[ upstream commit ad608fbcf166fec809e402d548761768f602702c ]
The event subscriptions are added to the subscribed event list while
holding a spinlock, but that lock is subsequently released while still
accessing the subscription object. This makes it possible to unsubscribe
the event --- and freeing the subscription object's memory --- while
the subscription object is simultaneously accessed.
Prevent this by adding a mutex to serialise the event subscription and
unsubscription. This also gives a guarantee to the callback ops that the
add op has returned before the del op is called.
This change also results in making the elems field less special:
subscriptions are only added to the event list once they are fully
initialised.
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Reviewed-by: Hans Verkuil <hans.verkuil(a)cisco.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
Cc: stable(a)vger.kernel.org # for 4.14 and up
Fixes: c3b5b0241f62 ("V4L/DVB: V4L: Events: Add backend")
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
---
drivers/media/v4l2-core/v4l2-event.c | 38 +++++++++++++++++++-----------------
drivers/media/v4l2-core/v4l2-fh.c | 2 ++
include/media/v4l2-fh.h | 1 +
3 files changed, 23 insertions(+), 18 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
index 8761aab99de95..fcf65f131a2ac 100644
--- a/drivers/media/v4l2-core/v4l2-event.c
+++ b/drivers/media/v4l2-core/v4l2-event.c
@@ -119,14 +119,6 @@ static void __v4l2_event_queue_fh(struct v4l2_fh *fh, const struct v4l2_event *e
if (sev == NULL)
return;
- /*
- * If the event has been added to the fh->subscribed list, but its
- * add op has not completed yet elems will be 0, treat this as
- * not being subscribed.
- */
- if (!sev->elems)
- return;
-
/* Increase event sequence number on fh. */
fh->sequence++;
@@ -209,6 +201,7 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
struct v4l2_subscribed_event *sev, *found_ev;
unsigned long flags;
unsigned i;
+ int ret = 0;
if (sub->type == V4L2_EVENT_ALL)
return -EINVAL;
@@ -226,31 +219,36 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
sev->flags = sub->flags;
sev->fh = fh;
sev->ops = ops;
+ sev->elems = elems;
+
+ mutex_lock(&fh->subscribe_lock);
spin_lock_irqsave(&fh->vdev->fh_lock, flags);
found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
- if (!found_ev)
- list_add(&sev->list, &fh->subscribed);
spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
if (found_ev) {
+ /* Already listening */
kfree(sev);
- return 0; /* Already listening */
+ goto out_unlock;
}
if (sev->ops && sev->ops->add) {
- int ret = sev->ops->add(sev, elems);
+ ret = sev->ops->add(sev, elems);
if (ret) {
- sev->ops = NULL;
- v4l2_event_unsubscribe(fh, sub);
- return ret;
+ kfree(sev);
+ goto out_unlock;
}
}
- /* Mark as ready for use */
- sev->elems = elems;
+ spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+ list_add(&sev->list, &fh->subscribed);
+ spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
- return 0;
+out_unlock:
+ mutex_unlock(&fh->subscribe_lock);
+
+ return ret;
}
EXPORT_SYMBOL_GPL(v4l2_event_subscribe);
@@ -289,6 +287,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
return 0;
}
+ mutex_lock(&fh->subscribe_lock);
+
spin_lock_irqsave(&fh->vdev->fh_lock, flags);
sev = v4l2_event_subscribed(fh, sub->type, sub->id);
@@ -306,6 +306,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
if (sev && sev->ops && sev->ops->del)
sev->ops->del(sev);
+ mutex_unlock(&fh->subscribe_lock);
+
kfree(sev);
return 0;
diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c
index e57c002b41506..573ec2f192d44 100644
--- a/drivers/media/v4l2-core/v4l2-fh.c
+++ b/drivers/media/v4l2-core/v4l2-fh.c
@@ -42,6 +42,7 @@ void v4l2_fh_init(struct v4l2_fh *fh, struct video_device *vdev)
INIT_LIST_HEAD(&fh->available);
INIT_LIST_HEAD(&fh->subscribed);
fh->sequence = -1;
+ mutex_init(&fh->subscribe_lock);
}
EXPORT_SYMBOL_GPL(v4l2_fh_init);
@@ -88,6 +89,7 @@ void v4l2_fh_exit(struct v4l2_fh *fh)
if (fh->vdev == NULL)
return;
v4l2_event_unsubscribe_all(fh);
+ mutex_destroy(&fh->subscribe_lock);
fh->vdev = NULL;
}
EXPORT_SYMBOL_GPL(v4l2_fh_exit);
diff --git a/include/media/v4l2-fh.h b/include/media/v4l2-fh.h
index 803516775162d..a2777a324e083 100644
--- a/include/media/v4l2-fh.h
+++ b/include/media/v4l2-fh.h
@@ -41,6 +41,7 @@ struct v4l2_fh {
/* Events */
wait_queue_head_t wait;
+ struct mutex subscribe_lock;
struct list_head subscribed; /* Subscribed events */
struct list_head available; /* Dequeueable event */
unsigned int navailable;
--
2.11.0
It should not appear in the 4.9 kernel,
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=…
it cause Can't set device: Protocol not supported Can't initialize
device: Protocol not supported
# rtk_hciattach -n -s 115200 /dev/ttyS1 rtk_h5
Realtek Bluetooth init uart with init speed:115200,
final_speed:115200, type:HCI UART H5
Realtek Bluetooth :Realtek hciattach version 2.5
Realtek Bluetooth :3-wire sync pattern resend : 1, len: 8
Realtek Bluetooth :Get SYNC Resp Pkt
Realtek Bluetooth :Get SYNC pkt-active mode
Realtek Bluetooth :3-wire config pattern resend : 1 , len: 10
Realtek Bluetooth :Get CONFG pkt-active mode
Realtek Bluetooth :Get CONFG resp pkt-active mode
Realtek Bluetooth :H5 init finished
Realtek Bluetooth :config offset(f4),length(8)
