Linux-stable-mirror

linux-stable-mirror@lists.linaro.org

300 participants
124137 discussions

[PATCH net] net/ipv4: defensive cipso option parsing

by Stefan Nuernberger

commit 40413955ee26 ("Cipso: cipso_v4_optptr enter infinite loop") fixed a possible infinite loop in the IP option parsing of CIPSO. The fix assumes that ip_options_compile filtered out all zero length options and that no other one-byte options beside IPOPT_END and IPOPT_NOOP exist. While this assumption currently holds true, add explicit checks for zero length and invalid length options to be safe for the future. Even though ip_options_compile should have validated the options, the introduction of new one-byte options can still confuse this code without the additional checks. Signed-off-by: Stefan Nuernberger <snu(a)amazon.com> Reviewed-by: David Woodhouse <dwmw(a)amazon.co.uk> Reviewed-by: Simon Veith <sveith(a)amazon.de> Cc: stable(a)vger.kernel.org --- net/ipv4/cipso_ipv4.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c index 82178cc69c96..f291b57b8474 100644 --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c @@ -1512,7 +1512,7 @@ static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def, * * Description: * Parse the packet's IP header looking for a CIPSO option. Returns a pointer - * to the start of the CIPSO option on success, NULL if one if not found. + * to the start of the CIPSO option on success, NULL if one is not found. * */ unsigned char *cipso_v4_optptr(const struct sk_buff *skb) @@ -1522,9 +1522,11 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb) int optlen; int taglen; - for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) { + for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 1; ) { switch (optptr[0]) { case IPOPT_CIPSO: + if (!optptr[1] || optptr[1] > optlen) + return NULL; return optptr; case IPOPT_END: return NULL; @@ -1534,6 +1536,10 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb) default: taglen = optptr[1]; } + + if (!taglen || taglen > optlen) + break; + optlen -= taglen; optptr += taglen; } -- 2.19.0

7 years, 3 months

[GIT PULL] commits for Linux 3.18

by Sasha Levin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Greg, Pleae pull commits for Linux 3.18 . I've sent a review request for all commits over a week ago and all comments were addressed. Thanks, Sasha ===== The following changes since commit a5f9be3576c3f9dd871f68eaf482278c0b3a6df2: Linux 3.18.120 (2018-08-28 07:21:37 +0200) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git tags/for-greg-3.18-17092018 for you to fetch changes up to 7058136ea11e4f5b2d0d65f6f6dbb714d2beec42: platform/x86: toshiba_acpi: Fix defined but not used build warnings (2018-09-04 13:44:36 -0400) - ---------------------------------------------------------------- for-greg-3.18-17092018 - ---------------------------------------------------------------- Andreas Gruenbacher (1): gfs2: Special-case rindex for gfs2_grow Anton Vasilyev (1): video: goldfishfb: fix memory leak on driver remove Bob Peterson (1): gfs2: Don't reject a supposedly full bitmap if we have blocks reserved Dan Carpenter (1): fbdev: omapfb: off by one in omapfb_register_client() Felix Fietkau (1): MIPS: ath79: fix system restart Fredrik Noring (1): fbdev: Distinguish between interlaced and progressive modes Julian Wiedmann (2): s390/qeth: fix race in used-buffer accounting s390/qeth: reset layer2 attribute on layer switch Lars-Peter Clausen (1): iio: ad9523: Fix displayed phase Manikanta Pubbisetty (1): mac80211: restrict delayed tailroom needed decrement Nicholas Piggin (1): powerpc/powernv: opal_put_chars partial write fix Randy Dunlap (3): mtd/maps: fix solutionengine.c printk format warnings fbdev/via: fix defined but not used warning platform/x86: toshiba_acpi: Fix defined but not used build warnings Sandipan Das (2): perf powerpc: Fix callchain ip filtering when return address is in a register perf powerpc: Fix callchain ip filtering Takashi Iwai (2): ALSA: msnd: Fix the default sample sizes ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro YueHaibing (1): xfrm: fix 'passing zero to ERR_PTR()' warning arch/mips/ath79/setup.c | 1 + arch/mips/include/asm/mach-ath79/ath79.h | 1 + arch/powerpc/platforms/powernv/opal.c | 2 +- drivers/iio/frequency/ad9523.c | 2 +- drivers/mtd/maps/solutionengine.c | 6 ++-- drivers/platform/x86/toshiba_acpi.c | 3 +- drivers/s390/net/qeth_core_main.c | 3 +- drivers/s390/net/qeth_core_sys.c | 1 + drivers/video/fbdev/core/modedb.c | 41 +++++++++++++++++------ drivers/video/fbdev/goldfishfb.c | 1 + drivers/video/fbdev/omap/omapfb_main.c | 2 +- drivers/video/fbdev/via/viafbdev.c | 3 +- fs/gfs2/bmap.c | 2 +- fs/gfs2/rgrp.c | 3 +- net/mac80211/cfg.c | 2 +- net/mac80211/key.c | 24 ++++++++----- net/xfrm/xfrm_policy.c | 5 ++- sound/isa/msnd/msnd_pinnacle.c | 4 +-- sound/usb/quirks-table.h | 3 +- tools/perf/arch/powerpc/util/skip-callchain-idx.c | 10 ++++-- 20 files changed, 80 insertions(+), 39 deletions(-) -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAlugPO8ACgkQ3qZv95d3 LNygexAAvz2wzEaH/mDTnQ0085ODaIA6wmr/U7dlzXjoE1vPko4EOg0y8GJPmRD0 DsFkX7fqCLoLT/LQcCMK+KKq5IsPNPDs35tOvCc1T0WofnIE1KVifz4zalmW3upc gT1HjZaza+agnw5QDs9RI0Y/y5vfR9Pwpmfi1e9V8vsNX8iR7i3YMI3HwS8g2Ggq gjVOlH2UyiyJpqruV1B6tRwZA+KE3RNmj7xIXwvRVd29MLI0CMs/mSOo57TvGvxp Wcn0IA0TK6T0LvNqgXNv+vjJhohfIN1TzhGiH0oEMiZVkRoHs1wqmkVQdkRPBApV GXMGvb1suh1NE8IRl4OP/z27zZoUBr+ksoLgFD+o6tzgiBp0zR+gPV87PVzPLN32 PKyru9V0LOrF3nnCS9k6iMboFUS/vWrctrxRIdd2oUPkljPwkzxx8jz6HUNJ606B 6vPeNMBdxH1Vqiptt29Qn6c9Lg35OkOi+6JMS0WWkTPCArvHBPKOodf/4DIslm4O 2ewBiq8ewmhfUTAxxQfk+xR0+YR6d4g82Q3PvZ4jyDsSosQWnThAwLjketoTRBmc BRcZKrqFvIMpVky0I2sl9U3ZFzlWWr2Z4PEKxu98o0AhUDCctzBHvXwL45c+7K0k CQEs5a76ecC99mAf5AjtrbAcnTjKx9R6Y1RJ8XS9gCjT5/CMA7M= =gANE -----END PGP SIGNATURE-----

