 +437,30 @@ new set of credentials by calling::
struct cred *prepare_creds(void);
-this locks current->cred_replace_mutex and then allocates and constructs a
-duplicate of the current process's credentials, returning with the mutex still
-held if successful. It returns NULL if not successful (out of memory).
+this allocates and constructs a duplicate of the current process's credentials.
+It returns NULL if not successful (out of memory).
+
+If called from __do_execve_file, the mutex current->signal->exec_guard_mutex
+is acquired before this function gets called, and usually released after
+the new process mmap and credentials are installed. However if one of the
+sibling threads are being traced when the execve is invoked, there is no
+guarantee how long it takes to terminate all sibling threads, and therefore
+the variable current->signal->unsafe_execve_in_progress is set, and the
+exec_guard_mutex is released immediately. Functions that may have effect
+on the credentials of a different thread need to lock the exec_guard_mutex
+and additionally check the unsafe_execve_in_progress status, and fail with
+-EAGAIN if that variable is set.
The mutex prevents ``ptrace()`` from altering the ptrace state of a process
while security checks on credentials construction and changing is taking place
as the ptrace state may alter the outcome, particularly in the case of
``execve()``.
+The mutex current->signal->exec_update_mutex is acquired when only a single
+thread is remaining, and the credentials and the process mmap are actually
+changed. Functions that only need to access to a consistent state of the
+credentials and the process mmap do only need to aquire this mutex.
+
The new credentials set should be altered appropriately, and any security
checks and hooks done. Both the current and the proposed sets of credentials
are available for this purpose as current_cred() will return the current set
@@ -466,9 +481,8 @@ by calling::
This will alter various aspects of the credentials and the process, giving the
LSM a chance to do likewise, then it will use ``rcu_assign_pointer()`` to
-actually commit the new credentials to ``current->cred``, it will release
-``current->cred_replace_mutex`` to allow ``ptrace()`` to take place, and it
-will notify the scheduler and others of the changes.
+actually commit the new credentials to ``current->cred``, and it will notify
+the scheduler and others of the changes.
This function is guaranteed to return 0, so that it can be tail-called at the
end of such functions as ``sys_setresuid()``.
@@ -486,8 +500,7 @@ invoked::
void abort_creds(struct cred *new);
-This releases the lock on ``current->cred_replace_mutex`` that
-``prepare_creds()`` got and then releases the new credentials.
+This releases the new credentials.
A typical credentials alteration function would look something like this::
--
1.9.1
This is the start of the stable review cycle for the 4.9.217 release.
There are 90 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 21 Mar 2020 12:37:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.217-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.217-rc1
Matteo Croce <mcroce(a)redhat.com>
ipv4: ensure rcu_read_lock() in cipso_v4_error()
Jann Horn <jannh(a)google.com>
mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
Kees Cook <keescook(a)chromium.org>
ARM: 8958/1: rename missed uaccess .fixup section
Florian Fainelli <f.fainelli(a)gmail.com>
ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
Qian Cai <cai(a)lca.pw>
jbd2: fix data races at struct journal_head
Linus Torvalds <torvalds(a)linux-foundation.org>
signal: avoid double atomic counter increments for user accounting
Madhuparna Bhowmik <madhuparnabhowmik10(a)gmail.com>
mac80211: rx: avoid RCU list traversal under mutex
Marek Vasut <marex(a)denx.de>
net: ks8851-ml: Fix IRQ handling and locking
Johannes Berg <johannes.berg(a)intel.com>
cfg80211: check reg_rule for NULL in handle_channel_custom()
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override
Mansour Behabadi <mansour(a)oxplot.com>
HID: apple: Add support for recent firmware on Magic Keyboards
Jean Delvare <jdelvare(a)suse.de>
ACPI: watchdog: Allow disabling WDAT at boot
Kim Phillips <kim.phillips(a)amd.com>
perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Use explicit tvlv padding for ELP packets
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid probe ELP information leak
Matthias Schiffer <mschiffer(a)universe-factory.net>
batman-adv: update data pointers after skb_cow()
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't schedule OGM for disabled interface
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid free/alloc race when handling OGM buffer
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid free/alloc race when handling OGM2 buffer
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix duplicated OGMs on NETDEV_UP
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Prevent duplicated gateway_node entry
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Fix multicast TT issues with bogus ROAM flags
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Avoid storing non-TT-sync flags on singular entries too
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix debugfs path for renamed softif
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix debugfs path for renamed hardif
Marek Lindner <mareklindner(a)neomailbox.ch>
batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Fix TT sync flags for intermediate TT responses
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid race in TT TVLV allocator helper
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix internal interface indices types
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
Sven Eckelmann <sven.eckelmann(a)openmesh.com>
batman-adv: Fix check of retrieved orig_gw in batadv_v_gw_is_eligible
Sven Eckelmann <sven.eckelmann(a)open-mesh.com>
batman-adv: Always initialize fragment header priority
Sven Eckelmann <sven.eckelmann(a)openmesh.com>
batman-adv: Avoid spurious warnings from bat_v neigh_cmp implementation
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: fix TT sync flag inconsistencies
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Accept only filled wifi station info
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Use default throughput value on cfg80211 error
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix rx packet/bytes stats on local ARP reply
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Initialize gw sel_class via batadv_algo
Linus Lüssing <linus.luessing(a)c0d3.blue>
batman-adv: Fix transmission of final, 16th fragment
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Fix double free during fragment merge error
Vladis Dronov <vdronov(a)redhat.com>
efi: Add a sanity check to efivar_store_raw()
Eric Dumazet <edumazet(a)google.com>
ipv6: restrict IPV6_ADDRFORM operation
Daniel Drake <drake(a)endlessm.com>
iommu/vt-d: Ignore devices with out-of-spec domain number
Zhenzhong Duan <zhenzhong.duan(a)gmail.com>
iommu/vt-d: Fix the wrong printing in RHSA parsing
qize wang <wangqize888888888(a)gmail.com>
mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
Jakub Kicinski <kuba(a)kernel.org>
netfilter: cthelper: add missing attribute validation for cthelper
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for channel switch
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for beacon report scanning
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for critical protocol indication
Yonghyun Hwang <yonghyun(a)google.com>
iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
Hans de Goede <hdegoede(a)redhat.com>
iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
Vladis Dronov <vdronov(a)redhat.com>
efi: Fix a race and a buffer overflow while reading efivars via sysfs
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
ARC: define __ALIGN_STR and __ALIGN symbols for ARC
Vitaly Kuznetsov <vkuznets(a)redhat.com>
KVM: x86: clear stale x86_emulate_ctxt->intercept value
Al Viro <viro(a)zeniv.linux.org.uk>
gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
Al Viro <viro(a)zeniv.linux.org.uk>
cifs_atomic_open(): fix double-put on late allocation failure
Colin Ian King <colin.king(a)canonical.com>
drm/amd/display: remove duplicated assignment to grph_obj_type
Hillf Danton <hdanton(a)sina.com>
workqueue: don't use wq_select_unbound_cpu() for bound works
Hans de Goede <hdegoede(a)redhat.com>
iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
Halil Pasic <pasic(a)linux.ibm.com>
virtio-blk: fix hw_queue stopped on arbitrary error
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: fix MDIO bus PM PHY resuming
Shakeel Butt <shakeelb(a)google.com>
cgroup: memcg: net: do not associate sock with unrelated cgroup
Eric Dumazet <edumazet(a)google.com>
bonding/alb: make sure arp header is pulled before accessing it
Eric Dumazet <edumazet(a)google.com>
slip: make slhc_compress() more robust against malicious packets
Jakub Kicinski <kuba(a)kernel.org>
net: fec: validate the new settings in fec_enet_set_coalesce()
Mahesh Bandewar <maheshb(a)google.com>
macvlan: add cond_resched() during multicast processing
Mahesh Bandewar <maheshb(a)google.com>
ipvlan: don't deref eth hdr before checking it's set
Eric Dumazet <edumazet(a)google.com>
ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
Paolo Abeni <pabeni(a)redhat.com>
ipvlan: egress mcast packets are not exceptional
Jiri Wiesner <jwiesner(a)suse.com>
ipvlan: do not add hardware address of master to its unicast filter list
Mahesh Bandewar <maheshb(a)google.com>
ipvlan: add cond_resched_rcu() while processing muticast backlog
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for vendor subcommand
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for SE API
Jakub Kicinski <kuba(a)kernel.org>
team: add missing attribute validation for array index
Jakub Kicinski <kuba(a)kernel.org>
team: add missing attribute validation for port ifindex
Jakub Kicinski <kuba(a)kernel.org>
net: fq: add missing attribute validation for orphan mask
Jakub Kicinski <kuba(a)kernel.org>
macsec: add missing attribute validation for port
Jakub Kicinski <kuba(a)kernel.org>
nl802154: add missing attribute validation for dev_type
Jakub Kicinski <kuba(a)kernel.org>
nl802154: add missing attribute validation
Jakub Kicinski <kuba(a)kernel.org>
fib: add missing attribute validation for tun_id
Vasundhara Volam <vasundhara-v.volam(a)broadcom.com>
bnxt_en: reinitialize IRQs when MTU is modified
You-Sheng Yang <vicamo.yang(a)canonical.com>
r8152: check disconnect status after long sleep
Dan Carpenter <dan.carpenter(a)oracle.com>
net: nfc: fix bounds checking bugs on "pipe"
Dmitry Bogdanov <dbogdanov(a)marvell.com>
net: macsec: update SCI upon MAC address change.
Hangbin Liu <liuhangbin(a)gmail.com>
ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface
Eric Dumazet <edumazet(a)google.com>
gre: fix uninit-value in __iptunnel_pull_header
Dmitry Yakunin <zeil(a)yandex-team.ru>
cgroup, netclassid: periodically release file_lock on classid updating
Florian Fainelli <f.fainelli(a)gmail.com>
net: phy: Avoid multiple suspends
David S. Miller <davem(a)davemloft.net>
phy: Revert toggling reset changes.