Realtek Bluetooth :config baud rate to :4928002, hwflowcontrol:5f, 1
Realtek Bluetooth :config offset(27),length(1)
Realtek Bluetooth :config offset(fe),length(1)
Realtek Bluetooth :config offset(15b),length(4)
Realtek Bluetooth :config offset(1e3),length(1)
Realtek Bluetooth :Get config baud rate from config file:4928002
Realtek Bluetooth :Load FW OK
Realtek Bluetooth :RTK send HCI_VENDOR_READ_RTK_ROM_VERISION_Command
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :receive hci command complete event with command:1001
Realtek Bluetooth :Read RTK LMP version with Status:0
Realtek Bluetooth :gLmpVersion = 0x8723
Realtek Bluetooth :RTK send HCI_VENDOR_READ_RTK_ROM_VERISION_Command
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :receive hci command complete event with command:fc6d
Realtek Bluetooth :Read RTK rom version with Status:0
Realtek Bluetooth :rtk_hw_cfg.eversion = 1
Realtek Bluetooth :rtk_get_fw_project_id: opcode 0, len 1, data 1
Realtek Bluetooth :fw_ver 0x1e3ee40e, patch_num 2
Realtek Bluetooth :patch length is 0x5e90
Realtek Bluetooth :start offset is 0x4f00
Realtek Bluetooth :fw: exists, config file: exists
Realtek Bluetooth :baudrate in change speed command: 0x2 0x80 0x92 0x4
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :receive hci command complete event with command:fc17
Realtek Bluetooth :Change BD Rate with status:0
Realtek Bluetooth :final_speed 1500000
Realtek Bluetooth :hw flow control enable
Realtek Bluetooth :iEndIndex:96 iLastPacketLen:71 iAdditionpkt:4
Realtek Bluetooth :hci_download_patch tx_index:0 rx_index: -1
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 0
Realtek Bluetooth :hci_download_patch tx_index:1 rx_index: 0
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 1
Realtek Bluetooth :hci_download_patch tx_index:2 rx_index: 1
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 2
Realtek Bluetooth :hci_download_patch tx_index:3 rx_index: 2
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 3
Realtek Bluetooth :hci_download_patch tx_index:4 rx_index: 3
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 4
Realtek Bluetooth :hci_download_patch tx_index:5 rx_index: 4
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 5
Realtek Bluetooth :hci_download_patch tx_index:6 rx_index: 5
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 6
Realtek Bluetooth :hci_download_patch tx_index:7 rx_index: 6
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 7
Realtek Bluetooth :hci_download_patch tx_index:8 rx_index: 7
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 8
Realtek Bluetooth :hci_download_patch tx_index:9 rx_index: 8
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 9
Realtek Bluetooth :hci_download_patch tx_index:10 rx_index: 9
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 10
Realtek Bluetooth :hci_download_patch tx_index:11 rx_index: 10
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 11
Realtek Bluetooth :hci_download_patch tx_index:12 rx_index: 11
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 12
Realtek Bluetooth :hci_download_patch tx_index:13 rx_index: 12
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 13
Realtek Bluetooth :hci_download_patch tx_index:14 rx_index: 13
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 14
Realtek Bluetooth :hci_download_patch tx_index:15 rx_index: 14
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 15
Realtek Bluetooth :hci_download_patch tx_index:16 rx_index: 15
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 16
Realtek Bluetooth :hci_download_patch tx_index:17 rx_index: 16
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 17
Realtek Bluetooth :hci_download_patch tx_index:18 rx_index: 17
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 18
Realtek Bluetooth :hci_download_patch tx_index:19 rx_index: 18
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 19
Realtek Bluetooth :hci_download_patch tx_index:20 rx_index: 19
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 20
Realtek Bluetooth :hci_download_patch tx_index:21 rx_index: 20
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 21
Realtek Bluetooth :hci_download_patch tx_index:22 rx_index: 21
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 22
Realtek Bluetooth :hci_download_patch tx_index:23 rx_index: 22
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 23
Realtek Bluetooth :hci_download_patch tx_index:24 rx_index: 23
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 24
Realtek Bluetooth :hci_download_patch tx_index:25 rx_index: 24
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 25
Realtek Bluetooth :hci_download_patch tx_index:26 rx_index: 25
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 26
Realtek Bluetooth :hci_download_patch tx_index:27 rx_index: 26
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 27
Realtek Bluetooth :hci_download_patch tx_index:28 rx_index: 27
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 28
Realtek Bluetooth :hci_download_patch tx_index:29 rx_index: 28
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 29
Realtek Bluetooth :hci_download_patch tx_index:30 rx_index: 29
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 30
Realtek Bluetooth :hci_download_patch tx_index:31 rx_index: 30