7 years, 3 months

[GIT PULL] commits for Linux 4.4

by Sasha Levin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Greg, Pleae pull commits for Linux 4.4 . I've sent a review request for all commits over a week ago and all comments were addressed. Thanks, Sasha ===== The following changes since commit c40a7b3592b3b7519eadc130c5583db2aaf70f68: Linux 4.4.156 (2018-09-15 09:40:42 +0200) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git tags/for-greg-4.4-17092018 for you to fetch changes up to 86d8d800d31c13b8c14a5a18da2ec8715da5fe0a: xen-netfront: fix warn message as irq device name has '/' (2018-09-15 10:24:32 -0400) - ---------------------------------------------------------------- for-greg-4.4-17092018 - ---------------------------------------------------------------- Andreas Gruenbacher (1): gfs2: Special-case rindex for gfs2_grow Anton Vasilyev (1): video: goldfishfb: fix memory leak on driver remove Bob Peterson (1): gfs2: Don't reject a supposedly full bitmap if we have blocks reserved Dan Carpenter (1): fbdev: omapfb: off by one in omapfb_register_client() Felix Fietkau (1): MIPS: ath79: fix system restart Fredrik Noring (1): fbdev: Distinguish between interlaced and progressive modes Hans Verkuil (1): media: videobuf2-core: check for q->error in vb2_core_qbuf() John Keeping (1): dmaengine: pl330: fix irq race with terminate_all Julian Wiedmann (2): s390/qeth: fix race in used-buffer accounting s390/qeth: reset layer2 attribute on layer switch Krzysztof Kozlowski (1): ARM: exynos: Clear global variable on init error path Loic Poulain (1): arm64: dts: qcom: db410c: Fix Bluetooth LED trigger Manikanta Pubbisetty (1): mac80211: restrict delayed tailroom needed decrement Masahiro Yamada (1): kbuild: add .DELETE_ON_ERROR special target Miao Zhong (1): iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register Michael MÃ¼ller (1): crypto: sharah - Unregister correct algorithms for SAHARA 3 Nicholas Mc Guire (1): clk: imx6ul: fix missing of_node_put() Nicholas Piggin (1): powerpc/powernv: opal_put_chars partial write fix Paul Cercueil (1): MIPS: jz4740: Bump zload address Randy Dunlap (3): mtd/maps: fix solutionengine.c printk format warnings fbdev/via: fix defined but not used warning platform/x86: toshiba_acpi: Fix defined but not used build warnings Sandipan Das (2): perf powerpc: Fix callchain ip filtering when return address is in a register perf powerpc: Fix callchain ip filtering Takashi Iwai (2): ALSA: msnd: Fix the default sample sizes ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro Vitaly Kuznetsov (1): xen-netfront: fix queue name setting Xiao Liang (1): xen-netfront: fix warn message as irq device name has '/' YueHaibing (1): xfrm: fix 'passing zero to ERR_PTR()' warning arch/arm/mach-exynos/suspend.c | 1 + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 +- arch/mips/ath79/setup.c | 1 + arch/mips/include/asm/mach-ath79/ath79.h | 1 + arch/mips/jz4740/Platform | 2 +- arch/powerpc/platforms/powernv/opal.c | 2 +- drivers/clk/imx/clk-imx6ul.c | 1 + drivers/crypto/sahara.c | 4 +-- drivers/dma/pl330.c | 5 +-- drivers/iommu/arm-smmu-v3.c | 1 + drivers/media/v4l2-core/videobuf2-core.c | 5 +++ drivers/mtd/maps/solutionengine.c | 6 ++-- drivers/net/xen-netfront.c | 6 ++-- drivers/platform/x86/toshiba_acpi.c | 3 +- drivers/s390/net/qeth_core_main.c | 3 +- drivers/s390/net/qeth_core_sys.c | 1 + drivers/video/fbdev/core/modedb.c | 41 +++++++++++++++++------ drivers/video/fbdev/goldfishfb.c | 1 + drivers/video/fbdev/omap/omapfb_main.c | 2 +- drivers/video/fbdev/via/viafbdev.c | 3 +- fs/gfs2/bmap.c | 2 +- fs/gfs2/rgrp.c | 3 +- net/mac80211/cfg.c | 2 +- net/mac80211/key.c | 24 ++++++++----- net/xfrm/xfrm_policy.c | 5 ++- scripts/Kbuild.include | 3 ++ sound/isa/msnd/msnd_pinnacle.c | 4 +-- sound/usb/quirks-table.h | 3 +- tools/perf/arch/powerpc/util/skip-callchain-idx.c | 10 ++++-- 29 files changed, 101 insertions(+), 46 deletions(-) -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAlugPOcACgkQ3qZv95d3 LNxQzhAAl454mfpZ6ZQIy0kRvfw9BZrlBF0yIZYS/QQ1cBJ7+j8sOdS1s/dtJkRK zpEvSImx6aUgKiuXrJUt6EJbWTUkLeZnfqoRkWe543T6oMgPJGXObmafkF3GlT1A d0AY17gdH2CB5IlovnrgyuUkMCNaB3Kv2yimo9fWVaIU4wuAfFt7HKHHWE/SQX2L SUiajdhGvWwBLcry7FefV/fU8Ug2sBSHoucxEkkb64SYl2jwC3lNB5U0upJkiCOe jtT7o0JQ3v3SzJLN2fRsYb64aVqLjp3OpQg4RODOO7f5NAzbyOATqtjQTxDUJ6wa wGiD+BjIWrd99oiWC/nIAgZS8adAtiRJ/NOgH/kR8OR3BgP7Wk4M6Zqej6YxXEw3 pid6/ZMiYIymj+YVqwQt0W0p8L2RwMK4R0eoDeZD1aeJTvkEJPmWov80B2nBdu2I XyB2A/Jay7+M3jnDZPVMjGVAh1ukGNglpsYgi7tkzxmSCS9oz10lgt1i5N9DXPBG WLlbCyPwof9JJLpiT1mlqx6PZYPy3XfUyq+bAFOpAEzdqv69lT3gtY5krz1iydIJ C+y1n8vFwmsVbrBACMIYFAbwxsH2kdwComA/nQKf9g1urMZGNrMgKO4qoZR5o9zX dZG26OrKCwbHAfV1aAvcQrH27Jc9VFEXYG31iShh+tdbymIWzgU= =/dVc -----END PGP SIGNATURE-----

