This is the start of the stable review cycle for the 4.19.232 release.
There are 34 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 02 Mar 2022 17:20:16 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.232-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.232-rc1
daniel.starke(a)siemens.com <daniel.starke(a)siemens.com>
tty: n_gsm: fix encoding of control signal octet bit DV
Hongyu Xie <xiehongyu1(a)kylinos.cn>
xhci: Prevent futile URB re-submissions due to incorrect return value.
Puma Hsu <pumahsu(a)google.com>
xhci: re-initialize the HC during resume if HCE was set
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
usb: dwc3: gadget: Let the interrupt handler disable bottom halves.
Hans de Goede <hdegoede(a)redhat.com>
usb: dwc3: pci: Fix Bay Trail phy GPIO mappings
Daniele Palmas <dnlplm(a)gmail.com>
USB: serial: option: add Telit LE910R1 compositions
Slark Xiao <slark_xiao(a)163.com>
USB: serial: option: add support for DW5829e
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracefs: Set the group ownership in apply_options() not parse_options()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
USB: gadget: validate endpoint index for xilinx udc
Daehwan Jung <dh10.jung(a)samsung.com>
usb: gadget: rndis: add spinlock for rndis response list
Dmytro Bagrii <dimich.dmb(a)gmail.com>
Revert "USB: serial: ch341: add new Product ID for CH341A"
Sergey Shtylyov <s.shtylyov(a)omp.ru>
ata: pata_hpt37x: disable primary channel on HPT371
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
iio: adc: men_z188_adc: Fix a resource leak in an error handling path
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Have traceon and traceoff trigger honor the instance
Linus Torvalds <torvalds(a)linux-foundation.org>
fget: clarify and improve __fget_files() implementation
Miaohe Lin <linmiaohe(a)huawei.com>
memblock: use kfree() to release kmalloced memblock regions
Karol Herbst <kherbst(a)redhat.com>
Revert "drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR"
Marc Zyngier <maz(a)kernel.org>
gpio: tegra186: Fix chip_data type confusion
daniel.starke(a)siemens.com <daniel.starke(a)siemens.com>
tty: n_gsm: fix proper link termination after failed open
Bart Van Assche <bvanassche(a)acm.org>
RDMA/ib_srp: Fix a deadlock
ChenXiaoSong <chenxiaosong2(a)huawei.com>
configfs: fix a race in configfs_{,un}register_subsystem()
Gal Pressman <gal(a)nvidia.com>
net/mlx5e: Fix wrong return value on ioctl EEPROM query failure
Maxime Ripard <maxime(a)cerno.tech>
drm/edid: Always set RGB444
Paul Blakey <paulb(a)nvidia.com>
openvswitch: Fix setting ipv6 fields causing hw csum failure
Tao Liu <thomas.liu(a)ucloud.cn>
gso: do not skip outer ip header in case of ipip and net_failover
Dan Carpenter <dan.carpenter(a)oracle.com>
tipc: Fix end of loop tests for list_for_each_entry()
Eric Dumazet <edumazet(a)google.com>
net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
Xin Long <lucien.xin(a)gmail.com>
ping: remove pr_err from ping_lookup
Oliver Neukum <oneukum(a)suse.com>
USB: zaurus: support another broken Zaurus
Oliver Neukum <oneukum(a)suse.com>
sr9700: sanity check for packet length
Helge Deller <deller(a)gmx.de>
parisc/unaligned: Fix ldw() and stw() unalignment handlers
Helge Deller <deller(a)gmx.de>
parisc/unaligned: Fix fldd and fstd unaligned handlers on 32-bit kernel
Stefano Garzarella <sgarzare(a)redhat.com>
vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
Zhang Qiao <zhangqiao22(a)huawei.com>
cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug
-------------
Diffstat:
Makefile | 4 +-
arch/parisc/kernel/unaligned.c | 14 ++---
drivers/ata/pata_hpt37x.c | 14 +++++
drivers/gpio/gpio-tegra186.c | 14 +++--
drivers/gpu/drm/drm_edid.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 37 +++++------
drivers/iio/adc/men_z188_adc.c | 9 ++-
drivers/infiniband/ulp/srp/ib_srp.c | 6 +-
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +-
drivers/net/usb/cdc_ether.c | 12 ++++
drivers/net/usb/sr9700.c | 2 +-
drivers/net/usb/zaurus.c | 12 ++++
drivers/tty/n_gsm.c | 4 +-
drivers/usb/dwc3/dwc3-pci.c | 4 +-
drivers/usb/dwc3/gadget.c | 2 +
drivers/usb/gadget/function/rndis.c | 8 +++
drivers/usb/gadget/function/rndis.h | 1 +
drivers/usb/gadget/udc/udc-xilinx.c | 6 ++
drivers/usb/host/xhci.c | 28 ++++++---
drivers/usb/serial/ch341.c | 1 -
drivers/usb/serial/option.c | 12 ++++
drivers/vhost/vsock.c | 21 ++++---
fs/configfs/dir.c | 14 +++++
fs/file.c | 73 +++++++++++++++++-----
fs/tracefs/inode.c | 5 +-
include/net/checksum.h | 5 ++
kernel/cgroup/cpuset.c | 2 +
kernel/trace/trace_events_trigger.c | 52 +++++++++++++--
mm/memblock.c | 10 ++-
net/core/skbuff.c | 4 +-
net/ipv4/af_inet.c | 5 +-
net/ipv4/ping.c | 1 -
net/ipv6/ip6_offload.c | 2 +
net/openvswitch/actions.c | 46 +++++++++++---
net/tipc/name_table.c | 2 +-
net/tipc/socket.c | 2 +-
36 files changed, 337 insertions(+), 101 deletions(-)
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 5adf349439d29f92467e864f728dfc23180f3ef9 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz(a)infradead.org>
Date: Thu, 3 Mar 2022 12:23:23 +0100
Subject: [PATCH] x86/module: Fix the paravirt vs alternative order
Ever since commit
4e6292114c74 ("x86/paravirt: Add new features for paravirt patching")
there is an ordering dependency between patching paravirt ops and
patching alternatives, the module loader still violates this.
Fixes: 4e6292114c74 ("x86/paravirt: Add new features for paravirt patching")
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Signed-off-by: Borislav Petkov <bp(a)suse.de>
Reviewed-by: Miroslav Benes <mbenes(a)suse.cz>
Cc: <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20220303112825.068773913@infradead.org
diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index 95fa745e310a..96d7c27b7093 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -273,6 +273,14 @@ int module_finalize(const Elf_Ehdr *hdr,
retpolines = s;
}
+ /*
+ * See alternative_instructions() for the ordering rules between the
+ * various patching types.
+ */
+ if (para) {
+ void *pseg = (void *)para->sh_addr;
+ apply_paravirt(pseg, pseg + para->sh_size);
+ }
if (retpolines) {
void *rseg = (void *)retpolines->sh_addr;
apply_retpolines(rseg, rseg + retpolines->sh_size);
@@ -290,11 +298,6 @@ int module_finalize(const Elf_Ehdr *hdr,
tseg, tseg + text->sh_size);
}
- if (para) {
- void *pseg = (void *)para->sh_addr;
- apply_paravirt(pseg, pseg + para->sh_size);
- }
-
/* make jump label nops */
jump_label_apply_nops(me);
This is the start of the stable review cycle for the 4.19.235 release.
There are 29 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 16 Mar 2022 14:59:12 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.235-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.235-rc2
Valentin Schneider <valentin.schneider(a)arm.com>
ia64: ensure proper NUMA distance and possible map initialization
Dietmar Eggemann <dietmar.eggemann(a)arm.com>
sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa()
Valentin Schneider <valentin.schneider(a)arm.com>
sched/topology: Make sched_init_numa() use a set for the deduplicating sort
Qu Wenruo <wqu(a)suse.com>
btrfs: unlock newly allocated extent buffer after error
Josh Triplett <josh(a)joshtriplett.org>
ext4: add check to prevent attempting to resize an fs with sparse_super2
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: fix Thumb2 regression with Spectre BHB
Michael S. Tsirkin <mst(a)redhat.com>
virtio: acknowledge all features before access
Michael S. Tsirkin <mst(a)redhat.com>
virtio: unexport virtio_finalize_features
Emil Renner Berthing <kernel(a)esmil.dk>
riscv: Fix auipc+jalr relocation range checks
Robert Hancock <robert.hancock(a)calian.com>
net: macb: Fix lost RX packet wakeup race in NAPI receive
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: gdm724x: fix use after free in gdm_lte_rx()
Randy Dunlap <rdunlap(a)infradead.org>
ARM: Spectre-BHB: provide empty stub for non-config
Mike Kravetz <mike.kravetz(a)oracle.com>
selftests/memfd: clean up mapping in mfd_fail_write
Sven Schnelle <svens(a)linux.ibm.com>
tracing: Ensure trace buffer is at least 4096 bytes large
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: Check for hotplug-status existence before watching"
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
suresh kumar <suresh2514(a)gmail.com>
net-sysfs: add check for netdevice being present to speed_show
Eric Dumazet <edumazet(a)google.com>
sctp: fix kernel-infoleak for SCTP sockets
Clément Léger <clement.leger(a)bootlin.com>
net: phy: DP83822: clear MISR2 register to disable interrupts
Miaoqian Lin <linmq006(a)gmail.com>
gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
Mark Featherston <mark(a)embeddedTS.com>
gpio: ts4900: Do not set DAT and OE together
Pavel Skripkin <paskripkin(a)gmail.com>
NFC: port100: fix use-after-free in port100_send_complete
Mohammad Kabat <mohammadkab(a)nvidia.com>
net/mlx5: Fix size field in bufferx_reg struct
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: lpc_eth: Handle error for clk_enable
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: ti: cpts: Handle error for clk_enable
Miaoqian Lin <linmq006(a)gmail.com>
ethernet: Fix error handling in xemaclite_of_probe
Tom Rix <trix(a)redhat.com>
qed: return status of qed_iov_get_link
Jia-Ju Bai <baijiaju1990(a)gmail.com>
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
-------------
Diffstat:
Makefile | 4 +-
arch/arm/include/asm/spectre.h | 6 ++
arch/arm/kernel/entry-armv.S | 4 +-
arch/ia64/kernel/acpi.c | 7 +-
arch/riscv/kernel/module.c | 21 +++--
drivers/gpio/gpio-ts4900.c | 24 ++++--
drivers/net/ethernet/cadence/macb_main.c | 25 +++++-
drivers/net/ethernet/freescale/gianfar_ethtool.c | 1 +
drivers/net/ethernet/nxp/lpc_eth.c | 5 +-
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++--
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 ++
drivers/net/ethernet/ti/cpts.c | 4 +-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +-
drivers/net/phy/dp83822.c | 2 +-
drivers/net/xen-netback/xenbus.c | 13 ++--
drivers/nfc/port100.c | 2 +
drivers/staging/gdm724x/gdm_lte.c | 5 +-
drivers/virtio/virtio.c | 40 +++++-----
fs/btrfs/extent-tree.c | 1 +
fs/ext4/resize.c | 5 ++
include/linux/mlx5/mlx5_ifc.h | 4 +-
include/linux/topology.h | 1 +
include/linux/virtio.h | 1 -
include/linux/virtio_config.h | 3 +-
kernel/sched/topology.c | 99 ++++++++++++------------
kernel/trace/trace.c | 10 ++-
net/ax25/af_ax25.c | 7 ++
net/core/net-sysfs.c | 2 +-
net/sctp/diag.c | 9 +--
tools/testing/selftests/memfd/memfd_test.c | 1 +
30 files changed, 212 insertions(+), 123 deletions(-)
Dzień dobry,
czy rozważali Państwo rozwój kwalifikacji językowych swoich pracowników?
Opracowaliśmy kursy językowe dla różnych branż, w których koncentrujemy się na podniesieniu poziomu słownictwa i jakości komunikacji wykorzystując autorską metodę, stworzoną specjalnie dla wymagającego biznesu.
Niestandardowy kurs on-line, dopasowany do profilu firmy i obszarów świadczonych usług, w szybkim czasie przyniesie efekty, które zwiększą komfort i jakość pracy, rozwijając możliwości biznesowe.
Zdalne szkolenie językowe to m.in. zajęcia z native speakerami, które w szybkim czasie nauczą pracowników rozmawiać za pomocą jasnego i zwięzłego języka Business English.
Czy mógłbym przedstawić więcej szczegółów i opowiedzieć jak działamy?
Pozdrawiam
Krzysztof Maj
Hi,
Upstream kernel commit 88a686728b37 ("kbuild: simplify access to the
kernel's version") [0] extended the Makefile to add the following
defines to the linux/version.h file:
#define LINUX_VERSION_MAJOR $(VERSION)
#define LINUX_VERSION_PATCHLEVEL $(PATCHLEVEL)
#define LINUX_VERSION_SUBLEVEL $(SUBLEVEL)
I would like to have these defines especially LINUX_VERSION_SUBLEVEL
also in older stable kernel versions to make it easier for out of tree
kernel code to detect which version it is compiling against.
In the Linux drivers backports project [1] we backport the current wifi
driver to older Linux versions, so someone with an old kernel can use
current wifi drivers. To make this work we have to know which kernel
version it is being compiled against. The Makefile has access to the
SUBLEVEL variable and can also forward it to the C code, but this does
not work when someone compiles some other driver against the mac80211
subsystem provided by backports for example.
I tried to cherry-pick commit 88a686728b37 to kernel 4.9, but it did not
apply cleanly. Would it get accepted when I just port the changes in the
main Makefile to the currently supported LTS kernel versions?
Hauke
[0]: https://git.kernel.org/linus/88a686728b3739d3598851e729c0e81f194e5c53
[1]: https://backports.wiki.kernel.org/index.php/Main_Page
Here would be my suggestion for kernel 4.9, I haven't tested this yet:
--- a/Makefile
+++ b/Makefile
@@ -1142,7 +1142,10 @@ endef
define filechk_version.h
(echo \#define LINUX_VERSION_CODE $(shell \
expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 255); \
- echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))';)
+ echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))';) \
+ echo \#define LINUX_VERSION_MAJOR $(VERSION); \
+ echo \#define LINUX_VERSION_PATCHLEVEL $(PATCHLEVEL); \
+ echo \#define LINUX_VERSION_SUBLEVEL $(SUBLEVEL)
endef
$(version_h): $(srctree)/Makefile FORCE
When we mount a jffs2 image, assume that the first few blocks of
the image are normal and contain at least one xattr-related inode,
but the next block is abnormal. As a result, an error is returned
in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then
called in jffs2_build_filesystem() and then again in
jffs2_do_fill_super().
Finally we can observe the following report:
==================================================================
BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac
Read of size 8 at addr ffff8881243384e0 by task mount/719
Call Trace:
dump_stack+0x115/0x16b
jffs2_clear_xattr_subsystem+0x95/0x6ac
jffs2_do_fill_super+0x84f/0xc30
jffs2_fill_super+0x2ea/0x4c0
mtd_get_sb+0x254/0x400
mtd_get_sb_by_nr+0x4f/0xd0
get_tree_mtd+0x498/0x840
jffs2_get_tree+0x25/0x30
vfs_get_tree+0x8d/0x2e0
path_mount+0x50f/0x1e50
do_mount+0x107/0x130
__se_sys_mount+0x1c5/0x2f0
__x64_sys_mount+0xc7/0x160
do_syscall_64+0x45/0x70
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Allocated by task 719:
kasan_save_stack+0x23/0x60
__kasan_kmalloc.constprop.0+0x10b/0x120
kasan_slab_alloc+0x12/0x20
kmem_cache_alloc+0x1c0/0x870
jffs2_alloc_xattr_ref+0x2f/0xa0
jffs2_scan_medium.cold+0x3713/0x4794
jffs2_do_mount_fs.cold+0xa7/0x2253
jffs2_do_fill_super+0x383/0xc30
jffs2_fill_super+0x2ea/0x4c0
[...]
Freed by task 719:
kmem_cache_free+0xcc/0x7b0
jffs2_free_xattr_ref+0x78/0x98
jffs2_clear_xattr_subsystem+0xa1/0x6ac
jffs2_do_mount_fs.cold+0x5e6/0x2253
jffs2_do_fill_super+0x383/0xc30
jffs2_fill_super+0x2ea/0x4c0
[...]
The buggy address belongs to the object at ffff8881243384b8
which belongs to the cache jffs2_xattr_ref of size 48
The buggy address is located 40 bytes inside of
48-byte region [ffff8881243384b8, ffff8881243384e8)
[...]
==================================================================
The triggering of the BUG is shown in the following stack:
-----------------------------------------------------------
jffs2_fill_super
jffs2_do_fill_super
jffs2_do_mount_fs
jffs2_build_filesystem
jffs2_scan_medium
jffs2_scan_eraseblock <--- ERROR
jffs2_clear_xattr_subsystem <--- free
jffs2_clear_xattr_subsystem <--- free again
-----------------------------------------------------------
An error is returned in jffs2_do_mount_fs(). If the error is returned
by jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to
be executed. If the error is returned by jffs2_build_filesystem(), the
jffs2_clear_xattr_subsystem() also does not need to be executed again.
So move jffs2_clear_xattr_subsystem() from 'out_inohash' to 'out_root'
to fix this UAF problem.
Fixes: aa98d7cf59b5 ("[JFFS2][XATTR] XATTR support on JFFS2 (version. 5)")
Cc: stable(a)vger.kernel.org
Reported-by: Hulk Robot <hulkci(a)huawei.com>
Signed-off-by: Baokun Li <libaokun1(a)huawei.com>
---
fs/jffs2/fs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 2ac410477c4f..71f03a5d36ed 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -603,8 +603,8 @@ int jffs2_do_fill_super(struct super_block *sb, struct fs_context *fc)
jffs2_free_ino_caches(c);
jffs2_free_raw_node_refs(c);
kvfree(c->blocks);
- out_inohash:
jffs2_clear_xattr_subsystem(c);
+ out_inohash:
kfree(c->inocache_list);
out_wbuf:
jffs2_flash_cleanup(c);
--
2.31.1
From: Nadav Amit <namit(a)vmware.com>
When a PTE is set by UFFD operations such as UFFDIO_COPY, the PTE is
currently only marked as write-protected if the VMA has VM_WRITE flag
set. This seems incorrect or at least would be unexpected by the users.
Consider the following sequence of operations that are being performed
on a certain page:
mprotect(PROT_READ)
UFFDIO_COPY(UFFDIO_COPY_MODE_WP)
mprotect(PROT_READ|PROT_WRITE)
At this point the user would expect to still get UFFD notification when
the page is accessed for write, but the user would not get one, since
the PTE was not marked as UFFD_WP during UFFDIO_COPY.
Fix it by always marking PTEs as UFFD_WP regardless on the
write-permission in the VMA flags.
Fixes: 292924b26024 ("userfaultfd: wp: apply _PAGE_UFFD_WP bit")
Cc: Mike Rapoport <rppt(a)linux.vnet.ibm.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Peter Xu <peterx(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Nadav Amit <namit(a)vmware.com>
---
mm/userfaultfd.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 0780c2a57ff1..885e5adb0168 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -72,12 +72,15 @@ int mfill_atomic_install_pte(struct mm_struct *dst_mm, pmd_t *dst_pmd,
_dst_pte = pte_mkdirty(_dst_pte);
if (page_in_cache && !vm_shared)
writable = false;
- if (writable) {
- if (wp_copy)
- _dst_pte = pte_mkuffd_wp(_dst_pte);
- else
- _dst_pte = pte_mkwrite(_dst_pte);
- }
+
+ /*
+ * Always mark a PTE as write-protected when needed, regardless of
+ * VM_WRITE, which the user might change.
+ */
+ if (wp_copy)
+ _dst_pte = pte_mkuffd_wp(_dst_pte);
+ else if (writable)
+ _dst_pte = pte_mkwrite(_dst_pte);
dst_pte = pte_offset_map_lock(dst_mm, dst_pmd, dst_addr, &ptl);
--
2.25.1
From: Guo Ziliang <guo.ziliang(a)zte.com.cn>
Subject: mm: swap: get rid of deadloop in swapin readahead
In our testing, a deadloop task was found. Through sysrq printing, same
stack was found every time, as follows:
__swap_duplicate+0x58/0x1a0
swapcache_prepare+0x24/0x30
__read_swap_cache_async+0xac/0x220
read_swap_cache_async+0x58/0xa0
swapin_readahead+0x24c/0x628
do_swap_page+0x374/0x8a0
__handle_mm_fault+0x598/0xd60
handle_mm_fault+0x114/0x200
do_page_fault+0x148/0x4d0
do_translation_fault+0xb0/0xd4
do_mem_abort+0x50/0xb0
The reason for the deadloop is that swapcache_prepare() always returns
EEXIST, indicating that SWAP_HAS_CACHE has not been cleared, so that it
cannot jump out of the loop. We suspect that the task that clears the
SWAP_HAS_CACHE flag never gets a chance to run. We try to lower the
priority of the task stuck in a deadloop so that the task that clears the
SWAP_HAS_CACHE flag will run. The results show that the system returns to
normal after the priority is lowered.
In our testing, multiple real-time tasks are bound to the same core, and
the task in the deadloop is the highest priority task of the core, so the
deadloop task cannot be preempted.
Although cond_resched() is used by __read_swap_cache_async, it is an empty
function in the preemptive system and cannot achieve the purpose of
releasing the CPU. A high-priority task cannot release the CPU unless
preempted by a higher-priority task. But when this task is already the
highest priority task on this core, other tasks will not be able to be
scheduled. So we think we should replace cond_resched() with
schedule_timeout_uninterruptible(1), schedule_timeout_interruptible will
call set_current_state first to set the task state, so the task will be
removed from the running queue, so as to achieve the purpose of giving up
the CPU and prevent it from running in kernel mode for too long.
(akpm: ugly hack becomes uglier. But it fixes the issue in a
backportable-to-stable fashion while we hopefully work on something
better)
Link: https://lkml.kernel.org/r/20220221111749.1928222-1-cgel.zte@gmail.com
Signed-off-by: Guo Ziliang <guo.ziliang(a)zte.com.cn>
Reported-by: Zeal Robot <zealci(a)zte.com.cn>
Reviewed-by: Ran Xiaokai <ran.xiaokai(a)zte.com.cn>
Reviewed-by: Jiang Xuexin <jiang.xuexin(a)zte.com.cn>
Reviewed-by: Yang Yang <yang.yang29(a)zte.com.cn>
Acked-by: Hugh Dickins <hughd(a)google.com>
Cc: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Minchan Kim <minchan(a)kernel.org>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Roger Quadros <rogerq(a)kernel.org>
Cc: Ziliang Guo <guo.ziliang(a)zte.com.cn>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/swap_state.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/swap_state.c~mm-swap-get-rid-of-deadloop-in-swapin-readahead
+++ a/mm/swap_state.c
@@ -478,7 +478,7 @@ struct page *__read_swap_cache_async(swp
* __read_swap_cache_async(), which has set SWAP_HAS_CACHE
* in swap_map, but not yet added its page to swap cache.
*/
- cond_resched();
+ schedule_timeout_uninterruptible(1);
}
/*
_
The patch titled
Subject: mm: fix panic in __alloc_pages
has been removed from the -mm tree. Its filename was
mm-fix-panic-in-__alloc_pages.patch
This patch was dropped because an alternative patch was merged
------------------------------------------------------
From: Alexey Makhalov <amakhalov(a)vmware.com>
Subject: mm: fix panic in __alloc_pages
There is a kernel panic caused by pcpu_alloc_pages() passing offlined and
uninitialized node to alloc_pages_node() leading to panic by NULL
dereferencing uninitialized NODE_DATA(nid).
CPU2 has been hot-added
BUG: unable to handle page fault for address: 0000000000001608
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 0 PID: 1 Comm: systemd Tainted: G E 5.15.0-rc7+ #11
Hardware name: VMware, Inc. VMware7,1/440BX Desktop Reference Platform, BIOS VMW
RIP: 0010:__alloc_pages+0x127/0x290
Code: 4c 89 f0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 44 89 e0 48 8b 55 b8 c1 e8 0c 83 e0 01 88 45 d0 4c 89 c8 48 85 d2 0f 85 1a 01 00 00 <45> 3b 41 08 0f 82 10 01 00 00 48 89 45 c0 48 8b 00 44 89 e2 81 e2
RSP: 0018:ffffc900006f3bc8 EFLAGS: 00010246
RAX: 0000000000001600 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000cc2
RBP: ffffc900006f3c18 R08: 0000000000000001 R09: 0000000000001600
R10: ffffc900006f3a40 R11: ffff88813c9fffe8 R12: 0000000000000cc2
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000cc2
FS: 00007f27ead70500(0000) GS:ffff88807ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000001608 CR3: 000000000582c003 CR4: 00000000001706b0
Call Trace:
pcpu_alloc_pages.constprop.0+0xe4/0x1c0
pcpu_populate_chunk+0x33/0xb0
pcpu_alloc+0x4d3/0x6f0
__alloc_percpu_gfp+0xd/0x10
alloc_mem_cgroup_per_node_info+0x54/0xb0
mem_cgroup_alloc+0xed/0x2f0
mem_cgroup_css_alloc+0x33/0x2f0
css_create+0x3a/0x1f0
cgroup_apply_control_enable+0x12b/0x150
cgroup_mkdir+0xdd/0x110
kernfs_iop_mkdir+0x4f/0x80
vfs_mkdir+0x178/0x230
do_mkdirat+0xfd/0x120
__x64_sys_mkdir+0x47/0x70
? syscall_exit_to_user_mode+0x21/0x50
do_syscall_64+0x43/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
Panic can be easily reproduced by disabling udev rule for automatic
onlining hot added CPU followed by CPU with memoryless node (NUMA node
with CPU only) hot add.
Hot adding CPU and memoryless node does not bring the node to online
state. Memoryless node will be onlined only during the onlining its CPU.
Node can be in one of the following states:
1. not present.(nid == NUMA_NO_NODE)
2. present, but offline (nid > NUMA_NO_NODE, node_online(nid) == 0,
NODE_DATA(nid) == NULL)
3. present and online (nid > NUMA_NO_NODE, node_online(nid) > 0,
NODE_DATA(nid) != NULL)
Percpu code is doing allocations for all possible CPUs. The issue happens
when it serves hot added but not yet onlined CPU when its node is in 2nd
state. This node is not ready to use, fallback to numa_mem_id().