Petr Malat <oss(a)malat.biz>
NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array
-------------
Diffstat:
Documentation/filesystems/porting | 7 ++
Documentation/kernel-parameters.txt | 4 +
Makefile | 4 +-
arch/arc/include/asm/linkage.h | 2 +
arch/arm/kernel/vdso.c | 2 +
arch/arm/lib/copy_from_user.S | 2 +-
arch/x86/events/amd/uncore.c | 14 +--
arch/x86/kvm/emulate.c | 1 +
drivers/acpi/acpi_watchdog.c | 12 ++-
drivers/block/virtio_blk.c | 8 +-
drivers/firmware/efi/efivars.c | 32 ++++--
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 3 +-
drivers/hid/hid-apple.c | 3 +-
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++
drivers/iommu/dmar.c | 21 ++--
drivers/iommu/intel-iommu.c | 13 ++-
drivers/net/bonding/bond_alb.c | 20 ++--
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +-
drivers/net/ethernet/freescale/fec_main.c | 6 +-
drivers/net/ethernet/micrel/ks8851_mll.c | 14 +--
drivers/net/ipvlan/ipvlan_core.c | 19 ++--
drivers/net/ipvlan/ipvlan_main.c | 5 +-
drivers/net/macsec.c | 12 ++-
drivers/net/macvlan.c | 2 +
drivers/net/phy/phy_device.c | 18 ++--
drivers/net/slip/slhc.c | 14 ++-
drivers/net/team/team.c | 2 +
drivers/net/usb/r8152.c | 6 ++
drivers/net/wireless/marvell/mwifiex/tdls.c | 70 +++++++++++--
fs/cifs/dir.c | 1 -
fs/gfs2/inode.c | 2 +-
fs/jbd2/transaction.c | 8 +-
fs/nfs/dir.c | 2 -
fs/open.c | 3 -
include/linux/phy.h | 2 +
include/net/fib_rules.h | 1 +
kernel/cgroup.c | 4 +
kernel/signal.c | 23 +++--
kernel/workqueue.c | 14 +--
mm/memcontrol.c | 4 +
mm/slub.c | 9 ++
net/batman-adv/bat_iv_ogm.c | 105 +++++++++++++++----
net/batman-adv/bat_v.c | 25 +++--
net/batman-adv/bat_v_elp.c | 22 ++--
net/batman-adv/bat_v_ogm.c | 42 ++++++--
net/batman-adv/debugfs.c | 40 +++++++
net/batman-adv/debugfs.h | 11 ++
net/batman-adv/distributed-arp-table.c | 5 +-
net/batman-adv/fragmentation.c | 22 ++--
net/batman-adv/gateway_client.c | 11 +-
net/batman-adv/gateway_common.c | 5 +
net/batman-adv/hard-interface.c | 51 +++++++--
net/batman-adv/originator.c | 4 +-
net/batman-adv/originator.h | 4 +-
net/batman-adv/routing.c | 11 +-
net/batman-adv/soft-interface.c | 1 -
net/batman-adv/translation-table.c | 149 ++++++++++++++++++++++-----
net/batman-adv/types.h | 22 +++-
net/core/netclassid_cgroup.c | 47 +++++++--
net/ieee802154/nl_policy.c | 6 ++
net/ipv4/cipso_ipv4.c | 7 +-
net/ipv4/gre_demux.c | 12 ++-
net/ipv6/addrconf.c | 4 +
net/ipv6/ipv6_sockglue.c | 10 +-
net/mac80211/rx.c | 2 +-
net/netfilter/nfnetlink_cthelper.c | 2 +
net/nfc/hci/core.c | 19 +++-
net/nfc/netlink.c | 3 +
net/sched/sch_fq.c | 1 +
net/wireless/nl80211.c | 5 +
net/wireless/reg.c | 2 +-
71 files changed, 809 insertions(+), 242 deletions(-)
The patch titled
Subject: mm, slub: prevent kmalloc_node crashes and memory leaks
has been added to the -mm tree. Its filename is
mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-slub-prevent-kmalloc_node-crash…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-slub-prevent-kmalloc_node-crash…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Vlastimil Babka <vbabka(a)suse.cz>
Subject: mm, slub: prevent kmalloc_node crashes and memory leaks
Sachin reports [1] a crash in SLUB __slab_alloc():
BUG: Kernel NULL pointer dereference on read at 0x000073b0
Faulting instruction address: 0xc0000000003d55f4
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 19 PID: 1 Comm: systemd Not tainted 5.6.0-rc2-next-20200218-autotest #1
NIP: c0000000003d55f4 LR: c0000000003d5b94 CTR: 0000000000000000
REGS: c0000008b37836d0 TRAP: 0300 Not tainted (5.6.0-rc2-next-20200218-autotest)
MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24004844 XER: 00000000
CFAR: c00000000000dec4 DAR: 00000000000073b0 DSISR: 40000000 IRQMASK: 1
GPR00: c0000000003d5b94 c0000008b3783960 c00000000155d400 c0000008b301f500
GPR04: 0000000000000dc0 0000000000000002 c0000000003443d8 c0000008bb398620
GPR08: 00000008ba2f0000 0000000000000001 0000000000000000 0000000000000000
GPR12: 0000000024004844 c00000001ec52a00 0000000000000000 0000000000000000
GPR16: c0000008a1b20048 c000000001595898 c000000001750c18 0000000000000002
GPR20: c000000001750c28 c000000001624470 0000000fffffffe0 5deadbeef0000122
GPR24: 0000000000000001 0000000000000dc0 0000000000000002 c0000000003443d8
GPR28: c0000008b301f500 c0000008bb398620 0000000000000000 c00c000002287180
NIP [c0000000003d55f4] ___slab_alloc+0x1f4/0x760
LR [c0000000003d5b94] __slab_alloc+0x34/0x60
Call Trace:
[c0000008b3783960] [c0000000003d5734] ___slab_alloc+0x334/0x760 (unreliable)
[c0000008b3783a40] [c0000000003d5b94] __slab_alloc+0x34/0x60
[c0000008b3783a70] [c0000000003d6fa0] __kmalloc_node+0x110/0x490
[c0000008b3783af0] [c0000000003443d8] kvmalloc_node+0x58/0x110
[c0000008b3783b30] [c0000000003fee38] mem_cgroup_css_online+0x108/0x270
[c0000008b3783b90] [c000000000235aa8] online_css+0x48/0xd0
[c0000008b3783bc0] [c00000000023eaec] cgroup_apply_control_enable+0x2ec/0x4d0
[c0000008b3783ca0] [c000000000242318] cgroup_mkdir+0x228/0x5f0
[c0000008b3783d10] [c00000000051e170] kernfs_iop_mkdir+0x90/0xf0
[c0000008b3783d50] [c00000000043dc00] vfs_mkdir+0x110/0x230
[c0000008b3783da0] [c000000000441c90] do_mkdirat+0xb0/0x1a0
[c0000008b3783e20] [c00000000000b278] system_call+0x5c/0x68
This is a PowerPC platform with following NUMA topology:
available: 2 nodes (0-1)
node 0 cpus:
node 0 size: 0 MB
node 0 free: 0 MB
node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
node 1 size: 35247 MB
node 1 free: 30907 MB
node distances:
node 0 1
0: 10 40
1: 40 10
possible numa nodes: 0-31
This only happens with a mmotm patch "mm/memcontrol.c: allocate shrinker_map on
appropriate NUMA node" [2] which effectively calls kmalloc_node for each
possible node. SLUB however only allocates kmem_cache_node on online
N_NORMAL_MEMORY nodes, and relies on node_to_mem_node to return such valid node
for other nodes since commit a561ce00b09e ("slub: fall back to
node_to_mem_node() node if allocating on memoryless node"). This is however not
true in this configuration where the _node_numa_mem_ array is not initialized
for nodes 0 and 2-31, thus it contains zeroes and get_partial() ends up
accessing non-allocated kmem_cache_node.
A related issue was reported by Bharata (originally by Ramachandran) [3] where
a similar PowerPC configuration, but with mainline kernel without patch [2]
ends up allocating large amounts of pages by kmalloc-1k kmalloc-512. This seems
to have the same underlying issue with node_to_mem_node() not behaving as
expected, and might probably also lead to an infinite loop with
CONFIG_SLUB_CPU_PARTIAL [4].
This patch should fix both issues by not relying on node_to_mem_node() anymore
and instead simply falling back to NUMA_NO_NODE, when kmalloc_node(node) is
attempted for a node that's not online, or has no usable memory. The "usable
memory" condition is also changed from node_present_pages() to N_NORMAL_MEMORY
node state, as that is exactly the condition that SLUB uses to allocate
kmem_cache_node structures. The check in get_partial() is removed completely,
as the checks in ___slab_alloc() are now sufficient to prevent get_partial()
being reached with an invalid node.
[1] https://lore.kernel.org/linux-next/3381CD91-AB3D-4773-BA04-E7A072A63968@lin…
[2] https://lore.kernel.org/linux-mm/fff0e636-4c36-ed10-281c-8cdb0687c839@virtu…
[3] https://lore.kernel.org/linux-mm/20200317092624.GB22538@in.ibm.com/
[4] https://lore.kernel.org/linux-mm/088b5996-faae-8a56-ef9c-5b567125ae54@suse.…
Link: http://lkml.kernel.org/r/20200320115533.9604-1-vbabka@suse.cz
Fixes: a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node")
Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz>
Reported-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com>
Tested-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com>
Reported-by: PUVICHAKRAVARTHY RAMACHANDRAN <puvichakravarthy(a)in.ibm.com>
Tested-by: Bharata B Rao <bharata(a)linux.ibm.com>
Debugged-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Reviewed-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Michael Ellerman <mpe(a)ellerman.id.au>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Christopher Lameter <cl(a)linux.com>
Cc: linuxppc-dev(a)lists.ozlabs.org
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Kirill Tkhai <ktkhai(a)virtuozzo.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Nathan Lynch <nathanl(a)linux.ibm.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/slub.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
--- a/mm/slub.c~mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks
+++ a/mm/slub.c
@@ -1973,8 +1973,6 @@ static void *get_partial(struct kmem_cac
if (node == NUMA_NO_NODE)
searchnode = numa_mem_id();
- else if (!node_present_pages(node))
- searchnode = node_to_mem_node(node);
object = get_partial_node(s, get_node(s, searchnode), c, flags);
if (object || node != NUMA_NO_NODE)
@@ -2563,17 +2561,27 @@ static void *___slab_alloc(struct kmem_c
struct page *page;
page = c->page;
- if (!page)
+ if (!page) {
+ /*
+ * if the node is not online or has no normal memory, just
+ * ignore the node constraint
+ */
+ if (unlikely(node != NUMA_NO_NODE &&
+ !node_state(node, N_NORMAL_MEMORY)))
+ node = NUMA_NO_NODE;
goto new_slab;
+ }
redo:
if (unlikely(!node_match(page, node))) {
- int searchnode = node;
-
- if (node != NUMA_NO_NODE && !node_present_pages(node))
- searchnode = node_to_mem_node(node);
-
- if (unlikely(!node_match(page, searchnode))) {
+ /*
+ * same as above but node_match() being false already
+ * implies node != NUMA_NO_NODE
+ */
+ if (!node_state(node, N_NORMAL_MEMORY)) {
+ node = NUMA_NO_NODE;
+ goto redo;
+ } else {
stat(s, ALLOC_NODE_MISMATCH);
deactivate_slab(s, page, c->freelist, c);
goto new_slab;
_
Patches currently in -mm which might be from vbabka(a)suse.cz are
mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks.patch
revert-topology-add-support-for-node_to_mem_node-to-determine-the-fallback-node.patch
mm-compaction-fully-assume-capture-is-not-null-in-compact_zone_order.patch
mm-hugetlb-remove-unnecessary-memory-fetch-in-pageheadhuge.patch
This changes perf_event_set_clock to use the new exec_update_mutex
instead of cred_guard_mutex.
This should be safe, as the credentials are only used for reading.
Signed-off-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
---
kernel/events/core.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index e453589..71cba8c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1249,7 +1249,7 @@ static void put_ctx(struct perf_event_context *ctx)
* function.
*
* Lock order:
- * cred_guard_mutex
+ * exec_update_mutex
* task_struct::perf_event_mutex
* perf_event_context::mutex
* perf_event::child_mutex;
@@ -11263,14 +11263,14 @@ static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id)
}
if (task) {
- err = mutex_lock_interruptible(&task->signal->cred_guard_mutex);
+ err = mutex_lock_interruptible(&task->signal->exec_update_mutex);
if (err)
goto err_task;
/*
* Reuse ptrace permission checks for now.
*
- * We must hold cred_guard_mutex across this and any potential
+ * We must hold exec_update_mutex across this and any potential
* perf_install_in_context() call for this new event to
* serialize against exec() altering our credentials (and the
* perf_event_exit_task() that could imply).
@@ -11559,7 +11559,7 @@ static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id)
mutex_unlock(&ctx->mutex);
if (task) {
- mutex_unlock(&task->signal->cred_guard_mutex);
+ mutex_unlock(&task->signal->exec_update_mutex);
put_task_struct(task);
}
@@ -11595,7 +11595,7 @@ static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id)
free_event(event);
err_cred:
if (task)
- mutex_unlock(&task->signal->cred_guard_mutex);
+ mutex_unlock(&task->signal->exec_update_mutex);
err_task:
if (task)
put_task_struct(task);
@@ -11900,7 +11900,7 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn)
/*
* When a child task exits, feed back event values to parent events.
*
- * Can be called with cred_guard_mutex held when called from
+ * Can be called with exec_update_mutex held when called from
* install_exec_creds().
*/
void perf_event_exit_task(struct task_struct *child)
--
1.9.1
This changes do_io_accounting to use the new exec_update_mutex
instead of cred_guard_mutex.
This fixes possible deadlocks when the trace is accessing
/proc/$pid/io for instance.
This should be safe, as the credentials are only used for reading.
Signed-off-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
---
fs/proc/base.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index fed76abf..6b13fc4 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2861,7 +2861,7 @@ static int do_io_accounting(struct task_struct *task, struct seq_file *m, int wh
unsigned long flags;
int result;
- result = mutex_lock_killable(&task->signal->cred_guard_mutex);
+ result = mutex_lock_killable(&task->signal->exec_update_mutex);
if (result)
return result;
@@ -2897,7 +2897,7 @@ static int do_io_accounting(struct task_struct *task, struct seq_file *m, int wh
result = 0;
out_unlock:
- mutex_unlock(&task->signal->cred_guard_mutex);
+ mutex_unlock(&task->signal->exec_update_mutex);
return result;
}
--
1.9.1
This changes lock_trace to use the new exec_update_mutex
instead of cred_guard_mutex.
This fixes possible deadlocks when the trace is accessing
/proc/$pid/stack for instance.
This should be safe, as the credentials are only used for reading,
and task->mm is updated on execve under the new exec_update_mutex.
Signed-off-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
---
fs/proc/base.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index c7c6427..fed76abf 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -405,11 +405,11 @@ static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
static int lock_trace(struct task_struct *task)
{
- int err = mutex_lock_killable(&task->signal->cred_guard_mutex);
+ int err = mutex_lock_killable(&task->signal->exec_update_mutex);
if (err)
return err;
if (!ptrace_may_access(task, PTRACE_MODE_ATTACH_FSCREDS)) {
- mutex_unlock(&task->signal->cred_guard_mutex);
+ mutex_unlock(&task->signal->exec_update_mutex);
return -EPERM;
}
return 0;
@@ -417,7 +417,7 @@ static int lock_trace(struct task_struct *task)
static void unlock_trace(struct task_struct *task)
{
- mutex_unlock(&task->signal->cred_guard_mutex);
+ mutex_unlock(&task->signal->exec_update_mutex);
}
#ifdef CONFIG_STACKTRACE
--
1.9.1
This removes an outdated comment in prepare_kernel_cred.
There is no "cred_replace_mutex" any more, so the comment must
go away.
Signed-off-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
Reviewed-by: Kees Cook <keescook(a)chromium.org>
---
kernel/cred.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/kernel/cred.c b/kernel/cred.c
index 809a985..71a7926 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -675,8 +675,6 @@ void __init cred_init(void)
* The caller may change these controls afterwards if desired.
*
* Returns the new credentials or NULL if out of memory.
- *
- * Does not take, and does not return holding current->cred_replace_mutex.
*/
struct cred *prepare_kernel_cred(struct task_struct *daemon)
{
--
1.9.1
This removes a duplicate "a" in the comment in process_vm_rw_core.