7 years, 3 months

[GIT PULL] commits for Linux 4.9

by Sasha Levin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Greg, Pleae pull commits for Linux 4.9 . I've sent a review request for all commits over a week ago and all comments were addressed. Thanks, Sasha ===== The following changes since commit 927556eb3a72306db1ba5ab8b9bb9914433302ba: Linux 4.9.127 (2018-09-15 09:43:07 +0200) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git tags/for-greg-4.9-17092018 for you to fetch changes up to bb180cbca65d450c5bd1b0e10995ef5eb56ff1e1: xen-netfront: fix warn message as irq device name has '/' (2018-09-15 10:24:21 -0400) - ---------------------------------------------------------------- for-greg-4.9-17092018 - ---------------------------------------------------------------- Andreas Gruenbacher (1): gfs2: Special-case rindex for gfs2_grow Anton Vasilyev (1): video: goldfishfb: fix memory leak on driver remove Ard Biesheuvel (1): efi/arm: preserve early mapping of UEFI memory map longer for BGRT Bhushan Shah (1): ARM: dts: qcom: msm8974-hammerhead: increase load on l20 for sdhci Bob Peterson (1): gfs2: Don't reject a supposedly full bitmap if we have blocks reserved Christoffer Dall (1): KVM: arm/arm64: Fix vgic init race Dan Carpenter (1): fbdev: omapfb: off by one in omapfb_register_client() Daniel Mack (1): video: fbdev: pxafb: clear allocated memory for video modes Felix Fietkau (1): MIPS: ath79: fix system restart Fredrik Noring (1): fbdev: Distinguish between interlaced and progressive modes Hanna Hawa (1): dmaengine: mv_xor_v2: kill the tasklets upon exit Hans Verkuil (1): media: videobuf2-core: check for q->error in vb2_core_qbuf() Jakub Kicinski (1): nfp: avoid buffer leak when FW communication fails John Keeping (1): dmaengine: pl330: fix irq race with terminate_all Julian Wiedmann (2): s390/qeth: fix race in used-buffer accounting s390/qeth: reset layer2 attribute on layer switch Krzysztof Ha?asa (1): media: tw686x: Fix oops on buffer alloc failure Krzysztof Kozlowski (1): ARM: exynos: Clear global variable on init error path Loic Poulain (1): arm64: dts: qcom: db410c: Fix Bluetooth LED trigger Manikanta Pubbisetty (1): mac80211: restrict delayed tailroom needed decrement Masahiro Yamada (1): kbuild: add .DELETE_ON_ERROR special target Miao Zhong (1): iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register Michael MÃ¼ller (1): crypto: sharah - Unregister correct algorithms for SAHARA 3 Nicholas Mc Guire (1): clk: imx6ul: fix missing of_node_put() Nicholas Piggin (1): powerpc/powernv: opal_put_chars partial write fix Paul Cercueil (1): MIPS: jz4740: Bump zload address Pingfan Liu (1): drivers/base: stop new probing during shutdown Piotr Sawicki (1): Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets Rajan Vaja (1): clk: clk-fixed-factor: Clear OF_POPULATED flag in case of failure Randy Dunlap (3): mtd/maps: fix solutionengine.c printk format warnings fbdev/via: fix defined but not used warning platform/x86: toshiba_acpi: Fix defined but not used build warnings Sandipan Das (2): perf powerpc: Fix callchain ip filtering when return address is in a register perf powerpc: Fix callchain ip filtering Takashi Iwai (2): ALSA: msnd: Fix the default sample sizes ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro Thomas Richter (1): perf test: Fix subtest number when showing results Vitaly Kuznetsov (1): xen-netfront: fix queue name setting Xiao Liang (1): xen-netfront: fix warn message as irq device name has '/' YueHaibing (2): xfrm: fix 'passing zero to ERR_PTR()' warning wan/fsl_ucc_hdlc: use IS_ERR_VALUE() to check return value of qe_muram_alloc Zhu Yanjun (1): IB/rxe: Drop QP0 silently .../dts/qcom-msm8974-lge-nexus5-hammerhead.dts | 2 ++ arch/arm/mach-exynos/suspend.c | 1 + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 +- arch/mips/ath79/setup.c | 1 + arch/mips/include/asm/mach-ath79/ath79.h | 1 + arch/mips/jz4740/Platform | 2 +- arch/powerpc/platforms/powernv/opal.c | 2 +- drivers/base/core.c | 3 ++ drivers/clk/clk-fixed-factor.c | 9 ++++- drivers/clk/imx/clk-imx6ul.c | 1 + drivers/crypto/sahara.c | 4 +-- drivers/dma/mv_xor_v2.c | 2 ++ drivers/dma/pl330.c | 5 +-- drivers/firmware/efi/arm-init.c | 1 - drivers/firmware/efi/arm-runtime.c | 4 ++- drivers/infiniband/sw/rxe/rxe_recv.c | 9 +++-- drivers/iommu/arm-smmu-v3.c | 1 + drivers/media/pci/tw686x/tw686x-video.c | 11 ++++-- drivers/media/v4l2-core/videobuf2-core.c | 5 +++ drivers/mtd/maps/solutionengine.c | 6 ++-- .../net/ethernet/netronome/nfp/nfp_net_common.c | 13 +++++-- drivers/net/wan/fsl_ucc_hdlc.c | 6 ++-- drivers/net/xen-netfront.c | 6 ++-- drivers/platform/x86/toshiba_acpi.c | 3 +- drivers/s390/net/qeth_core_main.c | 3 +- drivers/s390/net/qeth_core_sys.c | 1 + drivers/video/fbdev/core/modedb.c | 41 ++++++++++++++++------ drivers/video/fbdev/goldfishfb.c | 1 + drivers/video/fbdev/omap/omapfb_main.c | 2 +- drivers/video/fbdev/pxafb.c | 4 +-- drivers/video/fbdev/via/viafbdev.c | 3 +- fs/gfs2/bmap.c | 2 +- fs/gfs2/rgrp.c | 3 +- net/mac80211/cfg.c | 2 +- net/mac80211/key.c | 24 ++++++++----- net/xfrm/xfrm_policy.c | 5 ++- scripts/Kbuild.include | 3 ++ security/smack/smack_lsm.c | 14 +++++--- sound/isa/msnd/msnd_pinnacle.c | 4 +-- sound/usb/quirks-table.h | 3 +- tools/perf/arch/powerpc/util/skip-callchain-idx.c | 10 ++++-- tools/perf/tests/builtin-test.c | 2 +- virt/kvm/arm/vgic/vgic-init.c | 4 +++ 43 files changed, 163 insertions(+), 68 deletions(-) -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAlugPOAACgkQ3qZv95d3 LNyTIxAAicYE/fiFKVcZc37qZPFV4MPSVH5J4aXbObvIy85IzJUSJ/hnwoymvYX+ 8fS+a3ctAC/lpMlSjxz+TtcIyMscEWEQcOZSFQPST+RycohywsADCZhweYFlw04m D88nGiffYRBU151TyORd0mXaklN1rMqx/5wWgRBAi9c5p9h9gx+DpJaXQGTD2/6C qL4q8UM92rNs8UnIEG3A2z6M5PlVgEaPkQzHrjfUUNLlHIwXYAtSJ7AT5WQdzO7+ l2V+9/EyGlLWQY9Rm3/QIVxWJv2b106K8uA/q8olt1pqlwsGZX8yMWwHWzwQMK9v lU9ri5ZbgEYjNvUbE8y7nhRtajSa/AJuY8P+Ytk/iFtryo809Y/JUss03eu6KU75 hgTB7cBeB7Fb4ircFQ9MVmeccmLmXemvuH87YFUNNlaZBwOJWf/0MqGLFtJ5s4c3 ie9aW9jw96xbWB9SJDKT6dpnCBibus43TYF4bniRsMWpSnNbRYCDruRzQCzj5qnW 2ew1noQpr2st0fJtJEcQgjd/gMbVmQEkUOxdnTGL3y3dSDppHWBGDVzbkudTkwCg Y1hfFJTpf9dYeTN4vrNPm2GYAIBINjW0m38b5PpM/NH9cOnC8jq9ogG+8OGTvqAz V01J8xPOPXWX/kunc5rFYxRN+MhF1k64iT7W4DhUW3999BHJ410= =csQ/ -----END PGP SIGNATURE-----