Link: https://lkml.kernel.org/r/20211108202325.20304-1-amakhalov@vmware.com
Signed-off-by: Alexey Makhalov <amakhalov(a)vmware.com>
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Acked-by: Dennis Zhou <dennis(a)kernel.org>
Cc: David Hildenbrand <david(a)redhat.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: Tejun Heo <tj(a)kernel.org>
Cc: Christoph Lameter <cl(a)linux.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/percpu-vm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/mm/percpu-vm.c~mm-fix-panic-in-__alloc_pages
+++ a/mm/percpu-vm.c
@@ -84,15 +84,19 @@ static int pcpu_alloc_pages(struct pcpu_
gfp_t gfp)
{
unsigned int cpu, tcpu;
- int i;
+ int i, nid;
gfp |= __GFP_HIGHMEM;
for_each_possible_cpu(cpu) {
+ nid = cpu_to_node(cpu);
+ if (nid == NUMA_NO_NODE || !node_online(nid))
+ nid = numa_mem_id();
+
for (i = page_start; i < page_end; i++) {
struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
- *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
+ *pagep = alloc_pages_node(nid, gfp, 0);
if (!*pagep)
goto err;
}
_
Patches currently in -mm which might be from amakhalov(a)vmware.com are
The number of policies are 10, so can't be supported by the bitmap size
of u8. Even though there are no platfoms with these many policies, but
as correctness increase to u32.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
Fixes: 16fc8eca1975 ("thermal/int340x_thermal: Add additional UUIDs")
Cc: stable(a)vger.kernel.org
---
v2
- Changed u16 to u32 for better alignment as suggested by David
drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
index 72acb1f61849..348b1f4ef801 100644
--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
@@ -53,7 +53,7 @@ struct int3400_thermal_priv {
struct art *arts;
int trt_count;
struct trt *trts;
- u8 uuid_bitmap;
+ u32 uuid_bitmap;
int rel_misc_dev_res;
int current_uuid_index;
char *data_vault;
--
2.31.1
From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Don't just mask off all the PSF GV points when SAGV gets disabled.
This should in fact cause the Pcode to reject the request since
at least one PSF point must remain enabled at all times.
Cc: stable(a)vger.kernel.org
Cc: Stanislav Lisovskiy <stanislav.lisovskiy(a)intel.com>
Fixes: 192fbfb76744 ("drm/i915: Implement PSF GV point support")
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
---
drivers/gpu/drm/i915/display/intel_bw.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c
index ad1564ca7269..adf58c58513b 100644
--- a/drivers/gpu/drm/i915/display/intel_bw.c
+++ b/drivers/gpu/drm/i915/display/intel_bw.c
@@ -992,7 +992,8 @@ int intel_bw_atomic_check(struct intel_atomic_state *state)
* cause.
*/
if (!intel_can_enable_sagv(dev_priv, new_bw_state)) {
- allowed_points = BIT(max_bw_point);
+ allowed_points &= ADLS_PSF_PT_MASK;
+ allowed_points |= BIT(max_bw_point);
drm_dbg_kms(&dev_priv->drm, "No SAGV, using single QGV point %d\n",
max_bw_point);
}
--
2.34.1
From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
For modern platforms the spec explicitly states that a
SAGV block time of zero means that SAGV is not supported.
Let's extend that to all platforms. Supposedly there should
be no systems where this isn't true, and it'll allow us to:
- use the same code regardless of older vs. newer platform
- wm latencies already treat 0 as disabled, so this fits well
with other related code
- make it a bit more clear when SAGV is used vs. not
- avoid overflows from adding U32_MAX with a u16 wm0 latency value
which could cause us to miscalculate the SAGV watermarks on tgl+
Cc: stable(a)vger.kernel.org
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
---
drivers/gpu/drm/i915/intel_pm.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 8ee31c9590a7..40a3094e55ca 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3696,8 +3696,7 @@ skl_setup_sagv_block_time(struct drm_i915_private *dev_priv)
MISSING_CASE(DISPLAY_VER(dev_priv));
}
- /* Default to an unusable block time */
- dev_priv->sagv_block_time_us = -1;
+ dev_priv->sagv_block_time_us = 0;
}
/*
@@ -5644,7 +5643,7 @@ static void skl_compute_plane_wm(const struct intel_crtc_state *crtc_state,
result->min_ddb_alloc = max(min_ddb_alloc, blocks) + 1;
result->enable = true;
- if (DISPLAY_VER(dev_priv) < 12)
+ if (DISPLAY_VER(dev_priv) < 12 && dev_priv->sagv_block_time_us)
result->can_sagv = latency >= dev_priv->sagv_block_time_us;
}
@@ -5677,7 +5676,10 @@ static void tgl_compute_sagv_wm(const struct intel_crtc_state *crtc_state,
struct drm_i915_private *dev_priv = to_i915(crtc_state->uapi.crtc->dev);
struct skl_wm_level *sagv_wm = &plane_wm->sagv.wm0;
struct skl_wm_level *levels = plane_wm->wm;
- unsigned int latency = dev_priv->wm.skl_latency[0] + dev_priv->sagv_block_time_us;
+ unsigned int latency = 0;
+
+ if (dev_priv->sagv_block_time_us)
+ latency = dev_priv->sagv_block_time_us + dev_priv->wm.skl_latency[0];
skl_compute_plane_wm(crtc_state, plane, 0, latency,
wm_params, &levels[0],
--
2.34.1
Stable Team,
> Revert of revert of "io_uring: wait potential ->release() on resurrect",
> which adds a helper for resurrect not racing completion reinit, as was
> removed because of a strange bug with no clear root or link to the
> patch.
>
> Was improved, instead of rcu_synchronize(), just wait_for_completion()
> because we're at 0 refs and it will happen very shortly. Specifically
> use non-interruptible version to ignore all pending signals that may
> have ended prior interruptible wait.
>
> This reverts commit cb5e1b81304e089ee3ca948db4d29f71902eb575.
>
> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com>
> ---
> fs/io_uring.c | 18 ++++++++++++++----
> 1 file changed, 14 insertions(+), 4 deletions(-)
Please back-port this as far as it will apply.
Definitely through v5.10.y.
It solves a critical bug.
Subject: "io_uring: return back safer resurrect"
Upstream commit:: f70865db5ff35f5ed0c7e9ef63e7cca3d4947f04
--
Lee Jones [李琼斯]
Principal Technical Lead - Developer Services
Linaro.org │ Open source software for Arm SoCs
Follow Linaro: Facebook | Twitter | Blog
Daniel Dao has reported [1] a regression on workloads that may trigger
a lot of refaults (anon and file). The underlying issue is that flushing
rstat is expensive. Although rstat flush are batched with (nr_cpus *
MEMCG_BATCH) stat updates, it seems like there are workloads which
genuinely do stat updates larger than batch value within short amount of
time. Since the rstat flush can happen in the performance critical
codepaths like page faults, such workload can suffer greatly.
This patch fixes this regression by making the rstat flushing
conditional in the performance critical codepaths. More specifically,
the kernel relies on the async periodic rstat flusher to flush the stats
and only if the periodic flusher is delayed by more than twice the
amount of its normal time window then the kernel allows rstat flushing
from the performance critical codepaths.
Now the question: what are the side-effects of this change? The worst
that can happen is the refault codepath will see 4sec old lruvec stats
and may cause false (or missed) activations of the refaulted page which
may under-or-overestimate the workingset size. Though that is not very
concerning as the kernel can already miss or do false activations.
There are two more codepaths whose flushing behavior is not changed by
this patch and we may need to come to them in future. One is the
writeback stats used by dirty throttling and second is the deactivation
heuristic in the reclaim. For now keeping an eye on them and if there is
report of regression due to these codepaths, we will reevaluate then.
Link: https://lore.kernel.org/all/CA+wXwBSyO87ZX5PVwdHm-=dBjZYECGmfnydUicUyrQqndg… [1]
Fixes: 1f828223b799 ("memcg: flush lruvec stats in the refault")
Signed-off-by: Shakeel Butt <shakeelb(a)google.com>
Reported-by: Daniel Dao <dqminh(a)cloudflare.com>
Cc: <stable(a)vger.kernel.org>
---
include/linux/memcontrol.h | 5 +++++
mm/memcontrol.c | 12 +++++++++++-
mm/workingset.c | 2 +-
3 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index a68dce3873fc..89b14729d59f 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -1012,6 +1012,7 @@ static inline unsigned long lruvec_page_state_local(struct lruvec *lruvec,
}
void mem_cgroup_flush_stats(void);
+void mem_cgroup_flush_stats_delayed(void);
void __mod_memcg_lruvec_state(struct lruvec *lruvec, enum node_stat_item idx,
int val);
@@ -1455,6 +1456,10 @@ static inline void mem_cgroup_flush_stats(void)
{
}
+static inline void mem_cgroup_flush_stats_delayed(void)
+{
+}
+
static inline void __mod_memcg_lruvec_state(struct lruvec *lruvec,
enum node_stat_item idx, int val)
{
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index f79bb3f25ce4..edfb337e6948 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -587,6 +587,9 @@ static DECLARE_DEFERRABLE_WORK(stats_flush_dwork, flush_memcg_stats_dwork);
static DEFINE_SPINLOCK(stats_flush_lock);
static DEFINE_PER_CPU(unsigned int, stats_updates);
static atomic_t stats_flush_threshold = ATOMIC_INIT(0);
+static u64 flush_next_time;
+
+#define FLUSH_TIME (2UL*HZ)
/*
* Accessors to ensure that preemption is disabled on PREEMPT_RT because it can
@@ -637,6 +640,7 @@ static void __mem_cgroup_flush_stats(void)
if (!spin_trylock_irqsave(&stats_flush_lock, flag))
return;
+ flush_next_time = jiffies_64 + 2*FLUSH_TIME;
cgroup_rstat_flush_irqsafe(root_mem_cgroup->css.cgroup);
atomic_set(&stats_flush_threshold, 0);
spin_unlock_irqrestore(&stats_flush_lock, flag);
@@ -648,10 +652,16 @@ void mem_cgroup_flush_stats(void)
__mem_cgroup_flush_stats();
}
+void mem_cgroup_flush_stats_delayed(void)
+{
+ if (rstat_flush_time && time_after64(jiffies_64, flush_next_time))
+ mem_cgroup_flush_stats();
+}
+
static void flush_memcg_stats_dwork(struct work_struct *w)
{
__mem_cgroup_flush_stats();
- queue_delayed_work(system_unbound_wq, &stats_flush_dwork, 2UL*HZ);
+ queue_delayed_work(system_unbound_wq, &stats_flush_dwork, FLUSH_TIME);
}
/**
diff --git a/mm/workingset.c b/mm/workingset.c
index 8a3828acc0bf..592569a8974c 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -355,7 +355,7 @@ void workingset_refault(struct folio *folio, void *shadow)
mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + file, nr);
- mem_cgroup_flush_stats();
+ mem_cgroup_flush_stats_delayed();
/*
* Compare the distance to the existing workingset size. We
* don't activate pages that couldn't stay resident even if
--
2.35.1.616.g0bdcbb4464-goog
Hi Rafael,
We (Fedora) have been receiving a whole bunch of bug reports about
laptops getting hot/toasty while suspended with kernels >= 5.16.10
and this seems to still happen with 5.17-rc7 too.
The following are all bugzilla.redhat.com bug numbers:
1750910 - Laptop failed to suspend and completely drained the battery
2050036 - Framework laptop: 5.16.5 breaks s2idle sleep
2053957 - Package c-states never go below C2
2056729 - No lid events when closing lid / laptop does not suspend
2057909 - Thinkpad X1C 9th in s2idle suspend still draining battery to zero over night , Ap
2059668 - HP Envy Laptop deadlocks on entering suspend power state when plugged in. Case ge
2059688 - Dell G15 5510 s2idle fails in 5.16.11 works in 5.16.10
And one of the bugs has also been mirrored at bugzilla.kernel.org by
the reporter:
bko215641 - Dell G15 5510 s2idle fails in 5.16.11 works in 5.16.10
The common denominator here (besides the kernel version) seems to
be that these are all Ice or Tiger Lake systems (I did not do
check this applies 100% to all bugs, but it does see, to be a pattern).
A similar arch-linux report:
https://bbs.archlinux.org/viewtopic.php?id=274292&p=2
Suggest that reverting
"ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE"
which was cherry-picked into 5.16.10 fixes things.
If you want I can create Fedora kernel test-rpms of a recent
5.16.y with just that one commit reverted and ask users to
confirm if that helps. Please let me know if doing that woulkd
be useful ?
Regards,
Hans
As pointed out by this bug report [1], the buffered write is now broken on
S29GL064N. The reason is that changed the buffered write to use chip_good
instead of chip_ready. One way to solve the issue is to revert the change
partially to use chip_ready for S29GL064N since the way of least surprise.
[1] https://lore.kernel.org/r/b687c259-6413-26c9-d4c9-b3afa69ea124@pengutronix.…
Fixes: dfeae1073583("mtd: cfi_cmdset_0002: Change write buffer to check correct value")
Signed-off-by: Tokunori Ikegami <ikegami.t(a)gmail.com>
Tested-by: Ahmad Fatoum <a.fatoum(a)pengutronix.de>
Cc: Miquel Raynal <miquel.raynal(a)bootlin.com>
Cc: Richard Weinberger <richard(a)nod.at>
Cc: Vignesh Raghavendra <vigneshr(a)ti.com>
Cc: linux-mtd(a)lists.infradead.org
Cc: stable(a)vger.kernel.org
Tokunori Ikegami (3):
mtd: cfi_cmdset_0002: Add S29GL064N ID definition
mtd: cfi_cmdset_0002: Move and rename
chip_check/chip_ready/chip_good_for_write
mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
drivers/mtd/chips/cfi_cmdset_0002.c | 89 +++++++++++++++--------------
1 file changed, 47 insertions(+), 42 deletions(-)
--
2.32.0
We might have RISC-V systems (such as QEMU) where VMID is not part
of the TLB entry tag so these systems will have to flush all TLB
enteries upon any change in hgatp.VMID.
Currently, we zero-out hgatp CSR in kvm_arch_vcpu_put() and we
re-program hgatp CSR in kvm_arch_vcpu_load(). For above described
systems, this will flush all TLB enteries whenever VCPU exits to
user-space hence reducing performance.
This patch fixes above described performance issue by not clearing
hgatp CSR in kvm_arch_vcpu_put().
Fixes: 34bde9d8b9e6 ("RISC-V: KVM: Implement VCPU world-switch")
Cc: stable(a)vger.kernel.org
Signed-off-by: Anup Patel <apatel(a)ventanamicro.com>
---
arch/riscv/kvm/vcpu.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c
index 624166004e36..6785aef4cbd4 100644
--- a/arch/riscv/kvm/vcpu.c
+++ b/arch/riscv/kvm/vcpu.c
@@ -653,8 +653,6 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
vcpu->arch.isa);
kvm_riscv_vcpu_host_fp_restore(&vcpu->arch.host_context);
- csr_write(CSR_HGATP, 0);
-
csr->vsstatus = csr_read(CSR_VSSTATUS);
csr->vsie = csr_read(CSR_VSIE);
csr->vstvec = csr_read(CSR_VSTVEC);
--
2.25.1
Hi stable,
I tried to called you but the network was so bad.
Please download the attached receipt of payment made today 03/16/2022 03:44:48 pm
Email me back soon as you received the payment confirmation
Regards
Dr Steve
Hi Reviewers,
This patch fixes a use-after-free error when /proc/lockdep is read by
user after a lockdep splat.
I checked and I think this patch can be applied to stable-5.4 and
later.
commit: 61cc4534b6550997c97a03759ab46b29d44c0017
Subject: locking/lockdep: Avoid potential access of invalid memory in
lock_class
Thanks.
Cheng-Jui Wang
The driver_override field from platform driver should not be initialized
from static memory (string literal) because the core later kfree() it,
for example when driver_override is set via sysfs.
Use dedicated helper to set driver_override properly.
Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com>
Acked-by: Stephen Boyd <sboyd(a)kernel.org>
---
drivers/clk/imx/clk-scu.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c
index 083da31dc3ea..4b2268b7d0d0 100644
--- a/drivers/clk/imx/clk-scu.c
+++ b/drivers/clk/imx/clk-scu.c
@@ -683,7 +683,12 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name,
return ERR_PTR(ret);
}
- pdev->driver_override = "imx-scu-clk";
+ ret = driver_set_override(&pdev->dev, &pdev->driver_override,
+ "imx-scu-clk", strlen("imx-scu-clk"));
+ if (ret) {
+ platform_device_put(pdev);
+ return ERR_PTR(ret);
+ }
ret = imx_clk_scu_attach_pd(&pdev->dev, rsrc_id);
if (ret)
--
2.32.0
From: Xin Long <lucien.xin(a)gmail.com>
commit eae5783908042a762c24e1bd11876edb91d314b1 upstream.
This patch fixes the problems below:
1. In non-shutdown_ack_sent states: in sctp_sf_do_5_1B_init() and
sctp_sf_do_5_2_2_dupinit():
chunk length check should be done before any checks that may cause
to send abort, as making packet for abort will access the init_tag
from init_hdr in sctp_ootb_pkt_new().
2. In shutdown_ack_sent state: in sctp_sf_do_9_2_reshutack():
The same checks as does in sctp_sf_do_5_2_2_dupinit() is needed
for sctp_sf_do_9_2_reshutack().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin(a)gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com>
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
[OP: adjusted context for 4.14]
Signed-off-by: Ovidiu Panait <ovidiu.panait(a)windriver.com>
---
CVE-2021-3772 patchset consists of 7 fixes:
[1] 4f7019c7eb33 ("sctp: use init_tag from inithdr for ABORT chunk")
[2] eae578390804 ("sctp: fix the processing for INIT chunk")
[3] 438b95a7c98f ("sctp: fix the processing for INIT_ACK chunk")
[4] a64b341b8695 ("sctp: fix the processing for COOKIE_ECHO chunk")
[5] aa0f697e4528 ("sctp: add vtag check in sctp_sf_violation")
[6] ef16b1734f0a ("sctp: add vtag check in sctp_sf_do_8_5_1_E_sa")
[7] 9d02831e517a ("sctp: add vtag check in sctp_sf_ootb")
This series contains backports for [2] and [3], which are the only fixes
missing from 4.14-stable. Only small contextual adjustments were made.
net/sctp/sm_statefuns.c | 71 ++++++++++++++++++++++++++---------------
1 file changed, 46 insertions(+), 25 deletions(-)
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index b26067798dbf..91aecc3449d2 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -161,6 +161,12 @@ static enum sctp_disposition __sctp_sf_do_9_1_abort(
void *arg,
struct sctp_cmd_seq *commands);
+static enum sctp_disposition
+__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands);
+
/* Small helper function that checks if the chunk length
* is of the appropriate length. The 'required_length' argument
* is set to be the size of a specific chunk we are testing.
@@ -337,6 +343,14 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
if (!chunk->singleton)
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ /* Make sure that the INIT chunk has a valid length.
+ * Normally, this would cause an ABORT with a Protocol Violation
+ * error, but since we don't have an association, we'll
+ * just discard the packet.
+ */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
/* If the packet is an OOTB packet which is temporarily on the
* control endpoint, respond with an ABORT.
*/
@@ -351,14 +365,6 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
if (chunk->sctp_hdr->vtag != 0)
return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
- /* Make sure that the INIT chunk has a valid length.
- * Normally, this would cause an ABORT with a Protocol Violation
- * error, but since we don't have an association, we'll
- * just discard the packet.
- */
- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
-
/* If the INIT is coming toward a closing socket, we'll send back
* and ABORT. Essentially, this catches the race of INIT being
* backloged to the socket at the same time as the user isses close().
@@ -1460,19 +1466,16 @@ static enum sctp_disposition sctp_sf_do_unexpected_init(
if (!chunk->singleton)
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ /* Make sure that the INIT chunk has a valid length. */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
/* 3.1 A packet containing an INIT chunk MUST have a zero Verification
* Tag.
*/
if (chunk->sctp_hdr->vtag != 0)
return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
- /* Make sure that the INIT chunk has a valid length.
- * In this case, we generate a protocol violation since we have
- * an association established.
- */
- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
- commands);
/* Grab the INIT header. */
chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
@@ -1787,9 +1790,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
* its peer.
*/
if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
- disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
- SCTP_ST_CHUNK(chunk->chunk_hdr->type),
- chunk, commands);
+ disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc,
+ SCTP_ST_CHUNK(chunk->chunk_hdr->type),
+ chunk, commands);
if (SCTP_DISPOSITION_NOMEM == disposition)
goto nomem;
@@ -2847,13 +2850,11 @@ enum sctp_disposition sctp_sf_do_9_2_shut_ctsn(
* that belong to this association, it should discard the INIT chunk and
* retransmit the SHUTDOWN ACK chunk.
*/
-enum sctp_disposition sctp_sf_do_9_2_reshutack(
- struct net *net,
- const struct sctp_endpoint *ep,
- const struct sctp_association *asoc,
- const union sctp_subtype type,
- void *arg,
- struct sctp_cmd_seq *commands)
+static enum sctp_disposition
+__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands)
{
struct sctp_chunk *chunk = arg;
struct sctp_chunk *reply;
@@ -2887,6 +2888,26 @@ enum sctp_disposition sctp_sf_do_9_2_reshutack(
return SCTP_DISPOSITION_NOMEM;
}
+enum sctp_disposition
+sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands)
+{
+ struct sctp_chunk *chunk = arg;
+
+ if (!chunk->singleton)
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (chunk->sctp_hdr->vtag != 0)
+ return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
+
+ return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands);
+}
+
/*
* sctp_sf_do_ecn_cwr
*
--
2.25.1
From: "Michael S. Tsirkin" <mst(a)redhat.com>
[ Upstream commit 0e7174b9d5877130fec41fb4a16e0c2ee4958d44 ]
A common pattern for device reset is currently:
vdev->config->reset(vdev);
.. cleanup ..
reset prevents new interrupts from arriving and waits for interrupt
handlers to finish.
However if - as is common - the handler queues a work request which is
flushed during the cleanup stage, we have code adding buffers / trying
to get buffers while device is reset. Not good.
This was reproduced by running
modprobe virtio_console
modprobe -r virtio_console
in a loop.
Fix this up by calling virtio_break_device + flush before reset.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1786239
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/char/virtio_console.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 2632b0fdb1b5..a6b6dc204c1f 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2004,6 +2004,13 @@ static void virtcons_remove(struct virtio_device *vdev)
list_del(&portdev->list);
spin_unlock_irq(&pdrvdata_lock);
+ /* Device is going away, exit any polling for buffers */
+ virtio_break_device(vdev);
+ if (use_multiport(portdev))
+ flush_work(&portdev->control_work);
+ else
+ flush_work(&portdev->config_work);
+
/* Disable interrupts for vqs */
vdev->config->reset(vdev);
/* Finish up work that's lined up */
--
2.34.1
From: "Michael S. Tsirkin" <mst(a)redhat.com>
[ Upstream commit 0e7174b9d5877130fec41fb4a16e0c2ee4958d44 ]
A common pattern for device reset is currently:
vdev->config->reset(vdev);
.. cleanup ..
reset prevents new interrupts from arriving and waits for interrupt
handlers to finish.
However if - as is common - the handler queues a work request which is
flushed during the cleanup stage, we have code adding buffers / trying
to get buffers while device is reset. Not good.
This was reproduced by running
modprobe virtio_console
modprobe -r virtio_console
in a loop.
Fix this up by calling virtio_break_device + flush before reset.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1786239
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/char/virtio_console.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 0fb3a8e62e62..2140d401523f 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2001,6 +2001,13 @@ static void virtcons_remove(struct virtio_device *vdev)
list_del(&portdev->list);
spin_unlock_irq(&pdrvdata_lock);
+ /* Device is going away, exit any polling for buffers */
+ virtio_break_device(vdev);
+ if (use_multiport(portdev))
+ flush_work(&portdev->control_work);
+ else
+ flush_work(&portdev->config_work);
+
/* Disable interrupts for vqs */
vdev->config->reset(vdev);
/* Finish up work that's lined up */
--
2.34.1
From: Lina Wang <lina.wang(a)mediatek.com>
[ Upstream commit 4ff2980b6bd2aa6b4ded3ce3b7c0ccfab29980af ]
in tunnel mode, if outer interface(ipv4) is less, it is easily to let
inner IPV6 mtu be less than 1280. If so, a Packet Too Big ICMPV6 message
is received. When send again, packets are fragmentized with 1280, they
are still rejected with ICMPV6(Packet Too Big) by xfrmi_xmit2().
According to RFC4213 Section3.2.2:
if (IPv4 path MTU - 20) is less than 1280
if packet is larger than 1280 bytes
Send ICMPv6 "packet too big" with MTU=1280
Drop packet
else
Encapsulate but do not set the Don't Fragment
flag in the IPv4 header. The resulting IPv4
packet might be fragmented by the IPv4 layer
on the encapsulator or by some router along
the IPv4 path.
endif
else
if packet is larger than (IPv4 path MTU - 20)
Send ICMPv6 "packet too big" with
MTU = (IPv4 path MTU - 20).
Drop packet.
else
Encapsulate and set the Don't Fragment flag
in the IPv4 header.
endif
endif
Packets should be fragmentized with ipv4 outer interface, so change it.
After it is fragemtized with ipv4, there will be double fragmenation.
No.48 & No.51 are ipv6 fragment packets, No.48 is double fragmentized,
then tunneled with IPv4(No.49& No.50), which obey spec. And received peer
cannot decrypt it rightly.
48 2002::10 2002::11 1296(length) IPv6 fragment (off=0 more=y ident=0xa20da5bc nxt=50)
49 0x0000 (0) 2002::10 2002::11 1304 IPv6 fragment (off=0 more=y ident=0x7448042c nxt=44)
50 0x0000 (0) 2002::10 2002::11 200 ESP (SPI=0x00035000)
51 2002::10 2002::11 180 Echo (ping) request
52 0x56dc 2002::10 2002::11 248 IPv6 fragment (off=1232 more=n ident=0xa20da5bc nxt=50)
xfrm6_noneed_fragment has fixed above issues. Finally, it acted like below:
1 0x6206 192.168.1.138 192.168.1.1 1316 Fragmented IP protocol (proto=Encap Security Payload 50, off=0, ID=6206) [Reassembled in #2]
2 0x6206 2002::10 2002::11 88 IPv6 fragment (off=0 more=y ident=0x1f440778 nxt=50)
3 0x0000 2002::10 2002::11 248 ICMPv6 Echo (ping) request
Signed-off-by: Lina Wang <lina.wang(a)mediatek.com>
Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
net/ipv6/xfrm6_output.c | 16 ++++++++++++++++
net/xfrm/xfrm_interface.c | 5 ++++-
2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index b5941c9475f3..fbcec4827071 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -142,6 +142,19 @@ static int __xfrm6_output_finish(struct net *net, struct sock *sk, struct sk_buf
return x->outer_mode->afinfo->output_finish(sk, skb);
}
+static int xfrm6_noneed_fragment(struct sk_buff *skb)
+{
+ struct frag_hdr *fh;
+ u8 prevhdr = ipv6_hdr(skb)->nexthdr;
+
+ if (prevhdr != NEXTHDR_FRAGMENT)
+ return 0;
+ fh = (struct frag_hdr *)(skb->data + sizeof(struct ipv6hdr));
+ if (fh->nexthdr == NEXTHDR_ESP || fh->nexthdr == NEXTHDR_AUTH)
+ return 1;
+ return 0;
+}
+
static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
struct dst_entry *dst = skb_dst(skb);
@@ -170,6 +183,9 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
xfrm6_local_rxpmtu(skb, mtu);
kfree_skb(skb);
return -EMSGSIZE;
+ } else if (toobig && xfrm6_noneed_fragment(skb)) {
+ skb->ignore_df = 1;
+ goto skip_frag;
} else if (!skb->ignore_df && toobig && skb->sk) {
xfrm_local_error(skb, mtu);
kfree_skb(skb);
diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index 1ae8caca28a0..3c642328a117 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c
@@ -300,7 +300,10 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
if (mtu < IPV6_MIN_MTU)
mtu = IPV6_MIN_MTU;
- icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+ if (skb->len > 1280)
+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+ else
+ goto xmit;
} else {
if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
goto xmit;
--
2.34.1
From: Lucas Zampieri <lzampier(a)redhat.com>
[ Upstream commit 25666e8ccd952627899b09b68f7c9b68cfeaf028 ]
As of logitech lightspeed receiver fw version 04.02.B0009,
HIDPP_PARAM_DEVICE_INFO is being reported as 0x11.