Signed-off-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
Reviewed-by: Kees Cook <keescook(a)chromium.org>
---
mm/process_vm_access.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
index de41e83..74e957e 100644
--- a/mm/process_vm_access.c
+++ b/mm/process_vm_access.c
@@ -206,7 +206,7 @@ static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
if (!mm || IS_ERR(mm)) {
rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
/*
- * Explicitly map EACCES to EPERM as EPERM is a more a
+ * Explicitly map EACCES to EPERM as EPERM is a more
* appropriate error code for process_vw_readv/writev
*/
if (rc == -EACCES)
--
1.9.1
This fixes a deadlock in the tracer when tracing a multi-threaded
application that calls execve while more than one thread are running.
I observed that when running strace on the gcc test suite, it always
blocks after a while, when expect calls execve, because other threads
have to be terminated. They send ptrace events, but the strace is no
longer able to respond, since it is blocked in vm_access.
The deadlock is always happening when strace needs to access the
tracees process mmap, while another thread in the tracee starts to
execve a child process, but that cannot continue until the
PTRACE_EVENT_EXIT is handled and the WIFEXITED event is received:
strace D 0 30614 30584 0x00000000
Call Trace:
__schedule+0x3ce/0x6e0
schedule+0x5c/0xd0
schedule_preempt_disabled+0x15/0x20
__mutex_lock.isra.13+0x1ec/0x520
__mutex_lock_killable_slowpath+0x13/0x20
mutex_lock_killable+0x28/0x30
mm_access+0x27/0xa0
process_vm_rw_core.isra.3+0xff/0x550
process_vm_rw+0xdd/0xf0
__x64_sys_process_vm_readv+0x31/0x40
do_syscall_64+0x64/0x220
entry_SYSCALL_64_after_hwframe+0x44/0xa9
expect D 0 31933 30876 0x80004003
Call Trace:
__schedule+0x3ce/0x6e0
schedule+0x5c/0xd0
flush_old_exec+0xc4/0x770
load_elf_binary+0x35a/0x16c0
search_binary_handler+0x97/0x1d0
__do_execve_file.isra.40+0x5d4/0x8a0
__x64_sys_execve+0x49/0x60
do_syscall_64+0x64/0x220
entry_SYSCALL_64_after_hwframe+0x44/0xa9
This changes mm_access to use the new exec_update_mutex
instead of cred_guard_mutex.
This patch is based on the following patch by Eric W. Biederman:
"[PATCH 0/5] Infrastructure to allow fixing exec deadlocks"
Link: https://lore.kernel.org/lkml/87v9ne5y4y.fsf_-_@x220.int.ebiederm.org/
Signed-off-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
Reviewed-by: Kees Cook <keescook(a)chromium.org>
---
kernel/fork.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index 036b692..e23ccac 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1224,7 +1224,7 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
struct mm_struct *mm;
int err;
- err = mutex_lock_killable(&task->signal->cred_guard_mutex);
+ err = mutex_lock_killable(&task->signal->exec_update_mutex);
if (err)
return ERR_PTR(err);
@@ -1234,7 +1234,7 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
mmput(mm);
mm = ERR_PTR(-EACCES);
}
- mutex_unlock(&task->signal->cred_guard_mutex);
+ mutex_unlock(&task->signal->exec_update_mutex);
return mm;
}
--
1.9.1
I have read through the code in exec_mmap and I do not see anything
that depends on sighand or the sighand lock, or on signals in anyway
so this should be safe.
This rearrangement of code has two significant benefits. It makes
the determination of passing the point of no return by testing bprm->mm
accurate. All failures prior to that point in flush_old_exec are
either truly recoverable or they are fatal.
Further this consolidates all of the possible indefinite waits for
userspace together at the top of flush_old_exec. The possible wait
for a ptracer on PTRACE_EVENT_EXIT, the possible wait for a page fault
to be resolved in clear_child_tid, and the possible wait for a page
fault in exit_robust_list.
This consolidation allows the creation of a mutex to replace
cred_guard_mutex that is not held over possible indefinite userspace
waits. Which will allow removing deadlock scenarios from the kernel.
Signed-off-by: "Eric W. Biederman" <ebiederm(a)xmission.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
Reviewed-by: Kees Cook <keescook(a)chromium.org>
Reviewed-by: Kirill Tkhai <ktkhai(a)virtuozzo.com>
---
fs/exec.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/fs/exec.c b/fs/exec.c
index 215d86f7..d820a72 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1272,18 +1272,6 @@ int flush_old_exec(struct linux_binprm * bprm)
if (retval)
goto out;
-#ifdef CONFIG_POSIX_TIMERS
- exit_itimers(me->signal);
- flush_itimer_signals();
-#endif
-
- /*
- * Make the signal table private.
- */
- retval = unshare_sighand(me);
- if (retval)
- goto out;
-
/*
* Must be called _before_ exec_mmap() as bprm->mm is
* not visibile until then. This also enables the update
@@ -1307,6 +1295,18 @@ int flush_old_exec(struct linux_binprm * bprm)
*/
bprm->mm = NULL;
+#ifdef CONFIG_POSIX_TIMERS
+ exit_itimers(me->signal);
+ flush_itimer_signals();
+#endif
+
+ /*
+ * Make the signal table private.
+ */
+ retval = unshare_sighand(me);
+ if (retval)
+ goto out;
+
set_fs(USER_DS);
me->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD |
PF_NOFREEZE | PF_NO_SETAFFINITY);
--
1.9.1
These functions have very little to do with de_thread move them out
of de_thread an into flush_old_exec proper so it can be more clearly
seen what flush_old_exec is doing.
Signed-off-by: "Eric W. Biederman" <ebiederm(a)xmission.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
Reviewed-by: Kees Cook <keescook(a)chromium.org>
Acked-by: Christian Brauner <christian.brauner(a)ubuntu.com>
Reviewed-by: Kirill Tkhai <ktkhai(a)virtuozzo.com>
---
fs/exec.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/exec.c b/fs/exec.c
index ff74b9a..215d86f7 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1189,11 +1189,6 @@ static int de_thread(struct task_struct *tsk)
/* we have changed execution domain */
tsk->exit_signal = SIGCHLD;
-#ifdef CONFIG_POSIX_TIMERS
- exit_itimers(sig);
- flush_itimer_signals();
-#endif
-
BUG_ON(!thread_group_leader(tsk));
return 0;
@@ -1277,6 +1272,11 @@ int flush_old_exec(struct linux_binprm * bprm)
if (retval)
goto out;
+#ifdef CONFIG_POSIX_TIMERS
+ exit_itimers(me->signal);
+ flush_itimer_signals();
+#endif
+
/*
* Make the signal table private.
*/
--
1.9.1
This makes the code clearer and makes it easier to implement a mutex
that is not taken over any locations that may block indefinitely waiting
for userspace.
Signed-off-by: "Eric W. Biederman" <ebiederm(a)xmission.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
Reviewed-by: Kees Cook <keescook(a)chromium.org>
Acked-by: Christian Brauner <christian.brauner(a)ubuntu.com>
Reviewed-by: Kirill Tkhai <ktkhai(a)virtuozzo.com>
---
fs/exec.c | 39 ++++++++++++++++++++++++++-------------
1 file changed, 26 insertions(+), 13 deletions(-)
diff --git a/fs/exec.c b/fs/exec.c
index c3f3479..ff74b9a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1194,6 +1194,23 @@ static int de_thread(struct task_struct *tsk)
flush_itimer_signals();
#endif
+ BUG_ON(!thread_group_leader(tsk));
+ return 0;
+
+killed:
+ /* protects against exit_notify() and __exit_signal() */
+ read_lock(&tasklist_lock);
+ sig->group_exit_task = NULL;
+ sig->notify_count = 0;
+ read_unlock(&tasklist_lock);
+ return -EAGAIN;
+}
+
+
+static int unshare_sighand(struct task_struct *me)
+{
+ struct sighand_struct *oldsighand = me->sighand;
+
if (refcount_read(&oldsighand->count) != 1) {
struct sighand_struct *newsighand;
/*
@@ -1210,23 +1227,13 @@ static int de_thread(struct task_struct *tsk)
write_lock_irq(&tasklist_lock);
spin_lock(&oldsighand->siglock);
- rcu_assign_pointer(tsk->sighand, newsighand);
+ rcu_assign_pointer(me->sighand, newsighand);
spin_unlock(&oldsighand->siglock);
write_unlock_irq(&tasklist_lock);
__cleanup_sighand(oldsighand);
}
-
- BUG_ON(!thread_group_leader(tsk));
return 0;
-
-killed:
- /* protects against exit_notify() and __exit_signal() */
- read_lock(&tasklist_lock);
- sig->group_exit_task = NULL;
- sig->notify_count = 0;
- read_unlock(&tasklist_lock);
- return -EAGAIN;
}
char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
@@ -1264,14 +1271,20 @@ int flush_old_exec(struct linux_binprm * bprm)
int retval;
/*
- * Make sure we have a private signal table and that
- * we are unassociated from the previous thread group.
+ * Make this the only thread in the thread group.
*/
retval = de_thread(me);
if (retval)
goto out;
/*
+ * Make the signal table private.
+ */
+ retval = unshare_sighand(me);
+ if (retval)
+ goto out;
+
+ /*
* Must be called _before_ exec_mmap() as bprm->mm is
* not visibile until then. This also enables the update
* to be lockless.
--
1.9.1
Make it clear that current only needs to be computed once in
flush_old_exec. This may have some efficiency improvements and it
makes the code easier to change.
Signed-off-by: "Eric W. Biederman" <ebiederm(a)xmission.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger(a)hotmail.de>
Reviewed-by: Kees Cook <keescook(a)chromium.org>
Acked-by: Christian Brauner <christian.brauner(a)ubuntu.com>
Reviewed-by: Kirill Tkhai <ktkhai(a)virtuozzo.com>
---
fs/exec.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/exec.c b/fs/exec.c
index db17be5..c3f3479 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1260,13 +1260,14 @@ void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec)
*/
int flush_old_exec(struct linux_binprm * bprm)
{
+ struct task_struct *me = current;
int retval;
/*
* Make sure we have a private signal table and that
* we are unassociated from the previous thread group.
*/
- retval = de_thread(current);
+ retval = de_thread(me);
if (retval)
goto out;
@@ -1294,10 +1295,10 @@ int flush_old_exec(struct linux_binprm * bprm)
bprm->mm = NULL;
set_fs(USER_DS);
- current->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD |
+ me->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD |
PF_NOFREEZE | PF_NO_SETAFFINITY);
flush_thread();
- current->personality &= ~bprm->per_clear;
+ me->personality &= ~bprm->per_clear;
/*
* We have to apply CLOEXEC before we change whether the process is
@@ -1305,7 +1306,7 @@ int flush_old_exec(struct linux_binprm * bprm)
* trying to access the should-be-closed file descriptors of a process
* undergoing exec(2).
*/
- do_close_on_exec(current->files);
+ do_close_on_exec(me->files);
return 0;
out:
--
1.9.1
Hello,
We ran automated tests on a recent commit from this kernel tree:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: bea94317c526 - Linux 5.5.11-rc3
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: OK
Tests: FAILED
All kernel binaries, config files, and logs are available for download here:
https://cki-artifacts.s3.us-east-2.amazonaws.com/index.html?prefix=dataware…
One or more kernel tests failed:
ppc64le:
❌ LTP
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Compile testing
---------------
We compiled the kernel for 4 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
s390x:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
✅ LTP
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking socket: fuzz
✅ Networking sctp-auth: sockopts test
✅ Networking: igmp conformance test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - transport
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ storage: SCSI VPD
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ❌ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ Usex - version 1.9-29
🚧 ✅ storage: dm/common
Host 2:
✅ Boot test
✅ xfstests - ext4
✅ xfstests - xfs
✅ selinux-policy: serge-testsuite
✅ lvm thinp sanity
✅ storage: software RAID testing
🚧 ✅ Storage blktests
ppc64le:
Host 1:
✅ Boot test
✅ xfstests - ext4
✅ xfstests - xfs
✅ selinux-policy: serge-testsuite
✅ lvm thinp sanity
✅ storage: software RAID testing
🚧 ✅ IPMI driver test
🚧 ✅ IPMItool loop stress test
🚧 ✅ Storage blktests
Host 2:
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
❌ LTP
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking socket: fuzz
✅ Networking sctp-auth: sockopts test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ❌ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ Usex - version 1.9-29
🚧 ✅ storage: dm/common
s390x:
Host 1:
✅ Boot test
✅ selinux-policy: serge-testsuite
🚧 ✅ Storage blktests
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
⚡⚡⚡ Podman system integration test - as root
✅ Podman system integration test - as user
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking sctp-auth: sockopts test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - transport
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ❌ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ storage: dm/common
x86_64:
Host 1:
✅ Boot test
✅ Storage SAN device stress - megaraid_sas
Host 2:
✅ Boot test
✅ Storage SAN device stress - mpt3sas driver
Host 3:
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
✅ LTP
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking socket: fuzz
✅ Networking sctp-auth: sockopts test
✅ Networking: igmp conformance test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - transport
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ pciutils: sanity smoke test
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ storage: SCSI VPD
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ❌ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ Usex - version 1.9-29
🚧 ✅ storage: dm/common
Host 4:
✅ Boot test
✅ xfstests - ext4
✅ xfstests - xfs
✅ selinux-policy: serge-testsuite
✅ lvm thinp sanity
✅ storage: software RAID testing
✅ stress: stress-ng
🚧 ✅ IOMMU boot test
🚧 ✅ IPMI driver test
🚧 ✅ IPMItool loop stress test
🚧 ✅ Storage blktests
Test sources: https://github.com/CKI-project/tests-beaker
💚 Pull requests are welcome for new tests or improvements to existing tests!