7 years, 3 months

[GIT PULL] commits for Linux 4.14

by Sasha Levin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Greg, Pleae pull commits for Linux 4.14 . I've sent a review request for all commits over a week ago and all comments were addressed. Thanks, Sasha ===== The following changes since commit 5dfe87ac34e2326ae2957fc68b63212d84f78701: Linux 4.14.70 (2018-09-15 09:45:37 +0200) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git tags/for-greg-4.14-17092018 for you to fetch changes up to 64190d73856692f63af6becf8787c94a2df34432: xen-netfront: fix warn message as irq device name has '/' (2018-09-15 10:22:53 -0400) - ---------------------------------------------------------------- for-greg-4.14-17092018 - ---------------------------------------------------------------- Andreas Gruenbacher (1): gfs2: Special-case rindex for gfs2_grow Anton Vasilyev (1): video: goldfishfb: fix memory leak on driver remove Ard Biesheuvel (1): efi/arm: preserve early mapping of UEFI memory map longer for BGRT Bhushan Shah (1): ARM: dts: qcom: msm8974-hammerhead: increase load on l20 for sdhci Bob Peterson (1): gfs2: Don't reject a supposedly full bitmap if we have blocks reserved Christoffer Dall (1): KVM: arm/arm64: Fix vgic init race Dan Carpenter (1): fbdev: omapfb: off by one in omapfb_register_client() Daniel Mack (1): video: fbdev: pxafb: clear allocated memory for video modes Erich E. Hoover (1): usb: dwc3: change stream event enable bit back to 13 Felix Fietkau (1): MIPS: ath79: fix system restart Fredrik Noring (1): fbdev: Distinguish between interlaced and progressive modes Hanna Hawa (1): dmaengine: mv_xor_v2: kill the tasklets upon exit Hans Verkuil (1): media: videobuf2-core: check for q->error in vb2_core_qbuf() Jae Hyun Yoo (1): i2c: aspeed: Fix initial values of master and slave state Jakub Kicinski (1): nfp: avoid buffer leak when FW communication fails Jean-Philippe Brucker (1): iommu/io-pgtable-arm-v7s: Abort allocation when table address overflows the PTE Jiang Biao (2): x86/pti: Check the return value of pti_user_pagetable_walk_p4d() x86/pti: Check the return value of pti_user_pagetable_walk_pmd() Jiri Olsa (2): perf tools: Synthesize GROUP_DESC feature in pipe mode perf tools: Fix struct comm_str removal crash Joerg Roedel (1): x86/mm/pti: Add an overflow check to pti_clone_pmds() John Keeping (1): dmaengine: pl330: fix irq race with terminate_all Julian Wiedmann (2): s390/qeth: fix race in used-buffer accounting s390/qeth: reset layer2 attribute on layer switch Krzysztof Ha?asa (1): media: tw686x: Fix oops on buffer alloc failure Krzysztof Kozlowski (1): ARM: exynos: Clear global variable on init error path Leonard Crestez (1): reset: imx7: Fix always writing bits as 0 Loic Poulain (1): arm64: dts: qcom: db410c: Fix Bluetooth LED trigger Manikanta Pubbisetty (1): mac80211: restrict delayed tailroom needed decrement Mark Rutland (2): KVM: arm/arm64: vgic: Fix possible spectre-v1 write in vgic_mmio_write_apr() arm64: fix possible spectre-v1 write in ptrace_hbp_set_event() Masahiro Yamada (1): kbuild: add .DELETE_ON_ERROR special target Miao Zhong (1): iommu/arm-smmu-v3: sync the OVACKFLG to PRIQ consumer register Michael MÃ¼ller (1): crypto: sharah - Unregister correct algorithms for SAHARA 3 Mike Snitzer (1): block: allow max_discard_segments to be stacked Mikko Perttunen (1): clk: core: Potentially free connection id Nicholas Mc Guire (3): clk: imx6ul: fix missing of_node_put() staging: bcm2835-camera: fix timeout handling in wait_for_completion_timeout staging: bcm2835-camera: handle wait_for_completion_timeout return properly Nicholas Piggin (1): powerpc/powernv: opal_put_chars partial write fix Oder Chiou (1): ASoC: rt5514: Fix the issue of the delay volume applied Paul Cercueil (1): MIPS: jz4740: Bump zload address Pingfan Liu (1): drivers/base: stop new probing during shutdown Piotr Sawicki (1): Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets Rajan Vaja (1): clk: clk-fixed-factor: Clear OF_POPULATED flag in case of failure Randy Dunlap (3): mtd/maps: fix solutionengine.c printk format warnings fbdev/via: fix defined but not used warning platform/x86: toshiba_acpi: Fix defined but not used build warnings Sagi Grimberg (1): nvme-rdma: unquiesce