With patch "HID: logitech-dj: add support for the new lightspeed receiver
iteration", the mouse starts to error out with:
logitech-djreceiver: unusable device of type UNKNOWN (0x011) connected on
slot 1
and becomes unusable.
This has been noticed on a Logitech G Pro X Superlight fw MPM 25.01.B0018.
Signed-off-by: Lucas Zampieri <lzampier(a)redhat.com>
Acked-by: Nestor Lopez Casado <nlopezcasad(a)logitech.com>
Signed-off-by: Jiri Kosina <jkosina(a)suse.cz>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/hid/hid-logitech-dj.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 4267e2f2e70f..a663cbb7b683 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -1000,6 +1000,7 @@ static void logi_hidpp_recv_queue_notif(struct hid_device *hdev,
workitem.reports_supported |= STD_KEYBOARD;
break;
case 0x0f:
+ case 0x11:
device_type = "eQUAD Lightspeed 1.2";
logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
workitem.reports_supported |= STD_KEYBOARD;
--
2.34.1
Hello Christoph, stable,
I recently saw a crash caused by the kintegrityd workqueue that could only
be reproduced on older kernels.
A null pointer dereference in function bio_integrity_verify_fn.
The fix in Linus's tree for this:
3df49967f6f1 ("block: flush the integrity workqueue in blk_integrity_unregister")
was first merged in v5.15.
The fix has been backported to v5.10 LTS branch in:
1ef68b84bc11 ("block: flush the integrity workqueue in blk_integrity_unregister")
The fix doesn't have a fixes tag, but from inspecting the code,
I don't understand why this was only backported to v5.10, AFAICT it should
at least have been backported to v5.4, v4.19 and v4.14 LTS as well.
Original series:
https://lore.kernel.org/all/20210914070657.87677-3-hch@lst.de/
The blk_flush_integrity() call that actually fixes the crash should be
trivial to backport/add before clearing the flag and doing the memset.
Kind regards,
Niklas
I'm announcing the release of the 5.4.185 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 2
arch/arm/include/asm/spectre.h | 6 +
arch/arm/kernel/entry-armv.S | 4 -
arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 8 ++
arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 2
arch/riscv/kernel/module.c | 21 +++++-
arch/x86/include/asm/cpufeatures.h | 2
arch/x86/kernel/cpu/scattered.c | 1
arch/x86/kvm/svm.c | 3
arch/x86/mm/pageattr.c | 2
drivers/block/virtio_blk.c | 10 ++-
drivers/clk/qcom/gdsc.c | 26 ++++++--
drivers/clk/qcom/gdsc.h | 8 ++
drivers/gpio/gpio-ts4900.c | 24 +++++--
drivers/gpu/drm/sun4i/sun8i_mixer.h | 8 +-
drivers/mmc/host/meson-gx-mmc.c | 15 ++--
drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 7 ++
drivers/net/ethernet/cadence/macb_main.c | 25 +++++++
drivers/net/ethernet/freescale/gianfar_ethtool.c | 1
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 15 ++--
drivers/net/ethernet/nxp/lpc_eth.c | 5 +
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++--
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 ++
drivers/net/ethernet/ti/cpts.c | 4 -
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 -
drivers/net/phy/dp83822.c | 2
drivers/net/xen-netback/xenbus.c | 13 +---
drivers/nfc/port100.c | 2
drivers/staging/gdm724x/gdm_lte.c | 5 -
drivers/virtio/virtio.c | 39 ++++++------
fs/ext4/resize.c | 5 +
fs/fuse/dev.c | 12 +++
fs/fuse/file.c | 1
fs/fuse/fuse_i.h | 1
include/linux/mlx5/mlx5_ifc.h | 4 -
include/linux/virtio.h | 1
include/linux/virtio_config.h | 3
kernel/trace/trace.c | 10 +--
net/ax25/af_ax25.c | 7 ++
net/core/net-sysfs.c | 2
net/ipv6/addrconf.c | 2
net/sctp/diag.c | 9 --
tools/testing/selftests/bpf/prog_tests/timer_crash.c | 32 ++++++++++
tools/testing/selftests/bpf/progs/timer_crash.c | 54 +++++++++++++++++
tools/testing/selftests/memfd/memfd_test.c | 1
tools/testing/selftests/net/pmtu.sh | 7 +-
tools/testing/selftests/vm/map_fixed_noreplace.c | 49 +++++++++++----
48 files changed, 377 insertions(+), 114 deletions(-)
Aneesh Kumar K.V (1):
selftest/vm: fix map_fixed_noreplace test failure
Borislav Petkov (1):
x86/cpufeatures: Mark two free bits in word 3
Clément Léger (1):
net: phy: DP83822: clear MISR2 register to disable interrupts
Dan Carpenter (1):
staging: gdm724x: fix use after free in gdm_lte_rx()
Duoming Zhou (1):
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Emil Renner Berthing (1):
riscv: Fix auipc+jalr relocation range checks
Eric Dumazet (1):
sctp: fix kernel-infoleak for SCTP sockets
Greg Kroah-Hartman (1):
Linux 5.4.185
Guillaume Nault (1):
selftests: pmtu.sh: Kill tcpdump processes launched by subshell.
Jeremy Linton (1):
net: bcmgenet: Don't claim WOL when its not available
Jernej Skrabec (1):
drm/sun4i: mixer: Fix P010 and P210 format numbers
Jia-Ju Bai (1):
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
Jiasheng Jiang (2):
net: ethernet: ti: cpts: Handle error for clk_enable
net: ethernet: lpc_eth: Handle error for clk_enable
Joel Stanley (1):
ARM: dts: aspeed: Fix AST2600 quad spi group
Josh Triplett (1):
ext4: add check to prevent attempting to resize an fs with sparse_super2
Krish Sadhukhan (3):
x86/cpu: Add hardware-enforced cache coherency as a CPUID feature
x86/mm/pat: Don't flush cache if hardware enforces cache coherency across encryption domnains
KVM: SVM: Don't flush cache if hardware enforces cache coherency across encryption domains
Kumar Kartikeya Dwivedi (1):
selftests/bpf: Add test for bpf_timer overwriting crash
Marek Marczykowski-Górecki (2):
Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
Revert "xen-netback: Check for hotplug-status existence before watching"
Mark Featherston (1):
gpio: ts4900: Do not set DAT and OE together
Miaoqian Lin (2):
ethernet: Fix error handling in xemaclite_of_probe
gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
Michael S. Tsirkin (2):
virtio: unexport virtio_finalize_features
virtio: acknowledge all features before access
Mike Kravetz (1):
selftests/memfd: clean up mapping in mfd_fail_write
Miklos Szeredi (1):
fuse: fix pipe buffer lifetime for direct_io
Mohammad Kabat (1):
net/mlx5: Fix size field in bufferx_reg struct
Moshe Shemesh (1):
net/mlx5: Fix a race on command flush flow
Niels Dossche (1):
ipv6: prevent a possible race condition with lifetimes
Pali Rohár (2):
arm64: dts: armada-3720-turris-mox: Add missing ethernet0 alias
arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0
Pavel Skripkin (1):
NFC: port100: fix use-after-free in port100_send_complete
Randy Dunlap (1):
ARM: Spectre-BHB: provide empty stub for non-config
Robert Hancock (1):
net: macb: Fix lost RX packet wakeup race in NAPI receive
Rong Chen (1):
mmc: meson: Fix usage of meson_mmc_post_req()
Russell King (Oracle) (1):
ARM: fix Thumb2 regression with Spectre BHB
Sven Schnelle (1):
tracing: Ensure trace buffer is at least 4096 bytes large
Taniya Das (1):
clk: qcom: gdsc: Add support to update GDSC transition delay
Tom Rix (1):
qed: return status of qed_iov_get_link
Xie Yongji (1):
virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero
suresh kumar (1):
net-sysfs: add check for netdevice being present to speed_show
I'm announcing the release of the 4.19.235 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
arch/arm/include/asm/spectre.h | 6 +++
arch/arm/kernel/entry-armv.S | 4 +-
arch/riscv/kernel/module.c | 21 +++++++++---
drivers/gpio/gpio-ts4900.c | 24 ++++++++++---
drivers/net/ethernet/cadence/macb_main.c | 25 +++++++++++++-
drivers/net/ethernet/freescale/gianfar_ethtool.c | 1
drivers/net/ethernet/nxp/lpc_eth.c | 5 ++
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 ++++++----
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 ++++
drivers/net/ethernet/ti/cpts.c | 4 +-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +-
drivers/net/phy/dp83822.c | 2 -
drivers/net/xen-netback/xenbus.c | 13 ++-----
drivers/nfc/port100.c | 2 +
drivers/staging/gdm724x/gdm_lte.c | 5 +-
drivers/virtio/virtio.c | 40 ++++++++++++-----------
fs/btrfs/extent-tree.c | 1
fs/ext4/resize.c | 5 ++
include/linux/mlx5/mlx5_ifc.h | 4 +-
include/linux/virtio.h | 1
include/linux/virtio_config.h | 3 +
kernel/trace/trace.c | 10 +++--
net/ax25/af_ax25.c | 7 ++++
net/core/net-sysfs.c | 2 -
net/sctp/diag.c | 9 +----
tools/testing/selftests/memfd/memfd_test.c | 1
27 files changed, 157 insertions(+), 69 deletions(-)
Clément Léger (1):
net: phy: DP83822: clear MISR2 register to disable interrupts
Dan Carpenter (1):
staging: gdm724x: fix use after free in gdm_lte_rx()
Duoming Zhou (1):
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Emil Renner Berthing (1):
riscv: Fix auipc+jalr relocation range checks
Eric Dumazet (1):
sctp: fix kernel-infoleak for SCTP sockets
Greg Kroah-Hartman (1):
Linux 4.19.235
Jia-Ju Bai (1):
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
Jiasheng Jiang (2):
net: ethernet: ti: cpts: Handle error for clk_enable
net: ethernet: lpc_eth: Handle error for clk_enable
Josh Triplett (1):
ext4: add check to prevent attempting to resize an fs with sparse_super2
Marek Marczykowski-Górecki (2):
Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
Revert "xen-netback: Check for hotplug-status existence before watching"
Mark Featherston (1):
gpio: ts4900: Do not set DAT and OE together
Miaoqian Lin (2):
ethernet: Fix error handling in xemaclite_of_probe
gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
Michael S. Tsirkin (2):
virtio: unexport virtio_finalize_features
virtio: acknowledge all features before access
Mike Kravetz (1):
selftests/memfd: clean up mapping in mfd_fail_write
Mohammad Kabat (1):
net/mlx5: Fix size field in bufferx_reg struct
Pavel Skripkin (1):
NFC: port100: fix use-after-free in port100_send_complete
Qu Wenruo (1):
btrfs: unlock newly allocated extent buffer after error
Randy Dunlap (1):
ARM: Spectre-BHB: provide empty stub for non-config
Robert Hancock (1):
net: macb: Fix lost RX packet wakeup race in NAPI receive
Russell King (Oracle) (1):
ARM: fix Thumb2 regression with Spectre BHB
Sven Schnelle (1):
tracing: Ensure trace buffer is at least 4096 bytes large
Tom Rix (1):
qed: return status of qed_iov_get_link
suresh kumar (1):
net-sysfs: add check for netdevice being present to speed_show
I'm announcing the release of the 4.14.272 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
arch/arm/include/asm/spectre.h | 6 +++
arch/arm/kernel/entry-armv.S | 4 +-
drivers/gpio/gpio-ts4900.c | 24 ++++++++++++---
drivers/net/ethernet/nxp/lpc_eth.c | 5 ++-
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++++++----
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 ++++
drivers/net/ethernet/ti/cpts.c | 4 +-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +-
drivers/net/xen-netback/xenbus.c | 13 +++-----
drivers/nfc/port100.c | 2 +
drivers/staging/gdm724x/gdm_lte.c | 5 +--
drivers/virtio/virtio.c | 40 +++++++++++++-------------
fs/btrfs/extent-tree.c | 1
fs/ext4/resize.c | 5 +++
include/linux/mlx5/mlx5_ifc.h | 4 +-
include/linux/virtio.h | 1
include/linux/virtio_config.h | 3 +
kernel/trace/trace.c | 10 +++---
net/ax25/af_ax25.c | 7 ++++
net/core/net-sysfs.c | 2 -
net/sctp/sctp_diag.c | 9 +----
tools/testing/selftests/memfd/memfd_test.c | 1
23 files changed, 115 insertions(+), 62 deletions(-)
Dan Carpenter (1):
staging: gdm724x: fix use after free in gdm_lte_rx()
Duoming Zhou (1):
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Eric Dumazet (1):
sctp: fix kernel-infoleak for SCTP sockets
Greg Kroah-Hartman (1):
Linux 4.14.272
Jia-Ju Bai (1):
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
Jiasheng Jiang (2):
net: ethernet: ti: cpts: Handle error for clk_enable
net: ethernet: lpc_eth: Handle error for clk_enable
Josh Triplett (1):
ext4: add check to prevent attempting to resize an fs with sparse_super2
Marek Marczykowski-Górecki (2):
Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
Revert "xen-netback: Check for hotplug-status existence before watching"
Mark Featherston (1):
gpio: ts4900: Do not set DAT and OE together
Miaoqian Lin (1):
ethernet: Fix error handling in xemaclite_of_probe
Michael S. Tsirkin (2):
virtio: unexport virtio_finalize_features
virtio: acknowledge all features before access
Mike Kravetz (1):
selftests/memfd: clean up mapping in mfd_fail_write
Mohammad Kabat (1):
net/mlx5: Fix size field in bufferx_reg struct
Pavel Skripkin (1):
NFC: port100: fix use-after-free in port100_send_complete
Qu Wenruo (1):
btrfs: unlock newly allocated extent buffer after error
Randy Dunlap (1):
ARM: Spectre-BHB: provide empty stub for non-config
Russell King (Oracle) (1):
ARM: fix Thumb2 regression with Spectre BHB
Sven Schnelle (1):
tracing: Ensure trace buffer is at least 4096 bytes large
Tom Rix (1):
qed: return status of qed_iov_get_link
suresh kumar (1):
net-sysfs: add check for netdevice being present to speed_show
I'm announcing the release of the 4.9.307 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/arm/include/asm/spectre.h | 6 ++++++
arch/arm/kernel/entry-armv.S | 4 ++--
drivers/gpio/gpio-ts4900.c | 24 +++++++++++++++++++-----
drivers/net/ethernet/nxp/lpc_eth.c | 5 ++++-
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++++++++++-------
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 +++++++
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +++-
drivers/net/xen-netback/xenbus.c | 12 ++++--------
drivers/nfc/port100.c | 2 ++
drivers/staging/gdm724x/gdm_lte.c | 5 +++--
fs/btrfs/extent-tree.c | 1 +
include/linux/mlx5/mlx5_ifc.h | 4 ++--
kernel/trace/trace.c | 10 ++++++----
net/ax25/af_ax25.c | 7 +++++++
net/batman-adv/hard-interface.c | 13 ++++++++-----
net/core/net-sysfs.c | 2 +-
net/sctp/sctp_diag.c | 9 +++------
tools/testing/selftests/memfd/memfd_test.c | 1 +
19 files changed, 91 insertions(+), 45 deletions(-)
Dan Carpenter (1):
staging: gdm724x: fix use after free in gdm_lte_rx()
Duoming Zhou (1):
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Eric Dumazet (1):
sctp: fix kernel-infoleak for SCTP sockets
Greg Kroah-Hartman (1):
Linux 4.9.307
Jia-Ju Bai (1):
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
Jiasheng Jiang (1):
net: ethernet: lpc_eth: Handle error for clk_enable
Marek Marczykowski-Górecki (1):
Revert "xen-netback: Check for hotplug-status existence before watching"
Mark Featherston (1):
gpio: ts4900: Do not set DAT and OE together
Miaoqian Lin (1):
ethernet: Fix error handling in xemaclite_of_probe
Mike Kravetz (1):
selftests/memfd: clean up mapping in mfd_fail_write
Mohammad Kabat (1):
net/mlx5: Fix size field in bufferx_reg struct
Pavel Skripkin (1):
NFC: port100: fix use-after-free in port100_send_complete
Qu Wenruo (1):
btrfs: unlock newly allocated extent buffer after error
Randy Dunlap (1):
ARM: Spectre-BHB: provide empty stub for non-config
Russell King (Oracle) (1):
ARM: fix Thumb2 regression with Spectre BHB
Sven Eckelmann (2):
batman-adv: Request iflink once in batadv-on-batadv check
batman-adv: Don't expect inter-netns unique iflink indices
Sven Schnelle (1):
tracing: Ensure trace buffer is at least 4096 bytes large
Tom Rix (1):
qed: return status of qed_iov_get_link
suresh kumar (1):
net-sysfs: add check for netdevice being present to speed_show
patch_text must invoke patch_text_stop_machine on all online CPUs, but
it calls stop_machine_cpuslocked with NULL cpumask. As a result only one
CPU runs patch_text_stop_machine potentially leaving stale icache
entries on other CPUs. Fix that by calling stop_machine_cpuslocked with
cpu_online_mask as the last argument.
Cc: stable(a)vger.kernel.org
Fixes: 64711f9a47d4 ("xtensa: implement jump_label support")
Signed-off-by: Max Filippov <jcmvbkbc(a)gmail.com>
---
arch/xtensa/kernel/jump_label.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/xtensa/kernel/jump_label.c b/arch/xtensa/kernel/jump_label.c
index 61cf6497a646..0dde21e0d3de 100644
--- a/arch/xtensa/kernel/jump_label.c
+++ b/arch/xtensa/kernel/jump_label.c
@@ -61,7 +61,7 @@ static void patch_text(unsigned long addr, const void *data, size_t sz)
.data = data,
};
stop_machine_cpuslocked(patch_text_stop_machine,
- &patch, NULL);
+ &patch, cpu_online_mask);
} else {
unsigned long flags;
--
2.30.2
This is a note to let you know that I've just added the patch titled
dt-bindings: usb: hcd: correct usb-device path
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
From 801109b1a37ad99784e6370cc7e462596f505ea3 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com>
Date: Mon, 14 Mar 2022 19:18:30 +0100
Subject: dt-bindings: usb: hcd: correct usb-device path
The usb-device.yaml reference is absolute so it should use /schemas part
in path.
Fixes: 23bf6fc7046c ("dt-bindings: usb: convert usb-device.txt to YAML schema")
Cc: <stable(a)vger.kernel.org>
Reported-by: Rob Herring <robh(a)kernel.org>
Acked-by: Rob Herring <robh(a)kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com>
Link: https://lore.kernel.org/r/20220314181830.245853-1-krzysztof.kozlowski@canon…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
Documentation/devicetree/bindings/usb/usb-hcd.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/usb/usb-hcd.yaml b/Documentation/devicetree/bindings/usb/usb-hcd.yaml
index 56853c17af66..1dc3d5d7b44f 100644
--- a/Documentation/devicetree/bindings/usb/usb-hcd.yaml
+++ b/Documentation/devicetree/bindings/usb/usb-hcd.yaml
@@ -33,7 +33,7 @@ patternProperties:
"^.*@[0-9a-f]{1,2}$":
description: The hard wired USB devices
type: object
- $ref: /usb/usb-device.yaml
+ $ref: /schemas/usb/usb-device.yaml
additionalProperties: true
--
2.35.1
Syzbot found an issue [1] in ext4_fallocate().
The C reproducer [2] calls fallocate(), passing size 0xffeffeff000ul,
and offset 0x1000000ul, which, when added together exceed the disk size,
and trigger a BUG in ext4_ind_remove_space() [3].
According to the comment doc in ext4_ind_remove_space() the 'end'
parameter needs to be one block after the last block to remove.
In the case when the BUG is triggered it points to the last block on
a 4GB virtual disk image. This is calculated in
ext4_ind_remove_space() in [4].
This patch adds a check that ensure the length + offest to be
within the valid range and returns -ENOSPC error code in case
it is invalid.
LINK: [1] https://syzkaller.appspot.com/bug?id=b80bd9cf348aac724a4f4dff251800106d7213…
LINK: [2] https://syzkaller.appspot.com/text?tag=ReproC&x=14ba0238700000
LINK: [3] https://elixir.bootlin.com/linux/v5.17-rc8/source/fs/ext4/indirect.c#L1244
LINK: [4] https://elixir.bootlin.com/linux/v5.17-rc8/source/fs/ext4/indirect.c#L1234
Cc: Theodore Ts'o <tytso(a)mit.edu>
Cc: Andreas Dilger <adilger.kernel(a)dilger.ca>
Cc: Ritesh Harjani <riteshh(a)linux.ibm.com>
Cc: <linux-ext4(a)vger.kernel.org>
Cc: <stable(a)vger.kernel.org>
Cc: <linux-kernel(a)vger.kernel.org>
Fixes: a4bb6b64e39a ("ext4: enable "punch hole" functionality")
Reported-by: syzbot+7a806094edd5d07ba029(a)syzkaller.appspotmail.com
Signed-off-by: Tadeusz Struk <tadeusz.struk(a)linaro.org>
---
fs/ext4/inode.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 01c9e4f743ba..dd9c35113efe 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3924,7 +3924,8 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
struct super_block *sb = inode->i_sb;
ext4_lblk_t first_block, stop_block;
struct address_space *mapping = inode->i_mapping;
- loff_t first_block_offset, last_block_offset;
+ loff_t first_block_offset, last_block_offset, max_length;
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
handle_t *handle;
unsigned int credits;
int ret = 0, ret2 = 0;
@@ -3967,6 +3968,16 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
offset;
}
+ /*
+ * For punch hole the length + offset needs to be at least within
+ * one block before last
+ */
+ max_length = sbi->s_bitmap_maxbytes - sbi->s_blocksize;
+ if (offset + length >= max_length) {
+ ret = -ENOSPC;
+ goto out_mutex;
+ }
+
if (offset & (sb->s_blocksize - 1) ||
(offset + length) & (sb->s_blocksize - 1)) {
/*
--
2.35.1
Congratulations
You have been compensated with the sum of $5.3 million USD by the
United Nations, the payment will be made on ATM Visa Card
and send to you from Santander Bank of Spain, we need your
passport, address and your Whats-app number.
Best regards
Mrs. Chantal bill
This reverts commit 55dd7e059098ce4bd0a55c251cb78e74604abb57 as it
breaks network on my A20-olinuxino-lime2 hardware revision "K" which has
Micrel KSZ9031RNXCC-TR Gigabit PHY. Bastien has probably some previous
hardware revisions which were based on RTL8211E-VB-CG1 PHY and thus this
fix was working on his board.
Cc: stable(a)vger.kernel.org
Cc: Bastien Roucariès <rouca(a)debian.org>
References: https://github.com/openwrt/openwrt/issues/9153
References: https://github.com/OLIMEX/OLINUXINO/blob/master/HARDWARE/A20-OLinuXino-LIME…
Signed-off-by: Petr Štetiar <ynezz(a)true.cz>
---
arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
index ecb91fb899ff..8077f1716fbc 100644
--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
+++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
@@ -112,7 +112,7 @@ &gmac {
pinctrl-names = "default";
pinctrl-0 = <&gmac_rgmii_pins>;
phy-handle = <&phy1>;
- phy-mode = "rgmii-id";
+ phy-mode = "rgmii";
status = "okay";
};
Tie the lifetime the KVM module to the lifetime of each VM via
kvm.users_count. This way anything that grabs a reference to the VM via
kvm_get_kvm() cannot accidentally outlive the KVM module.
Prior to this commit, the lifetime of the KVM module was tied to the
lifetime of /dev/kvm file descriptors, VM file descriptors, and vCPU
file descriptors by their respective file_operations "owner" field.
This approach is insufficient because references grabbed via
kvm_get_kvm() do not prevent closing any of the aforementioned file
descriptors.
This fixes a long standing theoretical bug in KVM that at least affects
async page faults. kvm_setup_async_pf() grabs a reference via
kvm_get_kvm(), and drops it in an asynchronous work callback. Nothing
prevents the VM file descriptor from being closed and the KVM module
from being unloaded before this callback runs.
Fixes: af585b921e5d ("KVM: Halt vcpu if page it tries to access is swapped out")
Cc: stable(a)vger.kernel.org
Suggested-by: Ben Gardon <bgardon(a)google.com>
[ Based on a patch from Ben implemented for Google's kernel. ]
Signed-off-by: David Matlack <dmatlack(a)google.com>
---
virt/kvm/kvm_main.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 35ae6d32dae5..b59f0a29dbd5 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -117,6 +117,8 @@ EXPORT_SYMBOL_GPL(kvm_debugfs_dir);
static const struct file_operations stat_fops_per_vm;
+static struct file_operations kvm_chardev_ops;
+
static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl,
unsigned long arg);
#ifdef CONFIG_KVM_COMPAT
@@ -1131,6 +1133,11 @@ static struct kvm *kvm_create_vm(unsigned long type)
preempt_notifier_inc();
kvm_init_pm_notifier(kvm);
+ if (!try_module_get(kvm_chardev_ops.owner)) {
+ r = -ENODEV;
+ goto out_err;
+ }
+
return kvm;
out_err:
@@ -1220,6 +1227,7 @@ static void kvm_destroy_vm(struct kvm *kvm)
preempt_notifier_dec();
hardware_disable_all();
mmdrop(mm);
+ module_put(kvm_chardev_ops.owner);
}
void kvm_get_kvm(struct kvm *kvm)
base-commit: b13a3befc815eae574d87e6249f973dfbb6ad6cd
prerequisite-patch-id: 38f66d60319bf0bc9bf49f91f0f9119e5441629b
prerequisite-patch-id: 51aa921d68ea649d436ea68e1b8f4aabc3805156
--
2.35.1.616.g0bdcbb4464-goog
pstore_dump() is *always* invoked in atomic context (nowadays in an RCU
read-side critical section, before that under a spinlock).
It doesn't make sense to try to use semaphores here.
This is mostly a revert of commit ea84b580b955 ("pstore: Convert buf_lock
to semaphore"), except that two parts aren't restored back exactly as they
were:
- keep the lock initialization in pstore_register
- in efi_pstore_write(), always set the "block" flag to false
- omit "is_locked", that was unnecessary since
commit 959217c84c27 ("pstore: Actually give up during locking failure")
- fix the bailout message
The actual problem that the buggy commit was trying to address may have
been that the use of preemptible() in efi_pstore_write() was wrong - it
only looks at preempt_count() and the state of IRQs, but __rcu_read_lock()
doesn't touch either of those under CONFIG_PREEMPT_RCU.
(Sidenote: CONFIG_PREEMPT_RCU means that the scheduler can preempt tasks in
RCU read-side critical sections, but you're not allowed to actively
block/reschedule.)
Lockdep probably never caught the problem because it's very rare that you
actually hit the contended case, so lockdep always just sees the
down_trylock(), not the down_interruptible(), and so it can't tell that
there's a problem.