Aborted tests
-------------
Tests that didn't complete running successfully are marked with ⚡⚡⚡.
If this was caused by an infrastructure issue, we try to mark that
explicitly in the report.
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Testing timeout
---------------
We aim to provide a report within reasonable timeframe. Tests that haven't
finished running yet are marked with ⏱.
Hi
[This is an automated email]
This commit has been processed because it contains a -stable tag.
The stable tag indicates that it's relevant for the following trees: all
The bot has tested the following trees: v5.5.10, v5.4.26, v4.19.111, v4.14.173, v4.9.216, v4.4.216.
v5.5.10: Build OK!
v5.4.26: Build OK!
v4.19.111: Build OK!
v4.14.173: Build OK!
v4.9.216: Failed to apply! Possible dependencies:
Unable to calculate
v4.4.216: Failed to apply! Possible dependencies:
Unable to calculate
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks
Sasha
Sachin reports [1] a crash in SLUB __slab_alloc():
BUG: Kernel NULL pointer dereference on read at 0x000073b0
Faulting instruction address: 0xc0000000003d55f4
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 19 PID: 1 Comm: systemd Not tainted 5.6.0-rc2-next-20200218-autotest #1
NIP: c0000000003d55f4 LR: c0000000003d5b94 CTR: 0000000000000000
REGS: c0000008b37836d0 TRAP: 0300 Not tainted (5.6.0-rc2-next-20200218-autotest)
MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24004844 XER: 00000000
CFAR: c00000000000dec4 DAR: 00000000000073b0 DSISR: 40000000 IRQMASK: 1
GPR00: c0000000003d5b94 c0000008b3783960 c00000000155d400 c0000008b301f500
GPR04: 0000000000000dc0 0000000000000002 c0000000003443d8 c0000008bb398620
GPR08: 00000008ba2f0000 0000000000000001 0000000000000000 0000000000000000
GPR12: 0000000024004844 c00000001ec52a00 0000000000000000 0000000000000000
GPR16: c0000008a1b20048 c000000001595898 c000000001750c18 0000000000000002
GPR20: c000000001750c28 c000000001624470 0000000fffffffe0 5deadbeef0000122
GPR24: 0000000000000001 0000000000000dc0 0000000000000002 c0000000003443d8
GPR28: c0000008b301f500 c0000008bb398620 0000000000000000 c00c000002287180
NIP [c0000000003d55f4] ___slab_alloc+0x1f4/0x760
LR [c0000000003d5b94] __slab_alloc+0x34/0x60
Call Trace:
[c0000008b3783960] [c0000000003d5734] ___slab_alloc+0x334/0x760 (unreliable)
[c0000008b3783a40] [c0000000003d5b94] __slab_alloc+0x34/0x60
[c0000008b3783a70] [c0000000003d6fa0] __kmalloc_node+0x110/0x490
[c0000008b3783af0] [c0000000003443d8] kvmalloc_node+0x58/0x110
[c0000008b3783b30] [c0000000003fee38] mem_cgroup_css_online+0x108/0x270
[c0000008b3783b90] [c000000000235aa8] online_css+0x48/0xd0
[c0000008b3783bc0] [c00000000023eaec] cgroup_apply_control_enable+0x2ec/0x4d0
[c0000008b3783ca0] [c000000000242318] cgroup_mkdir+0x228/0x5f0
[c0000008b3783d10] [c00000000051e170] kernfs_iop_mkdir+0x90/0xf0
[c0000008b3783d50] [c00000000043dc00] vfs_mkdir+0x110/0x230
[c0000008b3783da0] [c000000000441c90] do_mkdirat+0xb0/0x1a0
[c0000008b3783e20] [c00000000000b278] system_call+0x5c/0x68
This is a PowerPC platform with following NUMA topology:
available: 2 nodes (0-1)
node 0 cpus:
node 0 size: 0 MB
node 0 free: 0 MB
node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
node 1 size: 35247 MB
node 1 free: 30907 MB
node distances:
node 0 1
0: 10 40
1: 40 10
possible numa nodes: 0-31
This only happens with a mmotm patch "mm/memcontrol.c: allocate shrinker_map on
appropriate NUMA node" [2] which effectively calls kmalloc_node for each
possible node. SLUB however only allocates kmem_cache_node on online
N_NORMAL_MEMORY nodes, and relies on node_to_mem_node to return such valid node
for other nodes since commit a561ce00b09e ("slub: fall back to
node_to_mem_node() node if allocating on memoryless node"). This is however not
true in this configuration where the _node_numa_mem_ array is not initialized
for nodes 0 and 2-31, thus it contains zeroes and get_partial() ends up
accessing non-allocated kmem_cache_node.
A related issue was reported by Bharata (originally by Ramachandran) [3] where
a similar PowerPC configuration, but with mainline kernel without patch [2]
ends up allocating large amounts of pages by kmalloc-1k kmalloc-512. This seems
to have the same underlying issue with node_to_mem_node() not behaving as
expected, and might probably also lead to an infinite loop with
CONFIG_SLUB_CPU_PARTIAL [4].
This patch should fix both issues by not relying on node_to_mem_node() anymore
and instead simply falling back to NUMA_NO_NODE, when kmalloc_node(node) is
attempted for a node that's not online, or has no usable memory. The "usable
memory" condition is also changed from node_present_pages() to N_NORMAL_MEMORY
node state, as that is exactly the condition that SLUB uses to allocate
kmem_cache_node structures. The check in get_partial() is removed completely,
as the checks in ___slab_alloc() are now sufficient to prevent get_partial()
being reached with an invalid node.
[1] https://lore.kernel.org/linux-next/3381CD91-AB3D-4773-BA04-E7A072A63968@lin…
[2] https://lore.kernel.org/linux-mm/fff0e636-4c36-ed10-281c-8cdb0687c839@virtu…
[3] https://lore.kernel.org/linux-mm/20200317092624.GB22538@in.ibm.com/
[4] https://lore.kernel.org/linux-mm/088b5996-faae-8a56-ef9c-5b567125ae54@suse.…
Reported-and-tested-by: Sachin Sant <sachinp(a)linux.vnet.ibm.com>
Reported-by: PUVICHAKRAVARTHY RAMACHANDRAN <puvichakravarthy(a)in.ibm.com>
Tested-by: Bharata B Rao <bharata(a)linux.ibm.com>
Debugged-by: Srikar Dronamraju <srikar(a)linux.vnet.ibm.com>
Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz>
Fixes: a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node")
Cc: stable(a)vger.kernel.org
Cc: Mel Gorman <mgorman(a)techsingularity.net>
Cc: Michael Ellerman <mpe(a)ellerman.id.au>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Christopher Lameter <cl(a)linux.com>
Cc: linuxppc-dev(a)lists.ozlabs.org
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Kirill Tkhai <ktkhai(a)virtuozzo.com>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: Nathan Lynch <nathanl(a)linux.ibm.com>
---
Hi, after the RFC got positive test results from reporters, I'm resending
as a proper patch.
Thanks,
Vlastimil
mm/slub.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index 17dc00e33115..7113b1f9cd77 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1973,8 +1973,6 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node,
if (node == NUMA_NO_NODE)
searchnode = numa_mem_id();
- else if (!node_present_pages(node))
- searchnode = node_to_mem_node(node);
object = get_partial_node(s, get_node(s, searchnode), c, flags);
if (object || node != NUMA_NO_NODE)
@@ -2563,17 +2561,27 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
struct page *page;
page = c->page;
- if (!page)
+ if (!page) {
+ /*
+ * if the node is not online or has no normal memory, just
+ * ignore the node constraint
+ */
+ if (unlikely(node != NUMA_NO_NODE &&
+ !node_state(node, N_NORMAL_MEMORY)))
+ node = NUMA_NO_NODE;
goto new_slab;
+ }
redo:
if (unlikely(!node_match(page, node))) {
- int searchnode = node;
-
- if (node != NUMA_NO_NODE && !node_present_pages(node))
- searchnode = node_to_mem_node(node);
-
- if (unlikely(!node_match(page, searchnode))) {
+ /*
+ * same as above but node_match() being false already
+ * implies node != NUMA_NO_NODE
+ */
+ if (!node_state(node, N_NORMAL_MEMORY)) {
+ node = NUMA_NO_NODE;
+ goto redo;
+ } else {
stat(s, ALLOC_NODE_MISMATCH);
deactivate_slab(s, page, c->freelist, c);
goto new_slab;
--
2.25.1
When a cfs rq is throttled, the latter and its child are removed from the
leaf list but their nr_running is not changed which includes staying higher
than 1. When a task is enqueued in this throttled branch, the cfs rqs must
be added back in order to ensure correct ordering in the list but this can
only happens if nr_running == 1.
When cfs bandwidth is used, we call unconditionnaly list_add_leaf_cfs_rq()
when enqueuing an entity to make sure that the complete branch will be
added.
Similarly unthrottle_cfs_rq() can stop adding cfs in the list when a parent
is throttled. Iterate the remaining entity to ensure that the complete
branch will be added in the list.
Reported-by: Christian Borntraeger <borntraeger(a)de.ibm.com>
Tested-by: Christian Borntraeger <borntraeger(a)de.ibm.com>
Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com>
Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com>
Cc: stable(a)vger.kernel.org #v5.1+
Signed-off-by: Vincent Guittot <vincent.guittot(a)linaro.org>
---
Change since v1:
- added the iteration at the end of unthrottle_cfs_rq() as Dietmar
reported use case which triggered assert_list_leaf_cfs_rq()
kernel/sched/fair.c | 26 ++++++++++++++++++++++----
1 file changed, 22 insertions(+), 4 deletions(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index fcc968669aea..ae50a09cbead 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4117,6 +4117,7 @@ static inline void check_schedstat_required(void)
#endif
}
+static inline bool cfs_bandwidth_used(void);
/*
* MIGRATION
@@ -4195,10 +4196,16 @@ enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
__enqueue_entity(cfs_rq, se);
se->on_rq = 1;
- if (cfs_rq->nr_running == 1) {
+ /*
+ * When bandwidth control is enabled, cfs might have been removed
+ * because of a parent been throttled but cfs->nr_running > 1. Try to
+ * add it unconditionnally.
+ */
+ if (cfs_rq->nr_running == 1 || cfs_bandwidth_used())
list_add_leaf_cfs_rq(cfs_rq);
+
+ if (cfs_rq->nr_running == 1)
check_enqueue_throttle(cfs_rq);
- }
}
static void __clear_buddies_last(struct sched_entity *se)
@@ -4779,11 +4786,22 @@ void unthrottle_cfs_rq(struct cfs_rq *cfs_rq)
break;
}
- assert_list_leaf_cfs_rq(rq);
-
if (!se)
add_nr_running(rq, task_delta);
+ /*
+ * The cfs_rq_throttled() breaks in the above iteration can result in
+ * incomplete leaf list maintenance, resulting in triggering the
+ * assertion below.
+ */
+ for_each_sched_entity(se) {
+ cfs_rq = cfs_rq_of(se);
+
+ list_add_leaf_cfs_rq(cfs_rq);
+ }
+
+ assert_list_leaf_cfs_rq(rq);
+
/* Determine whether we need to wake up potentially idle CPU: */
if (rq->curr == rq->idle && rq->cfs.nr_running)
resched_curr(rq);
--
2.17.1
Hello,
We ran automated tests on a recent commit from this kernel tree:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: c0ef7f763513 - Linux 5.5.11-rc2
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: FAILED
All kernel binaries, config files, and logs are available for download here:
https://cki-artifacts.s3.us-east-2.amazonaws.com/index.html?prefix=dataware…
We attempted to compile the kernel for multiple architectures, but the compile
failed on one or more architectures:
aarch64: FAILED (see build-aarch64.log.xz attachment)
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Compile testing
---------------
We compiled the kernel for 4 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
s390x:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hello,
We ran automated tests on a recent commit from this kernel tree:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: e9842f9e58e1 - Linux 5.5.11-rc1
The results of these automated tests are provided below.
Overall result: FAILED (see details below)
Merge: OK
Compile: FAILED
All kernel binaries, config files, and logs are available for download here:
https://cki-artifacts.s3.us-east-2.amazonaws.com/index.html?prefix=dataware…
We attempted to compile the kernel for multiple architectures, but the compile
failed on one or more architectures:
aarch64: FAILED (see build-aarch64.log.xz attachment)
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Compile testing
---------------
We compiled the kernel for 4 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
s390x:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
The patch below does not apply to the 5.5-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 1292e3efb149ee21d8d33d725eeed4e6b1ade963 Mon Sep 17 00:00:00 2001
From: Ulf Hansson <ulf.hansson(a)linaro.org>
Date: Tue, 10 Mar 2020 12:49:43 +0100
Subject: [PATCH] mmc: core: Allow host controllers to require R1B for CMD6
It has turned out that some host controllers can't use R1B for CMD6 and
other commands that have R1B associated with them. Therefore invent a new
host cap, MMC_CAP_NEED_RSP_BUSY to let them specify this.