queues when deleting the controller Sandipan Das (2): perf powerpc: Fix callchain ip filtering when return address is in a register perf powerpc: Fix callchain ip filtering Takashi Iwai (3): ALSA: pcm: Add __force to cast in snd_pcm_lib_read/write() ALSA: msnd: Fix the default sample sizes ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro Thomas Richter (1): perf test: Fix subtest number when showing results Todor Tomov (1): media: ov5645: Supported external clock is 24MHz Vitaly Kuznetsov (1): xen-netfront: fix queue name setting Wei Yongjun (1): IB/ipoib: Fix error return code in ipoib_dev_init() Xiao Liang (1): xen-netfront: fix warn message as irq device name has '/' YueHaibing (3): xfrm: fix 'passing zero to ERR_PTR()' warning amd-xgbe: use dma_mapping_error to check map errors wan/fsl_ucc_hdlc: use IS_ERR_VALUE() to check return value of qe_muram_alloc Zhu Yanjun (1): IB/rxe: Drop QP0 silently .../dts/qcom-msm8974-lge-nexus5-hammerhead.dts | 2 ++ arch/arm/mach-exynos/suspend.c | 1 + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 +- arch/arm64/kernel/ptrace.c | 19 +++++----- arch/mips/ath79/setup.c | 1 + arch/mips/include/asm/mach-ath79/ath79.h | 1 + arch/mips/jz4740/Platform | 2 +- arch/powerpc/platforms/powernv/opal.c | 2 +- arch/x86/mm/pti.c | 25 ++++++++++--- block/blk-settings.c | 2 +- drivers/base/core.c | 3 ++ drivers/clk/clk-fixed-factor.c | 9 ++++- drivers/clk/clk.c | 3 ++ drivers/clk/imx/clk-imx6ul.c | 1 + drivers/crypto/sahara.c | 4 +-- drivers/dma/mv_xor_v2.c | 2 ++ drivers/dma/pl330.c | 5 +-- drivers/firmware/efi/arm-init.c | 1 - drivers/firmware/efi/arm-runtime.c | 4 ++- drivers/i2c/busses/i2c-aspeed.c | 4 +-- drivers/infiniband/sw/rxe/rxe_recv.c | 9 +++-- drivers/infiniband/ulp/ipoib/ipoib_main.c | 3 +- drivers/iommu/arm-smmu-v3.c | 1 + drivers/iommu/io-pgtable-arm-v7s.c | 7 +++- drivers/media/i2c/ov5645.c | 13 +++---- drivers/media/pci/tw686x/tw686x-video.c | 11 ++++-- drivers/media/v4l2-core/videobuf2-core.c | 5 +++ drivers/mtd/maps/solutionengine.c | 6 ++-- drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 7 ++-- .../net/ethernet/netronome/nfp/nfp_net_common.c | 13 +++++-- drivers/net/wan/fsl_ucc_hdlc.c | 6 ++-- drivers/net/xen-netfront.c | 6 ++-- drivers/nvme/host/rdma.c | 2 ++ drivers/platform/x86/toshiba_acpi.c | 3 +- drivers/reset/reset-imx7.c | 2 +- drivers/s390/net/qeth_core_main.c | 3 +- drivers/s390/net/qeth_core_sys.c | 1 + .../vc04_services/bcm2835-camera/bcm2835-camera.c | 7 ++-- .../vc04_services/bcm2835-camera/mmal-vchiq.c | 11 +++--- drivers/usb/dwc3/gadget.h | 2 +- drivers/video/fbdev/core/modedb.c | 41 ++++++++++++++++------ drivers/video/fbdev/goldfishfb.c | 1 + drivers/video/fbdev/omap/omapfb_main.c | 2 +- drivers/video/fbdev/pxafb.c | 4 +-- drivers/video/fbdev/via/viafbdev.c | 3 +- fs/gfs2/bmap.c | 2 +- fs/gfs2/rgrp.c | 3 +- include/sound/pcm.h | 4 +-- net/mac80211/cfg.c | 2 +- net/mac80211/key.c | 24 ++++++++----- net/xfrm/xfrm_policy.c | 5 ++- scripts/Kbuild.include | 3 ++ security/smack/smack_lsm.c | 14 +++++--- sound/isa/msnd/msnd_pinnacle.c | 4 +-- sound/soc/codecs/rt5514.c | 8 ++--- sound/usb/quirks-table.h | 3 +- tools/perf/arch/powerpc/util/skip-callchain-idx.c | 10 ++++-- tools/perf/tests/builtin-test.c | 2 +- tools/perf/util/comm.c | 16 ++++++--- tools/perf/util/header.c | 2 +- virt/kvm/arm/vgic/vgic-init.c | 4 +++ virt/kvm/arm/vgic/vgic-mmio-v2.c | 3 ++ 62 files changed, 253 insertions(+), 118 deletions(-) -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAlugPNMACgkQ3qZv95d3 LNzARxAAvjj18hSYWqS/PbHjOFUtAuZmEwNQPvj0oVaLLfLAFKs362ZYILvN5oV+ 4MfDuDoWhGQ8qF4yXlLg2yqTtUX9geKf92m6rr11tily7VA1BbYBtk+j4gk7IKP6 1EMZ/hOm7jAn2AyCgWsQPgSmUR544peOCdHaUg/Qmi2JjAzMGEG9iclaWcgq79Y9 qjZjNdJGQh7OtSqQfsA3nfnG2zNLjU6u2q5BXxtVDB4bPkk8exU+oUNBw5Izb7ww hWsNSQFjas/ulzh8prM0gNyqPn5iGWqzmdyW5VAoxsDy0KSfw8CT9KUzk81Gz/DO OZBIGjodzkfqsQ8UgBZPd9DDJfnyGIPuNUHsk5kNaEZiSBdt+iZKVbY6BkuVU5Qa E0Af4x6vBkOEO9ofpIwQSbpjm3IwpHuM0sBnzU8TDa7vpYoaxqUSXx0C8nm/0nZ4 EzFw+BTUn3T1Zo8zsnBBXDlnHa+fx/RpUeMCuPrHrAL/ZrJltkrVRzmPbpfnBWqT elX23+RZTG3BDTcbgXuB5na2BnppXZyG6L3aoY+68kk9fyACe5CD+6a320N9dueM kxWgQ9n2byKiiofS7quip7hMcRKVnqvFdiBXTd+zZEcpE2uPue8NQ04BAzrp+DKH p3/R5SDjCFTiqJCtB/W6RdkYFZGZK9yTsDKNdjEHq1DlyzyV+t4= =KTqg -----END PGP SIGNATURE-----