Fixes: ea84b580b955 ("pstore: Convert buf_lock to semaphore")
Cc: stable(a)vger.kernel.org
Acked-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
Signed-off-by: Jann Horn <jannh(a)google.com>
---
drivers/firmware/efi/efi-pstore.c | 2 +-
fs/pstore/platform.c | 38 +++++++++++++++----------------
include/linux/pstore.h | 6 ++---
3 files changed, 22 insertions(+), 24 deletions(-)
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 0ef086e43090..7e771c56c13c 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -266,7 +266,7 @@ static int efi_pstore_write(struct pstore_record *record)
efi_name[i] = name[i];
ret = efivar_entry_set_safe(efi_name, vendor, PSTORE_EFI_ATTRIBUTES,
- preemptible(), record->size, record->psi->buf);
+ false, record->size, record->psi->buf);
if (record->reason == KMSG_DUMP_OOPS && try_module_get(THIS_MODULE))
if (!schedule_work(&efivar_work))
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index f243cb5e6a4f..e26162f102ff 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -143,21 +143,22 @@ static void pstore_timer_kick(void)
mod_timer(&pstore_timer, jiffies + msecs_to_jiffies(pstore_update_ms));
}
-/*
- * Should pstore_dump() wait for a concurrent pstore_dump()? If
- * not, the current pstore_dump() will report a failure to dump
- * and return.
- */
-static bool pstore_cannot_wait(enum kmsg_dump_reason reason)
+static bool pstore_cannot_block_path(enum kmsg_dump_reason reason)
{
- /* In NMI path, pstore shouldn't block regardless of reason. */
+ /*
+ * In case of NMI path, pstore shouldn't be blocked
+ * regardless of reason.
+ */
if (in_nmi())
return true;
switch (reason) {
/* In panic case, other cpus are stopped by smp_send_stop(). */
case KMSG_DUMP_PANIC:
- /* Emergency restart shouldn't be blocked. */
+ /*
+ * Emergency restart shouldn't be blocked by spinning on
+ * pstore_info::buf_lock.
+ */
case KMSG_DUMP_EMERG:
return true;
default:
@@ -389,21 +390,19 @@ static void pstore_dump(struct kmsg_dumper *dumper,
unsigned long total = 0;
const char *why;
unsigned int part = 1;
+ unsigned long flags = 0;
int ret;
why = kmsg_dump_reason_str(reason);
- if (down_trylock(&psinfo->buf_lock)) {
- /* Failed to acquire lock: give up if we cannot wait. */
- if (pstore_cannot_wait(reason)) {
- pr_err("dump skipped in %s path: may corrupt error record\n",
- in_nmi() ? "NMI" : why);
- return;
- }
- if (down_interruptible(&psinfo->buf_lock)) {
- pr_err("could not grab semaphore?!\n");
+ if (pstore_cannot_block_path(reason)) {
+ if (!spin_trylock_irqsave(&psinfo->buf_lock, flags)) {
+ pr_err("dump skipped in %s path because of concurrent dump\n",
+ in_nmi() ? "NMI" : why);
return;
}
+ } else {
+ spin_lock_irqsave(&psinfo->buf_lock, flags);
}
kmsg_dump_rewind(&iter);
@@ -467,8 +466,7 @@ static void pstore_dump(struct kmsg_dumper *dumper,
total += record.size;
part++;
}
-
- up(&psinfo->buf_lock);
+ spin_unlock_irqrestore(&psinfo->buf_lock, flags);
}
static struct kmsg_dumper pstore_dumper = {
@@ -594,7 +592,7 @@ int pstore_register(struct pstore_info *psi)
psi->write_user = pstore_write_user_compat;
psinfo = psi;
mutex_init(&psinfo->read_mutex);
- sema_init(&psinfo->buf_lock, 1);
+ spin_lock_init(&psinfo->buf_lock);
if (psi->flags & PSTORE_FLAGS_DMESG)
allocate_buf_for_compression();
diff --git a/include/linux/pstore.h b/include/linux/pstore.h
index eb93a54cff31..e97a8188f0fd 100644
--- a/include/linux/pstore.h
+++ b/include/linux/pstore.h
@@ -14,7 +14,7 @@
#include <linux/errno.h>
#include <linux/kmsg_dump.h>
#include <linux/mutex.h>
-#include <linux/semaphore.h>
+#include <linux/spinlock.h>
#include <linux/time.h>
#include <linux/types.h>
@@ -87,7 +87,7 @@ struct pstore_record {
* @owner: module which is responsible for this backend driver
* @name: name of the backend driver
*
- * @buf_lock: semaphore to serialize access to @buf
+ * @buf_lock: spinlock to serialize access to @buf
* @buf: preallocated crash dump buffer
* @bufsize: size of @buf available for crash dump bytes (must match
* smallest number of bytes available for writing to a
@@ -178,7 +178,7 @@ struct pstore_info {
struct module *owner;
const char *name;
- struct semaphore buf_lock;
+ spinlock_t buf_lock;
char *buf;
size_t bufsize;
base-commit: 83e396641110663d3c7bb25b9bc0c6a750359ecf
--
2.35.1.723.g4982287a31-goog
This is a note to let you know that I've just added the patch titled
usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
From 16b1941eac2bd499f065a6739a40ce0011a3d740 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern(a)rowland.harvard.edu>
Date: Sat, 5 Mar 2022 21:47:22 -0500
Subject: usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
The syzbot fuzzer found a use-after-free bug:
BUG: KASAN: use-after-free in dev_uevent+0x712/0x780 drivers/base/core.c:2320
Read of size 8 at addr ffff88802b934098 by task udevd/3689
CPU: 2 PID: 3689 Comm: udevd Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255
__kasan_report mm/kasan/report.c:442 [inline]
kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
dev_uevent+0x712/0x780 drivers/base/core.c:2320
uevent_show+0x1b8/0x380 drivers/base/core.c:2391
dev_attr_show+0x4b/0x90 drivers/base/core.c:2094
Although the bug manifested in the driver core, the real cause was a
race with the gadget core. dev_uevent() does:
if (dev->driver)
add_uevent_var(env, "DRIVER=%s", dev->driver->name);
and between the test and the dereference of dev->driver, the gadget
core sets dev->driver to NULL.
The race wouldn't occur if the gadget core registered its devices on
a real bus, using the standard synchronization techniques of the
driver core. However, it's not necessary to make such a large change
in order to fix this bug; all we need to do is make sure that
udc->dev.driver is always NULL.
In fact, there is no reason for udc->dev.driver ever to be set to
anything, let alone to the value it currently gets: the address of the
gadget's driver. After all, a gadget driver only knows how to manage
a gadget, not how to manage a UDC.
This patch simply removes the statements in the gadget core that touch
udc->dev.driver.
Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class")
CC: <stable(a)vger.kernel.org>
Reported-and-tested-by: syzbot+348b571beb5eeb70a582(a)syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu>
Link: https://lore.kernel.org/r/YiQgukfFFbBnwJ/9@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/gadget/udc/core.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 568534a0d17c..c109b069f511 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1436,7 +1436,6 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
usb_gadget_udc_stop(udc);
udc->driver = NULL;
- udc->dev.driver = NULL;
udc->gadget->dev.driver = NULL;
}
@@ -1498,7 +1497,6 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri
driver->function);
udc->driver = driver;
- udc->dev.driver = &driver->driver;
udc->gadget->dev.driver = &driver->driver;
usb_gadget_udc_set_speed(udc, driver->max_speed);
@@ -1521,7 +1519,6 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri
dev_err(&udc->dev, "failed to start %s: %d\n",
udc->driver->function, ret);
udc->driver = NULL;
- udc->dev.driver = NULL;
udc->gadget->dev.driver = NULL;
return ret;
}
--
2.35.1
This is a note to let you know that I've just added the patch titled
usb: usbtmc: Fix bug in pipe direction for control transfers
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
From e9b667a82cdcfe21d590344447d65daed52b353b Mon Sep 17 00:00:00 2001
From: Alan Stern <stern(a)rowland.harvard.edu>
Date: Thu, 3 Mar 2022 16:00:17 -0500
Subject: usb: usbtmc: Fix bug in pipe direction for control transfers
The syzbot fuzzer reported a minor bug in the usbtmc driver:
usb 5-1: BOGUS control dir, pipe 80001e80 doesn't match bRequestType 0
WARNING: CPU: 0 PID: 3813 at drivers/usb/core/urb.c:412
usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410
Modules linked in:
CPU: 0 PID: 3813 Comm: syz-executor122 Not tainted
5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0
...
Call Trace:
<TASK>
usb_start_wait_urb+0x113/0x530 drivers/usb/core/message.c:58
usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153
usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1947 [inline]
The problem is that usbtmc_ioctl_request() uses usb_rcvctrlpipe() for
all of its transfers, whether they are in or out. It's easy to fix.
CC: <stable(a)vger.kernel.org>
Reported-and-tested-by: syzbot+a48e3d1a875240cab5de(a)syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu>
Link: https://lore.kernel.org/r/YiEsYTPEE6lOCOA5@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/class/usbtmc.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 73f419adce61..4bb6d304eb4b 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1919,6 +1919,7 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data,
struct usbtmc_ctrlrequest request;
u8 *buffer = NULL;
int rv;
+ unsigned int is_in, pipe;
unsigned long res;
res = copy_from_user(&request, arg, sizeof(struct usbtmc_ctrlrequest));
@@ -1928,12 +1929,14 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data,
if (request.req.wLength > USBTMC_BUFSIZE)
return -EMSGSIZE;
+ is_in = request.req.bRequestType & USB_DIR_IN;
+
if (request.req.wLength) {
buffer = kmalloc(request.req.wLength, GFP_KERNEL);
if (!buffer)
return -ENOMEM;
- if ((request.req.bRequestType & USB_DIR_IN) == 0) {
+ if (!is_in) {
/* Send control data to device */
res = copy_from_user(buffer, request.data,
request.req.wLength);
@@ -1944,8 +1947,12 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data,
}
}
+ if (is_in)
+ pipe = usb_rcvctrlpipe(data->usb_dev, 0);
+ else
+ pipe = usb_sndctrlpipe(data->usb_dev, 0);
rv = usb_control_msg(data->usb_dev,
- usb_rcvctrlpipe(data->usb_dev, 0),
+ pipe,
request.req.bRequest,
request.req.bRequestType,
request.req.wValue,
@@ -1957,7 +1964,7 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data,
goto exit;
}
- if (rv && (request.req.bRequestType & USB_DIR_IN)) {
+ if (rv && is_in) {
/* Read control data from device */
res = copy_to_user(request.data, buffer, rv);
if (res)
--
2.35.1
This is a note to let you know that I've just added the patch titled
dt-bindings: usb: hcd: correct usb-device path
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the usb-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
From 801109b1a37ad99784e6370cc7e462596f505ea3 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com>
Date: Mon, 14 Mar 2022 19:18:30 +0100
Subject: dt-bindings: usb: hcd: correct usb-device path
The usb-device.yaml reference is absolute so it should use /schemas part
in path.
Fixes: 23bf6fc7046c ("dt-bindings: usb: convert usb-device.txt to YAML schema")
Cc: <stable(a)vger.kernel.org>
Reported-by: Rob Herring <robh(a)kernel.org>
Acked-by: Rob Herring <robh(a)kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com>
Link: https://lore.kernel.org/r/20220314181830.245853-1-krzysztof.kozlowski@canon…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
Documentation/devicetree/bindings/usb/usb-hcd.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/usb/usb-hcd.yaml b/Documentation/devicetree/bindings/usb/usb-hcd.yaml
index 56853c17af66..1dc3d5d7b44f 100644
--- a/Documentation/devicetree/bindings/usb/usb-hcd.yaml
+++ b/Documentation/devicetree/bindings/usb/usb-hcd.yaml
@@ -33,7 +33,7 @@ patternProperties:
"^.*@[0-9a-f]{1,2}$":
description: The hard wired USB devices
type: object
- $ref: /usb/usb-device.yaml
+ $ref: /schemas/usb/usb-device.yaml
additionalProperties: true
--
2.35.1
From: Xin Long <lucien.xin(a)gmail.com>
commit eae5783908042a762c24e1bd11876edb91d314b1 upstream.
This patch fixes the problems below:
1. In non-shutdown_ack_sent states: in sctp_sf_do_5_1B_init() and
sctp_sf_do_5_2_2_dupinit():
chunk length check should be done before any checks that may cause
to send abort, as making packet for abort will access the init_tag
from init_hdr in sctp_ootb_pkt_new().
2. In shutdown_ack_sent state: in sctp_sf_do_9_2_reshutack():
The same checks as does in sctp_sf_do_5_2_2_dupinit() is needed
for sctp_sf_do_9_2_reshutack().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin(a)gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com>
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
[OP: adjusted context for 4.19]
Signed-off-by: Ovidiu Panait <ovidiu.panait(a)windriver.com>
---
CVE-2021-3772 patchset consists of 7 fixes:
[1] 4f7019c7eb33 ("sctp: use init_tag from inithdr for ABORT chunk")
[2] eae578390804 ("sctp: fix the processing for INIT chunk")
[3] 438b95a7c98f ("sctp: fix the processing for INIT_ACK chunk")
[4] a64b341b8695 ("sctp: fix the processing for COOKIE_ECHO chunk")
[5] aa0f697e4528 ("sctp: add vtag check in sctp_sf_violation")
[6] ef16b1734f0a ("sctp: add vtag check in sctp_sf_do_8_5_1_E_sa")
[7] 9d02831e517a ("sctp: add vtag check in sctp_sf_ootb")
This series contains backports for [2] and [3], which are the only fixes
missing from 4.19-stable. Only small contextual adjustments were made.
net/sctp/sm_statefuns.c | 71 ++++++++++++++++++++++++++---------------
1 file changed, 46 insertions(+), 25 deletions(-)
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index ebca069064df..5e17df88df5d 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -164,6 +164,12 @@ static enum sctp_disposition __sctp_sf_do_9_1_abort(
void *arg,
struct sctp_cmd_seq *commands);
+static enum sctp_disposition
+__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands);
+
/* Small helper function that checks if the chunk length
* is of the appropriate length. The 'required_length' argument
* is set to be the size of a specific chunk we are testing.
@@ -345,6 +351,14 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
if (!chunk->singleton)
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ /* Make sure that the INIT chunk has a valid length.
+ * Normally, this would cause an ABORT with a Protocol Violation
+ * error, but since we don't have an association, we'll
+ * just discard the packet.
+ */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
/* If the packet is an OOTB packet which is temporarily on the
* control endpoint, respond with an ABORT.
*/
@@ -359,14 +373,6 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
if (chunk->sctp_hdr->vtag != 0)
return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
- /* Make sure that the INIT chunk has a valid length.
- * Normally, this would cause an ABORT with a Protocol Violation
- * error, but since we don't have an association, we'll
- * just discard the packet.
- */
- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
-
/* If the INIT is coming toward a closing socket, we'll send back
* and ABORT. Essentially, this catches the race of INIT being
* backloged to the socket at the same time as the user isses close().
@@ -1499,19 +1505,16 @@ static enum sctp_disposition sctp_sf_do_unexpected_init(
if (!chunk->singleton)
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ /* Make sure that the INIT chunk has a valid length. */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
/* 3.1 A packet containing an INIT chunk MUST have a zero Verification
* Tag.
*/
if (chunk->sctp_hdr->vtag != 0)
return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
- /* Make sure that the INIT chunk has a valid length.
- * In this case, we generate a protocol violation since we have
- * an association established.
- */
- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
- commands);
/* Grab the INIT header. */
chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
@@ -1829,9 +1832,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
* its peer.
*/
if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
- disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
- SCTP_ST_CHUNK(chunk->chunk_hdr->type),
- chunk, commands);
+ disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc,
+ SCTP_ST_CHUNK(chunk->chunk_hdr->type),
+ chunk, commands);
if (SCTP_DISPOSITION_NOMEM == disposition)
goto nomem;
@@ -2930,13 +2933,11 @@ enum sctp_disposition sctp_sf_do_9_2_shut_ctsn(
* that belong to this association, it should discard the INIT chunk and
* retransmit the SHUTDOWN ACK chunk.
*/
-enum sctp_disposition sctp_sf_do_9_2_reshutack(
- struct net *net,
- const struct sctp_endpoint *ep,
- const struct sctp_association *asoc,
- const union sctp_subtype type,
- void *arg,
- struct sctp_cmd_seq *commands)
+static enum sctp_disposition
+__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands)
{
struct sctp_chunk *chunk = arg;
struct sctp_chunk *reply;
@@ -2970,6 +2971,26 @@ enum sctp_disposition sctp_sf_do_9_2_reshutack(
return SCTP_DISPOSITION_NOMEM;
}
+enum sctp_disposition
+sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands)
+{
+ struct sctp_chunk *chunk = arg;
+
+ if (!chunk->singleton)
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (chunk->sctp_hdr->vtag != 0)
+ return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
+
+ return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands);
+}
+
/*
* sctp_sf_do_ecn_cwr
*
--
2.25.1
From: Xin Long <lucien.xin(a)gmail.com>
commit eae5783908042a762c24e1bd11876edb91d314b1 upstream.
This patch fixes the problems below:
1. In non-shutdown_ack_sent states: in sctp_sf_do_5_1B_init() and
sctp_sf_do_5_2_2_dupinit():
chunk length check should be done before any checks that may cause
to send abort, as making packet for abort will access the init_tag
from init_hdr in sctp_ootb_pkt_new().
2. In shutdown_ack_sent state: in sctp_sf_do_9_2_reshutack():
The same checks as does in sctp_sf_do_5_2_2_dupinit() is needed
for sctp_sf_do_9_2_reshutack().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin(a)gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com>
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
[OP: adjusted context for 5.4]
Signed-off-by: Ovidiu Panait <ovidiu.panait(a)windriver.com>
---
CVE-2021-3772 patchset consists of 7 fixes:
[1] 4f7019c7eb33 ("sctp: use init_tag from inithdr for ABORT chunk")
[2] eae578390804 ("sctp: fix the processing for INIT chunk")
[3] 438b95a7c98f ("sctp: fix the processing for INIT_ACK chunk")
[4] a64b341b8695 ("sctp: fix the processing for COOKIE_ECHO chunk")
[5] aa0f697e4528 ("sctp: add vtag check in sctp_sf_violation")
[6] ef16b1734f0a ("sctp: add vtag check in sctp_sf_do_8_5_1_E_sa")
[7] 9d02831e517a ("sctp: add vtag check in sctp_sf_ootb")
This is a backport for [2], which is the only fix missing from 5.4-stable.
Only small contextual adjustments were made.
net/sctp/sm_statefuns.c | 71 ++++++++++++++++++++++++++---------------
1 file changed, 46 insertions(+), 25 deletions(-)
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 7c6dcbc8e98b..1d2f633c6c7c 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -149,6 +149,12 @@ static enum sctp_disposition __sctp_sf_do_9_1_abort(
void *arg,
struct sctp_cmd_seq *commands);
+static enum sctp_disposition
+__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands);
+
/* Small helper function that checks if the chunk length
* is of the appropriate length. The 'required_length' argument
* is set to be the size of a specific chunk we are testing.
@@ -330,6 +336,14 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
if (!chunk->singleton)
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ /* Make sure that the INIT chunk has a valid length.
+ * Normally, this would cause an ABORT with a Protocol Violation
+ * error, but since we don't have an association, we'll
+ * just discard the packet.
+ */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
/* If the packet is an OOTB packet which is temporarily on the
* control endpoint, respond with an ABORT.
*/
@@ -344,14 +358,6 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
if (chunk->sctp_hdr->vtag != 0)
return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
- /* Make sure that the INIT chunk has a valid length.
- * Normally, this would cause an ABORT with a Protocol Violation
- * error, but since we don't have an association, we'll
- * just discard the packet.
- */
- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
-
/* If the INIT is coming toward a closing socket, we'll send back
* and ABORT. Essentially, this catches the race of INIT being
* backloged to the socket at the same time as the user isses close().
@@ -1484,19 +1490,16 @@ static enum sctp_disposition sctp_sf_do_unexpected_init(
if (!chunk->singleton)
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ /* Make sure that the INIT chunk has a valid length. */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
/* 3.1 A packet containing an INIT chunk MUST have a zero Verification
* Tag.
*/
if (chunk->sctp_hdr->vtag != 0)
return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
- /* Make sure that the INIT chunk has a valid length.
- * In this case, we generate a protocol violation since we have
- * an association established.
- */
- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
- commands);
/* Grab the INIT header. */
chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
@@ -1814,9 +1817,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
* its peer.
*/
if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
- disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
- SCTP_ST_CHUNK(chunk->chunk_hdr->type),
- chunk, commands);
+ disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc,
+ SCTP_ST_CHUNK(chunk->chunk_hdr->type),
+ chunk, commands);
if (SCTP_DISPOSITION_NOMEM == disposition)
goto nomem;
@@ -2915,13 +2918,11 @@ enum sctp_disposition sctp_sf_do_9_2_shut_ctsn(
* that belong to this association, it should discard the INIT chunk and
* retransmit the SHUTDOWN ACK chunk.
*/
-enum sctp_disposition sctp_sf_do_9_2_reshutack(
- struct net *net,
- const struct sctp_endpoint *ep,
- const struct sctp_association *asoc,
- const union sctp_subtype type,
- void *arg,
- struct sctp_cmd_seq *commands)
+static enum sctp_disposition
+__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands)
{
struct sctp_chunk *chunk = arg;
struct sctp_chunk *reply;
@@ -2955,6 +2956,26 @@ enum sctp_disposition sctp_sf_do_9_2_reshutack(
return SCTP_DISPOSITION_NOMEM;
}
+enum sctp_disposition
+sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands)
+{
+ struct sctp_chunk *chunk = arg;
+
+ if (!chunk->singleton)
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (chunk->sctp_hdr->vtag != 0)
+ return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
+
+ return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands);
+}
+
/*
* sctp_sf_do_ecn_cwr
*
--
2.25.1
From: Xin Long <lucien.xin(a)gmail.com>
commit eae5783908042a762c24e1bd11876edb91d314b1 upstream.
This patch fixes the problems below:
1. In non-shutdown_ack_sent states: in sctp_sf_do_5_1B_init() and
sctp_sf_do_5_2_2_dupinit():
chunk length check should be done before any checks that may cause
to send abort, as making packet for abort will access the init_tag
from init_hdr in sctp_ootb_pkt_new().
2. In shutdown_ack_sent state: in sctp_sf_do_9_2_reshutack():
The same checks as does in sctp_sf_do_5_2_2_dupinit() is needed
for sctp_sf_do_9_2_reshutack().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin(a)gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com>
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
[OP: adjusted context for 5.10]
Signed-off-by: Ovidiu Panait <ovidiu.panait(a)windriver.com>
---
CVE-2021-3772 patchset consists of 7 fixes:
[1] 4f7019c7eb33 ("sctp: use init_tag from inithdr for ABORT chunk")
[2] eae578390804 ("sctp: fix the processing for INIT chunk")
[3] 438b95a7c98f ("sctp: fix the processing for INIT_ACK chunk")
[4] a64b341b8695 ("sctp: fix the processing for COOKIE_ECHO chunk")
[5] aa0f697e4528 ("sctp: add vtag check in sctp_sf_violation")
[6] ef16b1734f0a ("sctp: add vtag check in sctp_sf_do_8_5_1_E_sa")
[7] 9d02831e517a ("sctp: add vtag check in sctp_sf_ootb")
This is a backport for [2], which is the only fix missing from 5.10-stable.
Only small contextual adjustments were made.
net/sctp/sm_statefuns.c | 71 ++++++++++++++++++++++++++---------------
1 file changed, 46 insertions(+), 25 deletions(-)
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 096e6be1d8fc..ee0b2b03657c 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -149,6 +149,12 @@ static enum sctp_disposition __sctp_sf_do_9_1_abort(
void *arg,
struct sctp_cmd_seq *commands);
+static enum sctp_disposition
+__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands);
+
/* Small helper function that checks if the chunk length
* is of the appropriate length. The 'required_length' argument
* is set to be the size of a specific chunk we are testing.
@@ -330,6 +336,14 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
if (!chunk->singleton)
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ /* Make sure that the INIT chunk has a valid length.
+ * Normally, this would cause an ABORT with a Protocol Violation
+ * error, but since we don't have an association, we'll
+ * just discard the packet.
+ */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
/* If the packet is an OOTB packet which is temporarily on the
* control endpoint, respond with an ABORT.
*/
@@ -344,14 +358,6 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
if (chunk->sctp_hdr->vtag != 0)
return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
- /* Make sure that the INIT chunk has a valid length.
- * Normally, this would cause an ABORT with a Protocol Violation
- * error, but since we don't have an association, we'll
- * just discard the packet.
- */
- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
-
/* If the INIT is coming toward a closing socket, we'll send back
* and ABORT. Essentially, this catches the race of INIT being
* backloged to the socket at the same time as the user isses close().
@@ -1484,19 +1490,16 @@ static enum sctp_disposition sctp_sf_do_unexpected_init(
if (!chunk->singleton)
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ /* Make sure that the INIT chunk has a valid length. */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
/* 3.1 A packet containing an INIT chunk MUST have a zero Verification
* Tag.
*/
if (chunk->sctp_hdr->vtag != 0)
return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
- /* Make sure that the INIT chunk has a valid length.
- * In this case, we generate a protocol violation since we have
- * an association established.
- */
- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
- commands);
/* Grab the INIT header. */
chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
@@ -1814,9 +1817,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
* its peer.
*/
if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
- disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
- SCTP_ST_CHUNK(chunk->chunk_hdr->type),
- chunk, commands);
+ disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc,
+ SCTP_ST_CHUNK(chunk->chunk_hdr->type),
+ chunk, commands);
if (SCTP_DISPOSITION_NOMEM == disposition)
goto nomem;
@@ -2915,13 +2918,11 @@ enum sctp_disposition sctp_sf_do_9_2_shut_ctsn(
* that belong to this association, it should discard the INIT chunk and
* retransmit the SHUTDOWN ACK chunk.
*/
-enum sctp_disposition sctp_sf_do_9_2_reshutack(
- struct net *net,
- const struct sctp_endpoint *ep,
- const struct sctp_association *asoc,
- const union sctp_subtype type,
- void *arg,
- struct sctp_cmd_seq *commands)
+static enum sctp_disposition
+__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands)
{
struct sctp_chunk *chunk = arg;
struct sctp_chunk *reply;
@@ -2955,6 +2956,26 @@ enum sctp_disposition sctp_sf_do_9_2_reshutack(
return SCTP_DISPOSITION_NOMEM;
}
+enum sctp_disposition
+sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
+ const struct sctp_association *asoc,
+ const union sctp_subtype type, void *arg,
+ struct sctp_cmd_seq *commands)
+{
+ struct sctp_chunk *chunk = arg;
+
+ if (!chunk->singleton)
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (chunk->sctp_hdr->vtag != 0)
+ return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
+
+ return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands);
+}
+
/*
* sctp_sf_do_ecn_cwr
*
--
2.25.1
This is the start of the stable review cycle for the 5.10.105 release.