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 31
Realtek Bluetooth :hci_download_patch tx_index:32 rx_index: 31
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 32
Realtek Bluetooth :hci_download_patch tx_index:33 rx_index: 32
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 33
Realtek Bluetooth :hci_download_patch tx_index:34 rx_index: 33
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 34
Realtek Bluetooth :hci_download_patch tx_index:35 rx_index: 34
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 35
Realtek Bluetooth :hci_download_patch tx_index:36 rx_index: 35
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 36
Realtek Bluetooth :hci_download_patch tx_index:37 rx_index: 36
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 37
Realtek Bluetooth :hci_download_patch tx_index:38 rx_index: 37
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 38
Realtek Bluetooth :hci_download_patch tx_index:39 rx_index: 38
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 39
Realtek Bluetooth :hci_download_patch tx_index:40 rx_index: 39
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 40
Realtek Bluetooth :hci_download_patch tx_index:41 rx_index: 40
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 41
Realtek Bluetooth :hci_download_patch tx_index:42 rx_index: 41
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 42
Realtek Bluetooth :hci_download_patch tx_index:43 rx_index: 42
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 43
Realtek Bluetooth :hci_download_patch tx_index:44 rx_index: 43
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 44
Realtek Bluetooth :hci_download_patch tx_index:45 rx_index: 44
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 45
Realtek Bluetooth :hci_download_patch tx_index:46 rx_index: 45
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 46
Realtek Bluetooth :hci_download_patch tx_index:47 rx_index: 46
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 47
Realtek Bluetooth :hci_download_patch tx_index:48 rx_index: 47
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 48
Realtek Bluetooth :hci_download_patch tx_index:49 rx_index: 48
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 49
Realtek Bluetooth :hci_download_patch tx_index:50 rx_index: 49
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 50
Realtek Bluetooth :hci_download_patch tx_index:51 rx_index: 50
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 51
Realtek Bluetooth :hci_download_patch tx_index:52 rx_index: 51
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 52
Realtek Bluetooth :hci_download_patch tx_index:53 rx_index: 52
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 53
Realtek Bluetooth :hci_download_patch tx_index:54 rx_index: 53
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 54
Realtek Bluetooth :hci_download_patch tx_index:55 rx_index: 54
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 55
Realtek Bluetooth :hci_download_patch tx_index:56 rx_index: 55
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 56
Realtek Bluetooth :hci_download_patch tx_index:57 rx_index: 56
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 57
Realtek Bluetooth :hci_download_patch tx_index:58 rx_index: 57
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 58
Realtek Bluetooth :hci_download_patch tx_index:59 rx_index: 58
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 59
Realtek Bluetooth :hci_download_patch tx_index:60 rx_index: 59
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 60
Realtek Bluetooth :hci_download_patch tx_index:61 rx_index: 60
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 61
Realtek Bluetooth :hci_download_patch tx_index:62 rx_index: 61
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 62
Realtek Bluetooth :hci_download_patch tx_index:63 rx_index: 62
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 63
Realtek Bluetooth :hci_download_patch tx_index:64 rx_index: 63
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 64
Realtek Bluetooth :hci_download_patch tx_index:65 rx_index: 64
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 65
Realtek Bluetooth :hci_download_patch tx_index:66 rx_index: 65
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 66
Realtek Bluetooth :hci_download_patch tx_index:67 rx_index: 66
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 67
Realtek Bluetooth :hci_download_patch tx_index:68 rx_index: 67
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 68
Realtek Bluetooth :hci_download_patch tx_index:69 rx_index: 68
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 69
Realtek Bluetooth :hci_download_patch tx_index:70 rx_index: 69
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 70
Realtek Bluetooth :hci_download_patch tx_index:71 rx_index: 70
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 71
Realtek Bluetooth :hci_download_patch tx_index:72 rx_index: 71
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 72
Realtek Bluetooth :hci_download_patch tx_index:73 rx_index: 72
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 73
Realtek Bluetooth :hci_download_patch tx_index:74 rx_index: 73
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 74
Realtek Bluetooth :hci_download_patch tx_index:75 rx_index: 74
