While looking at BUGs associated with invalid huge page map counts,
it was discovered and observed that a huge pte pointer could become
'invalid' and point to another task's page table. Consider the
following:
A task takes a page fault on a shared hugetlbfs file and calls
huge_pte_alloc to get a ptep. Suppose the returned ptep points to a
shared pmd.
Now, another task truncates the hugetlbfs file. As part of truncation,
it unmaps everyone who has the file mapped. If the range being
truncated is covered by a shared pmd, huge_pmd_unshare will be called.
For all but the last user of the shared pmd, huge_pmd_unshare will
clear the pud pointing to the pmd. If the task in the middle of the
page fault is not the last user, the ptep returned by huge_pte_alloc
now points to another task's page table or worse. This leads to bad
things such as incorrect page map/reference counts or invalid memory
references.
To fix, expand the use of i_mmap_rwsem as follows:
- i_mmap_rwsem is held in read mode whenever huge_pmd_share is called.
huge_pmd_share is only called via huge_pte_alloc, so callers of
huge_pte_alloc take i_mmap_rwsem before calling. In addition, callers
of huge_pte_alloc continue to hold the semaphore until finished with
the ptep.
- i_mmap_rwsem is held in write mode whenever huge_pmd_unshare is called.
Cc: <stable(a)vger.kernel.org>
Fixes: 39dde65c9940 ("shared page table for hugetlb page")
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
---
mm/hugetlb.c | 70 ++++++++++++++++++++++++++++++++++-----------
mm/memory-failure.c | 14 ++++++++-
mm/migrate.c | 13 ++++++++-
mm/rmap.c | 3 ++
mm/userfaultfd.c | 11 +++++--
5 files changed, 91 insertions(+), 20 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 309fb8c969af..ab4c77b8c72c 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3239,6 +3239,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
int cow;
struct hstate *h = hstate_vma(vma);
unsigned long sz = huge_page_size(h);
+ struct address_space *mapping = vma->vm_file->f_mapping;
unsigned long mmun_start; /* For mmu_notifiers */
unsigned long mmun_end; /* For mmu_notifiers */
int ret = 0;
@@ -3252,11 +3253,23 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
for (addr = vma->vm_start; addr < vma->vm_end; addr += sz) {
spinlock_t *src_ptl, *dst_ptl;
+
src_pte = huge_pte_offset(src, addr, sz);
if (!src_pte)
continue;
+
+ /*
+ * i_mmap_rwsem must be held to call huge_pte_alloc.
+ * Continue to hold until finished with dst_pte, otherwise
+ * it could go away if part of a shared pmd.
+ *
+ * Technically, i_mmap_rwsem is only needed in the non-cow
+ * case as cow mappings are not shared.
+ */
+ i_mmap_lock_read(mapping);
dst_pte = huge_pte_alloc(dst, addr, sz);
if (!dst_pte) {
+ i_mmap_unlock_read(mapping);
ret = -ENOMEM;
break;
}
@@ -3271,8 +3284,10 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
* after taking the lock below.
*/
dst_entry = huge_ptep_get(dst_pte);
- if ((dst_pte == src_pte) || !huge_pte_none(dst_entry))
+ if ((dst_pte == src_pte) || !huge_pte_none(dst_entry)) {
+ i_mmap_unlock_read(mapping);
continue;
+ }
dst_ptl = huge_pte_lock(h, dst, dst_pte);
src_ptl = huge_pte_lockptr(h, src, src_pte);
@@ -3321,6 +3336,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
}
spin_unlock(src_ptl);
spin_unlock(dst_ptl);
+
+ i_mmap_unlock_read(mapping);
}
if (cow)
@@ -3772,14 +3789,18 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
};
/*
- * hugetlb_fault_mutex must be dropped before
- * handling userfault. Reacquire after handling
- * fault to make calling code simpler.
+ * hugetlb_fault_mutex and i_mmap_rwsem must be
+ * dropped before handling userfault. Reacquire
+ * after handling fault to make calling code simpler.
*/
hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping,
idx, haddr);
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
+
ret = handle_userfault(&vmf, VM_UFFD_MISSING);
+
+ i_mmap_lock_read(mapping);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
goto out;
}
@@ -3927,6 +3948,11 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
ptep = huge_pte_offset(mm, haddr, huge_page_size(h));
if (ptep) {
+ /*
+ * Since we hold no locks, ptep could be stale. That is
+ * OK as we are only making decisions based on content and
+ * not actually modifying content here.
+ */
entry = huge_ptep_get(ptep);
if (unlikely(is_hugetlb_entry_migration(entry))) {
migration_entry_wait_huge(vma, mm, ptep);
@@ -3934,20 +3960,31 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
} else if (unlikely(is_hugetlb_entry_hwpoisoned(entry)))
return VM_FAULT_HWPOISON_LARGE |
VM_FAULT_SET_HINDEX(hstate_index(h));
- } else {
- ptep = huge_pte_alloc(mm, haddr, huge_page_size(h));
- if (!ptep)
- return VM_FAULT_OOM;
}
+ /*
+ * Acquire i_mmap_rwsem before calling huge_pte_alloc and hold
+ * until finished with ptep. This prevents huge_pmd_unshare from
+ * being called elsewhere and making the ptep no longer valid.
+ *
+ * ptep could have already be assigned via huge_pte_offset. That
+ * is OK, as huge_pte_alloc will return the same value unless
+ * something changed.
+ */
mapping = vma->vm_file->f_mapping;
- idx = vma_hugecache_offset(h, vma, haddr);
+ i_mmap_lock_read(mapping);
+ ptep = huge_pte_alloc(mm, haddr, huge_page_size(h));
+ if (!ptep) {
+ i_mmap_unlock_read(mapping);
+ return VM_FAULT_OOM;
+ }
/*
* Serialize hugepage allocation and instantiation, so that we don't
* get spurious allocation failures if two CPUs race to instantiate
* the same page in the page cache.
*/
+ idx = vma_hugecache_offset(h, vma, haddr);
hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, haddr);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
@@ -4035,6 +4072,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
}
out_mutex:
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
/*
* Generally it's safe to hold refcount during waiting page lock. But
* here we just wait to defer the next page fault to avoid busy loop and
@@ -4639,10 +4677,12 @@ void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
* Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc()
* and returns the corresponding pte. While this is not necessary for the
* !shared pmd case because we can allocate the pmd later as well, it makes the
- * code much cleaner. pmd allocation is essential for the shared case because
- * pud has to be populated inside the same i_mmap_rwsem section - otherwise
- * racing tasks could either miss the sharing (see huge_pte_offset) or select a
- * bad pmd for sharing.
+ * code much cleaner.
+ *
+ * This routine must be called with i_mmap_rwsem held in at least read mode.