7 years, 3 months

+ mm-thp-fix-mlocking-thp-page-with-migration-enabled.patch added to -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: mm, thp: fix mlocking THP page with migration enabled has been added to the -mm tree. Its filename is mm-thp-fix-mlocking-thp-page-with-migration-enabled.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-thp-fix-mlocking-thp-page-with-… and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-thp-fix-mlocking-thp-page-with-… Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> Subject: mm, thp: fix mlocking THP page with migration enabled A transparent huge page is represented by a single entry on an LRU list. Therefore, we can only make unevictable an entire compound page, not individual subpages. If a user tries to mlock() part of a huge page, we want the rest of the page to be reclaimable. We handle this by keeping PTE-mapped huge pages on normal LRU lists: the PMD on border of VM_LOCKED VMA will be split into PTE table. Introduction of THP migration breaks[1] the rules around mlocking THP pages. If we had a single PMD mapping of the page in mlocked VMA, the page will get mlocked, regardless of PTE mappings of the page. For tmpfs/shmem it's easy to fix by checking PageDoubleMap() in remove_migration_pmd(). Anon THP pages can only be shared between processes via fork(). Mlocked page can only be shared if parent mlocked it before forking, otherwise CoW will be triggered on mlock(). For Anon-THP, we can fix the issue by munlocking the page on removing PTE migration entry for the page. PTEs for the page will always come after mlocked PMD: rmap walks VMAs from oldest to newest. Test-case: #include <unistd.h> #include <sys/mman.h> #include <sys/wait.h> #include <linux/mempolicy.h> #include <numaif.h> int main(void) { unsigned long nodemask = 4; void *addr; addr = mmap((void *)0x20000000UL, 2UL << 20, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_LOCKED, -1, 0); if (fork()) { wait(NULL); return 0; } mlock(addr, 4UL << 10); mbind(addr, 2UL << 20, MPOL_PREFERRED | MPOL_F_RELATIVE_NODES, &nodemask, 4, MPOL_MF_MOVE); return 0; } [1] https://lkml.kernel.org/r/CAOMGZ=G52R-30rZvhGxEbkTw7rLLwBGadVYeo--iizcD3upL… Link: http://lkml.kernel.org/r/20180917133816.43995-1-kirill.shutemov@linux.intel… Fixes: 616b8371539a ("mm: thp: enable thp migration in generic path") Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Reported-by: Vegard Nossum <vegard.nossum(a)oracle.com> Reviewed-by: Zi Yan <zi.yan(a)cs.rutgers.edu> Cc: Naoya Horiguchi <n-horiguchi(a)ah.jp.nec.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: <stable(a)vger.kernel.org> [4.14+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/huge_memory.c | 2 +- mm/migrate.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) --- a/mm/huge_memory.c~mm-thp-fix-mlocking-thp-page-with-migration-enabled +++ a/mm/huge_memory.c @@ -2931,7 +2931,7 @@ void remove_migration_pmd(struct page_vm else page_add_file_rmap(new, true); set_pmd_at(mm, mmun_start, pvmw->pmd, pmde); - if (vma->vm_flags & VM_LOCKED) + if ((vma->vm_flags & VM_LOCKED) && !PageDoubleMap(new)) mlock_vma_page(new); update_mmu_cache_pmd(vma, address, pvmw->pmd); } --- a/mm/migrate.c~mm-thp-fix-mlocking-thp-page-with-migration-enabled +++ a/mm/migrate.c @@ -275,6 +275,9 @@ static bool remove_migration_pte(struct if (vma->vm_flags & VM_LOCKED && !PageTransCompound(new)) mlock_vma_page(new); + if (PageTransHuge(page) && PageMlocked(page)) + clear_page_mlock(page); + /* No need to invalidate - it was non-present before */ update_mmu_cache(vma, pvmw.address, pvmw.pte); } _ Patches currently in -mm which might be from kirill.shutemov(a)linux.intel.com are mm-thp-fix-mlocking-thp-page-with-migration-enabled.patch