There are 58 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 12 Mar 2022 14:07:58 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.105-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.105-rc2
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE"
Juergen Gross <jgross(a)suse.com>
xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
Juergen Gross <jgross(a)suse.com>
xen/gnttab: fix gnttab_end_foreign_access() without page specified
Juergen Gross <jgross(a)suse.com>
xen/pvcalls: use alloc/free_pages_exact()
Juergen Gross <jgross(a)suse.com>
xen/9p: use alloc/free_pages_exact()
Juergen Gross <jgross(a)suse.com>
xen: remove gnttab_query_foreign_access()
Juergen Gross <jgross(a)suse.com>
xen/gntalloc: don't use gnttab_query_foreign_access()
Juergen Gross <jgross(a)suse.com>
xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
Juergen Gross <jgross(a)suse.com>
xen/netfront: don't use gnttab_query_foreign_access() for mapped status
Juergen Gross <jgross(a)suse.com>
xen/blkfront: don't use gnttab_query_foreign_access() for mapped status
Juergen Gross <jgross(a)suse.com>
xen/grant-table: add gnttab_try_end_foreign_access()
Juergen Gross <jgross(a)suse.com>
xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: fix build warning in proc-v7-bugs.c
Nathan Chancellor <nathan(a)kernel.org>
ARM: Do not use NOCROSSREFS directive with ld.lld
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: fix co-processor register typo
Emmanuel Gil Peyrot <linkmauve(a)linkmauve.fr>
ARM: fix build error when BPF_SYSCALL is disabled
James Morse <james.morse(a)arm.com>
arm64: proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting
James Morse <james.morse(a)arm.com>
arm64: Use the clearbhb instruction in mitigations
James Morse <james.morse(a)arm.com>
KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
James Morse <james.morse(a)arm.com>
arm64: Mitigate spectre style branch history side channels
James Morse <james.morse(a)arm.com>
KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A
James Morse <james.morse(a)arm.com>
arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
James Morse <james.morse(a)arm.com>
arm64: Add percpu vectors for EL1
James Morse <james.morse(a)arm.com>
arm64: entry: Add macro for reading symbol addresses from the trampoline
James Morse <james.morse(a)arm.com>
arm64: entry: Add vectors that have the bhb mitigation sequences
James Morse <james.morse(a)arm.com>
arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
James Morse <james.morse(a)arm.com>
arm64: entry: Allow the trampoline text to occupy multiple pages
James Morse <james.morse(a)arm.com>
arm64: entry: Make the kpti trampoline's kpti sequence optional
James Morse <james.morse(a)arm.com>
arm64: entry: Move trampoline macros out of ifdef'd section
James Morse <james.morse(a)arm.com>
arm64: entry: Don't assume tramp_vectors is the start of the vectors
James Morse <james.morse(a)arm.com>
arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
James Morse <james.morse(a)arm.com>
arm64: entry: Move the trampoline data page before the text page
James Morse <james.morse(a)arm.com>
arm64: entry: Free up another register on kpti's tramp_exit path
James Morse <james.morse(a)arm.com>
arm64: entry: Make the trampoline cleanup optional
James Morse <james.morse(a)arm.com>
arm64: spectre: Rename spectre_v4_patch_fw_mitigation_conduit
James Morse <james.morse(a)arm.com>
arm64: entry.S: Add ventry overflow sanity checks
Joey Gouly <joey.gouly(a)arm.com>
arm64: cpufeature: add HWCAP for FEAT_RPRES
Joey Gouly <joey.gouly(a)arm.com>
arm64: cpufeature: add HWCAP for FEAT_AFP
Joey Gouly <joey.gouly(a)arm.com>
arm64: add ID_AA64ISAR2_EL1 sys register
Marc Zyngier <maz(a)kernel.org>
arm64: Add HWCAP for self-synchronising virtual counter
Anshuman Khandual <anshuman.khandual(a)arm.com>
arm64: Add Cortex-A510 CPU part definition
Anshuman Khandual <anshuman.khandual(a)arm.com>
arm64: Add Cortex-X2 CPU part definition
Suzuki K Poulose <suzuki.poulose(a)arm.com>
arm64: Add Neoverse-N2, Cortex-A710 CPU part definition
Hector Martin <marcan(a)marcan.st>
arm64: cputype: Add CPU implementor & types for the Apple M1 cores
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: include unprivileged BPF status in Spectre V2 reporting
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: Spectre-BHB workaround
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: use LOADADDR() to get load address of sections
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: early traps initialisation
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: report Spectre v2 status through sysfs
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/speculation: Warn about Spectre v2 LFENCE mitigation
Kim Phillips <kim.phillips(a)amd.com>
x86/speculation: Update link to AMD speculation whitepaper
Kim Phillips <kim.phillips(a)amd.com>
x86/speculation: Use generic retpoline by default on AMD
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
Peter Zijlstra <peterz(a)infradead.org>
Documentation/hw-vuln: Update spectre doc
Peter Zijlstra <peterz(a)infradead.org>
x86/speculation: Add eIBRS + Retpoline options
Peter Zijlstra (Intel) <peterz(a)infradead.org>
x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
Peter Zijlstra <peterz(a)infradead.org>
x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
-------------
Diffstat:
Documentation/admin-guide/hw-vuln/spectre.rst | 48 ++--
Documentation/admin-guide/kernel-parameters.txt | 8 +-
Documentation/arm64/cpu-feature-registers.rst | 29 +-
Documentation/arm64/elf_hwcaps.rst | 12 +
Makefile | 4 +-
arch/arm/include/asm/assembler.h | 10 +
arch/arm/include/asm/spectre.h | 32 +++
arch/arm/include/asm/vmlinux.lds.h | 43 ++-
arch/arm/kernel/Makefile | 2 +
arch/arm/kernel/entry-armv.S | 79 +++++-
arch/arm/kernel/entry-common.S | 24 ++
arch/arm/kernel/spectre.c | 71 +++++
arch/arm/kernel/traps.c | 65 ++++-
arch/arm/mm/Kconfig | 11 +
arch/arm/mm/proc-v7-bugs.c | 208 +++++++++++---
arch/arm64/Kconfig | 9 +
arch/arm64/include/asm/assembler.h | 33 +++
arch/arm64/include/asm/cpu.h | 1 +
arch/arm64/include/asm/cpucaps.h | 3 +-
arch/arm64/include/asm/cpufeature.h | 28 ++
arch/arm64/include/asm/cputype.h | 22 ++
arch/arm64/include/asm/fixmap.h | 6 +-
arch/arm64/include/asm/hwcap.h | 3 +
arch/arm64/include/asm/insn.h | 1 +
arch/arm64/include/asm/kvm_asm.h | 8 +
arch/arm64/include/asm/kvm_mmu.h | 3 +-
arch/arm64/include/asm/mmu.h | 6 +
arch/arm64/include/asm/sections.h | 5 +
arch/arm64/include/asm/spectre.h | 4 +
arch/arm64/include/asm/sysreg.h | 18 ++
arch/arm64/include/asm/vectors.h | 73 +++++
arch/arm64/include/uapi/asm/hwcap.h | 3 +
arch/arm64/include/uapi/asm/kvm.h | 5 +
arch/arm64/kernel/cpu_errata.c | 7 +
arch/arm64/kernel/cpufeature.c | 28 +-
arch/arm64/kernel/cpuinfo.c | 4 +
arch/arm64/kernel/entry.S | 213 ++++++++++----
arch/arm64/kernel/proton-pack.c | 359 +++++++++++++++++++++++-
arch/arm64/kernel/vmlinux.lds.S | 2 +-
arch/arm64/kvm/arm.c | 3 +-
arch/arm64/kvm/hyp/hyp-entry.S | 4 +
arch/arm64/kvm/hyp/smccc_wa.S | 75 +++++
arch/arm64/kvm/hyp/vhe/switch.c | 9 +-
arch/arm64/kvm/hypercalls.c | 12 +
arch/arm64/kvm/psci.c | 18 +-
arch/arm64/kvm/sys_regs.c | 2 +-
arch/arm64/mm/mmu.c | 12 +-
arch/x86/include/asm/cpufeatures.h | 2 +-
arch/x86/include/asm/nospec-branch.h | 16 +-
arch/x86/kernel/cpu/bugs.c | 205 ++++++++++----
drivers/acpi/ec.c | 10 -
drivers/acpi/sleep.c | 14 +-
drivers/block/xen-blkfront.c | 63 +++--
drivers/net/xen-netfront.c | 54 ++--
drivers/scsi/xen-scsifront.c | 3 +-
drivers/xen/gntalloc.c | 25 +-
drivers/xen/grant-table.c | 71 ++---
drivers/xen/pvcalls-front.c | 8 +-
drivers/xen/xenbus/xenbus_client.c | 24 +-
include/linux/arm-smccc.h | 5 +
include/linux/bpf.h | 12 +
include/xen/grant_table.h | 19 +-
kernel/sysctl.c | 7 +
net/9p/trans_xen.c | 14 +-
tools/arch/x86/include/asm/cpufeatures.h | 2 +-
65 files changed, 1825 insertions(+), 354 deletions(-)
This is the start of the stable review cycle for the 5.10.106 release.
There are 71 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 16 Mar 2022 11:27:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.106-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.106-rc1
David Howells <dhowells(a)redhat.com>
watch_queue: Fix filter limit check
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: fix Thumb2 regression with Spectre BHB
Josh Triplett <josh(a)joshtriplett.org>
ext4: add check to prevent attempting to resize an fs with sparse_super2
Li Huafei <lihuafei1(a)huawei.com>
x86/traps: Mark do_int3() NOKPROBE_SYMBOL
Ross Philipson <ross.philipson(a)oracle.com>
x86/boot: Add setup_indirect support in early_memremap_is_setup_data()
Ross Philipson <ross.philipson(a)oracle.com>
x86/boot: Fix memremap of setup_indirect structures
David Howells <dhowells(a)redhat.com>
watch_queue: Make comment about setting ->defunct more accurate
David Howells <dhowells(a)redhat.com>
watch_queue: Fix lack of barrier/sync/lock between post and read
David Howells <dhowells(a)redhat.com>
watch_queue: Free the alloc bitmap when the watch_queue is torn down
David Howells <dhowells(a)redhat.com>
watch_queue: Fix the alloc bitmap size to reflect notes allocated
David Howells <dhowells(a)redhat.com>
watch_queue: Fix to always request a pow-of-2 pipe ring size
David Howells <dhowells(a)redhat.com>
watch_queue: Fix to release page in ->release()
David Howells <dhowells(a)redhat.com>
watch_queue, pipe: Free watchqueue state after clearing pipe ring
Michael S. Tsirkin <mst(a)redhat.com>
virtio: acknowledge all features before access
Michael S. Tsirkin <mst(a)redhat.com>
virtio: unexport virtio_finalize_features
Pali Rohár <pali(a)kernel.org>
arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0
Emil Renner Berthing <kernel(a)esmil.dk>
riscv: Fix auipc+jalr relocation range checks
Rong Chen <rong.chen(a)amlogic.com>
mmc: meson: Fix usage of meson_mmc_post_req()
Robert Hancock <robert.hancock(a)calian.com>
net: macb: Fix lost RX packet wakeup race in NAPI receive
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: gdm724x: fix use after free in gdm_lte_rx()
Hans de Goede <hdegoede(a)redhat.com>
staging: rtl8723bs: Fix access-point mode deadlock
Miklos Szeredi <mszeredi(a)redhat.com>
fuse: fix pipe buffer lifetime for direct_io
Randy Dunlap <rdunlap(a)infradead.org>
ARM: Spectre-BHB: provide empty stub for non-config
Mike Kravetz <mike.kravetz(a)oracle.com>
selftests/memfd: clean up mapping in mfd_fail_write
Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com>
selftest/vm: fix map_fixed_noreplace test failure
Sven Schnelle <svens(a)linux.ibm.com>
tracing: Ensure trace buffer is at least 4096 bytes large
Niels Dossche <dossche.niels(a)gmail.com>
ipv6: prevent a possible race condition with lifetimes
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: Check for hotplug-status existence before watching"
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
Shreeya Patel <shreeya.patel(a)collabora.com>
gpio: Return EPROBE_DEFER if gc->to_irq is NULL
Vikash Chandola <vikash.chandola(a)linux.intel.com>
hwmon: (pmbus) Clear pmbus fault/warning bits after read
suresh kumar <suresh2514(a)gmail.com>
net-sysfs: add check for netdevice being present to speed_show
Jon Lin <jon.lin(a)rock-chips.com>
spi: rockchip: terminate dma transmission when slave abort
Jon Lin <jon.lin(a)rock-chips.com>
spi: rockchip: Fix error in getting num-cs property
Kumar Kartikeya Dwivedi <memxor(a)gmail.com>
selftests/bpf: Add test for bpf_timer overwriting crash
Jeremy Linton <jeremy.linton(a)arm.com>
net: bcmgenet: Don't claim WOL when its not available
Eric Dumazet <edumazet(a)google.com>
sctp: fix kernel-infoleak for SCTP sockets
Clément Léger <clement.leger(a)bootlin.com>
net: phy: DP83822: clear MISR2 register to disable interrupts
Miaoqian Lin <linmq006(a)gmail.com>
gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
Mark Featherston <mark(a)embeddedTS.com>
gpio: ts4900: Do not set DAT and OE together
Guillaume Nault <gnault(a)redhat.com>
selftests: pmtu.sh: Kill tcpdump processes launched by subshell.
Pavel Skripkin <paskripkin(a)gmail.com>
NFC: port100: fix use-after-free in port100_send_complete
Roi Dayan <roid(a)nvidia.com>
net/mlx5e: Lag, Only handle events from highest priority multipath entry
Moshe Shemesh <moshe(a)nvidia.com>
net/mlx5: Fix a race on command flush flow
Mohammad Kabat <mohammadkab(a)nvidia.com>
net/mlx5: Fix size field in bufferx_reg struct
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: lpc_eth: Handle error for clk_enable
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: ti: cpts: Handle error for clk_enable
Tung Nguyen <tung.q.nguyen(a)dektech.com.au>
tipc: fix incorrect order of state message data sanity check
Miaoqian Lin <linmq006(a)gmail.com>
ethernet: Fix error handling in xemaclite_of_probe
Jedrzej Jagielski <jedrzej.jagielski(a)intel.com>
ice: Fix curr_link_speed advertised speed
Anirudh Venkataramanan <anirudh.venkataramanan(a)intel.com>
ice: Rename a couple of variables
Anirudh Venkataramanan <anirudh.venkataramanan(a)intel.com>
ice: Remove unnecessary checker loop
Anirudh Venkataramanan <anirudh.venkataramanan(a)intel.com>
ice: Align macro names to the specification
Jacob Keller <jacob.e.keller(a)intel.com>
ice: stop disabling VFs due to PF error responses
Jacob Keller <jacob.e.keller(a)intel.com>
i40e: stop disabling VFs due to PF error responses
Joel Stanley <joel(a)jms.id.au>
ARM: dts: aspeed: Fix AST2600 quad spi group
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
net: dsa: mt7530: fix incorrect test in mt753x_phylink_validate()
Jernej Skrabec <jernej.skrabec(a)gmail.com>
drm/sun4i: mixer: Fix P010 and P210 format numbers
Tom Rix <trix(a)redhat.com>
qed: return status of qed_iov_get_link
Steffen Klassert <steffen.klassert(a)secunet.com>
esp: Fix BEET mode inter address family tunneling on GSO
Jia-Ju Bai <baijiaju1990(a)gmail.com>
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
Jia-Ju Bai <baijiaju1990(a)gmail.com>
isdn: hfcpci: check the return value of dma_set_mask() in setup_hw()
Xie Yongji <xieyongji(a)bytedance.com>
virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero
Alexey Khoroshilov <khoroshilov(a)ispras.ru>
mISDN: Fix memory leak in dsp_pipeline_build()
Zhen Lei <thunder.leizhen(a)huawei.com>
mISDN: Remove obsolete PIPELINE_DEBUG debugging information
Tung Nguyen <tung.q.nguyen(a)dektech.com.au>
tipc: fix kernel panic when enabling bearer
Pali Rohár <pali(a)kernel.org>
arm64: dts: armada-3720-turris-mox: Add missing ethernet0 alias
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
HID: vivaldi: fix sysfs attributes leak
Taniya Das <tdas(a)codeaurora.org>
clk: qcom: gdsc: Add support to update GDSC transition delay
Maxime Ripard <maxime(a)cerno.tech>
ARM: boot: dts: bcm2711: Fix HVS register range
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 2 +-
arch/arm/boot/dts/bcm2711.dtsi | 1 +
arch/arm/include/asm/spectre.h | 6 ++
arch/arm/kernel/entry-armv.S | 4 +-
.../boot/dts/marvell/armada-3720-turris-mox.dts | 8 ++-
arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 2 +-
arch/riscv/kernel/module.c | 21 ++++--
arch/x86/kernel/e820.c | 41 ++++++++----
arch/x86/kernel/kdebugfs.c | 37 ++++++++---
arch/x86/kernel/ksysfs.c | 77 +++++++++++++++++-----
arch/x86/kernel/setup.c | 34 ++++++++--
arch/x86/kernel/traps.c | 1 +
arch/x86/mm/ioremap.c | 57 ++++++++++++++--
drivers/block/virtio_blk.c | 10 ++-
drivers/clk/qcom/gdsc.c | 26 ++++++--
drivers/clk/qcom/gdsc.h | 8 ++-
drivers/gpio/gpio-ts4900.c | 24 +++++--
drivers/gpio/gpiolib.c | 10 +++
drivers/gpu/drm/sun4i/sun8i_mixer.h | 8 +--
drivers/hid/hid-vivaldi.c | 2 +-
drivers/hwmon/pmbus/pmbus_core.c | 5 ++
drivers/isdn/hardware/mISDN/hfcpci.c | 6 +-
drivers/isdn/mISDN/dsp_pipeline.c | 52 ++-------------
drivers/mmc/host/meson-gx-mmc.c | 15 +++--
drivers/net/dsa/mt7530.c | 2 +-
drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 7 ++
drivers/net/ethernet/cadence/macb_main.c | 25 ++++++-
drivers/net/ethernet/freescale/gianfar_ethtool.c | 1 +
drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 6 +-
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 57 ++--------------
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 5 --
drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 10 +--
drivers/net/ethernet/intel/ice/ice_common.c | 13 ++--
drivers/net/ethernet/intel/ice/ice_ethtool.c | 70 +++++++++-----------
drivers/net/ethernet/intel/ice/ice_main.c | 12 ++--
drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 18 -----
drivers/net/ethernet/intel/ice/ice_virtchnl_pf.h | 3 -
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 15 +++--
drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 11 +++-
drivers/net/ethernet/nxp/lpc_eth.c | 5 +-
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++--
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 ++
drivers/net/ethernet/ti/cpts.c | 4 +-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +-
drivers/net/phy/dp83822.c | 2 +-
drivers/net/xen-netback/xenbus.c | 14 ++--
drivers/nfc/port100.c | 2 +
drivers/spi/spi-rockchip.c | 13 +++-
drivers/staging/gdm724x/gdm_lte.c | 5 +-
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 7 +-
drivers/staging/rtl8723bs/core/rtw_recv.c | 10 ++-
drivers/staging/rtl8723bs/core/rtw_sta_mgt.c | 22 +++----
drivers/staging/rtl8723bs/core/rtw_xmit.c | 16 +++--
drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c | 2 +
drivers/virtio/virtio.c | 40 ++++++-----
fs/ext4/resize.c | 5 ++
fs/fuse/dev.c | 12 +++-
fs/fuse/file.c | 1 +
fs/fuse/fuse_i.h | 1 +
fs/pipe.c | 11 ++--
include/linux/mlx5/mlx5_ifc.h | 4 +-
include/linux/virtio.h | 1 -
include/linux/virtio_config.h | 3 +-
include/linux/watch_queue.h | 3 +-
kernel/trace/trace.c | 10 +--
kernel/watch_queue.c | 15 +++--
net/ax25/af_ax25.c | 7 ++
net/core/net-sysfs.c | 2 +-
net/ipv4/esp4_offload.c | 3 +
net/ipv6/addrconf.c | 2 +
net/ipv6/esp6_offload.c | 3 +
net/sctp/diag.c | 9 +--
net/tipc/bearer.c | 12 ++--
net/tipc/link.c | 9 +--
.../testing/selftests/bpf/prog_tests/timer_crash.c | 32 +++++++++
tools/testing/selftests/bpf/progs/timer_crash.c | 54 +++++++++++++++
tools/testing/selftests/memfd/memfd_test.c | 1 +
tools/testing/selftests/net/pmtu.sh | 7 +-
tools/testing/selftests/vm/map_fixed_noreplace.c | 49 ++++++++++----
80 files changed, 744 insertions(+), 399 deletions(-)
This is the start of the stable review cycle for the 4.19.235 release.
There are 30 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 16 Mar 2022 11:27:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.235-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.235-rc1
Valentin Schneider <valentin.schneider(a)arm.com>
ia64: ensure proper NUMA distance and possible map initialization
Dietmar Eggemann <dietmar.eggemann(a)arm.com>
sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa()
Valentin Schneider <valentin.schneider(a)arm.com>
sched/topology: Make sched_init_numa() use a set for the deduplicating sort
Qu Wenruo <wqu(a)suse.com>
btrfs: unlock newly allocated extent buffer after error
Josh Triplett <josh(a)joshtriplett.org>
ext4: add check to prevent attempting to resize an fs with sparse_super2
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: fix Thumb2 regression with Spectre BHB
Michael S. Tsirkin <mst(a)redhat.com>
virtio: acknowledge all features before access
Michael S. Tsirkin <mst(a)redhat.com>
virtio: unexport virtio_finalize_features
James Morse <james.morse(a)arm.com>
KVM: arm64: Reset PMC_EL0 to avoid a panic() on systems with no PMU
Emil Renner Berthing <kernel(a)esmil.dk>
riscv: Fix auipc+jalr relocation range checks
Robert Hancock <robert.hancock(a)calian.com>
net: macb: Fix lost RX packet wakeup race in NAPI receive
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: gdm724x: fix use after free in gdm_lte_rx()
Randy Dunlap <rdunlap(a)infradead.org>
ARM: Spectre-BHB: provide empty stub for non-config
Mike Kravetz <mike.kravetz(a)oracle.com>
selftests/memfd: clean up mapping in mfd_fail_write
Sven Schnelle <svens(a)linux.ibm.com>
tracing: Ensure trace buffer is at least 4096 bytes large
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: Check for hotplug-status existence before watching"
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
suresh kumar <suresh2514(a)gmail.com>
net-sysfs: add check for netdevice being present to speed_show
Eric Dumazet <edumazet(a)google.com>
sctp: fix kernel-infoleak for SCTP sockets
Clément Léger <clement.leger(a)bootlin.com>
net: phy: DP83822: clear MISR2 register to disable interrupts
Miaoqian Lin <linmq006(a)gmail.com>
gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
Mark Featherston <mark(a)embeddedTS.com>
gpio: ts4900: Do not set DAT and OE together
Pavel Skripkin <paskripkin(a)gmail.com>
NFC: port100: fix use-after-free in port100_send_complete
Mohammad Kabat <mohammadkab(a)nvidia.com>
net/mlx5: Fix size field in bufferx_reg struct
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: lpc_eth: Handle error for clk_enable
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: ti: cpts: Handle error for clk_enable
Miaoqian Lin <linmq006(a)gmail.com>
ethernet: Fix error handling in xemaclite_of_probe
Tom Rix <trix(a)redhat.com>
qed: return status of qed_iov_get_link
Jia-Ju Bai <baijiaju1990(a)gmail.com>
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
-------------
Diffstat:
Makefile | 4 +-
arch/arm/include/asm/spectre.h | 6 ++
arch/arm/kernel/entry-armv.S | 4 +-
arch/arm64/kvm/sys_regs.c | 4 +-
arch/ia64/kernel/acpi.c | 7 +-
arch/riscv/kernel/module.c | 21 +++--
drivers/gpio/gpio-ts4900.c | 24 ++++--
drivers/net/ethernet/cadence/macb_main.c | 25 +++++-
drivers/net/ethernet/freescale/gianfar_ethtool.c | 1 +
drivers/net/ethernet/nxp/lpc_eth.c | 5 +-
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++--
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 ++
drivers/net/ethernet/ti/cpts.c | 4 +-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +-
drivers/net/phy/dp83822.c | 2 +-
drivers/net/xen-netback/xenbus.c | 13 ++--
drivers/nfc/port100.c | 2 +
drivers/staging/gdm724x/gdm_lte.c | 5 +-
drivers/virtio/virtio.c | 40 +++++-----
fs/btrfs/extent-tree.c | 1 +
fs/ext4/resize.c | 5 ++
include/linux/mlx5/mlx5_ifc.h | 4 +-
include/linux/topology.h | 1 +
include/linux/virtio.h | 1 -
include/linux/virtio_config.h | 3 +-
kernel/sched/topology.c | 99 ++++++++++++------------
kernel/trace/trace.c | 10 ++-
net/ax25/af_ax25.c | 7 ++
net/core/net-sysfs.c | 2 +-
net/sctp/diag.c | 9 +--
tools/testing/selftests/memfd/memfd_test.c | 1 +
31 files changed, 215 insertions(+), 124 deletions(-)
--
Hello Dear,
how are you today?hope you are fine
My name is Dr Ava Smith ,Am an English and French nationalities.
I will give you pictures and more details about me as soon as i hear from you
Thanks
Ava
From: Zucheng Zheng <zhengzucheng(a)huawei.com>
On some specific platforms, the cpufreq driver does not define
cpufreq_driver.get() routine (eg:x86 intel_pstate driver), as a
result, the cpufreq_get() can't get the correct CPU frequency.
Modern x86 processors include the hardware needed to accurately
calculate frequency over an interval -- APERF, MPERF and the TSC.
Here we use arch_freq_get_on_cpu() in preference to any driver
driver-specific cpufreq_driver.get() routine to get CPU frequency.
Fixes: f8475cef9008 ("x86: use common aperfmperf_khz_on_cpu() to calculate KHz using APERF/MPERF")
Signed-off-by: Zucheng Zheng <zhengzucheng(a)huawei.com>
---
drivers/cpufreq/cpufreq.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 80f535cc8a75..d777257b4454 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1806,10 +1806,14 @@ unsigned int cpufreq_get(unsigned int cpu)
{
struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
unsigned int ret_freq = 0;
+ unsigned int freq;
if (policy) {
down_read(&policy->rwsem);
- if (cpufreq_driver->get)
+ freq = arch_freq_get_on_cpu(policy->cpu);
+ if (freq)
+ ret_freq = freq;
+ else if (cpufreq_driver->get)
ret_freq = __cpufreq_get(policy);
up_read(&policy->rwsem);
--
2.18.0.huawei.25
This is the start of the stable review cycle for the 4.9.307 release.