+ * For hugetlbfs, this prevents removal of any page table entries associated
+ * with the address space. This is important as we are setting up sharing
+ * based on existing page table entries (mappings).
*/
pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
{
@@ -4659,7 +4699,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
if (!vma_shareable(vma, addr))
return (pte_t *)pmd_alloc(mm, pud, addr);
- i_mmap_lock_write(mapping);
vma_interval_tree_foreach(svma, &mapping->i_mmap, idx, idx) {
if (svma == vma)
continue;
@@ -4689,7 +4728,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
spin_unlock(ptl);
out:
pte = (pte_t *)pmd_alloc(mm, pud, addr);
- i_mmap_unlock_write(mapping);
return pte;
}
@@ -4700,7 +4738,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
* indicated by page_count > 1, unmap is achieved by clearing pud and
* decrementing the ref count. If count == 1, the pte page is not shared.
*
- * called with page table lock held.
+ * Called with page table lock held and i_mmap_rwsem held in write mode.
*
* returns: 1 successfully unmapped a shared pte page
* 0 the underlying pte page is not shared, or it is the last user
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 0cd3de3550f0..b992d1295578 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1028,7 +1028,19 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
if (kill)
collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED);
- unmap_success = try_to_unmap(hpage, ttu);
+ if (!PageHuge(hpage)) {
+ unmap_success = try_to_unmap(hpage, ttu);
+ } else {
+ /*
+ * For hugetlb pages, try_to_unmap could potentially call
+ * huge_pmd_unshare. Because of this, take semaphore in
+ * write mode here and set TTU_RMAP_LOCKED to indicate we
+ * have taken the lock at this higer level.
+ */
+ i_mmap_lock_write(mapping);
+ unmap_success = try_to_unmap(hpage, ttu|TTU_RMAP_LOCKED);
+ i_mmap_unlock_write(mapping);
+ }
if (!unmap_success)
pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n",
pfn, page_mapcount(hpage));
diff --git a/mm/migrate.c b/mm/migrate.c
index 84381b55b2bd..725edaef238a 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1307,8 +1307,19 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
goto put_anon;
if (page_mapped(hpage)) {
+ struct address_space *mapping = page_mapping(hpage);
+
+ /*
+ * try_to_unmap could potentially call huge_pmd_unshare.
+ * Because of this, take semaphore in write mode here and
+ * set TTU_RMAP_LOCKED to let lower levels know we have
+ * taken the lock.
+ */
+ i_mmap_lock_write(mapping);
try_to_unmap(hpage,
- TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
+ TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS|
+ TTU_RMAP_LOCKED);
+ i_mmap_unlock_write(mapping);
page_was_mapped = 1;
}
diff --git a/mm/rmap.c b/mm/rmap.c
index 85b7f9423352..322e656d0225 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1374,6 +1374,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
/*
* If sharing is possible, start and end will be adjusted
* accordingly.
+ *
+ * If called for a huge page, caller must hold i_mmap_rwsem
+ * in write mode as it is possible to call huge_pmd_unshare.
*/
adjust_range_if_pmd_sharing_possible(vma, &start, &end);
}
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 458acda96f20..48368589f519 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -267,10 +267,14 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
VM_BUG_ON(dst_addr & ~huge_page_mask(h));
/*
- * Serialize via hugetlb_fault_mutex
+ * Serialize via i_mmap_rwsem and hugetlb_fault_mutex.
+ * i_mmap_rwsem ensures the dst_pte remains valid even
+ * in the case of shared pmds. fault mutex prevents
+ * races with other faulting threads.
*/
- idx = linear_page_index(dst_vma, dst_addr);
mapping = dst_vma->vm_file->f_mapping;
+ i_mmap_lock_read(mapping);
+ idx = linear_page_index(dst_vma, dst_addr);
hash = hugetlb_fault_mutex_hash(h, dst_mm, dst_vma, mapping,
idx, dst_addr);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
@@ -279,6 +283,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
dst_pte = huge_pte_alloc(dst_mm, dst_addr, huge_page_size(h));
if (!dst_pte) {
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
goto out_unlock;
}
@@ -286,6 +291,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
dst_pteval = huge_ptep_get(dst_pte);
if (!huge_pte_none(dst_pteval)) {
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
goto out_unlock;
}
@@ -293,6 +299,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
dst_addr, src_addr, &page);
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
vm_alloc_shared = vm_shared;
cond_resched();
--
2.17.2
This is a note to let you know that I've just added the patch titled
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From 8d503f206c336677954160ac62f0c7d9c219cd89 Mon Sep 17 00:00:00 2001
From: Scott Chen <scott(a)labau.com.tw>
Date: Thu, 13 Dec 2018 06:01:47 -0500
Subject: USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Add device ids to pl2303 for the HP POS pole displays:
LM920: 03f0:026b
TD620: 03f0:0956
LD960TA: 03f0:4439
LD220TA: 03f0:4349
LM940: 03f0:5039
Signed-off-by: Scott Chen <scott(a)labau.com.tw>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
drivers/usb/serial/pl2303.c | 5 +++++
drivers/usb/serial/pl2303.h | 5 +++++
2 files changed, 10 insertions(+)
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index a4e0d13fc121..98e7a5df0f6d 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -91,9 +91,14 @@ static const struct usb_device_id id_table[] = {
{ USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
{ USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
{ USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
{ USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
{ USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) },
{ USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
{ USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 26965cc23c17..4e2554d55362 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -119,10 +119,15 @@
/* Hewlett-Packard POS Pole Displays */
#define HP_VENDOR_ID 0x03f0
+#define HP_LM920_PRODUCT_ID 0x026b
+#define HP_TD620_PRODUCT_ID 0x0956
#define HP_LD960_PRODUCT_ID 0x0b39
#define HP_LCM220_PRODUCT_ID 0x3139
#define HP_LCM960_PRODUCT_ID 0x3239
#define HP_LD220_PRODUCT_ID 0x3524
+#define HP_LD220TA_PRODUCT_ID 0x4349
+#define HP_LD960TA_PRODUCT_ID 0x4439
+#define HP_LM940_PRODUCT_ID 0x5039
/* Cressi Edy (diving computer) PC interface */
#define CRESSI_VENDOR_ID 0x04b8
--
2.20.1
> From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
> Date: 2018年12月20日周四 上午10:39
> Subject: [PATCH 4.14 00/72] 4.14.90-stable review
> To: <linux-kernel(a)vger.kernel.org>
> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>,
> <torvalds(a)linux-foundation.org>, <akpm(a)linux-foundation.org>,
> <linux(a)roeck-us.net>, <shuah(a)kernel.org>, <patches(a)kernelci.org>,
> <ben.hutchings(a)codethink.co.uk>, <lkft-triage(a)lists.linaro.org>,
> <stable(a)vger.kernel.org>
>
>
> This is the start of the stable review cycle for the 4.14.90 release.