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 75
Realtek Bluetooth :hci_download_patch tx_index:76 rx_index: 75
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 76
Realtek Bluetooth :hci_download_patch tx_index:77 rx_index: 76
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 77
Realtek Bluetooth :hci_download_patch tx_index:78 rx_index: 77
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 78
Realtek Bluetooth :hci_download_patch tx_index:79 rx_index: 78
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 79
Realtek Bluetooth :hci_download_patch tx_index:80 rx_index: 79
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 80
Realtek Bluetooth :hci_download_patch tx_index:81 rx_index: 80
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 81
Realtek Bluetooth :hci_download_patch tx_index:82 rx_index: 81
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 82
Realtek Bluetooth :hci_download_patch tx_index:83 rx_index: 82
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 83
Realtek Bluetooth :hci_download_patch tx_index:84 rx_index: 83
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 84
Realtek Bluetooth :hci_download_patch tx_index:85 rx_index: 84
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 85
Realtek Bluetooth :hci_download_patch tx_index:86 rx_index: 85
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 86
Realtek Bluetooth :hci_download_patch tx_index:87 rx_index: 86
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 87
Realtek Bluetooth :hci_download_patch tx_index:88 rx_index: 87
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 88
Realtek Bluetooth :hci_download_patch tx_index:89 rx_index: 88
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 89
Realtek Bluetooth :hci_download_patch tx_index:90 rx_index: 89
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 90
Realtek Bluetooth :hci_download_patch tx_index:91 rx_index: 90
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 91
Realtek Bluetooth :hci_download_patch tx_index:92 rx_index: 91
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 92
Realtek Bluetooth :hci_download_patch tx_index:93 rx_index: 92
Realtek Bluetooth :Received reliable seqno 0 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 93
Realtek Bluetooth :hci_download_patch tx_index:94 rx_index: 93
Realtek Bluetooth :Received reliable seqno 1 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 94
Realtek Bluetooth :hci_download_patch tx_index:95 rx_index: 94
Realtek Bluetooth :Received reliable seqno 2 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 95
Realtek Bluetooth :hci_download_patch tx_index:96 rx_index: 95
Realtek Bluetooth :Received reliable seqno 3 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 96
Realtek Bluetooth :hci_download_patch tx_index:97 rx_index: 96
Realtek Bluetooth :Received reliable seqno 4 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 97
Realtek Bluetooth :hci_download_patch tx_index:98 rx_index: 97
Realtek Bluetooth :Received reliable seqno 5 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 98
Realtek Bluetooth :hci_download_patch tx_index:99 rx_index: 98
Realtek Bluetooth :Received reliable seqno 6 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 99
Realtek Bluetooth :Send FW last command
Realtek Bluetooth :hci_download_patch tx_index:100 rx_index: 99
Realtek Bluetooth :Received reliable seqno 7 from card
Realtek Bluetooth :rtk_hw_cfg.rx_index 100
Realtek Bluetooth :Init Process finished
Can't set device: Protocol not supported
Can't initialize device: Protocol not supported
This is a note to let you know that I've just added the patch titled
usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From effd14f66cc1ef6701a19c5a56e39c35f4d395a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Niew=C3=B6hner?= <linux(a)mniewoehner.de>
Date: Sun, 25 Nov 2018 17:57:33 +0100
Subject: usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream
series
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cherry G230 Stream 2.0 (G85-231) and 3.0 (G85-232) need this quirk to
function correctly. This fixes a but where double pressing numlock locks
up the device completely with need to replug the keyboard.
Signed-off-by: Michael Niewöhner <linux(a)mniewoehner.de>
Tested-by: Michael Niewöhner <linux(a)mniewoehner.de>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f9ff03e6af93..0690fcff0ea2 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -209,6 +209,9 @@ static const struct usb_device_id usb_quirk_list[] = {
/* Microsoft LifeCam-VX700 v2.0 */
{ USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
+ { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
{ USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
--
2.19.2
This is a note to let you know that I've just added the patch titled
USB: usb-storage: Add new IDs to ums-realtek
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From a84a1bcc992f0545a51d2e120b8ca2ef20e2ea97 Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng(a)canonical.com>
Date: Fri, 23 Nov 2018 08:42:19 +0000
Subject: USB: usb-storage: Add new IDs to ums-realtek
There are two new Realtek card readers require ums-realtek to work
correctly.
Add the new IDs to support them.