There are 19 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 16 Mar 2022 14:59:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.307-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.307-rc2
Qu Wenruo <wqu(a)suse.com>
btrfs: unlock newly allocated extent buffer after error
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: fix Thumb2 regression with Spectre BHB
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't expect inter-netns unique iflink indices
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Request iflink once in batadv-on-batadv check
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: gdm724x: fix use after free in gdm_lte_rx()
Randy Dunlap <rdunlap(a)infradead.org>
ARM: Spectre-BHB: provide empty stub for non-config
Mike Kravetz <mike.kravetz(a)oracle.com>
selftests/memfd: clean up mapping in mfd_fail_write
Sven Schnelle <svens(a)linux.ibm.com>
tracing: Ensure trace buffer is at least 4096 bytes large
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: Check for hotplug-status existence before watching"
suresh kumar <suresh2514(a)gmail.com>
net-sysfs: add check for netdevice being present to speed_show
Eric Dumazet <edumazet(a)google.com>
sctp: fix kernel-infoleak for SCTP sockets
Mark Featherston <mark(a)embeddedTS.com>
gpio: ts4900: Do not set DAT and OE together
Pavel Skripkin <paskripkin(a)gmail.com>
NFC: port100: fix use-after-free in port100_send_complete
Mohammad Kabat <mohammadkab(a)nvidia.com>
net/mlx5: Fix size field in bufferx_reg struct
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: lpc_eth: Handle error for clk_enable
Miaoqian Lin <linmq006(a)gmail.com>
ethernet: Fix error handling in xemaclite_of_probe
Tom Rix <trix(a)redhat.com>
qed: return status of qed_iov_get_link
Jia-Ju Bai <baijiaju1990(a)gmail.com>
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
-------------
Diffstat:
Makefile | 4 ++--
arch/arm/include/asm/spectre.h | 6 ++++++
arch/arm/kernel/entry-armv.S | 4 ++--
drivers/gpio/gpio-ts4900.c | 24 +++++++++++++++++++-----
drivers/net/ethernet/nxp/lpc_eth.c | 5 ++++-
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++++++++++-------
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 +++++++
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +++-
drivers/net/xen-netback/xenbus.c | 12 ++++--------
drivers/nfc/port100.c | 2 ++
drivers/staging/gdm724x/gdm_lte.c | 5 +++--
fs/btrfs/extent-tree.c | 1 +
include/linux/mlx5/mlx5_ifc.h | 4 ++--
kernel/trace/trace.c | 10 ++++++----
net/ax25/af_ax25.c | 7 +++++++
net/batman-adv/hard-interface.c | 13 ++++++++-----
net/core/net-sysfs.c | 2 +-
net/sctp/sctp_diag.c | 9 +++------
tools/testing/selftests/memfd/memfd_test.c | 1 +
19 files changed, 92 insertions(+), 46 deletions(-)
This is the start of the stable review cycle for the 4.14.272 release.
There are 22 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 16 Mar 2022 14:58:59 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.272-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.272-rc2
Qu Wenruo <wqu(a)suse.com>
btrfs: unlock newly allocated extent buffer after error
Josh Triplett <josh(a)joshtriplett.org>
ext4: add check to prevent attempting to resize an fs with sparse_super2
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: fix Thumb2 regression with Spectre BHB
Michael S. Tsirkin <mst(a)redhat.com>
virtio: acknowledge all features before access
Michael S. Tsirkin <mst(a)redhat.com>
virtio: unexport virtio_finalize_features
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: gdm724x: fix use after free in gdm_lte_rx()
Randy Dunlap <rdunlap(a)infradead.org>
ARM: Spectre-BHB: provide empty stub for non-config
Mike Kravetz <mike.kravetz(a)oracle.com>
selftests/memfd: clean up mapping in mfd_fail_write
Sven Schnelle <svens(a)linux.ibm.com>
tracing: Ensure trace buffer is at least 4096 bytes large
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: Check for hotplug-status existence before watching"
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
suresh kumar <suresh2514(a)gmail.com>
net-sysfs: add check for netdevice being present to speed_show
Eric Dumazet <edumazet(a)google.com>
sctp: fix kernel-infoleak for SCTP sockets
Mark Featherston <mark(a)embeddedTS.com>
gpio: ts4900: Do not set DAT and OE together
Pavel Skripkin <paskripkin(a)gmail.com>
NFC: port100: fix use-after-free in port100_send_complete
Mohammad Kabat <mohammadkab(a)nvidia.com>
net/mlx5: Fix size field in bufferx_reg struct
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: lpc_eth: Handle error for clk_enable
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: ti: cpts: Handle error for clk_enable
Miaoqian Lin <linmq006(a)gmail.com>
ethernet: Fix error handling in xemaclite_of_probe
Tom Rix <trix(a)redhat.com>
qed: return status of qed_iov_get_link
Jia-Ju Bai <baijiaju1990(a)gmail.com>
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
-------------
Diffstat:
Makefile | 4 +--
arch/arm/include/asm/spectre.h | 6 ++++
arch/arm/kernel/entry-armv.S | 4 +--
drivers/gpio/gpio-ts4900.c | 24 ++++++++++++----
drivers/net/ethernet/nxp/lpc_eth.c | 5 +++-
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++++++-----
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 +++++
drivers/net/ethernet/ti/cpts.c | 4 ++-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 ++-
drivers/net/xen-netback/xenbus.c | 13 ++++-----
drivers/nfc/port100.c | 2 ++
drivers/staging/gdm724x/gdm_lte.c | 5 ++--
drivers/virtio/virtio.c | 40 ++++++++++++++-------------
fs/btrfs/extent-tree.c | 1 +
fs/ext4/resize.c | 5 ++++
include/linux/mlx5/mlx5_ifc.h | 4 +--
include/linux/virtio.h | 1 -
include/linux/virtio_config.h | 3 +-
kernel/trace/trace.c | 10 ++++---
net/ax25/af_ax25.c | 7 +++++
net/core/net-sysfs.c | 2 +-
net/sctp/sctp_diag.c | 9 ++----
tools/testing/selftests/memfd/memfd_test.c | 1 +
23 files changed, 116 insertions(+), 63 deletions(-)
Lime2 HW first public revisions G/G1/G2 used RTL8211E PHYs. Later public
revision K and newest are using KSZ9031 PHYs. Up to commit bbc4d71d6354
("net: phy: realtek: fix rtl8211e rx/tx delay config") it was possible
to use same DTS for A20-olinuxino-lime2 with either KSZ9031 or RTL8211E
PHYs, thus on all HW revisions.
Having commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay
config") applied, Bastien found out, that his board using RTL8211E PHY
doesn't work anymore and tried to fix it by providing proper `phy-mode`
in commit 55dd7e059098 ("ARM: dts: sun7i: A20-olinuxino-lime2: Fix
ethernet phy-mode") with following reasoning:
Commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay
config") sets the RX/TX delay according to the phy-mode property in the
device tree. For the A20-olinuxino-lime2 board this is "rgmii", which is
the wrong setting.
Indeed, the settings were likely wrong, but only for boards with G/G1/G2
revisions using RTL8211E PHY. Those settings were still correct on
boards with HW revisions K and later with KSZ9031 PHY, so this fix was
incorrect.
So fix it properly by introducing separate DTS for boards with G/G1/G2
revisions using proper PHY mode for RTL8211E PHY.
Cc: stable(a)vger.kernel.org
Cc: Bastien Roucariès <rouca(a)debian.org>
References: https://github.com/OLIMEX/OLINUXINO/blob/master/HARDWARE/A20-OLinuXino-LIME…
Signed-off-by: Petr Štetiar <ynezz(a)true.cz>
---
arch/arm/boot/dts/Makefile | 2 ++
.../boot/dts/sun7i-a20-olinuxino-lime2-emmc-revG.dts | 11 +++++++++++
arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-revG.dts | 11 +++++++++++
3 files changed, 24 insertions(+)
create mode 100644 arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc-revG.dts
create mode 100644 arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-revG.dts
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index e41eca79c950..241a1a229f0f 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -1244,7 +1244,9 @@ dtb-$(CONFIG_MACH_SUN7I) += \
sun7i-a20-olinuxino-lime.dtb \
sun7i-a20-olinuxino-lime-emmc.dtb \
sun7i-a20-olinuxino-lime2.dtb \
+ sun7i-a20-olinuxino-lime2-revG.dtb \
sun7i-a20-olinuxino-lime2-emmc.dtb \
+ sun7i-a20-olinuxino-lime2-emmc-revG.dtb \
sun7i-a20-olinuxino-micro.dtb \
sun7i-a20-olinuxino-micro-emmc.dtb \
sun7i-a20-orangepi.dtb \
diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc-revG.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc-revG.dts
new file mode 100644
index 000000000000..1e29f973614d
--- /dev/null
+++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc-revG.dts
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0+
+#include "sun7i-a20-olinuxino-lime2-emmc.dts"
+
+/ {
+ model = "Olimex A20-OLinuXino-LIME2-eMMC (Rev G/G1/G2)";
+ compatible = "olimex,a20-olinuxino-lime2-emmc-revG", "allwinner,sun7i-a20";
+};
+
+&gmac {
+ phy-mode = "rgmii-id";
+};
diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-revG.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-revG.dts
new file mode 100644
index 000000000000..7122dc99810a
--- /dev/null
+++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-revG.dts
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0+
+#include "sun7i-a20-olinuxino-lime2.dts"
+
+/ {
+ model = "Olimex A20-OLinuXino-LIME2 (Rev G/G1/G2)";
+ compatible = "olimex,a20-olinuxino-lime2-revG", "allwinner,sun7i-a20";
+};
+
+&gmac {
+ phy-mode = "rgmii-id";
+};
This reverts commit 55dd7e059098ce4bd0a55c251cb78e74604abb57 as it
breaks network on my A20-olinuxino-lime2 hardware revision "K" which has
Micrel KSZ9031RNXCC-TR Gigabit PHY. Bastien has probably some previous
hardware revisions which were based on RTL8211E-VB-CG1 PHY and thus this
fix was working on his board.
Cc: stable(a)vger.kernel.org
Cc: Bastien Roucariès <rouca(a)debian.org>
References: https://github.com/openwrt/openwrt/issues/9153
References: https://github.com/OLIMEX/OLINUXINO/blob/master/HARDWARE/A20-OLinuXino-LIME…
Signed-off-by: Petr Štetiar <ynezz(a)true.cz>
---
arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
index ecb91fb899ff..8077f1716fbc 100644
--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
+++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
@@ -112,7 +112,7 @@ &gmac {
pinctrl-names = "default";
pinctrl-0 = <&gmac_rgmii_pins>;
phy-handle = <&phy1>;
- phy-mode = "rgmii-id";
+ phy-mode = "rgmii";
status = "okay";
};
blkcg_init_queue() may add rq qos structures to request queue, previously
blk_cleanup_queue() calls rq_qos_exit() to release them, but commit
8e141f9eb803 ("block: drain file system I/O on del_gendisk")
moves rq_qos_exit() into del_gendisk(), so memory leak is caused
because queues may not have disk, such as un-present scsi luns, nvme
admin queue, ...
Fixes the issue by adding rq_qos_exit() to blk_cleanup_queue() back.
BTW, v5.18 won't need this patch any more since we move
blkcg_init_queue()/blkcg_exit_queue() into disk allocation/release
handler, and patches have been in for-5.18/block.
Cc: Christoph Hellwig <hch(a)lst.de>
Cc: stable(a)vger.kernel.org
Fixes: 8e141f9eb803 ("block: drain file system I/O on del_gendisk")
Reported-by: syzbot+b42749a851a47a0f581b(a)syzkaller.appspotmail.com
Signed-off-by: Ming Lei <ming.lei(a)redhat.com>
---
block/blk-core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/block/blk-core.c b/block/blk-core.c
index ce08f0aa9dfc..4965307cf7d6 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -50,6 +50,7 @@
#include "blk-pm.h"
#include "blk-cgroup.h"
#include "blk-throttle.h"
+#include "blk-rq-qos.h"
struct dentry *blk_debugfs_root;
@@ -321,6 +322,9 @@ void blk_cleanup_queue(struct request_queue *q)
*/
blk_freeze_queue(q);
+ /* cleanup rq qos structures for queue without disk */
+ rq_qos_exit(q);
+
blk_queue_flag_set(QUEUE_FLAG_DEAD, q);
blk_sync_queue(q);
--
2.31.1
The number of policies are 10, so can't be supported by the bitmap size
of u8. Even though there are no platfoms with these many policies, but
as correctness increase to u16.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
Fixes: 16fc8eca1975 ("thermal/int340x_thermal: Add additional UUIDs")
Cc: stable(a)vger.kernel.org
---
drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
index 72acb1f61849..c2d3df302214 100644
--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
@@ -53,7 +53,7 @@ struct int3400_thermal_priv {
struct art *arts;
int trt_count;
struct trt *trts;
- u8 uuid_bitmap;
+ u16 uuid_bitmap;
int rel_misc_dev_res;
int current_uuid_index;
char *data_vault;
--
2.31.1
The following commit has been merged into the irq/urgent branch of tip:
Commit-ID: 83dbf898a2d45289be875deb580e93050ba67529
Gitweb: https://git.kernel.org/tip/83dbf898a2d45289be875deb580e93050ba67529
Author: Stefan Roese <sr(a)denx.de>
AuthorDate: Tue, 14 Dec 2021 12:49:32 +01:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Tue, 14 Dec 2021 13:23:32 +01:00
PCI/MSI: Mask MSI-X vectors only on success
Masking all unused MSI-X entries is done to ensure that a crash kernel
starts from a clean slate, which correponds to the reset state of the
device as defined in the PCI-E specificion 3.0 and later:
Vector Control for MSI-X Table Entries
--------------------------------------
"00: Mask bit: When this bit is set, the function is prohibited from
sending a message using this MSI-X Table entry.
...
This bit’s state after reset is 1 (entry is masked)."
A Marvell NVME device fails to deliver MSI interrupts after trying to
enable MSI-X interrupts due to that masking. It seems to take the MSI-X
mask bits into account even when MSI-X is disabled.
While not specification compliant, this can be cured by moving the masking
into the success path, so that the MSI-X table entries stay in device reset
state when the MSI-X setup fails.
[ tglx: Move it into the success path, add comment and amend changelog ]
Fixes: aa8092c1d1f1 ("PCI/MSI: Mask all unused MSI-X entries")
Signed-off-by: Stefan Roese <sr(a)denx.de>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: linux-pci(a)vger.kernel.org
Cc: Bjorn Helgaas <bhelgaas(a)google.com>
Cc: Michal Simek <michal.simek(a)xilinx.com>
Cc: Marek Vasut <marex(a)denx.de>
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/r/20211210161025.3287927-1-sr@denx.de
---
drivers/pci/msi.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 48e3f4e..6748cf9 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -722,9 +722,6 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
goto out_disable;
}
- /* Ensure that all table entries are masked. */
- msix_mask_all(base, tsize);
-
ret = msix_setup_entries(dev, base, entries, nvec, affd);
if (ret)
goto out_disable;
@@ -751,6 +748,16 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
/* Set MSI-X enabled bits and unmask the function */
pci_intx_for_msi(dev, 0);
dev->msix_enabled = 1;
+
+ /*
+ * Ensure that all table entries are masked to prevent
+ * stale entries from firing in a crash kernel.
+ *
+ * Done late to deal with a broken Marvell NVME device
+ * which takes the MSI-X mask bits into account even
+ * when MSI-X is disabled, which prevents MSI delivery.
+ */
+ msix_mask_all(base, tsize);
pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL, 0);
pcibios_free_irq(dev);
The rtl8821ce with RFE Type 6 behaves the same as ones with RFE Type 0.
This change has been tested in the repo at git://GitHub.com/lwfinger/rtw88.git.
It fixes commit 769a29ce2af4 ("rtw88: 8821c: add basic functions").
Fixes: 769a29ce2af4 ("rtw88: 8821c: add basic functions").
Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com>
Signed-off-by: Larry Finger <Larry.Finger(a)lwfinger.net>
Cc: stable(a)vger.kernel.org # 5.9+
---
Kalle,
This patch file was prepared a couple of months ago, but apparently not submitted
then. It should be applied as soon as possible.
Larry
---
drivers/net/wireless/realtek/rtw88/rtw8821c.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821c.c b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
index db078df63f85..b1f4afb50830 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
@@ -1514,6 +1514,7 @@ static const struct rtw_rfe_def rtw8821c_rfe_defs[] = {
[0] = RTW_DEF_RFE(8821c, 0, 0),
[2] = RTW_DEF_RFE_EXT(8821c, 0, 0, 2),
[4] = RTW_DEF_RFE_EXT(8821c, 0, 0, 2),
+ [6] = RTW_DEF_RFE(8821c, 0, 0),
};
static struct rtw_hw_reg rtw8821c_dig[] = {
--
2.35.1
vhost_vsock_handle_tx_kick() already holds the mutex during its call
to vhost_get_vq_desc(). All we have to do here is take the same lock
during virtqueue clean-up and we mitigate the reported issues.
Also WARN() as a precautionary measure. The purpose of this is to
capture possible future race conditions which may pop up over time.
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Lee Jones <lee.jones(a)linaro.org>
---
drivers/vhost/vhost.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 59edb5a1ffe28..bbaff6a5e21b8 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -693,6 +693,7 @@ void vhost_dev_cleanup(struct vhost_dev *dev)
int i;
for (i = 0; i < dev->nvqs; ++i) {
+ mutex_lock(&dev->vqs[i]->mutex);
if (dev->vqs[i]->error_ctx)
eventfd_ctx_put(dev->vqs[i]->error_ctx);
if (dev->vqs[i]->kick)
@@ -700,6 +701,7 @@ void vhost_dev_cleanup(struct vhost_dev *dev)
if (dev->vqs[i]->call_ctx.ctx)
eventfd_ctx_put(dev->vqs[i]->call_ctx.ctx);
vhost_vq_reset(dev, dev->vqs[i]);
+ mutex_unlock(&dev->vqs[i]->mutex);
}
vhost_dev_free_iovecs(dev);
if (dev->log_ctx)
--
2.35.1.723.g4982287a31-goog
I forgot to CC stable@ when submitting, doing it now:
Can this be picked for the next round of stable kernels (down to 5.10)?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
Thanks,
Kai
On 07.03.2022 09:22, Steffen Klassert wrote:
> On Thu, Mar 03, 2022 at 03:55:10PM +0100, kailueke(a)linux.microsoft.com wrote:
>> From: Kai Lueke <kailueke(a)linux.microsoft.com>
>>
>> This reverts commit 68ac0f3810e76a853b5f7b90601a05c3048b8b54 because ID
>> 0 was meant to be used for configuring the policy/state without
>> matching for a specific interface (e.g., Cilium is affected, see
>> https://github.com/cilium/cilium/pull/18789 and
>> https://github.com/cilium/cilium/pull/19019).
>>
>> Signed-off-by: Kai Lueke <kailueke(a)linux.microsoft.com>
> Applied, thanks Kai!
This is the start of the stable review cycle for the 4.14.272 release.
There are 23 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 16 Mar 2022 11:27:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.272-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.272-rc1
Qu Wenruo <wqu(a)suse.com>
btrfs: unlock newly allocated extent buffer after error
Josh Triplett <josh(a)joshtriplett.org>
ext4: add check to prevent attempting to resize an fs with sparse_super2
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: fix Thumb2 regression with Spectre BHB
Michael S. Tsirkin <mst(a)redhat.com>
virtio: acknowledge all features before access
Michael S. Tsirkin <mst(a)redhat.com>
virtio: unexport virtio_finalize_features
James Morse <james.morse(a)arm.com>
KVM: arm64: Reset PMC_EL0 to avoid a panic() on systems with no PMU
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: gdm724x: fix use after free in gdm_lte_rx()
Randy Dunlap <rdunlap(a)infradead.org>
ARM: Spectre-BHB: provide empty stub for non-config
Mike Kravetz <mike.kravetz(a)oracle.com>
selftests/memfd: clean up mapping in mfd_fail_write
Sven Schnelle <svens(a)linux.ibm.com>
tracing: Ensure trace buffer is at least 4096 bytes large
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: Check for hotplug-status existence before watching"
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
suresh kumar <suresh2514(a)gmail.com>
net-sysfs: add check for netdevice being present to speed_show
Eric Dumazet <edumazet(a)google.com>
sctp: fix kernel-infoleak for SCTP sockets
Mark Featherston <mark(a)embeddedTS.com>
gpio: ts4900: Do not set DAT and OE together
Pavel Skripkin <paskripkin(a)gmail.com>
NFC: port100: fix use-after-free in port100_send_complete
Mohammad Kabat <mohammadkab(a)nvidia.com>
net/mlx5: Fix size field in bufferx_reg struct
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: lpc_eth: Handle error for clk_enable
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: ti: cpts: Handle error for clk_enable
Miaoqian Lin <linmq006(a)gmail.com>
ethernet: Fix error handling in xemaclite_of_probe
Tom Rix <trix(a)redhat.com>
qed: return status of qed_iov_get_link
Jia-Ju Bai <baijiaju1990(a)gmail.com>
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
-------------
Diffstat:
Makefile | 4 +--
arch/arm/include/asm/spectre.h | 6 ++++
arch/arm/kernel/entry-armv.S | 4 +--
arch/arm64/kvm/sys_regs.c | 4 ++-
drivers/gpio/gpio-ts4900.c | 24 ++++++++++++----
drivers/net/ethernet/nxp/lpc_eth.c | 5 +++-
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++++++-----
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 +++++
drivers/net/ethernet/ti/cpts.c | 4 ++-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 ++-
drivers/net/xen-netback/xenbus.c | 13 ++++-----
drivers/nfc/port100.c | 2 ++
drivers/staging/gdm724x/gdm_lte.c | 5 ++--
drivers/virtio/virtio.c | 40 ++++++++++++++-------------
fs/btrfs/extent-tree.c | 1 +
fs/ext4/resize.c | 5 ++++
include/linux/mlx5/mlx5_ifc.h | 4 +--
include/linux/virtio.h | 1 -
include/linux/virtio_config.h | 3 +-
kernel/trace/trace.c | 10 ++++---
net/ax25/af_ax25.c | 7 +++++
net/core/net-sysfs.c | 2 +-
net/sctp/sctp_diag.c | 9 ++----
tools/testing/selftests/memfd/memfd_test.c | 1 +
24 files changed, 119 insertions(+), 64 deletions(-)
This is the start of the stable review cycle for the 4.9.307 release.
There are 20 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 16 Mar 2022 11:27:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.307-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.307-rc1
Qu Wenruo <wqu(a)suse.com>
btrfs: unlock newly allocated extent buffer after error
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
ARM: fix Thumb2 regression with Spectre BHB
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Don't expect inter-netns unique iflink indices
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Request iflink once in batadv-on-batadv check
James Morse <james.morse(a)arm.com>
KVM: arm64: Reset PMC_EL0 to avoid a panic() on systems with no PMU
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: gdm724x: fix use after free in gdm_lte_rx()
Randy Dunlap <rdunlap(a)infradead.org>
ARM: Spectre-BHB: provide empty stub for non-config
Mike Kravetz <mike.kravetz(a)oracle.com>
selftests/memfd: clean up mapping in mfd_fail_write
Sven Schnelle <svens(a)linux.ibm.com>
tracing: Ensure trace buffer is at least 4096 bytes large
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
Revert "xen-netback: Check for hotplug-status existence before watching"
suresh kumar <suresh2514(a)gmail.com>
net-sysfs: add check for netdevice being present to speed_show
Eric Dumazet <edumazet(a)google.com>
sctp: fix kernel-infoleak for SCTP sockets
Mark Featherston <mark(a)embeddedTS.com>
gpio: ts4900: Do not set DAT and OE together
Pavel Skripkin <paskripkin(a)gmail.com>
NFC: port100: fix use-after-free in port100_send_complete
Mohammad Kabat <mohammadkab(a)nvidia.com>
net/mlx5: Fix size field in bufferx_reg struct
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
net: ethernet: lpc_eth: Handle error for clk_enable
Miaoqian Lin <linmq006(a)gmail.com>
ethernet: Fix error handling in xemaclite_of_probe
Tom Rix <trix(a)redhat.com>
qed: return status of qed_iov_get_link
Jia-Ju Bai <baijiaju1990(a)gmail.com>
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
-------------
Diffstat:
Makefile | 4 ++--
arch/arm/include/asm/spectre.h | 6 ++++++
arch/arm/kernel/entry-armv.S | 4 ++--
arch/arm64/kvm/sys_regs.c | 4 +++-
drivers/gpio/gpio-ts4900.c | 24 +++++++++++++++++++-----
drivers/net/ethernet/nxp/lpc_eth.c | 5 ++++-
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++++++++++-------
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 +++++++
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +++-
drivers/net/xen-netback/xenbus.c | 12 ++++--------
drivers/nfc/port100.c | 2 ++
drivers/staging/gdm724x/gdm_lte.c | 5 +++--
fs/btrfs/extent-tree.c | 1 +
include/linux/mlx5/mlx5_ifc.h | 4 ++--
kernel/trace/trace.c | 10 ++++++----
net/ax25/af_ax25.c | 7 +++++++
net/batman-adv/hard-interface.c | 13 ++++++++-----
net/core/net-sysfs.c | 2 +-
net/sctp/sctp_diag.c | 9 +++------
tools/testing/selftests/memfd/memfd_test.c | 1 +
20 files changed, 95 insertions(+), 47 deletions(-)
The link to stable tree is redirected to
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git. Update
accordingly.
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Sasha Levin <sashal(a)kernel.org>
Cc: Jonathan Corbet <corbet(a)lwn.net>
Cc: stable(a)vger.kernel.org
Cc: linux-kernel(a)vger.kernel.org
Signed-off-by: Bagas Sanjaya <bagasdotme(a)gmail.com>
---
Documentation/process/stable-kernel-rules.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst
index c494914622e..a9a479fba90 100644
--- a/Documentation/process/stable-kernel-rules.rst
+++ b/Documentation/process/stable-kernel-rules.rst
@@ -178,7 +178,7 @@ Trees
- The finalized and tagged releases of all stable kernels can be found
in separate branches per version at:
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
+ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- The release candidate of all stable kernel versions can be found at:
--
An old man doll... just what I always wanted! - Clara
There is also stable release candidate tree. Mention it, however with a
warning that the tree is for testing purposes.
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Sasha Levin <sashal(a)kernel.org>
Cc: Jonathan Corbet <corbet(a)lwn.net>
Cc: stable(a)vger.kernel.org
Cc: linux-kernel(a)vger.kernel.org
Signed-off-by: Bagas Sanjaya <bagasdotme(a)gmail.com>
---
Documentation/process/stable-kernel-rules.rst | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst
index c207e476c11..c494914622e 100644
--- a/Documentation/process/stable-kernel-rules.rst
+++ b/Documentation/process/stable-kernel-rules.rst
@@ -180,6 +180,15 @@ Trees
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
+ - The release candidate of all stable kernel versions can be found at:
+
+ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/
+
+ .. warning::
+ The -stable-rc tree is a snapshot in time of the stable-queue tree and
+ will change frequently, hence will be rebased often. It should only be
+ used for testing purposes (e.g. to be consumed by CI systems).
+
Review committee
----------------
--
An old man doll... just what I always wanted! - Clara
In recent times, the review cycle for stable releases have been changed.
In particular, there is release candidate phase between ACKing patches
and new stable release. Also, in case of failed submissions (fail to
apply to stable tree), manual backport (Option 3) have to be submitted
instead.
Update the release cycle documentation on stable-kernel-rules.rst to
reflect the above.
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Sasha Levin <sashal(a)kernel.org>
Cc: Jonathan Corbet <corbet(a)lwn.net>
Cc: stable(a)vger.kernel.org
Cc: linux-kernel(a)vger.kernel.org
Signed-off-by: Bagas Sanjaya <bagasdotme(a)gmail.com>
---
Documentation/process/stable-kernel-rules.rst | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst
index d8ce4c0c775..c207e476c11 100644
--- a/Documentation/process/stable-kernel-rules.rst
+++ b/Documentation/process/stable-kernel-rules.rst
@@ -82,8 +82,8 @@ it to be applied to.