> There are 72 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Dec 22 08:59:06 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.90-rc…
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
> linux-4.14.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Merged, basic functional tests, no regression found.
Thanks,
--
Jack Wang
Linux Kernel Developer
1&1 IONOS Cloud GmbH | Greifswalder Str. 207 | 10405 Berlin | Germany
Phone: +49 30 57700-8042 | Fax: +49 30 57700-8598
E-mail: jinpu.wang(a)cloud.ionos.com | Web: www.ionos.de
Head Office: Berlin, Germany
District Court Berlin Charlottenburg, Registration number: HRB 125506 B
Executive Management: Christoph Steffens, Matthias Steinberg, Achim Weiss
Member of United Internet
This e-mail may contain confidential and/or privileged information. If
you are not the intended recipient of this e-mail, you are hereby
notified that saving, distribution or use of the content of this
e-mail in any way is prohibited. If you have received this e-mail in
error, please notify the sender and delete the e-mail.
This is the start of the stable review cycle for the 4.9.147 release.
There are 61 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Dec 22 08:58:31 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.147-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.147-rc1
Trent Piepho <tpiepho(a)impinj.com>
rtc: snvs: Add timeouts to avoid kernel lockups
Guy Shapiro <guy.shapiro(a)mobi-wize.com>
rtc: snvs: add a missing write sync
Israel Rukshin <israelr(a)mellanox.com>
nvmet-rdma: fix response use after free
Hans de Goede <hdegoede(a)redhat.com>
i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
Adamski, Krzysztof (Nokia - PL/Wroclaw) <krzysztof.adamski(a)nokia.com>
i2c: axxia: properly handle master timeout
Stefan Hajnoczi <stefanha(a)redhat.com>
vhost/vsock: fix reset orphans race with close timeout
Steve French <stfrench(a)microsoft.com>
cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)
Sam Bobroff <sbobroff(a)linux.ibm.com>
drm/ast: Fix connector leak during driver unload
Nicolas Saenz Julienne <nsaenzjulienne(a)suse.de>
ethernet: fman: fix wrong of_node_put() in probe function
Vladimir Murzin <vladimir.murzin(a)arm.com>
ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart
Chris Cole <chris(a)sageembedded.com>
ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling
Alexei Starovoitov <ast(a)kernel.org>
bpf: check pending signals while verifying programs
Saeed Mahameed <saeedm(a)mellanox.com>
net/mlx4_en: Fix build break when CONFIG_INET is off
Anderson Luiz Alves <alacn1(a)gmail.com>
mv88e6060: disable hardware level MAC learning
Juha-Matti Tilli <juha-matti.tilli(a)iki.fi>
libata: whitelist all SAMSUNG MZ7KM* solid-state disks
Tony Lindgren <tony(a)atomide.com>
Input: omap-keypad - fix keyboard debounce configuration
Dan Carpenter <dan.carpenter(a)oracle.com>
clk: mmp: Off by one in mmp_clk_add()
Dan Carpenter <dan.carpenter(a)oracle.com>
clk: mvebu: Off by one bugs in cp110_of_clk_get()
Yangtao Li <tiny.windzz(a)gmail.com>
ide: pmac: add of_node_put()
Yangtao Li <tiny.windzz(a)gmail.com>
drivers/tty: add missing of_node_put()
Yangtao Li <tiny.windzz(a)gmail.com>
drivers/sbus/char: add of_node_put()
Yangtao Li <tiny.windzz(a)gmail.com>
sbus: char: add of_node_put()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Fix a potential race in xprt_connect()
Dave Kleikamp <dave.kleikamp(a)oracle.com>
nfs: don't dirty kernel pages read by direct-io
Toni Peltonen <peltzi(a)peltzi.fi>
bonding: fix 802.3ad state sent to partner when unbinding slave
Jose Abreu <joabreu(a)synopsys.com>
ARC: io.h: Implement reads{x}()/writes{x}()
Sean Paul <seanpaul(a)chromium.org>
drm/msm: Grab a vblank reference when waiting for commit_done
YiFei Zhu <zhuyifei1999(a)gmail.com>
x86/earlyprintk/efi: Fix infinite loop on some screen widths
Cathy Avery <cavery(a)redhat.com>
scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload
Fred Herard <fred.herard(a)oracle.com>
scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset
Alexey Khoroshilov <khoroshilov(a)ispras.ru>
mac80211_hwsim: fix module init error paths for netlink
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
locking/qspinlock: Fix build for anonymous union in older GCC compilers
Peter Zijlstra <peterz(a)infradead.org>
locking/qspinlock, x86: Provide liveness guarantee
Will Deacon <will.deacon(a)arm.com>
locking/qspinlock/x86: Increase _Q_PENDING_LOOPS upper bound
Peter Zijlstra <peterz(a)infradead.org>
locking/qspinlock: Re-order code
Will Deacon <will.deacon(a)arm.com>
locking/qspinlock: Kill cmpxchg() loop when claiming lock from head of queue
Will Deacon <will.deacon(a)arm.com>
locking/qspinlock: Remove duplicate clear_pending() function from PV code
Will Deacon <will.deacon(a)arm.com>
locking/qspinlock: Remove unbounded cmpxchg() loop from locking slowpath
Will Deacon <will.deacon(a)arm.com>
locking/qspinlock: Merge 'struct __qspinlock' into 'struct qspinlock'
Will Deacon <will.deacon(a)arm.com>
locking/qspinlock: Bound spinning on pending->locked transition in slowpath
Will Deacon <will.deacon(a)arm.com>
locking/qspinlock: Ensure node is initialised before updating prev->next
Paul E. McKenney <paulmck(a)linux.vnet.ibm.com>
locking: Remove smp_read_barrier_depends() from queued_spin_lock_slowpath()
Michael J. Ruhl <michael.j.ruhl(a)intel.com>
IB/hfi1: Remove race conditions in user_sdma send path