Signed-off-by: Kai-Heng Feng <kai.heng.feng(a)canonical.com>
Acked-by: Alan Stern <stern(a)rowland.harvard.edu>
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/storage/unusual_realtek.h | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h
index d17cd95b55bb..6b2140f966ef 100644
--- a/drivers/usb/storage/unusual_realtek.h
+++ b/drivers/usb/storage/unusual_realtek.h
@@ -27,4 +27,14 @@ UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x9999,
"USB Card Reader",
USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+UNUSUAL_DEV(0x0bda, 0x0177, 0x0000, 0x9999,
+ "Realtek",
+ "USB Card Reader",
+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
+UNUSUAL_DEV(0x0bda, 0x0184, 0x0000, 0x9999,
+ "Realtek",
+ "USB Card Reader",
+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
#endif /* defined(CONFIG_USB_STORAGE_REALTEK) || ... */
--
2.19.2
On Sat, Nov 24, 2018 at 11:54 PM Sasha Levin <sashal(a)kernel.org> wrote:
>
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: cfe30b872058 libnvdimm, pmem: adjust for section collisions with 'System RAM'.
>
> The bot has tested the following trees: v4.19.4, v4.14.83, v4.9.140.
>
> v4.19.4: Build OK!
> v4.14.83: Build OK!
> v4.9.140: Failed to apply! Possible dependencies:
> Unable to calculate
>
>
> How should we proceed with this patch?
4.9-stable will need a manual backport since this code was refactored
in the intervening kernel releases.
The patch titled
Subject: lib/test_kmod.c: fix rmmod double free
has been added to the -mm tree. Its filename is
test_kmod-fix-rmmod-double-free.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/test_kmod-fix-rmmod-double-free.pa…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/test_kmod-fix-rmmod-double-free.pa…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Luis Chamberlain <mcgrof(a)kernel.org>
Subject: lib/test_kmod.c: fix rmmod double free
We free the misc device string twice on rmmod; fix this. Without this we
cannot remove the module without crashing.
Link: http://lkml.kernel.org/r/20181124050500.5257-1-mcgrof@kernel.org
Signed-off-by: Luis Chamberlain <mcgrof(a)kernel.org>
Reported-by: Randy Dunlap <rdunlap(a)infradead.org>
Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org>
Cc: <stable(a)vger.kernel.org> [4.12+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/lib/test_kmod.c~test_kmod-fix-rmmod-double-free
+++ a/lib/test_kmod.c
@@ -1214,7 +1214,6 @@ void unregister_test_dev_kmod(struct kmo
dev_info(test_dev->dev, "removing interface\n");
misc_deregister(&test_dev->misc_dev);
- kfree(&test_dev->misc_dev.name);
mutex_unlock(&test_dev->config_mutex);
mutex_unlock(&test_dev->trigger_mutex);
_
Patches currently in -mm which might be from mcgrof(a)kernel.org are
maintainers-update-name-change-for-myself.patch
test_kmod-fix-rmmod-double-free.patch
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From b082f2dd80612015cd6d9d84e52099734ec9a0e1 Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Date: Fri, 26 Oct 2018 15:28:56 +0300
Subject: [PATCH] x86/ldt: Remove unused variable in map_ldt_struct()
Splitting out the sanity check in map_ldt_struct() moved page table syncing
into a separate function, which made the pgd variable unused. Remove it.
[ tglx: Massaged changelog ]
Fixes: 9bae3197e15d ("x86/ldt: Split out sanity check in map_ldt_struct()")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Reviewed-by: Andy Lutomirski <luto(a)kernel.org>
Cc: bp(a)alien8.de
Cc: hpa(a)zytor.com
Cc: dave.hansen(a)linux.intel.com
Cc: peterz(a)infradead.org
Cc: boris.ostrovsky(a)oracle.com
Cc: jgross(a)suse.com
Cc: bhe(a)redhat.com
Cc: willy(a)infradead.org
Cc: linux-mm(a)kvack.org
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20181026122856.66224-4-kirill.shutemov@linux.inte…
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index 18e4525c5933..6135ae8ce036 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -207,7 +207,6 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
bool is_vmalloc;
spinlock_t *ptl;
int i, nr_pages;
- pgd_t *pgd;
if (!static_cpu_has(X86_FEATURE_PTI))
return 0;
@@ -221,13 +220,6 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
/* Check if the current mappings are sane */
sanity_check_ldt_mapping(mm);
- /*
- * Did we already have the top level entry allocated? We can't
- * use pgd_none() for this because it doens't do anything on
- * 4-level page table kernels.
- */
- pgd = pgd_offset(mm, LDT_BASE_ADDR);
-
is_vmalloc = is_vmalloc_addr(ldt->entries);
nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From a0e6e0831c516860fc7f9be1db6c081fe902ebcf Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Date: Fri, 26 Oct 2018 15:28:55 +0300
Subject: [PATCH] x86/ldt: Unmap PTEs for the slot before freeing LDT pages
modify_ldt(2) leaves the old LDT mapped after switching over to the new
one. The old LDT gets freed and the pages can be re-used.