:ref:`option_2` and :ref:`option_3` are more useful if the patch isn't deemed
worthy at the time it is applied to a public git tree (for instance, because
it deserves more regression testing first). :ref:`option_3` is especially
-useful if the patch needs some special handling to apply to an older kernel
-(e.g., if API's have changed in the meantime).
+useful if the original upstream patch needs to be backported (for example
+the backport needs some special handling due to e.g. API changes).
Note that for :ref:`option_3`, if the patch deviates from the original
upstream patch (for example because it had to be backported) this must be very
@@ -152,8 +152,17 @@ Review cycle
- If the patch is rejected by a member of the committee, or linux-kernel
members object to the patch, bringing up issues that the maintainers and
members did not realize, the patch will be dropped from the queue.
- - At the end of the review cycle, the ACKed patches will be added to the
- latest -stable release, and a new -stable release will happen.
+ - The ACKed patches will be posted again as part of release candidate (-rc)
+ to be tested by developers and testers.
+ - Usually only one -rc release is made, however if there are any outstanding
+ issues, some patches may be modified or dropped or additional patches may
+ be queued. Additional -rc releases are then released and tested until no
+ issues are found.
+ - Responding to the -rc releases can be done on the mailing list by sending
+ a "Tested-by:" email with any testing information desired. The "Tested-by:"
+ tags will be collected and added to the release commit.
+ - At the end of the review cycle, the new -stable release will be released
+ containing all the queued and tested patches.
- Security patches will be accepted into the -stable tree directly from the
security kernel team, and not go through the normal review cycle.
Contact the kernel security team for more details on this procedure.
--
An old man doll... just what I always wanted! - Clara
Security patches have different handling than rest of patches for
review.
Enclose note paragraph about such patches in `.. note::` block.
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Sasha Levin <sashal(a)kernel.org>
Cc: Jonathan Corbet <corbet(a)lwn.net>
Cc: stable(a)vger.kernel.org
Cc: linux-kernel(a)vger.kernel.org
Signed-off-by: Bagas Sanjaya <bagasdotme(a)gmail.com>
---
Documentation/process/stable-kernel-rules.rst | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst
index 003c865e9c2..691d7052546 100644
--- a/Documentation/process/stable-kernel-rules.rst
+++ b/Documentation/process/stable-kernel-rules.rst
@@ -35,7 +35,9 @@ Rules on what kind of patches are accepted, and which ones are not, into the
Procedure for submitting patches to the -stable tree
----------------------------------------------------
- - Security patches should not be handled (solely) by the -stable review
+.. note::
+
+ Security patches should not be handled (solely) by the -stable review
process but should follow the procedures in
:ref:`Documentation/admin-guide/security-bugs.rst <securitybugs>`.
--
An old man doll... just what I always wanted! - Clara
Hi Daniel,
On Sun, Mar 13, 2022 at 03:03:07PM +0100, Daniel Suchy wrote:
> Hello,
>
> I noticed boot problems on my Turris Omnia (with Marvell 88E6176 switch
> chip) after "net: dsa: mv88e6xxx: flush switchdev FDB workqueue before
> removing VLAN" commit https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
>
> Within logs I catched hung kernel tasks (see below), at least first is
> related to DSA subsystem.
>
> When I revert this patch, everything works as expected and without any
> issues.
>
> In my setup, I have few vlans on affected switch (i'm using ifupdown2 v3.0
> with iproute2 5.16 for configuration).
>
> It seems your this patch introduces some new problem (at least for 5.15
> kernels). I suggest revert this patch.
>
> - Daniel
Oh wow, I'm terribly sorry. Yes, this patch shouldn't have been
backported to kernel 5.15 and below, but I guess I missed the
backport notification email and forgot to tell Greg about this.
Patch "net: dsa: mv88e6xxx: flush switchdev FDB workqueue before
removing VLAN" needs to be immediately reverted from these trees.
Greg, to avoid this from happening in the future, would something like
this work? Is this parsed in some way?
Depends-on: 0faf890fc519 ("net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work") # which first appeared in v5.16
ATTENTION PLEASE,
I am Mrs Aminata Zongo, a personal Accountant/Executive board of
Directors working with United bank for African Burkina Faso (UBA). I
have an interesting business proposal for you that will be of immense
benefit to both of us. Although this may be hard for you to believe,
we stand to gain a huge amount between us in a matter of days. Please
grant me the benefit of doubt and hear me out. I need you to signify
your interest by replying to my mail.
Honestly, i have business transaction worth the sum of
(US$8,200,000.00) Eight Million two hundred thousand united state
dollars to transfer to you through proper documentation in position of
your own Account.
Most importantly, I will need you to promise to keep whatever you
learn from me between us even if you decide not to go along with me. I
will make more details available to you on receipt of a positive
response from you.
This transaction is risk-free; please urgently confirm your
willingness and interest to assist in this deal, I am in good faith
and with trust waiting for your Urgent respond and maximum cooperation
for more details.
Best Regards,
Mrs Aminata Zongo.
This bug is marked as fixed by commit:
net: core: netlink: add helper refcount dec and lock function
net: sched: add helper function to take reference to Qdisc
net: sched: extend Qdisc with rcu
net: sched: rename qdisc_destroy() to qdisc_put()
net: sched: use Qdisc rcu API instead of relying on rtnl lock
But I can't find it in any tested tree for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and
new crashes with the same signature are ignored.
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From ebe48d368e97d007bfeb76fcb065d6cfc4c96645 Mon Sep 17 00:00:00 2001
From: Steffen Klassert <steffen.klassert(a)secunet.com>
Date: Mon, 7 Mar 2022 13:11:39 +0100
Subject: [PATCH] esp: Fix possible buffer overflow in ESP transformation
The maximum message size that can be send is bigger than
the maximum site that skb_page_frag_refill can allocate.
So it is possible to write beyond the allocated buffer.
Fix this by doing a fallback to COW in that case.
v2:
Avoid get get_order() costs as suggested by Linus Torvalds.
Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Reported-by: valis <sec(a)valis.email>
Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com>
diff --git a/include/net/esp.h b/include/net/esp.h
index 9c5637d41d95..90cd02ff77ef 100644
--- a/include/net/esp.h
+++ b/include/net/esp.h
@@ -4,6 +4,8 @@
#include <linux/skbuff.h>
+#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)
+
struct ip_esp_hdr;
static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index e1b1d080e908..70e6c87fbe3d 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -446,6 +446,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
struct page *page;
struct sk_buff *trailer;
int tailen = esp->tailen;
+ unsigned int allocsz;
/* this is non-NULL only with TCP/UDP Encapsulation */
if (x->encap) {
@@ -455,6 +456,10 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
return err;
}
+ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+ if (allocsz > ESP_SKB_FRAG_MAXSIZE)
+ goto cow;
+
if (!skb_cloned(skb)) {
if (tailen <= skb_tailroom(skb)) {
nfrags = 1;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 7591160edce1..b0ffbcd5432d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -482,6 +482,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
struct page *page;
struct sk_buff *trailer;
int tailen = esp->tailen;
+ unsigned int allocsz;
if (x->encap) {
int err = esp6_output_encap(x, skb, esp);
@@ -490,6 +491,10 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
return err;
}
+ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+ if (allocsz > ESP_SKB_FRAG_MAXSIZE)
+ goto cow;
+
if (!skb_cloned(skb)) {
if (tailen <= skb_tailroom(skb)) {
nfrags = 1;
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From ebe48d368e97d007bfeb76fcb065d6cfc4c96645 Mon Sep 17 00:00:00 2001
From: Steffen Klassert <steffen.klassert(a)secunet.com>
Date: Mon, 7 Mar 2022 13:11:39 +0100
Subject: [PATCH] esp: Fix possible buffer overflow in ESP transformation
The maximum message size that can be send is bigger than
the maximum site that skb_page_frag_refill can allocate.
So it is possible to write beyond the allocated buffer.
Fix this by doing a fallback to COW in that case.
v2:
Avoid get get_order() costs as suggested by Linus Torvalds.
Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Reported-by: valis <sec(a)valis.email>
Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com>
diff --git a/include/net/esp.h b/include/net/esp.h
index 9c5637d41d95..90cd02ff77ef 100644
--- a/include/net/esp.h
+++ b/include/net/esp.h
@@ -4,6 +4,8 @@
#include <linux/skbuff.h>
+#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)
+
struct ip_esp_hdr;
static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index e1b1d080e908..70e6c87fbe3d 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -446,6 +446,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
struct page *page;
struct sk_buff *trailer;
int tailen = esp->tailen;
+ unsigned int allocsz;
/* this is non-NULL only with TCP/UDP Encapsulation */
if (x->encap) {
@@ -455,6 +456,10 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
return err;
}
+ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+ if (allocsz > ESP_SKB_FRAG_MAXSIZE)
+ goto cow;
+
if (!skb_cloned(skb)) {
if (tailen <= skb_tailroom(skb)) {
nfrags = 1;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 7591160edce1..b0ffbcd5432d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -482,6 +482,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
struct page *page;
struct sk_buff *trailer;
int tailen = esp->tailen;
+ unsigned int allocsz;
if (x->encap) {
int err = esp6_output_encap(x, skb, esp);
@@ -490,6 +491,10 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
return err;
}
+ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+ if (allocsz > ESP_SKB_FRAG_MAXSIZE)
+ goto cow;
+
if (!skb_cloned(skb)) {
if (tailen <= skb_tailroom(skb)) {
nfrags = 1;
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From ebe48d368e97d007bfeb76fcb065d6cfc4c96645 Mon Sep 17 00:00:00 2001
From: Steffen Klassert <steffen.klassert(a)secunet.com>
Date: Mon, 7 Mar 2022 13:11:39 +0100
Subject: [PATCH] esp: Fix possible buffer overflow in ESP transformation
The maximum message size that can be send is bigger than
the maximum site that skb_page_frag_refill can allocate.
So it is possible to write beyond the allocated buffer.
Fix this by doing a fallback to COW in that case.
v2:
Avoid get get_order() costs as suggested by Linus Torvalds.
Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Reported-by: valis <sec(a)valis.email>
Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com>
diff --git a/include/net/esp.h b/include/net/esp.h
index 9c5637d41d95..90cd02ff77ef 100644
--- a/include/net/esp.h
+++ b/include/net/esp.h
@@ -4,6 +4,8 @@
#include <linux/skbuff.h>
+#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)
+
struct ip_esp_hdr;
static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index e1b1d080e908..70e6c87fbe3d 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -446,6 +446,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
struct page *page;
struct sk_buff *trailer;
int tailen = esp->tailen;
+ unsigned int allocsz;
/* this is non-NULL only with TCP/UDP Encapsulation */
if (x->encap) {
@@ -455,6 +456,10 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
return err;
}
+ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+ if (allocsz > ESP_SKB_FRAG_MAXSIZE)
+ goto cow;
+
if (!skb_cloned(skb)) {
if (tailen <= skb_tailroom(skb)) {
nfrags = 1;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 7591160edce1..b0ffbcd5432d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -482,6 +482,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
struct page *page;
struct sk_buff *trailer;
int tailen = esp->tailen;
+ unsigned int allocsz;
if (x->encap) {
int err = esp6_output_encap(x, skb, esp);
@@ -490,6 +491,10 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
return err;
}
+ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+ if (allocsz > ESP_SKB_FRAG_MAXSIZE)
+ goto cow;
+
if (!skb_cloned(skb)) {
if (tailen <= skb_tailroom(skb)) {
nfrags = 1;
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 74583f1b92cb3bbba1a3741cea237545c56f506c Mon Sep 17 00:00:00 2001
From: Niklas Cassel <niklas.cassel(a)wdc.com>
Date: Tue, 1 Mar 2022 00:44:18 +0000
Subject: [PATCH] riscv: dts: k210: fix broken IRQs on hart1
Commit 67d96729a9e7 ("riscv: Update Canaan Kendryte K210 device tree")
incorrectly removed two entries from the PLIC interrupt-controller node's
interrupts-extended property.
The PLIC driver cannot know the mapping between hart contexts and hart ids,
so this information has to be provided by device tree, as specified by the
PLIC device tree binding.
The PLIC driver uses the interrupts-extended property, and initializes the
hart context registers in the exact same order as provided by the
interrupts-extended property.
In other words, if we don't specify the S-mode interrupts, the PLIC driver
will simply initialize the hart0 S-mode hart context with the hart1 M-mode
configuration. It is therefore essential to specify the S-mode IRQs even
though the system itself will only ever be running in M-mode.
Re-add the S-mode interrupts, so that we get working IRQs on hart1 again.
Cc: <stable(a)vger.kernel.org>
Fixes: 67d96729a9e7 ("riscv: Update Canaan Kendryte K210 device tree")
Signed-off-by: Niklas Cassel <niklas.cassel(a)wdc.com>
Signed-off-by: Palmer Dabbelt <palmer(a)rivosinc.com>
diff --git a/arch/riscv/boot/dts/canaan/k210.dtsi b/arch/riscv/boot/dts/canaan/k210.dtsi
index 56f57118c633..44d338514761 100644
--- a/arch/riscv/boot/dts/canaan/k210.dtsi
+++ b/arch/riscv/boot/dts/canaan/k210.dtsi
@@ -113,7 +113,8 @@ plic0: interrupt-controller@c000000 {
compatible = "canaan,k210-plic", "sifive,plic-1.0.0";
reg = <0xC000000 0x4000000>;
interrupt-controller;
- interrupts-extended = <&cpu0_intc 11>, <&cpu1_intc 11>;
+ interrupts-extended = <&cpu0_intc 11>, <&cpu0_intc 9>,
+ <&cpu1_intc 11>, <&cpu1_intc 9>;
riscv,ndev = <65>;
};
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 4e6f55120c7eccf6f9323bb681632e23cbcb3f3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala(a)linux.intel.com>
Date: Fri, 4 Feb 2022 16:18:18 +0200
Subject: [PATCH] drm/i915: Workaround broken BIOS DBUF configuration on
TGL/RKL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
On TGL/RKL the BIOS likes to use some kind of bogus DBUF layout
that doesn't match what the spec recommends. With a single active
pipe that is not going to be a problem, but with multiple pipes
active skl_commit_modeset_enables() goes into an infinite loop
since it can't figure out any order in which it can commit the
pipes without causing DBUF overlaps between the planes.
We'd need some kind of extra DBUF defrag stage in between to
make the transition possible. But that is clearly way too complex
a solution, so in the name of simplicity let's just sanitize the
DBUF state by simply turning off all planes when we detect a
pipe encroaching on its neighbours' DBUF slices. We only have
to disable the primary planes as all other planes should have
already been disabled (if they somehow were enabled) by
earlier sanitization steps.
And for good measure let's also sanitize in case the DBUF
allocations of the pipes already seem to overlap each other.
Cc: <stable(a)vger.kernel.org> # v5.14+
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/4762
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220204141818.1900-3-ville.s…
Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy(a)intel.com>
(cherry picked from commit 15512021eb3975a8c2366e3883337e252bb0eee5)
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index bf7ce684dd8e..bb4a85445fc6 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -10673,6 +10673,7 @@ intel_modeset_setup_hw_state(struct drm_device *dev,
vlv_wm_sanitize(dev_priv);
} else if (DISPLAY_VER(dev_priv) >= 9) {
skl_wm_get_hw_state(dev_priv);
+ skl_wm_sanitize(dev_priv);
} else if (HAS_PCH_SPLIT(dev_priv)) {
ilk_wm_get_hw_state(dev_priv);
}
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index a298846dd8cf..3edba7fd0c49 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -6698,6 +6698,74 @@ void skl_wm_get_hw_state(struct drm_i915_private *dev_priv)
dbuf_state->enabled_slices = dev_priv->dbuf.enabled_slices;
}
+static bool skl_dbuf_is_misconfigured(struct drm_i915_private *i915)
+{
+ const struct intel_dbuf_state *dbuf_state =
+ to_intel_dbuf_state(i915->dbuf.obj.state);
+ struct skl_ddb_entry entries[I915_MAX_PIPES] = {};
+ struct intel_crtc *crtc;
+
+ for_each_intel_crtc(&i915->drm, crtc) {
+ const struct intel_crtc_state *crtc_state =
+ to_intel_crtc_state(crtc->base.state);
+
+ entries[crtc->pipe] = crtc_state->wm.skl.ddb;
+ }
+
+ for_each_intel_crtc(&i915->drm, crtc) {
+ const struct intel_crtc_state *crtc_state =
+ to_intel_crtc_state(crtc->base.state);
+ u8 slices;
+
+ slices = skl_compute_dbuf_slices(crtc, dbuf_state->active_pipes,
+ dbuf_state->joined_mbus);
+ if (dbuf_state->slices[crtc->pipe] & ~slices)
+ return true;
+
+ if (skl_ddb_allocation_overlaps(&crtc_state->wm.skl.ddb, entries,
+ I915_MAX_PIPES, crtc->pipe))
+ return true;
+ }
+
+ return false;
+}
+
+void skl_wm_sanitize(struct drm_i915_private *i915)
+{
+ struct intel_crtc *crtc;
+
+ /*
+ * On TGL/RKL (at least) the BIOS likes to assign the planes
+ * to the wrong DBUF slices. This will cause an infinite loop
+ * in skl_commit_modeset_enables() as it can't find a way to
+ * transition between the old bogus DBUF layout to the new
+ * proper DBUF layout without DBUF allocation overlaps between
+ * the planes (which cannot be allowed or else the hardware
+ * may hang). If we detect a bogus DBUF layout just turn off
+ * all the planes so that skl_commit_modeset_enables() can
+ * simply ignore them.
+ */
+ if (!skl_dbuf_is_misconfigured(i915))
+ return;
+
+ drm_dbg_kms(&i915->drm, "BIOS has misprogrammed the DBUF, disabling all planes\n");
+
+ for_each_intel_crtc(&i915->drm, crtc) {
+ struct intel_plane *plane = to_intel_plane(crtc->base.primary);
+ const struct intel_plane_state *plane_state =
+ to_intel_plane_state(plane->base.state);
+ struct intel_crtc_state *crtc_state =
+ to_intel_crtc_state(crtc->base.state);
+
+ if (plane_state->uapi.visible)
+ intel_plane_disable_noatomic(crtc, plane);
+
+ drm_WARN_ON(&i915->drm, crtc_state->active_planes != 0);
+
+ memset(&crtc_state->wm.skl.ddb, 0, sizeof(crtc_state->wm.skl.ddb));
+ }
+}
+
static void ilk_pipe_wm_get_hw_state(struct intel_crtc *crtc)
{
struct drm_device *dev = crtc->base.dev;
diff --git a/drivers/gpu/drm/i915/intel_pm.h b/drivers/gpu/drm/i915/intel_pm.h
index 990cdcaf85ce..d2243653a893 100644
--- a/drivers/gpu/drm/i915/intel_pm.h
+++ b/drivers/gpu/drm/i915/intel_pm.h
@@ -47,6 +47,7 @@ void skl_pipe_wm_get_hw_state(struct intel_crtc *crtc,
struct skl_pipe_wm *out);
void g4x_wm_sanitize(struct drm_i915_private *dev_priv);
void vlv_wm_sanitize(struct drm_i915_private *dev_priv);
+void skl_wm_sanitize(struct drm_i915_private *dev_priv);
bool intel_can_enable_sagv(struct drm_i915_private *dev_priv,
const struct intel_bw_state *bw_state);
void intel_sagv_pre_plane_update(struct intel_atomic_state *state);
From: Filipe Manana <fdmanana(a)suse.com>
Commit d96b34248c2f4ea8cd09286090f2f6f77102eaab upstream.
We don't allow send and balance/relocation to run in parallel in order
to prevent send failing or silently producing some bad stream. This is
because while send is using an extent (specially metadata) or about to
read a metadata extent and expecting it belongs to a specific parent
node, relocation can run, the transaction used for the relocation is
committed and the extent gets reallocated while send is still using the
extent, so it ends up with a different content than expected. This can
result in just failing to read a metadata extent due to failure of the
validation checks (parent transid, level, etc), failure to find a
backreference for a data extent, and other unexpected failures. Besides
reallocation, there's also a similar problem of an extent getting
discarded when it's unpinned after the transaction used for block group
relocation is committed.
The restriction between balance and send was added in commit 9e967495e0e0
("Btrfs: prevent send failures and crashes due to concurrent relocation"),
kernel 5.3, while the more general restriction between send and relocation
was added in commit 1cea5cf0e664 ("btrfs: ensure relocation never runs
while we have send operations running"), kernel 5.14.
Both send and relocation can be very long running operations. Relocation
because it has to do a lot of IO and expensive backreference lookups in
case there are many snapshots, and send due to read IO when operating on
very large trees. This makes it inconvenient for users and tools to deal
with scheduling both operations.
For zoned filesystem we also have automatic block group relocation, so
send can fail with -EAGAIN when users least expect it or send can end up
delaying the block group relocation for too long. In the future we might
also get the automatic block group relocation for non zoned filesystems.
This change makes it possible for send and relocation to run in parallel.
This is achieved the following way:
1) For all tree searches, send acquires a read lock on the commit root
semaphore;
2) After each tree search, and before releasing the commit root semaphore,
the leaf is cloned and placed in the search path (struct btrfs_path);
3) After releasing the commit root semaphore, the changed_cb() callback
is invoked, which operates on the leaf and writes commands to the pipe
(or file in case send/receive is not used with a pipe). It's important
here to not hold a lock on the commit root semaphore, because if we did
we could deadlock when sending and receiving to the same filesystem
using a pipe - the send task blocks on the pipe because it's full, the
receive task, which is the only consumer of the pipe, triggers a
transaction commit when attempting to create a subvolume or reserve
space for a write operation for example, but the transaction commit
blocks trying to write lock the commit root semaphore, resulting in a
deadlock;
4) Before moving to the next key, or advancing to the next change in case
of an incremental send, check if a transaction used for relocation was
committed (or is about to finish its commit). If so, release the search
path(s) and restart the search, to where we were before, so that we
don't operate on stale extent buffers. The search restarts are always
possible because both the send and parent roots are RO, and no one can
add, remove of update keys (change their offset) in RO trees - the
only exception is deduplication, but that is still not allowed to run
in parallel with send;
5) Periodically check if there is contention on the commit root semaphore,
which means there is a transaction commit trying to write lock it, and
release the semaphore and reschedule if there is contention, so as to
avoid causing any significant delays to transaction commits.
This leaves some room for optimizations for send to have less path
releases and re searching the trees when there's relocation running, but
for now it's kept simple as it performs quite well (on very large trees
with resulting send streams in the order of a few hundred gigabytes).
Test case btrfs/187, from fstests, stresses relocation, send and
deduplication attempting to run in parallel, but without verifying if send
succeeds and if it produces correct streams. A new test case will be added
that exercises relocation happening in parallel with send and then checks
that send succeeds and the resulting streams are correct.
A final note is that for now this still leaves the mutual exclusion
between send operations and deduplication on files belonging to a root
used by send operations. A solution for that will be slightly more complex
but it will eventually be built on top of this change.
Signed-off-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: Anand Jain <anand.jain(a)oracle.com>
---
fs/btrfs/block-group.c | 9 +-
fs/btrfs/ctree.c | 98 ++++++++---
fs/btrfs/ctree.h | 14 +-
fs/btrfs/disk-io.c | 4 +-
fs/btrfs/relocation.c | 13 --
fs/btrfs/send.c | 357 +++++++++++++++++++++++++++++++++++------
fs/btrfs/transaction.c | 4 +
7 files changed, 395 insertions(+), 104 deletions(-)
diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
index d721c66d0b41..5edd07e0232d 100644
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -1491,7 +1491,6 @@ void btrfs_reclaim_bgs_work(struct work_struct *work)
container_of(work, struct btrfs_fs_info, reclaim_bgs_work);
struct btrfs_block_group *bg;
struct btrfs_space_info *space_info;
- LIST_HEAD(again_list);
if (!test_bit(BTRFS_FS_OPEN, &fs_info->flags))
return;
@@ -1562,18 +1561,14 @@ void btrfs_reclaim_bgs_work(struct work_struct *work)
div64_u64(zone_unusable * 100, bg->length));
trace_btrfs_reclaim_block_group(bg);
ret = btrfs_relocate_chunk(fs_info, bg->start);
- if (ret && ret != -EAGAIN)
+ if (ret)
btrfs_err(fs_info, "error relocating chunk %llu",
bg->start);
next:
+ btrfs_put_block_group(bg);
spin_lock(&fs_info->unused_bgs_lock);
- if (ret == -EAGAIN && list_empty(&bg->bg_list))
- list_add_tail(&bg->bg_list, &again_list);
- else
- btrfs_put_block_group(bg);
}
- list_splice_tail(&again_list, &fs_info->reclaim_bgs);
spin_unlock(&fs_info->unused_bgs_lock);
mutex_unlock(&fs_info->reclaim_bgs_lock);
btrfs_exclop_finish(fs_info);
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 95a6a63caf04..899f85445925 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1566,32 +1566,13 @@ static struct extent_buffer *btrfs_search_slot_get_root(struct btrfs_root *root,
struct btrfs_path *p,
int write_lock_level)
{
- struct btrfs_fs_info *fs_info = root->fs_info;
struct extent_buffer *b;
int root_lock = 0;
int level = 0;
if (p->search_commit_root) {
- /*
- * The commit roots are read only so we always do read locks,
- * and we always must hold the commit_root_sem when doing
- * searches on them, the only exception is send where we don't
- * want to block transaction commits for a long time, so
- * we need to clone the commit root in order to avoid races
- * with transaction commits that create a snapshot of one of
- * the roots used by a send operation.
- */
- if (p->need_commit_sem) {
- down_read(&fs_info->commit_root_sem);
- b = btrfs_clone_extent_buffer(root->commit_root);
- up_read(&fs_info->commit_root_sem);
- if (!b)
- return ERR_PTR(-ENOMEM);
-
- } else {
- b = root->commit_root;
- atomic_inc(&b->refs);
- }
+ b = root->commit_root;
+ atomic_inc(&b->refs);
level = btrfs_header_level(b);
/*
* Ensure that all callers have set skip_locking when
@@ -1657,6 +1638,42 @@ static struct extent_buffer *btrfs_search_slot_get_root(struct btrfs_root *root,
return b;
}
+/*
+ * Replace the extent buffer at the lowest level of the path with a cloned
+ * version. The purpose is to be able to use it safely, after releasing the
+ * commit root semaphore, even if relocation is happening in parallel, the
+ * transaction used for relocation is committed and the extent buffer is
+ * reallocated in the next transaction.
+ *
+ * This is used in a context where the caller does not prevent transaction
+ * commits from happening, either by holding a transaction handle or holding
+ * some lock, while it's doing searches through a commit root.
+ * At the moment it's only used for send operations.