Ilan Peer <ilan.peer(a)intel.com>
mac80211: Fix condition validating WMM IE
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
mac80211: don't WARN on bad WMM parameters from buggy APs
Chris Wilson <chris(a)chris-wilson.co.uk>
drm/i915/execlists: Apply a full mb before execution for Braswell
Brian Norris <briannorris(a)chromium.org>
Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"
Radu Rendec <radu.rendec(a)gmail.com>
powerpc/msi: Fix NULL pointer access in teardown code
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Fix memory leak of instance function hash filters
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Fix memory leak in set_trigger_filter()
Lubomir Rintel <lkundrak(a)v3.sk>
ARM: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt
Aaro Koskinen <aaro.koskinen(a)iki.fi>
MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
Jeff Moyer <jmoyer(a)redhat.com>
aio: fix spectre gadget in lookup_ioctx
Chen-Yu Tsai <wens(a)csie.org>
pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
Ingo Molnar <mingo(a)kernel.org>
timer/debug: Change /proc/timer_list from 0444 to 0400
Davidlohr Bueso <dave(a)stgolabs.net>
lib/interval_tree_test.c: allow users to limit scope of endpoint
Davidlohr Bueso <dave(a)stgolabs.net>
lib/rbtree-test: lower default params
Davidlohr Bueso <dave(a)stgolabs.net>
lib/rbtree_test.c: make input module parameters
Davidlohr Bueso <dave(a)stgolabs.net>
lib/interval_tree_test.c: allow full tree search
Davidlohr Bueso <dave(a)stgolabs.net>
lib/interval_tree_test.c: make test options module parameters
Will Deacon <will.deacon(a)arm.com>
signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/io.h | 72 ++++++++++
arch/arm/mach-mmp/cputype.h | 6 +-
arch/arm/mm/cache-v7.S | 8 +-
arch/arm/mm/cache-v7m.S | 14 +-
arch/powerpc/kernel/msi.c | 7 +-
arch/x86/include/asm/qspinlock.h | 25 +++-
arch/x86/include/asm/qspinlock_paravirt.h | 3 +-
arch/x86/platform/efi/early_printk.c | 2 +-
drivers/ata/libata-core.c | 1 +
drivers/clk/mmp/clk.c | 2 +-
drivers/clk/mvebu/cp110-system-controller.c | 4 +-
drivers/gpu/drm/ast/ast_fb.c | 1 +
drivers/gpu/drm/i915/intel_lrc.c | 7 +-
drivers/gpu/drm/msm/msm_atomic.c | 5 +
drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 6 -
drivers/i2c/busses/i2c-axxia.c | 40 ++++--
drivers/i2c/busses/i2c-scmi.c | 10 +-
drivers/ide/pmac.c | 1 +
drivers/infiniband/hw/hfi1/user_sdma.c | 28 ++--
drivers/infiniband/hw/hfi1/user_sdma.h | 7 +-
drivers/input/keyboard/omap4-keypad.c | 18 ++-
drivers/mmc/host/omap.c | 11 +-
drivers/net/bonding/bond_3ad.c | 3 +
drivers/net/dsa/mv88e6060.c | 10 +-
drivers/net/ethernet/freescale/fman/fman.c | 5 +-
drivers/net/ethernet/mellanox/mlx4/Kconfig | 2 +-
drivers/net/wireless/mac80211_hwsim.c | 12 +-
drivers/nvme/target/rdma.c | 3 +-
drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 2 +-
drivers/rtc/rtc-snvs.c | 104 ++++++++++-----
drivers/sbus/char/display7seg.c | 1 +
drivers/sbus/char/envctrl.c | 2 +
drivers/scsi/libiscsi.c | 4 +-
drivers/scsi/vmw_pvscsi.c | 4 +-
drivers/tty/serial/suncore.c | 1 +
drivers/vhost/vsock.c | 22 +++-
fs/aio.c | 2 +
fs/cifs/Kconfig | 2 +-
fs/nfs/direct.c | 9 +-
include/asm-generic/qspinlock_types.h | 32 ++++-
include/linux/compat.h | 3 +
kernel/bpf/verifier.c | 3 +
kernel/locking/qspinlock.c | 195 ++++++++++++++--------------
kernel/locking/qspinlock_paravirt.h | 42 ++----
kernel/signal.c | 17 ++-
kernel/time/timer_list.c | 2 +-
kernel/trace/ftrace.c | 1 +
kernel/trace/trace_events_trigger.c | 6 +-
lib/interval_tree_test.c | 93 ++++++++-----
lib/rbtree_test.c | 55 +++++---
net/mac80211/mlme.c | 3 +-
net/sunrpc/xprt.c | 11 +-
53 files changed, 604 insertions(+), 329 deletions(-)
The current implementation of elan_i2c is known to not support those
2 laptops.
A proper fix is to tweak both elantech and elan_i2c to transmit the
correct information from PS/2, which would make a bad candidate for
stable.
So to give us some time for fixing the root of the problem, disable
elan_i2c for the devices we know are not behaving properly.
Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1803600
Link: https://bugs.archlinux.org/task/59714
Fixes: df077237cf55 Input: elantech - detect new ICs and setup Host Notify for them
Cc: stable(a)vger.kernel.org # v4.18+
Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com>
---
drivers/input/mouse/elantech.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 2d95e8d93cc7..830ae9f07045 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1767,6 +1767,18 @@ static int elantech_smbus = IS_ENABLED(CONFIG_MOUSE_ELAN_I2C_SMBUS) ?
module_param_named(elantech_smbus, elantech_smbus, int, 0644);
MODULE_PARM_DESC(elantech_smbus, "Use a secondary bus for the Elantech device.");
+static const char * const i2c_blacklist_pnp_ids[] = {
+ /*
+ * these are known to not be working properly as bits are missing
+ * in elan_i2c
+ */
+ "LEN2131", /* ThinkPad P52 w/ NFC */
+ "LEN2132", /* ThinkPad P52 */
+ "LEN2133", /* ThinkPad P72 w/ NFC */
+ "LEN2134", /* ThinkPad P72 */
+ NULL
+};
+
static int elantech_create_smbus(struct psmouse *psmouse,
struct elantech_device_info *info,
bool leave_breadcrumbs)
@@ -1802,10 +1814,12 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
if (elantech_smbus == ELANTECH_SMBUS_NOT_SET) {
/*
- * New ICs are enabled by default.
+ * New ICs are enabled by default, unless mentioned in
+ * i2c_blacklist_pnp_ids.
* Old ICs are up to the user to decide.