Leaving the mapping in place can have security implications. The mapping is
present in the userspace page tables and Meltdown-like attacks can read
these freed and possibly reused pages.
It's relatively simple to fix: unmap the old LDT and flush TLB before
freeing the old LDT memory.
This further allows to avoid flushing the TLB in map_ldt_struct() as the
slot is unmapped and flushed by unmap_ldt_struct() or has never been mapped
at all.
[ tglx: Massaged changelog and removed the needless line breaks ]
Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: bp(a)alien8.de
Cc: hpa(a)zytor.com
Cc: dave.hansen(a)linux.intel.com
Cc: luto(a)kernel.org
Cc: peterz(a)infradead.org
Cc: boris.ostrovsky(a)oracle.com
Cc: jgross(a)suse.com
Cc: bhe(a)redhat.com
Cc: willy(a)infradead.org
Cc: linux-mm(a)kvack.org
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20181026122856.66224-3-kirill.shutemov@linux.inte…
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index ab18e0884dc6..18e4525c5933 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -199,14 +199,6 @@ static void sanity_check_ldt_mapping(struct mm_struct *mm)
/*
* If PTI is enabled, this maps the LDT into the kernelmode and
* usermode tables for the given mm.
- *
- * There is no corresponding unmap function. Even if the LDT is freed, we
- * leave the PTEs around until the slot is reused or the mm is destroyed.
- * This is harmless: the LDT is always in ordinary memory, and no one will
- * access the freed slot.
- *
- * If we wanted to unmap freed LDTs, we'd also need to do a flush to make
- * it useful, and the flush would slow down modify_ldt().
*/
static int
map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
@@ -214,8 +206,8 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
unsigned long va;
bool is_vmalloc;
spinlock_t *ptl;
+ int i, nr_pages;
pgd_t *pgd;
- int i;
if (!static_cpu_has(X86_FEATURE_PTI))
return 0;
@@ -238,7 +230,9 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
is_vmalloc = is_vmalloc_addr(ldt->entries);
- for (i = 0; i * PAGE_SIZE < ldt->nr_entries * LDT_ENTRY_SIZE; i++) {
+ nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
+
+ for (i = 0; i < nr_pages; i++) {
unsigned long offset = i << PAGE_SHIFT;
const void *src = (char *)ldt->entries + offset;
unsigned long pfn;
@@ -272,13 +266,39 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
/* Propagate LDT mapping to the user page-table */
map_ldt_struct_to_user(mm);
- va = (unsigned long)ldt_slot_va(slot);
- flush_tlb_mm_range(mm, va, va + LDT_SLOT_STRIDE, PAGE_SHIFT, false);
-
ldt->slot = slot;
return 0;
}
+static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
+{
+ unsigned long va;
+ int i, nr_pages;
+
+ if (!ldt)
+ return;
+
+ /* LDT map/unmap is only required for PTI */
+ if (!static_cpu_has(X86_FEATURE_PTI))
+ return;
+
+ nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
+
+ for (i = 0; i < nr_pages; i++) {
+ unsigned long offset = i << PAGE_SHIFT;
+ spinlock_t *ptl;
+ pte_t *ptep;
+
+ va = (unsigned long)ldt_slot_va(ldt->slot) + offset;
+ ptep = get_locked_pte(mm, va, &ptl);
+ pte_clear(mm, va, ptep);
+ pte_unmap_unlock(ptep, ptl);
+ }
+
+ va = (unsigned long)ldt_slot_va(ldt->slot);
+ flush_tlb_mm_range(mm, va, va + nr_pages * PAGE_SIZE, PAGE_SHIFT, false);
+}
+
#else /* !CONFIG_PAGE_TABLE_ISOLATION */
static int
@@ -286,6 +306,10 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
{
return 0;
}
+
+static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
+{
+}
#endif /* CONFIG_PAGE_TABLE_ISOLATION */
static void free_ldt_pgtables(struct mm_struct *mm)
@@ -524,6 +548,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
}
install_ldt(mm, new_ldt);
+ unmap_ldt_struct(mm, old_ldt);
free_ldt_struct(old_ldt);
error = 0;
The patch below does not apply to the 4.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From a0e6e0831c516860fc7f9be1db6c081fe902ebcf Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Date: Fri, 26 Oct 2018 15:28:55 +0300
Subject: [PATCH] x86/ldt: Unmap PTEs for the slot before freeing LDT pages
modify_ldt(2) leaves the old LDT mapped after switching over to the new
one. The old LDT gets freed and the pages can be re-used.
Leaving the mapping in place can have security implications. The mapping is
present in the userspace page tables and Meltdown-like attacks can read
these freed and possibly reused pages.
It's relatively simple to fix: unmap the old LDT and flush TLB before
freeing the old LDT memory.
This further allows to avoid flushing the TLB in map_ldt_struct() as the
slot is unmapped and flushed by unmap_ldt_struct() or has never been mapped
at all.