In __mmc_switch(), let's check the flag and use it to prevent R1B responses
from being converted into R1. Note that, this also means that the host are
on its own, when it comes to manage the busy timeout.
Suggested-by: Sowjanya Komatineni <skomatineni(a)nvidia.com>
Cc: <stable(a)vger.kernel.org>
Tested-by: Anders Roxell <anders.roxell(a)linaro.org>
Tested-by: Sowjanya Komatineni <skomatineni(a)nvidia.com>
Tested-by: Faiz Abbas <faiz_abbas(a)ti.com>
Tested-By: Peter Geis <pgwipeout(a)gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org>
diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
index da425ee2d9bf..e025604e17d4 100644
--- a/drivers/mmc/core/mmc_ops.c
+++ b/drivers/mmc/core/mmc_ops.c
@@ -542,9 +542,11 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
* If the max_busy_timeout of the host is specified, make sure it's
* enough to fit the used timeout_ms. In case it's not, let's instruct
* the host to avoid HW busy detection, by converting to a R1 response
- * instead of a R1B.
+ * instead of a R1B. Note, some hosts requires R1B, which also means
+ * they are on their own when it comes to deal with the busy timeout.
*/
- if (host->max_busy_timeout && (timeout_ms > host->max_busy_timeout))
+ if (!(host->caps & MMC_CAP_NEED_RSP_BUSY) && host->max_busy_timeout &&
+ (timeout_ms > host->max_busy_timeout))
use_r1b_resp = false;
cmd.opcode = MMC_SWITCH;
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index ba703384bea0..4c5eb3aa8e72 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -333,6 +333,7 @@ struct mmc_host {
MMC_CAP_UHS_SDR50 | MMC_CAP_UHS_SDR104 | \
MMC_CAP_UHS_DDR50)
#define MMC_CAP_SYNC_RUNTIME_PM (1 << 21) /* Synced runtime PM suspends. */
+#define MMC_CAP_NEED_RSP_BUSY (1 << 22) /* Commands with R1B can't use R1. */
#define MMC_CAP_DRIVER_TYPE_A (1 << 23) /* Host supports Driver Type A */
#define MMC_CAP_DRIVER_TYPE_C (1 << 24) /* Host supports Driver Type C */
#define MMC_CAP_DRIVER_TYPE_D (1 << 25) /* Host supports Driver Type D */
As mentioned in an earlier email thread [1], 4.19.99 broke the ability
to create stateful and stateless device links between the same set of
devices when it pulled in a valid bug fix [2]. While the fix was valid,
it removes a functionality that was present before the bug fix.
This patch series attempts to fix that by pulling in more patches from
upstream. I've just done compilation testing so far. But wanted to send
out a v1 to see if this patch list was acceptable before I fixed up the
commit text format to match what's needed for stable mailing list.
Some of the patches are new functionality, but for a first pass, it was
easier to pull these in than try and fix the conflicts. If these patches
are okay to pull into stable, then all I need to do is fix the commit
text.
Thanks,
Saravana
[1] - https://lore.kernel.org/stable/CAGETcx-0dKRWo=tTVcfJQhQUsMtX_LtL6yvDkb3CMbv…
[2] - 6fdc440366f1a99f344b629ac92f350aefd77911
Rafael J. Wysocki (5):
driver core: Fix adding device links to probing suppliers
driver core: Make driver core own stateful device links
driver core: Add device link flag DL_FLAG_AUTOPROBE_CONSUMER
driver core: Remove device link creation limitation
driver core: Fix creation of device links with PM-runtime flags
Yong Wu (1):
driver core: Remove the link if there is no driver with AUTO flag
Documentation/driver-api/device_link.rst | 63 +++--
drivers/base/core.c | 293 +++++++++++++++++------
drivers/base/dd.c | 2 +-
drivers/base/power/runtime.c | 4 +-
include/linux/device.h | 7 +-
5 files changed, 265 insertions(+), 104 deletions(-)
--
2.25.1.481.gfbce0eb801-goog
Prior, passing in chunks of 2, 3, or 4, followed by any additional
chunks would result in the chacha state counter getting out of sync,
resulting in incorrect encryption/decryption, which is a pretty nasty
crypto vuln, dating back to 2018. WireGuard users never experienced this
prior, because we have always, out of tree, used a different crypto
library, until the recent Frankenzinc addition. This commit fixes the
issue by advancing the pointers and state counter by the actual size
processed.
Fixes: f2ca1cbd0fb5 ("crypto: arm64/chacha - optimize for arbitrary length inputs")
Reported-and-tested-by: Emil Renner Berthing <kernel(a)esmil.dk>
Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com>
Cc: Ard Biesheuvel <ardb(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
arch/arm64/crypto/chacha-neon-glue.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/crypto/chacha-neon-glue.c b/arch/arm64/crypto/chacha-neon-glue.c
index c1f9660d104c..debb1de0d3dd 100644
--- a/arch/arm64/crypto/chacha-neon-glue.c
+++ b/arch/arm64/crypto/chacha-neon-glue.c
@@ -55,10 +55,10 @@ static void chacha_doneon(u32 *state, u8 *dst, const u8 *src,
break;
}
chacha_4block_xor_neon(state, dst, src, nrounds, l);
- bytes -= CHACHA_BLOCK_SIZE * 5;
- src += CHACHA_BLOCK_SIZE * 5;
- dst += CHACHA_BLOCK_SIZE * 5;
- state[12] += 5;
+ bytes -= l;
+ src += l;
+ dst += l;
+ state[12] += round_up(l, CHACHA_BLOCK_SIZE) / CHACHA_BLOCK_SIZE;
}
}
--
2.25.1
Dear Sir/Madam,,
Please confirm and give quotation as per attached,quote according
to Bill of
materials
Highlighted items will be supplied in large quantity.
Kind Regards.
Wilson Jasper
Purchase Manager
Walker Construction (UK) Ltd.
I will like a receipt of your acknowledgment mail.
When the CAL driver stops streaming, it will shut everything down
without waiting for the current frame to finish. This leaves the CAL DMA
in a slightly undefined state, and when CAL DMA is enabled when the
stream is started the next time, the old DMA transfer will continue.
It is not clear if the old DMA transfer continues with the exact
settings of the original transfer, or is it a mix of old and new
settings, but in any case the end result is memory corruption as the
destination memory address is no longer valid.
I could not find any way to ensure that any old DMA transfer would be
discarded, except perhaps full CAL reset. But we cannot do a full reset
when one port is getting enabled, as that would reset both ports.
This patch tries to make sure that the DMA transfer is finished properly
when the stream is being stopped. I say "tries", as, as mentioned above,
I don't see a way to force the DMA transfer to finish. I believe this
fixes the corruptions for normal cases, but if for some reason the DMA
of the final frame would stall a lot, resulting in timeout in the code
waiting for the DMA to finish, we'll again end up with unfinished DMA
transfer. However, I don't know what could cause such a timeout.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ti.com>
Cc: stable(a)vger.kernel.org
---
drivers/media/platform/ti-vpe/cal.c | 32 +++++++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
index 6c8f3702eac0..9dd6de14189b 100644
--- a/drivers/media/platform/ti-vpe/cal.c
+++ b/drivers/media/platform/ti-vpe/cal.c
@@ -412,6 +412,8 @@ struct cal_ctx {
struct cal_buffer *cur_frm;
/* Pointer pointing to next v4l2_buffer */
struct cal_buffer *next_frm;
+
+ bool dma_act;
};
static const struct cal_fmt *find_format_by_pix(struct cal_ctx *ctx,
@@ -942,6 +944,7 @@ static void csi2_lane_config(struct cal_ctx *ctx)
static void csi2_ppi_enable(struct cal_ctx *ctx)
{
+ reg_write(ctx->dev, CAL_CSI2_PPI_CTRL(ctx->csi2_port), BIT(3));
reg_write_field(ctx->dev, CAL_CSI2_PPI_CTRL(ctx->csi2_port),
CAL_GEN_ENABLE, CAL_CSI2_PPI_CTRL_IF_EN_MASK);
}
@@ -1204,15 +1207,25 @@ static irqreturn_t cal_irq(int irq_cal, void *data)
if (isportirqset(irqst2, 1)) {
ctx = dev->ctx[0];
+ spin_lock(&ctx->slock);
+ ctx->dma_act = false;
+
if (ctx->cur_frm != ctx->next_frm)
cal_process_buffer_complete(ctx);
+
+ spin_unlock(&ctx->slock);
}
if (isportirqset(irqst2, 2)) {
ctx = dev->ctx[1];
+ spin_lock(&ctx->slock);
+ ctx->dma_act = false;
+
if (ctx->cur_frm != ctx->next_frm)
cal_process_buffer_complete(ctx);
+
+ spin_unlock(&ctx->slock);
}
}
@@ -1228,6 +1241,7 @@ static irqreturn_t cal_irq(int irq_cal, void *data)
dma_q = &ctx->vidq;
spin_lock(&ctx->slock);
+ ctx->dma_act = true;
if (!list_empty(&dma_q->active) &&
ctx->cur_frm == ctx->next_frm)
cal_schedule_next_buffer(ctx);
@@ -1239,6 +1253,7 @@ static irqreturn_t cal_irq(int irq_cal, void *data)
dma_q = &ctx->vidq;
spin_lock(&ctx->slock);
+ ctx->dma_act = true;
if (!list_empty(&dma_q->active) &&
ctx->cur_frm == ctx->next_frm)
cal_schedule_next_buffer(ctx);
@@ -1711,10 +1726,27 @@ static void cal_stop_streaming(struct vb2_queue *vq)
struct cal_ctx *ctx = vb2_get_drv_priv(vq);
struct cal_dmaqueue *dma_q = &ctx->vidq;
struct cal_buffer *buf, *tmp;
+ unsigned long timeout;
unsigned long flags;
int ret;
+ bool dma_act;
csi2_ppi_disable(ctx);
+
+ /* wait for stream and dma to finish */
+ dma_act = true;
+ timeout = jiffies + msecs_to_jiffies(500);
+ while (dma_act && time_before(jiffies, timeout)) {
+ msleep(50);
+
+ spin_lock_irqsave(&ctx->slock, flags);
+ dma_act = ctx->dma_act;
+ spin_unlock_irqrestore(&ctx->slock, flags);
+ }
+
+ if (dma_act)
+ ctx_err(ctx, "failed to disable dma cleanly\n");
+
disable_irqs(ctx);
csi2_phy_deinit(ctx);
--
Texas Instruments Finland Oy, Porkkalankatu 22, 00180 Helsinki.
Y-tunnus/Business ID: 0615521-4. Kotipaikka/Domicile: Helsinki
Hello,
We ran automated tests on a recent commit from this kernel tree:
Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: 0d188a9d230a - Linux 5.5.11-rc2
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
All kernel binaries, config files, and logs are available for download here:
https://cki-artifacts.s3.us-east-2.amazonaws.com/index.html?prefix=dataware…
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Compile testing
---------------
We compiled the kernel for 4 architectures:
aarch64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
ppc64le:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
s390x:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
x86_64:
make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg
Hardware testing
----------------
We booted each kernel and ran the following tests:
aarch64:
Host 1:
✅ Boot test
✅ xfstests - ext4
✅ xfstests - xfs
✅ selinux-policy: serge-testsuite
✅ lvm thinp sanity
✅ storage: software RAID testing
✅ stress: stress-ng
🚧 ✅ IPMI driver test
🚧 ✅ IPMItool loop stress test
🚧 ✅ Storage blktests
Host 2:
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
✅ LTP
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking socket: fuzz
✅ Networking sctp-auth: sockopts test
✅ Networking: igmp conformance test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - transport
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ storage: SCSI VPD
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ❌ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ Usex - version 1.9-29
🚧 ✅ storage: dm/common
ppc64le:
Host 1:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
✅ LTP
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking socket: fuzz
✅ Networking sctp-auth: sockopts test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ⚡⚡⚡ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ Usex - version 1.9-29
🚧 ✅ storage: dm/common
Host 2:
✅ Boot test
✅ xfstests - ext4
✅ xfstests - xfs
✅ selinux-policy: serge-testsuite
✅ lvm thinp sanity
✅ storage: software RAID testing
🚧 ✅ IPMI driver test
🚧 ✅ IPMItool loop stress test
🚧 ✅ Storage blktests
s390x:
Host 1:
✅ Boot test
✅ selinux-policy: serge-testsuite
🚧 ✅ Storage blktests
Host 2:
⚡ Internal infrastructure issues prevented one or more tests (marked
with ⚡⚡⚡) from running on this architecture.
This is not the fault of the kernel that was tested.