*/
- if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
+ if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) ||
+ psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids))
return -ENXIO;
}
--
2.19.2
This is a note to let you know that I've just added the patch titled
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the usb-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From 8d503f206c336677954160ac62f0c7d9c219cd89 Mon Sep 17 00:00:00 2001
From: Scott Chen <scott(a)labau.com.tw>
Date: Thu, 13 Dec 2018 06:01:47 -0500
Subject: USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Add device ids to pl2303 for the HP POS pole displays:
LM920: 03f0:026b
TD620: 03f0:0956
LD960TA: 03f0:4439
LD220TA: 03f0:4349
LM940: 03f0:5039
Signed-off-by: Scott Chen <scott(a)labau.com.tw>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
drivers/usb/serial/pl2303.c | 5 +++++
drivers/usb/serial/pl2303.h | 5 +++++
2 files changed, 10 insertions(+)
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index a4e0d13fc121..98e7a5df0f6d 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -91,9 +91,14 @@ static const struct usb_device_id id_table[] = {
{ USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
{ USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
{ USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
{ USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
{ USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) },
{ USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
{ USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 26965cc23c17..4e2554d55362 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -119,10 +119,15 @@
/* Hewlett-Packard POS Pole Displays */
#define HP_VENDOR_ID 0x03f0
+#define HP_LM920_PRODUCT_ID 0x026b
+#define HP_TD620_PRODUCT_ID 0x0956
#define HP_LD960_PRODUCT_ID 0x0b39
#define HP_LCM220_PRODUCT_ID 0x3139
#define HP_LCM960_PRODUCT_ID 0x3239
#define HP_LD220_PRODUCT_ID 0x3524
+#define HP_LD220TA_PRODUCT_ID 0x4349
+#define HP_LD960TA_PRODUCT_ID 0x4439
+#define HP_LM940_PRODUCT_ID 0x5039
/* Cressi Edy (diving computer) PC interface */
#define CRESSI_VENDOR_ID 0x04b8
--
2.20.1
This is a note to let you know that I've just added the patch titled
staging: wilc1000: fix missing read_write setting when reading data
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From c58eef061dda7d843dcc0ad6fea7e597d4c377c0 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king(a)canonical.com>
Date: Wed, 19 Dec 2018 16:30:07 +0000
Subject: staging: wilc1000: fix missing read_write setting when reading data
Currently the cmd.read_write setting is not initialized so it contains
garbage from the stack. Fix this by setting it to 0 to indicate a
read is required.
Detected by CoverityScan, CID#1357925 ("Uninitialized scalar variable")
Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
Signed-off-by: Colin Ian King <colin.king(a)canonical.com>
Cc: stable <stable(a)vger.kernel.org>
Acked-by: Ajay Singh <ajay.kathat(a)microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/wilc1000/wilc_sdio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/staging/wilc1000/wilc_sdio.c b/drivers/staging/wilc1000/wilc_sdio.c
index 27fdfbdda5c0..e2f739fef21c 100644
--- a/drivers/staging/wilc1000/wilc_sdio.c
+++ b/drivers/staging/wilc1000/wilc_sdio.c
@@ -861,6 +861,7 @@ static int sdio_read_int(struct wilc *wilc, u32 *int_status)
if (!sdio_priv->irq_gpio) {
int i;
+ cmd.read_write = 0;
cmd.function = 1;
cmd.address = 0x04;
cmd.data = 0;
--
2.20.1
This is the start of the stable review cycle for the 4.4.169 release.
There are 40 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Dec 22 08:58:16 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.169-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.169-rc1
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: isa/wavefront: prevent some out of bound writes
Trent Piepho <tpiepho(a)impinj.com>
rtc: snvs: Add timeouts to avoid kernel lockups
Guy Shapiro <guy.shapiro(a)mobi-wize.com>
rtc: snvs: add a missing write sync
Hans de Goede <hdegoede(a)redhat.com>
i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
Adamski, Krzysztof (Nokia - PL/Wroclaw) <krzysztof.adamski(a)nokia.com>
i2c: axxia: properly handle master timeout
Steve French <stfrench(a)microsoft.com>
cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)
Chris Cole <chris(a)sageembedded.com>
ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling
Anderson Luiz Alves <alacn1(a)gmail.com>
mv88e6060: disable hardware level MAC learning
Juha-Matti Tilli <juha-matti.tilli(a)iki.fi>
libata: whitelist all SAMSUNG MZ7KM* solid-state disks
Tony Lindgren <tony(a)atomide.com>
Input: omap-keypad - fix keyboard debounce configuration
Dan Carpenter <dan.carpenter(a)oracle.com>
clk: mmp: Off by one in mmp_clk_add()
Yangtao Li <tiny.windzz(a)gmail.com>
ide: pmac: add of_node_put()
Yangtao Li <tiny.windzz(a)gmail.com>
drivers/tty: add missing of_node_put()
Yangtao Li <tiny.windzz(a)gmail.com>
drivers/sbus/char: add of_node_put()
Yangtao Li <tiny.windzz(a)gmail.com>
sbus: char: add of_node_put()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Fix a potential race in xprt_connect()
Toni Peltonen <peltzi(a)peltzi.fi>
bonding: fix 802.3ad state sent to partner when unbinding slave
Jose Abreu <joabreu(a)synopsys.com>
ARC: io.h: Implement reads{x}()/writes{x}()
Sean Paul <seanpaul(a)chromium.org>
drm/msm: Grab a vblank reference when waiting for commit_done
YiFei Zhu <zhuyifei1999(a)gmail.com>
x86/earlyprintk/efi: Fix infinite loop on some screen widths
Cathy Avery <cavery(a)redhat.com>
scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload
Fred Herard <fred.herard(a)oracle.com>
scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset
Alexey Khoroshilov <khoroshilov(a)ispras.ru>
mac80211_hwsim: fix module init error paths for netlink
Ilan Peer <ilan.peer(a)intel.com>
mac80211: Fix condition validating WMM IE
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
mac80211: don't WARN on bad WMM parameters from buggy APs
Yunlei He <heyunlei(a)huawei.com>
f2fs: fix a panic caused by NULL flush_cmd_control
Brian Norris <briannorris(a)chromium.org>
Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"
Radu Rendec <radu.rendec(a)gmail.com>
powerpc/msi: Fix NULL pointer access in teardown code
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Fix memory leak of instance function hash filters
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Fix memory leak in set_trigger_filter()
Aaro Koskinen <aaro.koskinen(a)iki.fi>
MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
Jeff Moyer <jmoyer(a)redhat.com>
aio: fix spectre gadget in lookup_ioctx
Chen-Yu Tsai <wens(a)csie.org>
pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
Guenter Roeck <linux(a)roeck-us.net>
powerpc/boot: Fix random libfdt related build errors
Ingo Molnar <mingo(a)kernel.org>
timer/debug: Change /proc/timer_list from 0444 to 0400
Davidlohr Bueso <dave(a)stgolabs.net>
lib/interval_tree_test.c: allow users to limit scope of endpoint
Davidlohr Bueso <dave(a)stgolabs.net>
lib/rbtree-test: lower default params
Davidlohr Bueso <dave(a)stgolabs.net>
lib/rbtree_test.c: make input module parameters
Davidlohr Bueso <dave(a)stgolabs.net>
lib/interval_tree_test.c: allow full tree search
Davidlohr Bueso <dave(a)stgolabs.net>
lib/interval_tree_test.c: make test options module parameters
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/io.h | 72 +++++++++++++++++++
arch/arm/mm/cache-v7.S | 8 ++-
arch/powerpc/boot/Makefile | 3 +-
arch/powerpc/kernel/msi.c | 7 +-
arch/x86/platform/efi/early_printk.c | 2 +-
drivers/ata/libata-core.c | 1 +
drivers/clk/mmp/clk.c | 2 +-
drivers/gpu/drm/msm/msm_atomic.c | 5 ++
drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 6 --
drivers/i2c/busses/i2c-axxia.c | 40 ++++++++---
drivers/i2c/busses/i2c-scmi.c | 10 ++-
drivers/ide/pmac.c | 1 +
drivers/input/keyboard/omap4-keypad.c | 18 +++--
drivers/mmc/host/omap.c | 11 ++-
drivers/net/bonding/bond_3ad.c | 3 +
drivers/net/dsa/mv88e6060.c | 10 +--
drivers/net/wireless/mac80211_hwsim.c | 12 ++--
drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 2 +-
drivers/rtc/rtc-snvs.c | 104 +++++++++++++++++++---------
drivers/sbus/char/display7seg.c | 1 +
drivers/sbus/char/envctrl.c | 2 +
drivers/scsi/libiscsi.c | 4 +-
drivers/scsi/vmw_pvscsi.c | 4 +-
drivers/tty/serial/suncore.c | 1 +
fs/aio.c | 2 +
fs/cifs/Kconfig | 2 +-
fs/f2fs/segment.c | 5 +-
kernel/time/timer_list.c | 2 +-
kernel/trace/ftrace.c | 1 +
kernel/trace/trace_events_trigger.c | 6 +-
lib/interval_tree_test.c | 93 ++++++++++++++++---------
lib/rbtree_test.c | 55 +++++++++------
net/mac80211/mlme.c | 3 +-
net/sunrpc/xprt.c | 11 ++-
sound/isa/wavefront/wavefront_synth.c | 9 +++
36 files changed, 376 insertions(+), 146 deletions(-)
This is the start of the stable review cycle for the 3.18.131 release.