[ tglx: Massaged changelog and removed the needless line breaks ]
Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: bp(a)alien8.de
Cc: hpa(a)zytor.com
Cc: dave.hansen(a)linux.intel.com
Cc: luto(a)kernel.org
Cc: peterz(a)infradead.org
Cc: boris.ostrovsky(a)oracle.com
Cc: jgross(a)suse.com
Cc: bhe(a)redhat.com
Cc: willy(a)infradead.org
Cc: linux-mm(a)kvack.org
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20181026122856.66224-3-kirill.shutemov@linux.inte…
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index ab18e0884dc6..18e4525c5933 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -199,14 +199,6 @@ static void sanity_check_ldt_mapping(struct mm_struct *mm)
/*
* If PTI is enabled, this maps the LDT into the kernelmode and
* usermode tables for the given mm.
- *
- * There is no corresponding unmap function. Even if the LDT is freed, we
- * leave the PTEs around until the slot is reused or the mm is destroyed.
- * This is harmless: the LDT is always in ordinary memory, and no one will
- * access the freed slot.
- *
- * If we wanted to unmap freed LDTs, we'd also need to do a flush to make
- * it useful, and the flush would slow down modify_ldt().
*/
static int
map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
@@ -214,8 +206,8 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
unsigned long va;
bool is_vmalloc;
spinlock_t *ptl;
+ int i, nr_pages;
pgd_t *pgd;
- int i;
if (!static_cpu_has(X86_FEATURE_PTI))
return 0;
@@ -238,7 +230,9 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
is_vmalloc = is_vmalloc_addr(ldt->entries);
- for (i = 0; i * PAGE_SIZE < ldt->nr_entries * LDT_ENTRY_SIZE; i++) {
+ nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
+
+ for (i = 0; i < nr_pages; i++) {
unsigned long offset = i << PAGE_SHIFT;
const void *src = (char *)ldt->entries + offset;
unsigned long pfn;
@@ -272,13 +266,39 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
/* Propagate LDT mapping to the user page-table */
map_ldt_struct_to_user(mm);
- va = (unsigned long)ldt_slot_va(slot);
- flush_tlb_mm_range(mm, va, va + LDT_SLOT_STRIDE, PAGE_SHIFT, false);
-
ldt->slot = slot;
return 0;
}
+static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
+{
+ unsigned long va;
+ int i, nr_pages;
+
+ if (!ldt)
+ return;
+
+ /* LDT map/unmap is only required for PTI */
+ if (!static_cpu_has(X86_FEATURE_PTI))
+ return;
+
+ nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
+
+ for (i = 0; i < nr_pages; i++) {
+ unsigned long offset = i << PAGE_SHIFT;
+ spinlock_t *ptl;
+ pte_t *ptep;
+
+ va = (unsigned long)ldt_slot_va(ldt->slot) + offset;
+ ptep = get_locked_pte(mm, va, &ptl);
+ pte_clear(mm, va, ptep);
+ pte_unmap_unlock(ptep, ptl);
+ }
+
+ va = (unsigned long)ldt_slot_va(ldt->slot);
+ flush_tlb_mm_range(mm, va, va + nr_pages * PAGE_SIZE, PAGE_SHIFT, false);
+}
+
#else /* !CONFIG_PAGE_TABLE_ISOLATION */
static int
@@ -286,6 +306,10 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
{
return 0;
}
+
+static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
+{
+}
#endif /* CONFIG_PAGE_TABLE_ISOLATION */
static void free_ldt_pgtables(struct mm_struct *mm)
@@ -524,6 +548,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
}
install_ldt(mm, new_ldt);
+ unmap_ldt_struct(mm, old_ldt);
free_ldt_struct(old_ldt);
error = 0;
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From a0e6e0831c516860fc7f9be1db6c081fe902ebcf Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com>
Date: Fri, 26 Oct 2018 15:28:55 +0300
Subject: [PATCH] x86/ldt: Unmap PTEs for the slot before freeing LDT pages
modify_ldt(2) leaves the old LDT mapped after switching over to the new
one. The old LDT gets freed and the pages can be re-used.
Leaving the mapping in place can have security implications. The mapping is
present in the userspace page tables and Meltdown-like attacks can read
these freed and possibly reused pages.
It's relatively simple to fix: unmap the old LDT and flush TLB before
freeing the old LDT memory.
This further allows to avoid flushing the TLB in map_ldt_struct() as the
slot is unmapped and flushed by unmap_ldt_struct() or has never been mapped
at all.