7 years, 3 months

+ mm-thp-fix-mlocking-thp-page-with-migration-enabled.patch added to -mm tree

by akpm＠linux-foundation.org

7 years, 3 months

[PATCH 13/17] target/core: Avoid that LUN reset sporadically triggers data corruption

by Bart Van Assche

If on an initiator system a LUN reset is issued while I/O is in progress with queue depth > 1, avoid that data corruption occurs as follows: - The initiator submits a READ (a). - The initiator submits a LUN reset before READ (a) completes. - The target responds that the LUN reset succeeded after READ (a) has been marked as CMD_T_COMPLETE and before .queue_status() has been called. - The initiator receives the LUN reset response and frees the tag used by READ (a). - The initiator submits READ (b) and reuses the tag of READ (a). - The initiator receives the response for READ (a) and interprets this as a completion for READ (b). - The initiator receives the completion for READ (b) and discards it. With the SRP initiator and target drivers and when running fio concurrently with sg_reset -d it only takes a few minutes to reproduce this. Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Fixes: commit febe562c20df ("target: Fix LUN_RESET active I/O handling for ACK_KREF") Cc: Nicholas Bellinger <nab(a)linux-iscsi.org> Cc: Mike Christie <mchristi(a)redhat.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: Hannes Reinecke <hare(a)suse.de> Cc: <stable(a)vger.kernel.org> --- drivers/target/target_core_tmr.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c index 2750a2c7b563..6e419396c1e4 100644 --- a/drivers/target/target_core_tmr.c +++ b/drivers/target/target_core_tmr.c @@ -90,7 +90,7 @@ static int target_check_cdb_and_preempt(struct list_head *list, return 1; } -static bool __target_check_io_state(struct se_cmd *se_cmd, +static bool __target_check_io_state(struct se_cmd *se_cmd, u32 skip_flags, struct se_session *tmr_sess, int tas) { struct se_session *sess = se_cmd->se_sess; @@ -108,7 +108,7 @@ static bool __target_check_io_state(struct se_cmd *se_cmd, * long as se_cmd->cmd_kref is still active unless zero. */ spin_lock(&se_cmd->t_state_lock); - if (se_cmd->transport_state & (CMD_T_COMPLETE | CMD_T_FABRIC_STOP)) { + if (se_cmd->transport_state & (skip_flags | CMD_T_FABRIC_STOP)) { pr_debug("Attempted to abort io tag: %llu already complete or" " fabric stop, skipping\n", se_cmd->tag); spin_unlock(&se_cmd->t_state_lock); @@ -165,7 +165,8 @@ void core_tmr_abort_task( printk("ABORT_TASK: Found referenced %s task_tag: %llu\n", se_cmd->se_tfo->get_fabric_name(), ref_tag); - if (!__target_check_io_state(se_cmd, se_sess, 0)) + if (!__target_check_io_state(se_cmd, CMD_T_COMPLETE, se_sess, + 0)) continue; spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); @@ -349,7 +350,7 @@ static void core_tmr_drain_state_list( continue; spin_lock(&sess->sess_cmd_lock); - rc = __target_check_io_state(cmd, tmr_sess, tas); + rc = __target_check_io_state(cmd, 0, tmr_sess, tas); spin_unlock(&sess->sess_cmd_lock); if (!rc) continue; -- 2.18.0