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking sctp-auth: sockopts test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - transport
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ⚡⚡⚡ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ storage: dm/common
x86_64:
Host 1:
✅ Boot test
✅ Podman system integration test - as root
✅ Podman system integration test - as user
✅ LTP
✅ Loopdev Sanity
✅ Memory function: memfd_create
✅ AMTU (Abstract Machine Test Utility)
✅ Networking bridge: sanity
✅ Ethernet drivers sanity
✅ Networking MACsec: sanity
✅ Networking socket: fuzz
✅ Networking sctp-auth: sockopts test
✅ Networking: igmp conformance test
✅ Networking route: pmtu
✅ Networking route_func - local
✅ Networking route_func - forward
✅ Networking TCP: keepalive test
✅ Networking UDP: socket
✅ Networking tunnel: geneve basic test
✅ Networking tunnel: gre basic
✅ L2TP basic test
✅ Networking tunnel: vxlan basic
✅ Networking ipsec: basic netns - transport
✅ Networking ipsec: basic netns - tunnel
✅ httpd: mod_ssl smoke sanity
✅ tuned: tune-processes-through-perf
✅ pciutils: sanity smoke test
✅ ALSA PCM loopback test
✅ ALSA Control (mixer) Userspace Element test
✅ storage: SCSI VPD
✅ trace: ftrace/tracer
🚧 ✅ CIFS Connectathon
🚧 ✅ POSIX pjd-fstest suites
🚧 ✅ jvm - DaCapo Benchmark Suite
🚧 ✅ jvm - jcstress tests
🚧 ✅ Memory function: kaslr
🚧 ✅ LTP: openposix test suite
🚧 ✅ Networking vnic: ipvlan/basic
🚧 ❌ audit: audit testsuite test
🚧 ✅ iotop: sanity
🚧 ✅ Usex - version 1.9-29
🚧 ✅ storage: dm/common
Host 2:
✅ Boot test
✅ xfstests - ext4
✅ xfstests - xfs
✅ selinux-policy: serge-testsuite
✅ lvm thinp sanity
✅ storage: software RAID testing
✅ stress: stress-ng
🚧 ✅ IOMMU boot test
🚧 ✅ IPMI driver test
🚧 ✅ IPMItool loop stress test
🚧 ✅ Storage blktests
Host 3:
✅ Boot test
✅ Storage SAN device stress - megaraid_sas
Host 4:
✅ Boot test
✅ Storage SAN device stress - mpt3sas driver
Test sources: https://github.com/CKI-project/tests-beaker
💚 Pull requests are welcome for new tests or improvements to existing tests!
Aborted tests
-------------
Tests that didn't complete running successfully are marked with ⚡⚡⚡.
If this was caused by an infrastructure issue, we try to mark that
explicitly in the report.
Waived tests
------------
If the test run included waived tests, they are marked with 🚧. Such tests are
executed but their results are not taken into account. Tests are waived when
their results are not reliable enough, e.g. when they're just introduced or are
being fixed.
Testing timeout
---------------
We aim to provide a report within reasonable timeframe. Tests that haven't
finished running yet are marked with ⏱.
The following commit has been merged into the perf/urgent branch of tip:
Commit-ID: be40920fbf1003c38ccdc02b571e01a75d890c82
Gitweb: https://git.kernel.org/tip/be40920fbf1003c38ccdc02b571e01a75d890c82
Author: Masami Hiramatsu <mhiramat(a)kernel.org>
AuthorDate: Sat, 07 Mar 2020 03:32:58 +09:00
Committer: Arnaldo Carvalho de Melo <acme(a)redhat.com>
CommitterDate: Fri, 06 Mar 2020 17:08:28 -03:00
tools: Let O= makes handle a relative path with -C option
When I tried to compile tools/perf from the top directory with the -C
option, the O= option didn't work correctly if I passed a relative path:
$ make O=BUILD -C tools/perf/
make: Entering directory '/home/mhiramat/ksrc/linux/tools/perf'
BUILD: Doing 'make -j8' parallel build
../scripts/Makefile.include:4: *** O=/home/mhiramat/ksrc/linux/tools/perf/BUILD does not exist. Stop.
make: *** [Makefile:70: all] Error 2
make: Leaving directory '/home/mhiramat/ksrc/linux/tools/perf'
The O= directory existence check failed because the check script ran in
the build target directory instead of the directory where I ran the make
command.
To fix that, once change directory to $(PWD) and check O= directory,
since the PWD is set to where the make command runs.
Fixes: c883122acc0d ("perf tools: Let O= makes handle relative paths")
Reported-by: Randy Dunlap <rdunlap(a)infradead.org>
Signed-off-by: Masami Hiramatsu <mhiramat(a)kernel.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Borislav Petkov <bp(a)alien8.de>
Cc: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: Jiri Olsa <jolsa(a)redhat.com>
Cc: Masahiro Yamada <masahiroy(a)kernel.org>
Cc: Michal Marek <michal.lkml(a)markovi.net>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Sasha Levin <sashal(a)kernel.org>
Cc: Steven Rostedt (VMware) <rostedt(a)goodmis.org>
Cc: stable(a)vger.kernel.org
Link: http://lore.kernel.org/lkml/158351957799.3363.15269768530697526765.stgit@de…
Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com>
---
tools/perf/Makefile | 2 +-
tools/scripts/Makefile.include | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 7902a56..b8fc7d9 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -35,7 +35,7 @@ endif
# Only pass canonical directory names as the output directory:
#
ifneq ($(O),)
- FULL_O := $(shell readlink -f $(O) || echo $(O))
+ FULL_O := $(shell cd $(PWD); readlink -f $(O) || echo $(O))
endif
#
diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
index ded7a95..6d2f3a1 100644
--- a/tools/scripts/Makefile.include
+++ b/tools/scripts/Makefile.include
@@ -1,8 +1,8 @@
# SPDX-License-Identifier: GPL-2.0
ifneq ($(O),)
ifeq ($(origin O), command line)
- dummy := $(if $(shell test -d $(O) || echo $(O)),$(error O=$(O) does not exist),)
- ABSOLUTE_O := $(shell cd $(O) ; pwd)
+ dummy := $(if $(shell cd $(PWD); test -d $(O) || echo $(O)),$(error O=$(O) does not exist),)
+ ABSOLUTE_O := $(shell cd $(PWD); cd $(O) ; pwd)
OUTPUT := $(ABSOLUTE_O)/$(if $(subdir),$(subdir)/)
COMMAND_O := O=$(ABSOLUTE_O)
ifeq ($(objtree),)
Fix to delete multiple probe event with filter correctly.
When we put an event with multiple probes, perf-probe fails
to delete with filters. This comes from a failure to list
up the event name because of overwrapping its name.
To fix this issue, skip to list up the event which has
same name.
Without this patch:
# perf probe -l \*
probe_perf:map__map_ip (on perf_sample__fprintf_brstackoff:21@
probe_perf:map__map_ip (on perf_sample__fprintf_brstackoff:25@
probe_perf:map__map_ip (on append_inlines:12@util/machine.c in
probe_perf:map__map_ip (on unwind_entry:19@util/machine.c in /
probe_perf:map__map_ip (on map__map_ip(a)util/map.h in /home/mhi
probe_perf:map__map_ip (on map__map_ip(a)util/map.h in /home/mhi
# perf probe -d \*
"*" does not hit any event.
Error: Failed to delete events. Reason: No such file or directory (Code: -2)
With this:
# perf probe -d \*
Removed event: probe_perf:map__map_ip
Fixes: 72363540c009 ("perf probe: Support multiprobe event")
Reported-by: Arnaldo Carvalho de Melo <acme(a)kernel.org>
Reported-by: He Zhe <zhe.he(a)windriver.com>
Signed-off-by: Masami Hiramatsu <mhiramat(a)kernel.org>
---
v2:
- Forward port on the latest perf/urgent tree.
- Add Fixes and Reporters.
---
tools/perf/util/probe-file.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
index 0f5fda11675f..8c852948513e 100644
--- a/tools/perf/util/probe-file.c
+++ b/tools/perf/util/probe-file.c
@@ -206,6 +206,9 @@ static struct strlist *__probe_file__get_namelist(int fd, bool include_group)
} else
ret = strlist__add(sl, tev.event);
clear_probe_trace_event(&tev);
+ /* Skip if there is same name multi-probe event in the list */
+ if (ret == -EEXIST)
+ ret = 0;
if (ret < 0)
break;
}
Dear Sir/Madam,,
Please confirm and give quotation as per attached,quote according
to Bill of
materials
Highlighted items will be supplied in large quantity.
Kind Regards.
Wilson Jasper
Purchase Manager
Walker Construction (UK) Ltd
I will like a receipt of your acknowledgment mail.
Userspace libraries, e.g. glibc's dprintf(), expect the default return value
for invalid seek situations: -ESPIPE, but when the IO was over /dev/kmsg the
current state of kernel code was returning the generic case of an -EINVAL.
Hence, userspace programs were not behaving as expected or documented.
With this patch we add SEEK_CUR case returning the expected value and also a
simple mention of it in kernel's documentation for those relying on that for
guidance.
Signed-off-by: Bruno Meneguele <bmeneg(a)redhat.com>
---
Documentation/ABI/testing/dev-kmsg | 2 ++
kernel/printk/printk.c | 4 ++++
2 files changed, 6 insertions(+)
diff --git a/Documentation/ABI/testing/dev-kmsg b/Documentation/ABI/testing/dev-kmsg
index f307506eb54c..8533d28e6fda 100644
--- a/Documentation/ABI/testing/dev-kmsg
+++ b/Documentation/ABI/testing/dev-kmsg
@@ -56,6 +56,8 @@ Description: The /dev/kmsg character device node provides userspace access
seek after the last record available at the time
the last SYSLOG_ACTION_CLEAR was issued.
+ While SEEK_CUR sets -ESPIPE (invalid seek) to errno.
+
The output format consists of a prefix carrying the syslog
prefix including priority and facility, the 64 bit message
sequence number and the monotonic timestamp in microseconds,
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index ad4606234545..d02606723d2d 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -963,6 +963,10 @@ static loff_t devkmsg_llseek(struct file *file, loff_t offset, int whence)
user->idx = log_next_idx;
user->seq = log_next_seq;
break;
+ case SEEK_CUR:
+ /* return the default errno for invalid seek */
+ ret = -ESPIPE;
+ break;
default:
ret = -EINVAL;
}
--
2.24.1
This is the start of the stable review cycle for the 4.19.111 release.