[ tglx: Massaged changelog and removed the needless line breaks ]
Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Cc: bp(a)alien8.de
Cc: hpa(a)zytor.com
Cc: dave.hansen(a)linux.intel.com
Cc: luto(a)kernel.org
Cc: peterz(a)infradead.org
Cc: boris.ostrovsky(a)oracle.com
Cc: jgross(a)suse.com
Cc: bhe(a)redhat.com
Cc: willy(a)infradead.org
Cc: linux-mm(a)kvack.org
Cc: stable(a)vger.kernel.org
Link: https://lkml.kernel.org/r/20181026122856.66224-3-kirill.shutemov@linux.inte…
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index ab18e0884dc6..18e4525c5933 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -199,14 +199,6 @@ static void sanity_check_ldt_mapping(struct mm_struct *mm)
/*
* If PTI is enabled, this maps the LDT into the kernelmode and
* usermode tables for the given mm.
- *
- * There is no corresponding unmap function. Even if the LDT is freed, we
- * leave the PTEs around until the slot is reused or the mm is destroyed.
- * This is harmless: the LDT is always in ordinary memory, and no one will
- * access the freed slot.
- *
- * If we wanted to unmap freed LDTs, we'd also need to do a flush to make
- * it useful, and the flush would slow down modify_ldt().
*/
static int
map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
@@ -214,8 +206,8 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
unsigned long va;
bool is_vmalloc;
spinlock_t *ptl;
+ int i, nr_pages;
pgd_t *pgd;
- int i;
if (!static_cpu_has(X86_FEATURE_PTI))
return 0;
@@ -238,7 +230,9 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
is_vmalloc = is_vmalloc_addr(ldt->entries);
- for (i = 0; i * PAGE_SIZE < ldt->nr_entries * LDT_ENTRY_SIZE; i++) {
+ nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
+
+ for (i = 0; i < nr_pages; i++) {
unsigned long offset = i << PAGE_SHIFT;
const void *src = (char *)ldt->entries + offset;
unsigned long pfn;
@@ -272,13 +266,39 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
/* Propagate LDT mapping to the user page-table */
map_ldt_struct_to_user(mm);
- va = (unsigned long)ldt_slot_va(slot);
- flush_tlb_mm_range(mm, va, va + LDT_SLOT_STRIDE, PAGE_SHIFT, false);
-
ldt->slot = slot;
return 0;
}
+static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
+{
+ unsigned long va;
+ int i, nr_pages;
+
+ if (!ldt)
+ return;
+
+ /* LDT map/unmap is only required for PTI */
+ if (!static_cpu_has(X86_FEATURE_PTI))
+ return;
+
+ nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
+
+ for (i = 0; i < nr_pages; i++) {
+ unsigned long offset = i << PAGE_SHIFT;
+ spinlock_t *ptl;
+ pte_t *ptep;
+
+ va = (unsigned long)ldt_slot_va(ldt->slot) + offset;
+ ptep = get_locked_pte(mm, va, &ptl);
+ pte_clear(mm, va, ptep);
+ pte_unmap_unlock(ptep, ptl);
+ }
+
+ va = (unsigned long)ldt_slot_va(ldt->slot);
+ flush_tlb_mm_range(mm, va, va + nr_pages * PAGE_SIZE, PAGE_SHIFT, false);
+}
+
#else /* !CONFIG_PAGE_TABLE_ISOLATION */
static int
@@ -286,6 +306,10 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
{
return 0;
}
+
+static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
+{
+}
#endif /* CONFIG_PAGE_TABLE_ISOLATION */
static void free_ldt_pgtables(struct mm_struct *mm)
@@ -524,6 +548,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
}
install_ldt(mm, new_ldt);
+ unmap_ldt_struct(mm, old_ldt);
free_ldt_struct(old_ldt);
error = 0;
patch is Reviewed-by: Karol Herbst <kherbst(a)redhat.com>
@Sasha: I think we can ignore this patch for those older kernels as
there is no mstm support to begin with inside Nouveau meaning you
wouldn't run into that issue.
On Sat, Nov 24, 2018 at 5:00 AM Sasha Levin <sashal(a)kernel.org> wrote:
>
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: all
>
> The bot has tested the following trees: v4.19.2, v4.18.19, v4.14.81, v4.9.137, v4.4.163, v3.18.125.
>
> v4.19.2: Build OK!
> v4.18.19: Build OK!
> v4.14.81: Failed to apply! Possible dependencies:
> Unable to calculate
>
> v4.9.137: Failed to apply! Possible dependencies:
> f479c0ba4a17 ("drm/nouveau/kms/nv50: initial support for DP 1.2 multi-stream")
>
> v4.4.163: Failed to apply! Possible dependencies:
> f479c0ba4a17 ("drm/nouveau/kms/nv50: initial support for DP 1.2 multi-stream")
>
> v3.18.125: Failed to apply! Possible dependencies:
> f479c0ba4a17 ("drm/nouveau/kms/nv50: initial support for DP 1.2 multi-stream")
>
>
> How should we proceed with this patch?
>
> --
> Thanks,
> Sasha
> _______________________________________________
> Nouveau mailing list
> Nouveau(a)lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/nouveau