There are 31 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Dec 22 08:57:30 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.131-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 3.18.131-rc1
Lior David <qca_liord(a)qca.qualcomm.com>
wil6210: missing length check in wmi_set_ie
Kees Cook <keescook(a)chromium.org>
swiotlb: clean up reporting
Jens Axboe <axboe(a)kernel.dk>
sr: pass down correctly sized SCSI sense buffer
Thomas Gleixner <tglx(a)linutronix.de>
posix-timers: Sanitize overrun handling
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command
Dan Carpenter <dan.carpenter(a)oracle.com>
ALSA: isa/wavefront: prevent some out of bound writes
Hans de Goede <hdegoede(a)redhat.com>
i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
Steve French <stfrench(a)microsoft.com>
cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)
Chris Cole <chris(a)sageembedded.com>
ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling
Juha-Matti Tilli <juha-matti.tilli(a)iki.fi>
libata: whitelist all SAMSUNG MZ7KM* solid-state disks
Tony Lindgren <tony(a)atomide.com>
Input: omap-keypad - fix keyboard debounce configuration
Yangtao Li <tiny.windzz(a)gmail.com>
ide: pmac: add of_node_put()
Yangtao Li <tiny.windzz(a)gmail.com>
drivers/tty: add missing of_node_put()
Yangtao Li <tiny.windzz(a)gmail.com>
drivers/sbus/char: add of_node_put()
Yangtao Li <tiny.windzz(a)gmail.com>
sbus: char: add of_node_put()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Fix a potential race in xprt_connect()
Toni Peltonen <peltzi(a)peltzi.fi>
bonding: fix 802.3ad state sent to partner when unbinding slave
YiFei Zhu <zhuyifei1999(a)gmail.com>
x86/earlyprintk/efi: Fix infinite loop on some screen widths
Cathy Avery <cavery(a)redhat.com>
scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload
Fred Herard <fred.herard(a)oracle.com>
scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset
Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
powerpc: Look for "stdout-path" when setting up legacy consoles
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Fix memory leak of instance function hash filters
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Fix memory leak in set_trigger_filter()
Aaro Koskinen <aaro.koskinen(a)iki.fi>
MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
Guenter Roeck <linux(a)roeck-us.net>
powerpc/boot: Fix random libfdt related build errors
Ingo Molnar <mingo(a)kernel.org>
timer/debug: Change /proc/timer_list from 0444 to 0400
Davidlohr Bueso <dave(a)stgolabs.net>
lib/interval_tree_test.c: allow users to limit scope of endpoint
Davidlohr Bueso <dave(a)stgolabs.net>
lib/rbtree-test: lower default params
Davidlohr Bueso <dave(a)stgolabs.net>
lib/rbtree_test.c: make input module parameters
Davidlohr Bueso <dave(a)stgolabs.net>
lib/interval_tree_test.c: allow full tree search
Davidlohr Bueso <dave(a)stgolabs.net>
lib/interval_tree_test.c: make test options module parameters
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mm/cache-v7.S | 8 +--
arch/powerpc/boot/Makefile | 3 +-
arch/powerpc/kernel/legacy_serial.c | 6 ++-
arch/x86/platform/efi/early_printk.c | 2 +-
drivers/ata/libata-core.c | 1 +
drivers/i2c/busses/i2c-scmi.c | 10 ++--
drivers/ide/pmac.c | 1 +
drivers/input/keyboard/omap4-keypad.c | 18 +++++--
drivers/mmc/host/omap.c | 11 +++-
drivers/net/bonding/bond_3ad.c | 3 ++
drivers/net/wireless/ath/wil6210/wmi.c | 7 ++-
drivers/sbus/char/display7seg.c | 1 +
drivers/sbus/char/envctrl.c | 2 +
drivers/scsi/libiscsi.c | 4 +-
drivers/scsi/sr_ioctl.c | 21 +++-----
drivers/scsi/vmw_pvscsi.c | 4 +-
drivers/tty/serial/suncore.c | 1 +
fs/cifs/Kconfig | 2 +-
include/linux/posix-timers.h | 4 +-
include/sound/pcm.h | 2 +-
kernel/time/posix-cpu-timers.c | 2 +-
kernel/time/posix-timers.c | 29 +++++++----
kernel/time/timer_list.c | 2 +-
kernel/trace/ftrace.c | 1 +
kernel/trace/trace_events_trigger.c | 6 ++-
lib/interval_tree_test.c | 93 ++++++++++++++++++++++------------
lib/rbtree_test.c | 55 ++++++++++++--------
lib/swiotlb.c | 18 +++----
net/sunrpc/xprt.c | 11 +++-
sound/core/pcm_lib.c | 2 -
sound/core/pcm_native.c | 6 +--
sound/isa/wavefront/wavefront_synth.c | 9 ++++
33 files changed, 224 insertions(+), 125 deletions(-)
AppArmor recently added the ability for profiles to match extended
attributes, with the intent of targeting "security.ima" and
"security.evm" to differentiate between sign and unsigned files.