There are 89 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 19 Mar 2020 10:31:16 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.111-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.111-rc1
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid free/alloc race when handling OGM2 buffer
Vladis Dronov <vdronov(a)redhat.com>
efi: Add a sanity check to efivar_store_raw()
Karsten Graul <kgraul(a)linux.ibm.com>
net/smc: cancel event worker during device removal
Karsten Graul <kgraul(a)linux.ibm.com>
net/smc: check for valid ib_client_data
Eric Dumazet <edumazet(a)google.com>
ipv6: restrict IPV6_ADDRFORM operation
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: acpi: put device when verifying client fails
Daniel Drake <drake(a)endlessm.com>
iommu/vt-d: Ignore devices with out-of-spec domain number
Zhenzhong Duan <zhenzhong.duan(a)gmail.com>
iommu/vt-d: Fix the wrong printing in RHSA parsing
Jakub Kicinski <kuba(a)kernel.org>
netfilter: nft_tunnel: add missing attribute validation for tunnels
Jakub Kicinski <kuba(a)kernel.org>
netfilter: nft_payload: add missing attribute validation for payload csum flags
Jakub Kicinski <kuba(a)kernel.org>
netfilter: cthelper: add missing attribute validation for cthelper
Tommi Rantala <tommi.t.rantala(a)nokia.com>
perf bench futex-wake: Restore thread count default to online CPU count
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for channel switch
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for beacon report scanning
Jakub Kicinski <kuba(a)kernel.org>
nl80211: add missing attribute validation for critical protocol indication
Hamish Martin <hamish.martin(a)alliedtelesis.co.nz>
i2c: gpio: suppress error on probe defer
Zhenyu Wang <zhenyuw(a)linux.intel.com>
drm/i915/gvt: Fix unnecessary schedule timer when no vGPU exits
Charles Keepax <ckeepax(a)opensource.cirrus.com>
pinctrl: core: Remove extra kref_get which blocks hogs being freed
Nicolas Belin <nbelin(a)baylibre.com>
pinctrl: meson-gxl: fix GPIOX sdio pins
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't schedule OGM for disabled interface
Yonghyun Hwang <yonghyun(a)google.com>
iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
Hans de Goede <hdegoede(a)redhat.com>
iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
Marc Zyngier <maz(a)kernel.org>
iommu/dma: Fix MSI reservation allocation
Tony Luck <tony.luck(a)intel.com>
x86/mce: Fix logic and comments around MSR_PPIN_CTL
Felix Fietkau <nbd(a)nbd.name>
mt76: fix array overflow on receiving too many fragments for a packet
Sai Praneeth <sai.praneeth.prakhya(a)intel.com>
efi: Make efi_rts_work accessible to efi page fault handler
Vladis Dronov <vdronov(a)redhat.com>
efi: Fix a race and a buffer overflow while reading efivars via sysfs
Wolfram Sang <wsa(a)the-dreams.de>
macintosh: windfarm: fix MODINFO regression
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
ARC: define __ALIGN_STR and __ALIGN symbols for ARC
Vitaly Kuznetsov <vkuznets(a)redhat.com>
KVM: x86: clear stale x86_emulate_ctxt->intercept value
Al Viro <viro(a)zeniv.linux.org.uk>
gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
Al Viro <viro(a)zeniv.linux.org.uk>
cifs_atomic_open(): fix double-put on late allocation failure
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
ktest: Add timeout for ssh sync testing
Colin Ian King <colin.king(a)canonical.com>
drm/amd/display: remove duplicated assignment to grph_obj_type
Hillf Danton <hdanton(a)sina.com>
workqueue: don't use wq_select_unbound_cpu() for bound works
Vasily Averin <vvs(a)virtuozzo.com>
netfilter: x_tables: xt_mttg_seq_next should increase position index
Vasily Averin <vvs(a)virtuozzo.com>
netfilter: xt_recent: recent_seq_next should increase position index
Vasily Averin <vvs(a)virtuozzo.com>
netfilter: synproxy: synproxy_cpu_seq_next should increase position index
Vasily Averin <vvs(a)virtuozzo.com>
netfilter: nf_conntrack: ct_cpu_seq_next should increase position index
Hans de Goede <hdegoede(a)redhat.com>
iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
Halil Pasic <pasic(a)linux.ibm.com>
virtio-blk: fix hw_queue stopped on arbitrary error
Dan Moulding <dmoulding(a)me.com>
iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices
Michal Koutný <mkoutny(a)suse.com>
cgroup: Iterate tasks that did not finish do_exit()
Vasily Averin <vvs(a)virtuozzo.com>
cgroup: cgroup_procs_next should increase position index
Mahesh Bandewar <maheshb(a)google.com>
macvlan: add cond_resched() during multicast processing
Jakub Kicinski <kuba(a)kernel.org>
net: fec: validate the new settings in fec_enet_set_coalesce()
Eric Dumazet <edumazet(a)google.com>
slip: make slhc_compress() more robust against malicious packets
Eric Dumazet <edumazet(a)google.com>
bonding/alb: make sure arp header is pulled before accessing it
Jakub Kicinski <kuba(a)kernel.org>
devlink: validate length of region addr/len
Jakub Kicinski <kuba(a)kernel.org>
tipc: add missing attribute validation for MTU property
Hangbin Liu <liuhangbin(a)gmail.com>
net/ipv6: remove the old peer route if change it to a new one
Hangbin Liu <liuhangbin(a)gmail.com>
net/ipv6: need update peer route when modify metric
Hangbin Liu <liuhangbin(a)gmail.com>
selftests/net/fib_tests: update addr_metric_test for peer route testing
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: fix MDIO bus PM PHY resuming
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for vendor subcommand
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for deactivate target
Jakub Kicinski <kuba(a)kernel.org>
nfc: add missing attribute validation for SE API
Jakub Kicinski <kuba(a)kernel.org>
team: add missing attribute validation for array index
Jakub Kicinski <kuba(a)kernel.org>
team: add missing attribute validation for port ifindex
Jakub Kicinski <kuba(a)kernel.org>
net: fq: add missing attribute validation for orphan mask
Jakub Kicinski <kuba(a)kernel.org>
macsec: add missing attribute validation for port
Jakub Kicinski <kuba(a)kernel.org>
can: add missing attribute validation for termination
Jakub Kicinski <kuba(a)kernel.org>
nl802154: add missing attribute validation for dev_type
Jakub Kicinski <kuba(a)kernel.org>
nl802154: add missing attribute validation
Jakub Kicinski <kuba(a)kernel.org>
fib: add missing attribute validation for tun_id
Jakub Kicinski <kuba(a)kernel.org>
devlink: validate length of param values
Eric Dumazet <edumazet(a)google.com>
net: memcg: fix lockdep splat in inet_csk_accept()
Shakeel Butt <shakeelb(a)google.com>
net: memcg: late association of sock to memcg
Shakeel Butt <shakeelb(a)google.com>
cgroup: memcg: net: do not associate sock with unrelated cgroup
Vasundhara Volam <vasundhara-v.volam(a)broadcom.com>
bnxt_en: reinitialize IRQs when MTU is modified
Edward Cree <ecree(a)solarflare.com>
sfc: detach from cb_page in efx_copy_channel()
You-Sheng Yang <vicamo.yang(a)canonical.com>
r8152: check disconnect status after long sleep
Colin Ian King <colin.king(a)canonical.com>
net: systemport: fix index check to avoid an array out of bounds access
Remi Pommarel <repk(a)triplefau.lt>
net: stmmac: dwmac1000: Disable ACS if enhanced descs are not used
Willem de Bruijn <willemb(a)google.com>
net/packet: tpacket_rcv: do not increment ring index on drop
Dan Carpenter <dan.carpenter(a)oracle.com>
net: nfc: fix bounds checking bugs on "pipe"
Dmitry Bogdanov <dbogdanov(a)marvell.com>
net: macsec: update SCI upon MAC address change.
Pablo Neira Ayuso <pablo(a)netfilter.org>
netlink: Use netlink header as base to calculate bad attribute offset
Hangbin Liu <liuhangbin(a)gmail.com>
net/ipv6: use configured metric when add peer route
Mahesh Bandewar <maheshb(a)google.com>
ipvlan: don't deref eth hdr before checking it's set
Eric Dumazet <edumazet(a)google.com>
ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
Jiri Wiesner <jwiesner(a)suse.com>
ipvlan: do not add hardware address of master to its unicast filter list
Mahesh Bandewar <maheshb(a)google.com>
ipvlan: add cond_resched_rcu() while processing muticast backlog
Hangbin Liu <liuhangbin(a)gmail.com>
ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface
Dmitry Yakunin <zeil(a)yandex-team.ru>
inet_diag: return classid for all socket types
Eric Dumazet <edumazet(a)google.com>
gre: fix uninit-value in __iptunnel_pull_header
Dmitry Yakunin <zeil(a)yandex-team.ru>
cgroup, netclassid: periodically release file_lock on classid updating
Florian Fainelli <f.fainelli(a)gmail.com>
net: phy: Avoid multiple suspends
David S. Miller <davem(a)davemloft.net>
phy: Revert toggling reset changes.
-------------
Diffstat:
Documentation/filesystems/porting | 7 +++
Makefile | 4 +-
arch/arc/include/asm/linkage.h | 2 +
arch/x86/kernel/cpu/mcheck/mce_intel.c | 9 ++--
arch/x86/kvm/emulate.c | 1 +
drivers/block/virtio_blk.c | 8 ++--
drivers/firmware/efi/efivars.c | 32 +++++++++----
drivers/firmware/efi/runtime-wrappers.c | 53 ++++------------------
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 3 +-
drivers/gpu/drm/i915/gvt/vgpu.c | 12 +++--
drivers/i2c/busses/i2c-gpio.c | 2 +-
drivers/i2c/i2c-core-acpi.c | 10 +++-
drivers/iommu/dma-iommu.c | 16 +++----
drivers/iommu/dmar.c | 21 ++++++---
drivers/iommu/intel-iommu.c | 13 ++++--
drivers/macintosh/windfarm_ad7417_sensor.c | 7 +++
drivers/macintosh/windfarm_fcu_controls.c | 7 +++
drivers/macintosh/windfarm_lm75_sensor.c | 16 ++++++-
drivers/macintosh/windfarm_lm87_sensor.c | 7 +++
drivers/macintosh/windfarm_max6690_sensor.c | 7 +++
drivers/macintosh/windfarm_smu_sat.c | 7 +++
drivers/net/bonding/bond_alb.c | 20 ++++----
drivers/net/can/dev.c | 1 +
drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +-
drivers/net/ethernet/freescale/fec_main.c | 6 +--
drivers/net/ethernet/sfc/efx.c | 1 +
.../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 3 +-
drivers/net/ipvlan/ipvlan_core.c | 19 ++++----
drivers/net/ipvlan/ipvlan_main.c | 5 +-
drivers/net/macsec.c | 12 +++--
drivers/net/macvlan.c | 2 +
drivers/net/phy/phy_device.c | 18 +++++---
drivers/net/slip/slhc.c | 14 ++++--
drivers/net/team/team.c | 2 +
drivers/net/usb/r8152.c | 8 ++++
drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 3 +-
drivers/net/wireless/mediatek/mt76/dma.c | 9 ++--
drivers/pinctrl/core.c | 1 -
drivers/pinctrl/meson/pinctrl-meson-gxl.c | 4 +-
fs/cifs/dir.c | 1 -
fs/gfs2/inode.c | 2 +-
fs/open.c | 3 --
include/linux/cgroup.h | 1 +
include/linux/efi.h | 36 +++++++++++++++
include/linux/inet_diag.h | 18 +++++---
include/linux/phy.h | 2 +
include/net/fib_rules.h | 1 +
kernel/cgroup/cgroup.c | 37 +++++++++++----
kernel/workqueue.c | 14 +++---
mm/memcontrol.c | 14 +-----
net/batman-adv/bat_iv_ogm.c | 4 ++
net/batman-adv/bat_v_ogm.c | 42 +++++++++++++----
net/batman-adv/types.h | 4 ++
net/core/devlink.c | 33 +++++++++-----
net/core/netclassid_cgroup.c | 47 +++++++++++++++----
net/core/sock.c | 5 +-
net/ieee802154/nl_policy.c | 6 +++
net/ipv4/gre_demux.c | 12 ++++-
net/ipv4/inet_connection_sock.c | 20 ++++++++
net/ipv4/inet_diag.c | 44 ++++++++----------
net/ipv4/raw_diag.c | 5 +-
net/ipv4/udp_diag.c | 5 +-
net/ipv6/addrconf.c | 49 +++++++++++++++-----
net/ipv6/ipv6_sockglue.c | 10 +++-
net/netfilter/nf_conntrack_standalone.c | 2 +-
net/netfilter/nf_synproxy_core.c | 2 +-
net/netfilter/nfnetlink_cthelper.c | 2 +
net/netfilter/nft_payload.c | 1 +
net/netfilter/nft_tunnel.c | 2 +
net/netfilter/x_tables.c | 6 +--
net/netfilter/xt_recent.c | 2 +-
net/netlink/af_netlink.c | 2 +-
net/nfc/hci/core.c | 19 ++++++--
net/nfc/netlink.c | 4 ++
net/packet/af_packet.c | 13 +++---
net/sched/sch_fq.c | 1 +
net/sctp/diag.c | 8 +---
net/smc/smc_ib.c | 3 ++
net/tipc/netlink.c | 3 +-
net/wireless/nl80211.c | 5 ++
tools/perf/bench/futex-wake.c | 4 +-
tools/testing/ktest/ktest.pl | 2 +-
tools/testing/selftests/net/fib_tests.sh | 34 ++++++++++++--
84 files changed, 625 insertions(+), 283 deletions(-)
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 870b4333a62e45b0b2000d14b301b7b8b8cad9da
Gitweb: https://git.kernel.org/tip/870b4333a62e45b0b2000d14b301b7b8b8cad9da
Author: Borislav Petkov <bp(a)suse.de>
AuthorDate: Wed, 18 Mar 2020 19:27:48 +01:00
Committer: Borislav Petkov <bp(a)suse.de>
CommitterDate: Thu, 19 Mar 2020 10:55:56 +01:00
x86/ioremap: Fix CONFIG_EFI=n build
In order to use efi_mem_type(), one needs CONFIG_EFI enabled. Otherwise
that function is undefined. Use IS_ENABLED() to check and avoid the
ifdeffery as the compiler optimizes away the following unreachable code
then.
Fixes: 985e537a4082 ("x86/ioremap: Map EFI runtime services data as encrypted for SEV")
Reported-by: Randy Dunlap <rdunlap(a)infradead.org>
Signed-off-by: Borislav Petkov <bp(a)suse.de>
Tested-by: Randy Dunlap <rdunlap(a)infradead.org>
Cc: Tom Lendacky <thomas.lendacky(a)amd.com>
Cc: <stable(a)vger.kernel.org>
Link: https://lkml.kernel.org/r/7561e981-0d9b-d62c-0ef2-ce6007aff1ab@infradead.org
---
arch/x86/mm/ioremap.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 935a91e..18c637c 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -115,6 +115,9 @@ static void __ioremap_check_other(resource_size_t addr, struct ioremap_desc *des
if (!sev_active())
return;
+ if (!IS_ENABLED(CONFIG_EFI))
+ return;
+
if (efi_mem_type(addr) == EFI_RUNTIME_SERVICES_DATA)
desc->flags |= IORES_MAP_ENCRYPTED;
}
Hi,
On Sun, Jan 5, 2020 at 2:47 PM David Miller <davem(a)davemloft.net> wrote:
>
> From: Wen Gong <wgong(a)codeaurora.org>
> Date: Fri, 3 Jan 2020 12:50:16 +0800
>
> > The len used for skb_put_padto is wrong, it need to add len of hdr.
>
> Thanks, applied.
I noticed this patch is in mainline now as:
ce57785bf91b net: qrtr: fix len of skb_put_padto in qrtr_node_enqueue
Though I'm not an expert on the code, it feels like a stable candidate
unless someone objects.
-Doug
Please pick the following commits for the 4.19 branch:
2507e6ab7a9a wimax: i2400: fix memory leak
6f3ef5c25cc7 wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle
I previously sent these to you for other stable branches, but
accidentally missed 4.19.
Ben.