+ */
+static int finish_need_commit_sem_search(struct btrfs_path *path)
+{
+ const int i = path->lowest_level;
+ const int slot = path->slots[i];
+ struct extent_buffer *lowest = path->nodes[i];
+ struct extent_buffer *clone;
+
+ ASSERT(path->need_commit_sem);
+
+ if (!lowest)
+ return 0;
+
+ lockdep_assert_held_read(&lowest->fs_info->commit_root_sem);
+
+ clone = btrfs_clone_extent_buffer(lowest);
+ if (!clone)
+ return -ENOMEM;
+
+ btrfs_release_path(path);
+ path->nodes[i] = clone;
+ path->slots[i] = slot;
+
+ return 0;
+}
/*
* btrfs_search_slot - look for a key in a tree and perform necessary
@@ -1693,6 +1710,7 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
const struct btrfs_key *key, struct btrfs_path *p,
int ins_len, int cow)
{
+ struct btrfs_fs_info *fs_info = root->fs_info;
struct extent_buffer *b;
int slot;
int ret;
@@ -1734,6 +1752,11 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
min_write_lock_level = write_lock_level;
+ if (p->need_commit_sem) {
+ ASSERT(p->search_commit_root);
+ down_read(&fs_info->commit_root_sem);
+ }
+
again:
prev_cmp = -1;
b = btrfs_search_slot_get_root(root, p, write_lock_level);
@@ -1928,6 +1951,16 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
done:
if (ret < 0 && !p->skip_release_on_error)
btrfs_release_path(p);
+
+ if (p->need_commit_sem) {
+ int ret2;
+
+ ret2 = finish_need_commit_sem_search(p);
+ up_read(&fs_info->commit_root_sem);
+ if (ret2)
+ ret = ret2;
+ }
+
return ret;
}
ALLOW_ERROR_INJECTION(btrfs_search_slot, ERRNO);
@@ -4396,7 +4429,9 @@ int btrfs_next_old_leaf(struct btrfs_root *root, struct btrfs_path *path,
int level;
struct extent_buffer *c;
struct extent_buffer *next;
+ struct btrfs_fs_info *fs_info = root->fs_info;
struct btrfs_key key;
+ bool need_commit_sem = false;
u32 nritems;
int ret;
int i;
@@ -4413,14 +4448,20 @@ int btrfs_next_old_leaf(struct btrfs_root *root, struct btrfs_path *path,
path->keep_locks = 1;
- if (time_seq)
+ if (time_seq) {
ret = btrfs_search_old_slot(root, &key, path, time_seq);
- else
+ } else {
+ if (path->need_commit_sem) {
+ path->need_commit_sem = 0;
+ need_commit_sem = true;
+ down_read(&fs_info->commit_root_sem);
+ }
ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+ }
path->keep_locks = 0;
if (ret < 0)
- return ret;
+ goto done;
nritems = btrfs_header_nritems(path->nodes[0]);
/*
@@ -4543,6 +4584,15 @@ int btrfs_next_old_leaf(struct btrfs_root *root, struct btrfs_path *path,
ret = 0;
done:
unlock_up(path, 0, 1, 0, NULL);
+ if (need_commit_sem) {
+ int ret2;
+
+ path->need_commit_sem = 1;
+ ret2 = finish_need_commit_sem_search(path);
+ up_read(&fs_info->commit_root_sem);
+ if (ret2)
+ ret = ret2;
+ }
return ret;
}
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index b46409801647..e89f814cc8f5 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -568,7 +568,6 @@ enum {
/*
* Indicate that relocation of a chunk has started, it's set per chunk
* and is toggled between chunks.
- * Set, tested and cleared while holding fs_info::send_reloc_lock.
*/
BTRFS_FS_RELOC_RUNNING,
@@ -668,6 +667,12 @@ struct btrfs_fs_info {
u64 generation;
u64 last_trans_committed;
+ /*
+ * Generation of the last transaction used for block group relocation
+ * since the filesystem was last mounted (or 0 if none happened yet).
+ * Must be written and read while holding btrfs_fs_info::commit_root_sem.
+ */
+ u64 last_reloc_trans;
u64 avg_delayed_ref_runtime;
/*
@@ -997,13 +1002,6 @@ struct btrfs_fs_info {
struct crypto_shash *csum_shash;
- spinlock_t send_reloc_lock;
- /*
- * Number of send operations in progress.
- * Updated while holding fs_info::send_reloc_lock.
- */
- int send_in_progress;
-
/* Type of exclusive operation running, protected by super_lock */
enum btrfs_exclusive_operation exclusive_operation;
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 2180fcef56ca..d5a590b11be5 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2859,6 +2859,7 @@ static int __cold init_tree_roots(struct btrfs_fs_info *fs_info)
/* All successful */
fs_info->generation = generation;
fs_info->last_trans_committed = generation;
+ fs_info->last_reloc_trans = 0;
/* Always begin writing backup roots after the one being used */
if (backup_index < 0) {
@@ -2992,9 +2993,6 @@ void btrfs_init_fs_info(struct btrfs_fs_info *fs_info)
spin_lock_init(&fs_info->swapfile_pins_lock);
fs_info->swapfile_pins = RB_ROOT;
- spin_lock_init(&fs_info->send_reloc_lock);
- fs_info->send_in_progress = 0;
-
fs_info->bg_reclaim_threshold = BTRFS_DEFAULT_RECLAIM_THRESH;
INIT_WORK(&fs_info->reclaim_bgs_work, btrfs_reclaim_bgs_work);
}
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index a050f9748fa7..a6661f2ad2c0 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3854,25 +3854,14 @@ struct inode *create_reloc_inode(struct btrfs_fs_info *fs_info,
* 0 success
* -EINPROGRESS operation is already in progress, that's probably a bug
* -ECANCELED cancellation request was set before the operation started
- * -EAGAIN can not start because there are ongoing send operations
*/
static int reloc_chunk_start(struct btrfs_fs_info *fs_info)
{
- spin_lock(&fs_info->send_reloc_lock);
- if (fs_info->send_in_progress) {
- btrfs_warn_rl(fs_info,
-"cannot run relocation while send operations are in progress (%d in progress)",
- fs_info->send_in_progress);
- spin_unlock(&fs_info->send_reloc_lock);
- return -EAGAIN;
- }
if (test_and_set_bit(BTRFS_FS_RELOC_RUNNING, &fs_info->flags)) {
/* This should not happen */
- spin_unlock(&fs_info->send_reloc_lock);
btrfs_err(fs_info, "reloc already running, cannot start");
return -EINPROGRESS;
}
- spin_unlock(&fs_info->send_reloc_lock);
if (atomic_read(&fs_info->reloc_cancel_req) > 0) {
btrfs_info(fs_info, "chunk relocation canceled on start");
@@ -3894,9 +3883,7 @@ static void reloc_chunk_end(struct btrfs_fs_info *fs_info)
/* Requested after start, clear bit first so any waiters can continue */
if (atomic_read(&fs_info->reloc_cancel_req) > 0)
btrfs_info(fs_info, "chunk relocation canceled during operation");
- spin_lock(&fs_info->send_reloc_lock);
clear_and_wake_up_bit(BTRFS_FS_RELOC_RUNNING, &fs_info->flags);
- spin_unlock(&fs_info->send_reloc_lock);
atomic_set(&fs_info->reloc_cancel_req, 0);
}
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 5612e8bf2ace..4d2c6ce29fe5 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -24,6 +24,7 @@
#include "transaction.h"
#include "compression.h"
#include "xattr.h"
+#include "print-tree.h"
/*
* Maximum number of references an extent can have in order for us to attempt to
@@ -95,6 +96,15 @@ struct send_ctx {
struct btrfs_path *right_path;
struct btrfs_key *cmp_key;
+ /*
+ * Keep track of the generation of the last transaction that was used
+ * for relocating a block group. This is periodically checked in order
+ * to detect if a relocation happened since the last check, so that we
+ * don't operate on stale extent buffers for nodes (level >= 1) or on
+ * stale disk_bytenr values of file extent items.
+ */
+ u64 last_reloc_trans;
+
/*
* infos of the currently processed inode. In case of deleted inodes,
* these are the values from the deleted inode.
@@ -1415,6 +1425,26 @@ static int find_extent_clone(struct send_ctx *sctx,
if (ret < 0)
goto out;
+ down_read(&fs_info->commit_root_sem);
+ if (fs_info->last_reloc_trans > sctx->last_reloc_trans) {
+ /*
+ * A transaction commit for a transaction in which block group
+ * relocation was done just happened.
+ * The disk_bytenr of the file extent item we processed is
+ * possibly stale, referring to the extent's location before
+ * relocation. So act as if we haven't found any clone sources
+ * and fallback to write commands, which will read the correct
+ * data from the new extent location. Otherwise we will fail
+ * below because we haven't found our own back reference or we
+ * could be getting incorrect sources in case the old extent
+ * was already reallocated after the relocation.
+ */
+ up_read(&fs_info->commit_root_sem);
+ ret = -ENOENT;
+ goto out;
+ }
+ up_read(&fs_info->commit_root_sem);
+
if (!backref_ctx.found_itself) {
/* found a bug in backref code? */
ret = -EIO;
@@ -6596,6 +6626,50 @@ static int changed_cb(struct btrfs_path *left_path,
{
int ret = 0;
+ /*
+ * We can not hold the commit root semaphore here. This is because in
+ * the case of sending and receiving to the same filesystem, using a
+ * pipe, could result in a deadlock:
+ *
+ * 1) The task running send blocks on the pipe because it's full;
+ *
+ * 2) The task running receive, which is the only consumer of the pipe,
+ * is waiting for a transaction commit (for example due to a space
+ * reservation when doing a write or triggering a transaction commit
+ * when creating a subvolume);
+ *
+ * 3) The transaction is waiting to write lock the commit root semaphore,
+ * but can not acquire it since it's being held at 1).
+ *
+ * Down this call chain we write to the pipe through kernel_write().
+ * The same type of problem can also happen when sending to a file that
+ * is stored in the same filesystem - when reserving space for a write
+ * into the file, we can trigger a transaction commit.
+ *
+ * Our caller has supplied us with clones of leaves from the send and
+ * parent roots, so we're safe here from a concurrent relocation and
+ * further reallocation of metadata extents while we are here. Below we
+ * also assert that the leaves are clones.
+ */
+ lockdep_assert_not_held(&sctx->send_root->fs_info->commit_root_sem);
+
+ /*
+ * We always have a send root, so left_path is never NULL. We will not
+ * have a leaf when we have reached the end of the send root but have
+ * not yet reached the end of the parent root.
+ */
+ if (left_path->nodes[0])
+ ASSERT(test_bit(EXTENT_BUFFER_UNMAPPED,
+ &left_path->nodes[0]->bflags));
+ /*
+ * When doing a full send we don't have a parent root, so right_path is
+ * NULL. When doing an incremental send, we may have reached the end of
+ * the parent root already, so we don't have a leaf at right_path.
+ */
+ if (right_path && right_path->nodes[0])
+ ASSERT(test_bit(EXTENT_BUFFER_UNMAPPED,
+ &right_path->nodes[0]->bflags));
+
if (result == BTRFS_COMPARE_TREE_SAME) {
if (key->type == BTRFS_INODE_REF_KEY ||
key->type == BTRFS_INODE_EXTREF_KEY) {
@@ -6642,14 +6716,46 @@ static int changed_cb(struct btrfs_path *left_path,
return ret;
}
+static int search_key_again(const struct send_ctx *sctx,
+ struct btrfs_root *root,
+ struct btrfs_path *path,
+ const struct btrfs_key *key)
+{
+ int ret;
+
+ if (!path->need_commit_sem)
+ lockdep_assert_held_read(&root->fs_info->commit_root_sem);
+
+ /*
+ * Roots used for send operations are readonly and no one can add,
+ * update or remove keys from them, so we should be able to find our
+ * key again. The only exception is deduplication, which can operate on
+ * readonly roots and add, update or remove keys to/from them - but at
+ * the moment we don't allow it to run in parallel with send.
+ */
+ ret = btrfs_search_slot(NULL, root, key, path, 0, 0);
+ ASSERT(ret <= 0);
+ if (ret > 0) {
+ btrfs_print_tree(path->nodes[path->lowest_level], false);
+ btrfs_err(root->fs_info,
+"send: key (%llu %u %llu) not found in %s root %llu, lowest_level %d, slot %d",
+ key->objectid, key->type, key->offset,
+ (root == sctx->parent_root ? "parent" : "send"),
+ root->root_key.objectid, path->lowest_level,
+ path->slots[path->lowest_level]);
+ return -EUCLEAN;
+ }
+
+ return ret;
+}
+
static int full_send_tree(struct send_ctx *sctx)
{
int ret;
struct btrfs_root *send_root = sctx->send_root;
struct btrfs_key key;
+ struct btrfs_fs_info *fs_info = send_root->fs_info;
struct btrfs_path *path;
- struct extent_buffer *eb;
- int slot;
path = alloc_path_for_send();
if (!path)
@@ -6660,6 +6766,10 @@ static int full_send_tree(struct send_ctx *sctx)
key.type = BTRFS_INODE_ITEM_KEY;
key.offset = 0;
+ down_read(&fs_info->commit_root_sem);
+ sctx->last_reloc_trans = fs_info->last_reloc_trans;
+ up_read(&fs_info->commit_root_sem);
+
ret = btrfs_search_slot_for_read(send_root, &key, path, 1, 0);
if (ret < 0)
goto out;
@@ -6667,15 +6777,35 @@ static int full_send_tree(struct send_ctx *sctx)
goto out_finish;
while (1) {
- eb = path->nodes[0];
- slot = path->slots[0];
- btrfs_item_key_to_cpu(eb, &key, slot);
+ btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
ret = changed_cb(path, NULL, &key,
BTRFS_COMPARE_TREE_NEW, sctx);
if (ret < 0)
goto out;
+ down_read(&fs_info->commit_root_sem);
+ if (fs_info->last_reloc_trans > sctx->last_reloc_trans) {
+ sctx->last_reloc_trans = fs_info->last_reloc_trans;
+ up_read(&fs_info->commit_root_sem);
+ /*
+ * A transaction used for relocating a block group was
+ * committed or is about to finish its commit. Release
+ * our path (leaf) and restart the search, so that we
+ * avoid operating on any file extent items that are
+ * stale, with a disk_bytenr that reflects a pre
+ * relocation value. This way we avoid as much as
+ * possible to fallback to regular writes when checking
+ * if we can clone file ranges.
+ */
+ btrfs_release_path(path);
+ ret = search_key_again(sctx, send_root, path, &key);
+ if (ret < 0)
+ goto out;
+ } else {
+ up_read(&fs_info->commit_root_sem);
+ }
+
ret = btrfs_next_item(send_root, path);
if (ret < 0)
goto out;
@@ -6693,6 +6823,20 @@ static int full_send_tree(struct send_ctx *sctx)
return ret;
}
+static int replace_node_with_clone(struct btrfs_path *path, int level)
+{
+ struct extent_buffer *clone;
+
+ clone = btrfs_clone_extent_buffer(path->nodes[level]);
+ if (!clone)
+ return -ENOMEM;
+
+ free_extent_buffer(path->nodes[level]);
+ path->nodes[level] = clone;
+
+ return 0;
+}
+
static int tree_move_down(struct btrfs_path *path, int *level, u64 reada_min_gen)
{
struct extent_buffer *eb;
@@ -6702,6 +6846,8 @@ static int tree_move_down(struct btrfs_path *path, int *level, u64 reada_min_gen
u64 reada_max;
u64 reada_done = 0;
+ lockdep_assert_held_read(&parent->fs_info->commit_root_sem);
+
BUG_ON(*level == 0);
eb = btrfs_read_node_slot(parent, slot);
if (IS_ERR(eb))
@@ -6725,6 +6871,10 @@ static int tree_move_down(struct btrfs_path *path, int *level, u64 reada_min_gen
path->nodes[*level - 1] = eb;
path->slots[*level - 1] = 0;
(*level)--;
+
+ if (*level == 0)
+ return replace_node_with_clone(path, 0);
+
return 0;
}
@@ -6738,8 +6888,10 @@ static int tree_move_next_or_upnext(struct btrfs_path *path,
path->slots[*level]++;
while (path->slots[*level] >= nritems) {
- if (*level == root_level)
+ if (*level == root_level) {
+ path->slots[*level] = nritems - 1;
return -1;
+ }
/* move upnext */
path->slots[*level] = 0;
@@ -6771,14 +6923,20 @@ static int tree_advance(struct btrfs_path *path,
} else {
ret = tree_move_down(path, level, reada_min_gen);
}
- if (ret >= 0) {
- if (*level == 0)
- btrfs_item_key_to_cpu(path->nodes[*level], key,
- path->slots[*level]);
- else
- btrfs_node_key_to_cpu(path->nodes[*level], key,
- path->slots[*level]);
- }
+
+ /*
+ * Even if we have reached the end of a tree, ret is -1, update the key
+ * anyway, so that in case we need to restart due to a block group
+ * relocation, we can assert that the last key of the root node still
+ * exists in the tree.
+ */
+ if (*level == 0)
+ btrfs_item_key_to_cpu(path->nodes[*level], key,
+ path->slots[*level]);
+ else
+ btrfs_node_key_to_cpu(path->nodes[*level], key,
+ path->slots[*level]);
+
return ret;
}
@@ -6807,6 +6965,97 @@ static int tree_compare_item(struct btrfs_path *left_path,
return 0;
}
+/*
+ * A transaction used for relocating a block group was committed or is about to
+ * finish its commit. Release our paths and restart the search, so that we are
+ * not using stale extent buffers:
+ *
+ * 1) For levels > 0, we are only holding references of extent buffers, without
+ * any locks on them, which does not prevent them from having been relocated
+ * and reallocated after the last time we released the commit root semaphore.
+ * The exception are the root nodes, for which we always have a clone, see
+ * the comment at btrfs_compare_trees();
+ *
+ * 2) For leaves, level 0, we are holding copies (clones) of extent buffers, so
+ * we are safe from the concurrent relocation and reallocation. However they
+ * can have file extent items with a pre relocation disk_bytenr value, so we
+ * restart the start from the current commit roots and clone the new leaves so
+ * that we get the post relocation disk_bytenr values. Not doing so, could
+ * make us clone the wrong data in case there are new extents using the old
+ * disk_bytenr that happen to be shared.
+ */
+static int restart_after_relocation(struct btrfs_path *left_path,
+ struct btrfs_path *right_path,
+ const struct btrfs_key *left_key,
+ const struct btrfs_key *right_key,
+ int left_level,
+ int right_level,
+ const struct send_ctx *sctx)
+{
+ int root_level;
+ int ret;
+
+ lockdep_assert_held_read(&sctx->send_root->fs_info->commit_root_sem);
+
+ btrfs_release_path(left_path);
+ btrfs_release_path(right_path);
+
+ /*
+ * Since keys can not be added or removed to/from our roots because they
+ * are readonly and we do not allow deduplication to run in parallel
+ * (which can add, remove or change keys), the layout of the trees should
+ * not change.
+ */
+ left_path->lowest_level = left_level;
+ ret = search_key_again(sctx, sctx->send_root, left_path, left_key);
+ if (ret < 0)
+ return ret;
+
+ right_path->lowest_level = right_level;
+ ret = search_key_again(sctx, sctx->parent_root, right_path, right_key);
+ if (ret < 0)
+ return ret;
+
+ /*
+ * If the lowest level nodes are leaves, clone them so that they can be
+ * safely used by changed_cb() while not under the protection of the
+ * commit root semaphore, even if relocation and reallocation happens in
+ * parallel.
+ */
+ if (left_level == 0) {
+ ret = replace_node_with_clone(left_path, 0);
+ if (ret < 0)
+ return ret;
+ }
+
+ if (right_level == 0) {
+ ret = replace_node_with_clone(right_path, 0);
+ if (ret < 0)
+ return ret;
+ }
+
+ /*
+ * Now clone the root nodes (unless they happen to be the leaves we have
+ * already cloned). This is to protect against concurrent snapshotting of
+ * the send and parent roots (see the comment at btrfs_compare_trees()).
+ */
+ root_level = btrfs_header_level(sctx->send_root->commit_root);
+ if (root_level > 0) {
+ ret = replace_node_with_clone(left_path, root_level);
+ if (ret < 0)
+ return ret;
+ }
+
+ root_level = btrfs_header_level(sctx->parent_root->commit_root);
+ if (root_level > 0) {
+ ret = replace_node_with_clone(right_path, root_level);
+ if (ret < 0)
+ return ret;
+ }
+
+ return 0;
+}
+
/*
* This function compares two trees and calls the provided callback for
* every changed/new/deleted item it finds.
@@ -6835,10 +7084,10 @@ static int btrfs_compare_trees(struct btrfs_root *left_root,
int right_root_level;
int left_level;
int right_level;
- int left_end_reached;
- int right_end_reached;
- int advance_left;
- int advance_right;
+ int left_end_reached = 0;
+ int right_end_reached = 0;
+ int advance_left = 0;
+ int advance_right = 0;
u64 left_blockptr;
u64 right_blockptr;
u64 left_gen;
@@ -6906,12 +7155,18 @@ static int btrfs_compare_trees(struct btrfs_root *left_root,
down_read(&fs_info->commit_root_sem);
left_level = btrfs_header_level(left_root->commit_root);
left_root_level = left_level;
+ /*
+ * We clone the root node of the send and parent roots to prevent races
+ * with snapshot creation of these roots. Snapshot creation COWs the
+ * root node of a tree, so after the transaction is committed the old
+ * extent can be reallocated while this send operation is still ongoing.
+ * So we clone them, under the commit root semaphore, to be race free.
+ */
left_path->nodes[left_level] =
btrfs_clone_extent_buffer(left_root->commit_root);
if (!left_path->nodes[left_level]) {
- up_read(&fs_info->commit_root_sem);
ret = -ENOMEM;
- goto out;
+ goto out_unlock;
}
right_level = btrfs_header_level(right_root->commit_root);
@@ -6919,9 +7174,8 @@ static int btrfs_compare_trees(struct btrfs_root *left_root,
right_path->nodes[right_level] =
btrfs_clone_extent_buffer(right_root->commit_root);
if (!right_path->nodes[right_level]) {
- up_read(&fs_info->commit_root_sem);
ret = -ENOMEM;
- goto out;
+ goto out_unlock;
}
/*
* Our right root is the parent root, while the left root is the "send"
@@ -6931,7 +7185,6 @@ static int btrfs_compare_trees(struct btrfs_root *left_root,
* will need to read them at some point.
*/
reada_min_gen = btrfs_header_generation(right_root->commit_root);
- up_read(&fs_info->commit_root_sem);
if (left_level == 0)
btrfs_item_key_to_cpu(left_path->nodes[left_level],
@@ -6946,11 +7199,26 @@ static int btrfs_compare_trees(struct btrfs_root *left_root,
btrfs_node_key_to_cpu(right_path->nodes[right_level],
&right_key, right_path->slots[right_level]);
- left_end_reached = right_end_reached = 0;
- advance_left = advance_right = 0;
+ sctx->last_reloc_trans = fs_info->last_reloc_trans;
while (1) {
- cond_resched();
+ if (need_resched() ||
+ rwsem_is_contended(&fs_info->commit_root_sem)) {
+ up_read(&fs_info->commit_root_sem);
+ cond_resched();
+ down_read(&fs_info->commit_root_sem);
+ }
+
+ if (fs_info->last_reloc_trans > sctx->last_reloc_trans) {
+ ret = restart_after_relocation(left_path, right_path,
+ &left_key, &right_key,
+ left_level, right_level,
+ sctx);
+ if (ret < 0)
+ goto out_unlock;
+ sctx->last_reloc_trans = fs_info->last_reloc_trans;
+ }
+
if (advance_left && !left_end_reached) {
ret = tree_advance(left_path, &left_level,
left_root_level,
@@ -6959,7 +7227,7 @@ static int btrfs_compare_trees(struct btrfs_root *left_root,
if (ret == -1)
left_end_reached = ADVANCE;
else if (ret < 0)
- goto out;
+ goto out_unlock;
advance_left = 0;
}
if (advance_right && !right_end_reached) {
@@ -6970,54 +7238,55 @@ static int btrfs_compare_trees(struct btrfs_root *left_root,
if (ret == -1)
right_end_reached = ADVANCE;
else if (ret < 0)
- goto out;
+ goto out_unlock;
advance_right = 0;
}
if (left_end_reached && right_end_reached) {
ret = 0;
- goto out;
+ goto out_unlock;
} else if (left_end_reached) {
if (right_level == 0) {
+ up_read(&fs_info->commit_root_sem);
ret = changed_cb(left_path, right_path,
&right_key,
BTRFS_COMPARE_TREE_DELETED,
sctx);
if (ret < 0)
goto out;
+ down_read(&fs_info->commit_root_sem);
}
advance_right = ADVANCE;
continue;
} else if (right_end_reached) {
if (left_level == 0) {
+ up_read(&fs_info->commit_root_sem);
ret = changed_cb(left_path, right_path,
&left_key,
BTRFS_COMPARE_TREE_NEW,
sctx);
if (ret < 0)
goto out;
+ down_read(&fs_info->commit_root_sem);
}
advance_left = ADVANCE;
continue;
}
if (left_level == 0 && right_level == 0) {
+ up_read(&fs_info->commit_root_sem);
cmp = btrfs_comp_cpu_keys(&left_key, &right_key);
if (cmp < 0) {
ret = changed_cb(left_path, right_path,
&left_key,
BTRFS_COMPARE_TREE_NEW,
sctx);
- if (ret < 0)
- goto out;
advance_left = ADVANCE;
} else if (cmp > 0) {
ret = changed_cb(left_path, right_path,
&right_key,
BTRFS_COMPARE_TREE_DELETED,
sctx);
- if (ret < 0)
- goto out;
advance_right = ADVANCE;
} else {
enum btrfs_compare_tree_result result;
@@ -7031,11 +7300,13 @@ static int btrfs_compare_trees(struct btrfs_root *left_root,
result = BTRFS_COMPARE_TREE_SAME;
ret = changed_cb(left_path, right_path,
&left_key, result, sctx);
- if (ret < 0)
- goto out;
advance_left = ADVANCE;
advance_right = ADVANCE;
}
+
+ if (ret < 0)
+ goto out;
+ down_read(&fs_info->commit_root_sem);
} else if (left_level == right_level) {
cmp = btrfs_comp_cpu_keys(&left_key, &right_key);
if (cmp < 0) {
@@ -7075,6 +7346,8 @@ static int btrfs_compare_trees(struct btrfs_root *left_root,
}
}
+out_unlock:
+ up_read(&fs_info->commit_root_sem);
out:
btrfs_free_path(left_path);
btrfs_free_path(right_path);
@@ -7413,21 +7686,7 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg)
if (ret)
goto out;
- spin_lock(&fs_info->send_reloc_lock);
- if (test_bit(BTRFS_FS_RELOC_RUNNING, &fs_info->flags)) {
- spin_unlock(&fs_info->send_reloc_lock);
- btrfs_warn_rl(fs_info,
- "cannot run send because a relocation operation is in progress");
- ret = -EAGAIN;
- goto out;
- }
- fs_info->send_in_progress++;
- spin_unlock(&fs_info->send_reloc_lock);
-
ret = send_subvol(sctx);
- spin_lock(&fs_info->send_reloc_lock);
- fs_info->send_in_progress--;
- spin_unlock(&fs_info->send_reloc_lock);
if (ret < 0)
goto out;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 9a6009108ea5..642cd2b55fa0 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -163,6 +163,10 @@ static noinline void switch_commit_roots(struct btrfs_trans_handle *trans)
struct btrfs_caching_control *caching_ctl, *next;
down_write(&fs_info->commit_root_sem);
+
+ if (test_bit(BTRFS_FS_RELOC_RUNNING, &fs_info->flags))
+ fs_info->last_reloc_trans = trans->transid;
+
list_for_each_entry_safe(root, tmp, &cur_trans->switch_commits,
dirty_list) {
list_del_init(&root->dirty_list);
--
2.33.1