The current implementation uses a path glob to match the extended
attribute value. To require the presence of a extended attribute,
profiles supply a wildcard:
# Match any file with the "security.apparmor" attribute
profile test /** xattrs=(security.apparmor="**") {
# ...
}
However, the glob matching implementation is intended for file paths and
doesn't handle null characters correctly. It's currently impossible to
write a profile that targets IMA and EVM attributes, since the
signatures can contain a null byte.
Add the ability for AppArmor to check the presence of an extended
attribute, and not its value. This fixes the profile matching allowing
profiles conditional on EVM and IMA signatures:
profile signed_binary /** xattrs=(security.evm security.ima) {
# ...
}
A modified apparmor_parser and associated regression tests to exercise
this fix can be found at:
https://gitlab.com/ericchiang/apparmor/commits/parser-xattrs-keys
Signed-off-by: Eric Chiang <ericchiang(a)google.com>
CC: stable(a)vger.kernel.org
---
security/apparmor/apparmorfs.c | 1 +
security/apparmor/domain.c | 25 +++++++++++++++++++++----
security/apparmor/include/policy.h | 6 ++++++
security/apparmor/policy.c | 3 +++
security/apparmor/policy_unpack.c | 18 ++++++++++++++++++
5 files changed, 49 insertions(+), 4 deletions(-)
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 8963203319ea..03d9b7f8a2fb 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -2212,6 +2212,7 @@ static struct aa_sfs_entry aa_sfs_entry_signal[] = {
static struct aa_sfs_entry aa_sfs_entry_attach[] = {
AA_SFS_FILE_BOOLEAN("xattr", 1),
+ AA_SFS_FILE_BOOLEAN("xattr_key", 1),
{ }
};
static struct aa_sfs_entry aa_sfs_entry_domain[] = {
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 08c88de0ffda..9f223756b416 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -317,16 +317,33 @@ static int aa_xattrs_match(const struct linux_binprm *bprm,
ssize_t size;
struct dentry *d;
char *value = NULL;
- int value_size = 0, ret = profile->xattr_count;
+ int value_size = 0;
+ int ret = profile->xattr_count + profile->xattr_keys_count;
- if (!bprm || !profile->xattr_count)
+ if (!bprm)
return 0;
+ d = bprm->file->f_path.dentry;
+
+ if (profile->xattr_keys_count) {
+ /* validate that these attributes are present, ignore values */
+ for (i = 0; i < profile->xattr_keys_count; i++) {
+ size = vfs_getxattr_alloc(d, profile->xattr_keys[i],
+ &value, value_size,
+ GFP_KERNEL);
+ if (size < 0) {
+ ret = -EINVAL;
+ goto out;
+ }
+ }
+ }
+
+ if (!profile->xattr_count)
+ goto out;
+
/* transition from exec match to xattr set */
state = aa_dfa_null_transition(profile->xmatch, state);
- d = bprm->file->f_path.dentry;
-
for (i = 0; i < profile->xattr_count; i++) {
size = vfs_getxattr_alloc(d, profile->xattrs[i], &value,
value_size, GFP_KERNEL);
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 8e6707c837be..8ed1d30de7ce 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -112,6 +112,10 @@ struct aa_data {
* @policy: general match rules governing policy
* @file: The set of rules governing basic file access and domain transitions
* @caps: capabilities for the profile
+ * @xattr_count: number of xattrs values
+ * @xattrs: extended attributes whose values must match the xmatch
+ * @xattr_keys_count: number of xattr keys values
+ * @xattr_keys: extended attributes that must be present to match the profile
* @rlimits: rlimits for the profile
*
* @dents: dentries for the profiles file entries in apparmorfs
@@ -152,6 +156,8 @@ struct aa_profile {
int xattr_count;
char **xattrs;
+ int xattr_keys_count;
+ char **xattr_keys;
struct aa_rlimit rlimits;
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index df9c5890a878..e0f9cf8b8318 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -231,6 +231,9 @@ void aa_free_profile(struct aa_profile *profile)
for (i = 0; i < profile->xattr_count; i++)
kzfree(profile->xattrs[i]);
kzfree(profile->xattrs);
+ for (i = 0; i < profile->xattr_keys_count; i++)
+ kzfree(profile->xattr_keys[i]);
+ kzfree(profile->xattr_keys);
for (i = 0; i < profile->secmark_count; i++)
kzfree(profile->secmark[i].label);
kzfree(profile->secmark);
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 379682e2a8d5..d1fd75093260 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -535,6 +535,24 @@ static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
goto fail;
}
+ if (unpack_nameX(e, AA_STRUCT, "xattr_keys")) {
+ int i, size;
+
+ size = unpack_array(e, NULL);
+ profile->xattr_keys_count = size;
+ profile->xattr_keys = kcalloc(size, sizeof(char *), GFP_KERNEL);
+ if (!profile->xattr_keys)
+ goto fail;
+ for (i = 0; i < size; i++) {
+ if (!unpack_strdup(e, &profile->xattr_keys[i], NULL))
+ goto fail;
+ }
+ if (!unpack_nameX(e, AA_ARRAYEND, NULL))
+ goto fail;
+ if (!unpack_nameX(e, AA_STRUCTEND, NULL))
+ goto fail;
+ }
+
return 1;
fail:
--
2.20.1.415.g653613c723-goog
The patch titled
Subject: hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race
has been added to the -mm tree. Its filename is
hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/hugetlbfs-use-i_mmap_rwsem-to-fix-…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/hugetlbfs-use-i_mmap_rwsem-to-fix-…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Subject: hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race
hugetlbfs page faults can race with truncate and hole punch operations.
Current code in the page fault path attempts to handle this by 'backing
out' operations if we encounter the race. One obvious omission in the
current code is removing a page newly added to the page cache. This is
pretty straight forward to address, but there is a more subtle and
difficult issue of backing out hugetlb reservations. To handle this
correctly, the 'reservation state' before page allocation needs to be
noted so that it can be properly backed out. There are four distinct
possibilities for reservation state: shared/reserved, shared/no-resv,
private/reserved and private/no-resv. Backing out a reservation may
require memory allocation which could fail so that needs to be taken
into account as well.
Instead of writing the required complicated code for this rare
occurrence, just eliminate the race. i_mmap_rwsem is now held in read
mode for the duration of page fault processing. Hold i_mmap_rwsem
longer in truncation and hold punch code to cover the call to
remove_inode_hugepages.
With this modification, code in remove_inode_hugepages checking for
races becomes 'dead' as it can not longer happen. Remove the dead code
and expand comments to explain reasoning. Similarly, checks for races
with truncation in the page fault path can be simplified and removed.