--
Ben Hutchings, Software Developer Codethink Ltd
https://www.codethink.co.uk/ Dale House, 35 Dale Street
Manchester, M1 2HF, United Kingdom
This is a note to let you know that I've just added the patch titled
nvmem: check for NULL reg_read and reg_write before dereferencing
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 3c91ef69a3e94f78546b246225ed573fbf1735b4 Mon Sep 17 00:00:00 2001
From: Nicholas Johnson <nicholas.johnson-opensource(a)outlook.com.au>
Date: Tue, 10 Mar 2020 13:22:52 +0000
Subject: nvmem: check for NULL reg_read and reg_write before dereferencing
Return -EPERM if reg_read is NULL in bin_attr_nvmem_read() or if
reg_write is NULL in bin_attr_nvmem_write().
This prevents NULL dereferences such as the one described in
03cd45d2e219 ("thunderbolt: Prevent crash if non-active NVMem file is
read")
Signed-off-by: Nicholas Johnson <nicholas.johnson-opensource(a)outlook.com.au>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Link: https://lore.kernel.org/r/20200310132257.23358-10-srinivas.kandagatla@linar…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/nvmem/nvmem-sysfs.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/nvmem/nvmem-sysfs.c b/drivers/nvmem/nvmem-sysfs.c
index 9e0c429cd08a..8759c4470012 100644
--- a/drivers/nvmem/nvmem-sysfs.c
+++ b/drivers/nvmem/nvmem-sysfs.c
@@ -56,6 +56,9 @@ static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj,
count = round_down(count, nvmem->word_size);
+ if (!nvmem->reg_read)
+ return -EPERM;
+
rc = nvmem->reg_read(nvmem->priv, pos, buf, count);
if (rc)
@@ -90,6 +93,9 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
count = round_down(count, nvmem->word_size);
+ if (!nvmem->reg_write)
+ return -EPERM;
+
rc = nvmem->reg_write(nvmem->priv, pos, buf, count);
if (rc)
--
2.25.2
This is a note to let you know that I've just added the patch titled
nvmem: release the write-protect pin
to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From a9c3766cb19cdadf2776aba41b64470002645894 Mon Sep 17 00:00:00 2001
From: Khouloud Touil <ktouil(a)baylibre.com>
Date: Tue, 10 Mar 2020 13:22:50 +0000
Subject: nvmem: release the write-protect pin
Put the write-protect GPIO descriptor in nvmem_release() so that it can
be automatically released when the associated device's reference count
drops to 0.
Fixes: 2a127da461a9 ("nvmem: add support for the write-protect pin")
Reported-by: Geert Uytterhoeven <geert(a)linux-m68k.org>
Signed-off-by: Khouloud Touil <ktouil(a)baylibre.com>
Cc: stable <stable(a)vger.kernel.org>
[Bartosz: tweak the commit message]
Signed-off-by: Bartosz Golaszewski <bgolaszewski(a)baylibre.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Link: https://lore.kernel.org/r/20200310132257.23358-8-srinivas.kandagatla@linaro…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/nvmem/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 2758d90d63b7..c05c4f4a7b9e 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -72,6 +72,7 @@ static void nvmem_release(struct device *dev)
struct nvmem_device *nvmem = to_nvmem_device(dev);
ida_simple_remove(&nvmem_ida, nvmem->id);
+ gpiod_put(nvmem->wp_gpio);
kfree(nvmem);
}
--
2.25.2
From: Eric Biggers <ebiggers(a)google.com>
After request_module(), nothing is stopping the module from being
unloaded until someone takes a reference to it via try_get_module().
The WARN_ONCE() in get_fs_type() is thus user-reachable, via userspace
running 'rmmod' concurrently.
Since WARN_ONCE() is for kernel bugs only, not for user-reachable
situations, downgrade this warning to pr_warn_once().
Keep it printed once only, since the intent of this warning is to detect
a bug in modprobe at boot time. Printing the warning more than once
wouldn't really provide any useful extra information.
Fixes: 41124db869b7 ("fs: warn in case userspace lied about modprobe return")
Acked-by: Luis Chamberlain <mcgrof(a)kernel.org>
Reviewed-by: Jessica Yu <jeyu(a)kernel.org>
Cc: <stable(a)vger.kernel.org> # v4.13+
Cc: Alexei Starovoitov <ast(a)kernel.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Jeff Vander Stoep <jeffv(a)google.com>
Cc: Kees Cook <keescook(a)chromium.org>
Cc: NeilBrown <neilb(a)suse.com>
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
fs/filesystems.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/filesystems.c b/fs/filesystems.c
index 77bf5f95362da..90b8d879fbaf3 100644
--- a/fs/filesystems.c
+++ b/fs/filesystems.c
@@ -272,7 +272,9 @@ struct file_system_type *get_fs_type(const char *name)
fs = __get_fs_type(name, len);
if (!fs && (request_module("fs-%.*s", len, name) == 0)) {
fs = __get_fs_type(name, len);
- WARN_ONCE(!fs, "request_module fs-%.*s succeeded, but still no fs?\n", len, name);
+ if (!fs)
+ pr_warn_once("request_module fs-%.*s succeeded, but still no fs?\n",
+ len, name);
}
if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
--
2.25.1
From: Eric Biggers <ebiggers(a)google.com>
It's long been possible to disable kernel module autoloading completely
(while still allowing manual module insertion) by setting
/proc/sys/kernel/modprobe to the empty string. This can be preferable
to setting it to a nonexistent file since it avoids the overhead of an
attempted execve(), avoids potential deadlocks, and avoids the call to
security_kernel_module_request() and thus on SELinux-based systems
eliminates the need to write SELinux rules to dontaudit module_request.
However, when module autoloading is disabled in this way,
request_module() returns 0. This is broken because callers expect 0 to
mean that the module was successfully loaded.
Apparently this was never noticed because this method of disabling
module autoloading isn't used much, and also most callers don't use the
return value of request_module() since it's always necessary to check
whether the module registered its functionality or not anyway. But
improperly returning 0 can indeed confuse a few callers, for example
get_fs_type() in fs/filesystems.c where it causes a WARNING to be hit:
if (!fs && (request_module("fs-%.*s", len, name) == 0)) {
fs = __get_fs_type(name, len);
WARN_ONCE(!fs, "request_module fs-%.*s succeeded, but still no fs?\n", len, name);
}
This is easily reproduced with:
echo > /proc/sys/kernel/modprobe
mount -t NONEXISTENT none /
It causes:
request_module fs-NONEXISTENT succeeded, but still no fs?
WARNING: CPU: 1 PID: 1106 at fs/filesystems.c:275 get_fs_type+0xd6/0xf0
[...]
This should actually use pr_warn_once() rather than WARN_ONCE(), since
it's also user-reachable if userspace immediately unloads the module.
Regardless, request_module() should correctly return an error when it
fails. So let's make it return -ENOENT, which matches the error when
the modprobe binary doesn't exist.
I've also sent patches to document and test this case.
Acked-by: Luis Chamberlain <mcgrof(a)kernel.org>
Reviewed-by: Jessica Yu <jeyu(a)kernel.org>
Reviewed-by: Kees Cook <keescook(a)chromium.org>
Cc: stable(a)vger.kernel.org
Cc: Alexei Starovoitov <ast(a)kernel.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Jeff Vander Stoep <jeffv(a)google.com>
Cc: NeilBrown <neilb(a)suse.com>
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
kernel/kmod.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/kmod.c b/kernel/kmod.c
index bc6addd9152b4..a2de58de6ab62 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -120,7 +120,7 @@ static int call_modprobe(char *module_name, int wait)
* invoke it.
*
* If module auto-loading support is disabled then this function
- * becomes a no-operation.
+ * simply returns -ENOENT.
*/
int __request_module(bool wait, const char *fmt, ...)
{
@@ -137,7 +137,7 @@ int __request_module(bool wait, const char *fmt, ...)
WARN_ON_ONCE(wait && current_is_async());
if (!modprobe_path[0])
- return 0;
+ return -ENOENT;
va_start(args, fmt);
ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
--
2.25.1
From: Eric Biggers <ebiggers(a)google.com>
After request_module(), nothing is stopping the module from being
unloaded until someone takes a reference to it via try_get_module().
The WARN_ONCE() in get_fs_type() is thus user-reachable, via userspace
running 'rmmod' concurrently.
Since WARN_ONCE() is for kernel bugs only, not for user-reachable
situations, downgrade this warning to pr_warn_once().
Acked-by: Luis Chamberlain <mcgrof(a)kernel.org>
Cc: stable(a)vger.kernel.org
Cc: Alexei Starovoitov <ast(a)kernel.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Jeff Vander Stoep <jeffv(a)google.com>
Cc: Jessica Yu <jeyu(a)kernel.org>
Cc: Kees Cook <keescook(a)chromium.org>
Cc: NeilBrown <neilb(a)suse.com>
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
fs/filesystems.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/filesystems.c b/fs/filesystems.c
index 77bf5f95362da..90b8d879fbaf3 100644
--- a/fs/filesystems.c
+++ b/fs/filesystems.c
@@ -272,7 +272,9 @@ struct file_system_type *get_fs_type(const char *name)
fs = __get_fs_type(name, len);
if (!fs && (request_module("fs-%.*s", len, name) == 0)) {
fs = __get_fs_type(name, len);
- WARN_ONCE(!fs, "request_module fs-%.*s succeeded, but still no fs?\n", len, name);
+ if (!fs)
+ pr_warn_once("request_module fs-%.*s succeeded, but still no fs?\n",
+ len, name);
}
if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
--
2.25.1
From: Vasundhara Volam <vasundhara-v.volam(a)broadcom.com>
[ Upstream commit a9b952d267e59a3b405e644930f46d252cea7122 ]
MTU changes may affect the number of IRQs so we must call
bnxt_close_nic()/bnxt_open_nic() with the irq_re_init parameter
set to true. The reason is that a larger MTU may require
aggregation rings not needed with smaller MTU. We may not be
able to allocate the required number of aggregation rings and
so we reduce the number of channels which will change the number
of IRQs. Without this patch, it may crash eventually in
pci_disable_msix() when the IRQs are not properly unwound.
Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Vasundhara Volam <vasundhara-v.volam(a)broadcom.com>
Signed-off-by: Michael Chan <michael.chan(a)broadcom.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 81282b811a6cd..d91953eabfeb4 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5310,13 +5310,13 @@ static int bnxt_change_mtu(struct net_device *dev, int new_mtu)
return -EINVAL;
if (netif_running(dev))
- bnxt_close_nic(bp, false, false);
+ bnxt_close_nic(bp, true, false);
dev->mtu = new_mtu;
bnxt_set_ring_params(bp);
if (netif_running(dev))
- return bnxt_open_nic(bp, false, false);
+ return bnxt_open_nic(bp, true, false);
return 0;
}
--
2.20.1
From: Sven Eckelmann <sven(a)narfation.org>
[ Upstream commit 8e8ce08198de193e3d21d42e96945216e3d9ac7f ]
A transmission scheduling for an interface which is currently dropped by
batadv_iv_ogm_iface_disable could still be in progress. The B.A.T.M.A.N. V
is simply cancelling the workqueue item in an synchronous way but this is
not possible with B.A.T.M.A.N. IV because the OGM submissions are
intertwined.
Instead it has to stop submitting the OGM when it detect that the buffer
pointer is set to NULL.
Reported-by: syzbot+a98f2016f40b9cd3818a(a)syzkaller.appspotmail.com
Reported-by: syzbot+ac36b6a33c28a491e929(a)syzkaller.appspotmail.com
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Cc: Hillf Danton <hdanton(a)sina.com>
Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
net/batman-adv/bat_iv_ogm.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 780700fcbe63e..b08e3b331c503 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -934,6 +934,10 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
(hard_iface->if_status == BATADV_IF_TO_BE_REMOVED))
return;
+ /* interface already disabled by batadv_iv_ogm_iface_disable */
+ if (!*ogm_buff)
+ return;
+
/* the interface gets activated here to avoid race conditions between
* the moment of activating the interface in
* hardif_activate_interface() where the originator mac is set and
--
2.20.1
From: Vasily Averin <vvs(a)virtuozzo.com>
[ Upstream commit db8dd9697238be70a6b4f9d0284cd89f59c0e070 ]
if seq_file .next fuction does not change position index,
read after some lseek can generate unexpected output.
# mount | grep cgroup
# dd if=/mnt/cgroup.procs bs=1 # normal output
...
1294
1295
1296
1304
1382
584+0 records in
584+0 records out
584 bytes copied
dd: /mnt/cgroup.procs: cannot skip to specified offset
83 <<< generates end of last line
1383 <<< ... and whole last line once again
0+1 records in
0+1 records out
8 bytes copied
dd: /mnt/cgroup.procs: cannot skip to specified offset
1386 <<< generates last line anyway
0+1 records in
0+1 records out
5 bytes copied
https://bugzilla.kernel.org/show_bug.cgi?id=206283
Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com>
Signed-off-by: Tejun Heo <tj(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
kernel/cgroup/cgroup-v1.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index a2c05d2476ac5..d148965180893 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -501,6 +501,7 @@ static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos)
*/
p++;
if (p >= end) {
+ (*pos)++;
return NULL;
} else {
*pos = *p;
--
2.20.1