Link: http://lkml.kernel.org/r/20181218223557.5202-3-mike.kravetz@oracle.com
Fixes: ebed4bfc8da8 ("hugetlb: fix absurd HugePages_Rsvd")
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Michal Hocko <mhocko(a)kernel.org>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com>
Cc: "Aneesh Kumar K . V" <aneesh.kumar(a)linux.vnet.ibm.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: "Kirill A . Shutemov" <kirill.shutemov(a)linux.intel.com>
Cc: Davidlohr Bueso <dave(a)stgolabs.net>
Cc: Prakash Sangappa <prakash.sangappa(a)oracle.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/hugetlbfs/inode.c | 50 +++++++++++++----------------------------
mm/hugetlb.c | 21 ++++++++---------
2 files changed, 27 insertions(+), 44 deletions(-)
--- a/fs/hugetlbfs/inode.c~hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race
+++ a/fs/hugetlbfs/inode.c
@@ -383,17 +383,16 @@ hugetlb_vmdelete_list(struct rb_root_cac
* truncation is indicated by end of range being LLONG_MAX
* In this case, we first scan the range and release found pages.
* After releasing pages, hugetlb_unreserve_pages cleans up region/reserv
- * maps and global counts. Page faults can not race with truncation
- * in this routine. hugetlb_no_page() prevents page faults in the
- * truncated range. It checks i_size before allocation, and again after
- * with the page table lock for the page held. The same lock must be
- * acquired to unmap a page.
+ * maps and global counts.
* hole punch is indicated if end is not LLONG_MAX
* In the hole punch case we scan the range and release found pages.
* Only when releasing a page is the associated region/reserv map
* deleted. The region/reserv map for ranges without associated
- * pages are not modified. Page faults can race with hole punch.
- * This is indicated if we find a mapped page.
+ * pages are not modified.
+ *
+ * Callers of this routine must hold the i_mmap_rwsem in write mode to prevent
+ * races with page faults.
+ *
* Note: If the passed end of range value is beyond the end of file, but
* not LLONG_MAX this routine still performs a hole punch operation.
*/
@@ -423,32 +422,14 @@ static void remove_inode_hugepages(struc
for (i = 0; i < pagevec_count(&pvec); ++i) {
struct page *page = pvec.pages[i];
- u32 hash;
index = page->index;
- hash = hugetlb_fault_mutex_hash(h, current->mm,
- &pseudo_vma,
- mapping, index, 0);
- mutex_lock(&hugetlb_fault_mutex_table[hash]);
-
/*
- * If page is mapped, it was faulted in after being
- * unmapped in caller. Unmap (again) now after taking
- * the fault mutex. The mutex will prevent faults
- * until we finish removing the page.
- *
- * This race can only happen in the hole punch case.
- * Getting here in a truncate operation is a bug.
+ * A mapped page is impossible as callers should unmap
+ * all references before calling. And, i_mmap_rwsem
+ * prevents the creation of additional mappings.
*/
- if (unlikely(page_mapped(page))) {
- BUG_ON(truncate_op);
-
- i_mmap_lock_write(mapping);
- hugetlb_vmdelete_list(&mapping->i_mmap,
- index * pages_per_huge_page(h),
- (index + 1) * pages_per_huge_page(h));
- i_mmap_unlock_write(mapping);
- }
+ VM_BUG_ON(page_mapped(page));
lock_page(page);
/*
@@ -470,7 +451,6 @@ static void remove_inode_hugepages(struc
}
unlock_page(page);
- mutex_unlock(&hugetlb_fault_mutex_table[hash]);
}
huge_pagevec_release(&pvec);
cond_resched();
@@ -505,8 +485,8 @@ static int hugetlb_vmtruncate(struct ino
i_mmap_lock_write(mapping);
if (!RB_EMPTY_ROOT(&mapping->i_mmap.rb_root))
hugetlb_vmdelete_list(&mapping->i_mmap, pgoff, 0);
- i_mmap_unlock_write(mapping);
remove_inode_hugepages(inode, offset, LLONG_MAX);
+ i_mmap_unlock_write(mapping);
return 0;
}
@@ -540,8 +520,8 @@ static long hugetlbfs_punch_hole(struct
hugetlb_vmdelete_list(&mapping->i_mmap,
hole_start >> PAGE_SHIFT,
hole_end >> PAGE_SHIFT);
- i_mmap_unlock_write(mapping);
remove_inode_hugepages(inode, hole_start, hole_end);
+ i_mmap_unlock_write(mapping);
inode_unlock(inode);
}
@@ -624,7 +604,11 @@ static long hugetlbfs_fallocate(struct f
/* addr is the offset within the file (zero based) */
addr = index * hpage_size;
- /* mutex taken here, fault path and hole punch */
+ /*
+ * fault mutex taken here, protects against fault path
+ * and hole punch. inode_lock previously taken protects
+ * against truncation.
+ */
hash = hugetlb_fault_mutex_hash(h, mm, &pseudo_vma, mapping,
index, addr);
mutex_lock(&hugetlb_fault_mutex_table[hash]);
--- a/mm/hugetlb.c~hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race
+++ a/mm/hugetlb.c
@@ -3760,16 +3760,16 @@ static vm_fault_t hugetlb_no_page(struct
}
/*
- * Use page lock to guard against racing truncation
- * before we get page_table_lock.
+ * We can not race with truncation due to holding i_mmap_rwsem.
+ * Check once here for faults beyond end of file.
*/
+ size = i_size_read(mapping->host) >> huge_page_shift(h);
+ if (idx >= size)
+ goto out;
+
retry:
page = find_lock_page(mapping, idx);
if (!page) {
- size = i_size_read(mapping->host) >> huge_page_shift(h);
- if (idx >= size)
- goto out;
-
/*
* Check for page in userfault range
*/
@@ -3859,9 +3859,6 @@ retry:
}
ptl = huge_pte_lock(h, mm, ptep);
- size = i_size_read(mapping->host) >> huge_page_shift(h);
- if (idx >= size)
- goto backout;
ret = 0;
if (!huge_pte_none(huge_ptep_get(ptep)))
@@ -3964,8 +3961,10 @@ vm_fault_t hugetlb_fault(struct mm_struc
/*
* Acquire i_mmap_rwsem before calling huge_pte_alloc and hold
- * until finished with ptep. This prevents huge_pmd_unshare from
- * being called elsewhere and making the ptep no longer valid.
+ * until finished with ptep. This serves two purposes:
+ * 1) It prevents huge_pmd_unshare from being called elsewhere
+ * and making the ptep no longer valid.
+ * 2) It synchronizes us with file truncation.
*
* ptep could have already be assigned via huge_pte_offset. That
* is OK, as huge_pte_alloc will return the same value unless
_
Patches currently in -mm which might be from mike.kravetz(a)oracle.com are
hugetlbfs-use-i_mmap_rwsem-for-more-pmd-sharing-synchronization.patch
hugetlbfs-use-i_mmap_rwsem-to-fix-page-fault-truncate-race.patch