7 years, 3 months

[PATCH] tpm: separate cmd_ready/go_idle from runtime_pm

by Jarkko Sakkinen

From: Tomas Winkler <tomas.winkler(a)intel.com> commit 627448e85c766587f6fdde1ea3886d6615081c77 upstream Fix tpm ptt initialization error: tpm tpm0: A TPM error (378) occurred get tpm pcr allocation. We cannot use go_idle cmd_ready commands via runtime_pm handles as with the introduction of localities this is no longer an optional feature, while runtime pm can be not enabled. Though cmd_ready/go_idle provides a power saving, it's also a part of TPM2 protocol and should be called explicitly. This patch exposes cmd_read/go_idle via tpm class ops and removes runtime pm support as it is not used by any driver. When calling from nested context always use both flags: TPM_TRANSMIT_UNLOCKED and TPM_TRANSMIT_RAW. Both are needed to resolve tpm spaces and locality request recursive calls to tpm_transmit(). TPM_TRANSMIT_RAW should never be used standalone as it will fail on double locking. While TPM_TRANSMIT_UNLOCKED standalone should be called from non-recursive locked contexts. New wrappers are added tpm_cmd_ready() and tpm_go_idle() to streamline tpm_try_transmit code. tpm_crb no longer needs own power saving functions and can drop using tpm_pm_suspend/resume. This patch cannot be really separated from the locality fix. Fixes: 888d867df441 (tpm: cmd_ready command can be issued only after granting locality) Cc: stable(a)vger.kernel.org Fixes: 888d867df441 (tpm: cmd_ready command can be issued only after granting locality) Signed-off-by: Tomas Winkler <tomas.winkler(a)intel.com> Tested-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com> --- drivers/char/tpm/tpm-interface.c | 50 ++++++++++++--- drivers/char/tpm/tpm.h | 12 +++- drivers/char/tpm/tpm2-space.c | 16 +++-- drivers/char/tpm/tpm_crb.c | 101 +++++++++---------------------- include/linux/tpm.h | 2 + 5 files changed, 90 insertions(+), 91 deletions(-) diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 86b526b7d990..a2070ab86c82 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -369,10 +369,13 @@ static int tpm_validate_command(struct tpm_chip *chip, return -EINVAL; } -static int tpm_request_locality(struct tpm_chip *chip) +static int tpm_request_locality(struct tpm_chip *chip, unsigned int flags) { int rc; + if (flags & TPM_TRANSMIT_RAW) + return 0; + if (!chip->ops->request_locality) return 0; @@ -385,10 +388,13 @@ static int tpm_request_locality(struct tpm_chip *chip) return 0; } -static void tpm_relinquish_locality(struct tpm_chip *chip) +static void tpm_relinquish_locality(struct tpm_chip *chip, unsigned int flags) { int rc; + if (flags & TPM_TRANSMIT_RAW) + return; + if (!chip->ops->relinquish_locality) return; @@ -399,6 +405,28 @@ static void tpm_relinquish_locality(struct tpm_chip *chip) chip->locality = -1; } +static int tpm_cmd_ready(struct tpm_chip *chip, unsigned int flags) +{ + if (flags & TPM_TRANSMIT_RAW) + return 0; + + if (!chip->ops->cmd_ready) + return 0; + + return chip->ops->cmd_ready(chip); +} + +static int tpm_go_idle(struct tpm_chip *chip, unsigned int flags) +{ + if (flags & TPM_TRANSMIT_RAW) + return 0; + + if (!chip->ops->go_idle) + return 0; + + return chip->ops->go_idle(chip); +} + static ssize_t tpm_try_transmit(struct tpm_chip *chip, struct tpm_space *space, u8 *buf, size_t bufsiz, @@ -449,14 +477,15 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip, /* Store the decision as chip->locality will be changed. */ need_locality = chip->locality == -1; - if (!(flags & TPM_TRANSMIT_RAW) && need_locality) { - rc = tpm_request_locality(chip); + if (need_locality) { + rc = tpm_request_locality(chip, flags); if (rc < 0) goto out_no_locality; } - if (chip->dev.parent) - pm_runtime_get_sync(chip->dev.parent); + rc = tpm_cmd_ready(chip, flags); + if (rc) + goto out; rc = tpm2_prepare_space(chip, space, ordinal, buf); if (rc) @@ -516,13 +545,16 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip, } rc = tpm2_commit_space(chip, space, ordinal, buf, &len); + if (rc) + dev_err(&chip->dev, "tpm2_commit_space: error %d\n", rc); out: - if (chip->dev.parent) - pm_runtime_put_sync(chip->dev.parent); + rc = tpm_go_idle(chip, flags); + if (rc) + goto out; if (need_locality) - tpm_relinquish_locality(chip); + tpm_relinquish_locality(chip, flags); out_no_locality: if (chip->ops->clk_enable != NULL) diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index b83b30a3eea5..4bb9b4aa9b49 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -511,9 +511,17 @@ extern const struct file_operations tpm_fops; extern const struct file_operations tpmrm_fops; extern struct idr dev_nums_idr; +/** + * enum tpm_transmit_flags + * + * @TPM_TRANSMIT_UNLOCKED: used to lock sequence of tpm_transmit calls. + * @TPM_TRANSMIT_RAW: prevent recursive calls into setup steps + * (go idle, locality,..). Always use with UNLOCKED + * as it will fail on double locking. + */ enum tpm_transmit_flags { - TPM_TRANSMIT_UNLOCKED = BIT(0), - TPM_TRANSMIT_RAW = BIT(1), + TPM_TRANSMIT_UNLOCKED = BIT(0), + TPM_TRANSMIT_RAW = BIT(1), }; ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c index d26ea7513226..dabb2ae4e779 100644 --- a/drivers/char/tpm/tpm2-space.c +++ b/drivers/char/tpm/tpm2-space.c @@ -39,7 +39,8 @@ static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space) for (i = 0; i < ARRAY_SIZE(space->session_tbl); i++) { if (space->session_tbl[i]) tpm2_flush_context_cmd(chip, space->session_tbl[i], - TPM_TRANSMIT_UNLOCKED); + TPM_TRANSMIT_UNLOCKED | + TPM_TRANSMIT_RAW); } } @@ -84,7 +85,7 @@ static int tpm2_load_context(struct tpm_chip *chip, u8 *buf, tpm_buf_append(&tbuf, &buf[*offset], body_size); rc = tpm_transmit_cmd(chip, NULL, tbuf.data, PAGE_SIZE, 4, - TPM_TRANSMIT_UNLOCKED, NULL); + TPM_TRANSMIT_UNLOCKED | TPM_TRANSMIT_RAW, NULL); if (rc < 0) { dev_warn(&chip->dev, "%s: failed with a system error %d\n", __func__, rc); @@ -133,7 +134,7 @@ static int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf, tpm_buf_append_u32(&tbuf, handle); rc = tpm_transmit_cmd(chip, NULL, tbuf.data, PAGE_SIZE, 0, - TPM_TRANSMIT_UNLOCKED, NULL); + TPM_TRANSMIT_UNLOCKED | TPM_TRANSMIT_RAW, NULL); if (rc < 0) { dev_warn(&chip->dev, "%s: failed with a system error %d\n", __func__, rc); @@ -170,7 +171,8 @@ static void tpm2_flush_space(struct tpm_chip *chip) for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) if (space->context_tbl[i] && ~space->context_tbl[i]) tpm2_flush_context_cmd(chip, space->context_tbl[i], - TPM_TRANSMIT_UNLOCKED); + TPM_TRANSMIT_UNLOCKED | + TPM_TRANSMIT_RAW); tpm2_flush_sessions(chip, space); } @@ -377,7 +379,8 @@ static int tpm2_map_response_header(struct tpm_chip *chip, u32 cc, u8 *rsp, return 0; out_no_slots: - tpm2_flush_context_cmd(chip, phandle, TPM_TRANSMIT_UNLOCKED); + tpm2_flush_context_cmd(chip, phandle, + TPM_TRANSMIT_UNLOCKED | TPM_TRANSMIT_RAW); dev_warn(&chip->dev, "%s: out of slots for 0x%08X\n", __func__, phandle); return -ENOMEM; @@ -465,7 +468,8 @@ static int tpm2_save_space(struct tpm_chip *chip) return rc; tpm2_flush_context_cmd(chip, space->context_tbl[i], - TPM_TRANSMIT_UNLOCKED); + TPM_TRANSMIT_UNLOCKED | + TPM_TRANSMIT_RAW); space->context_tbl[i] = ~0; } diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c index bb756ad7897e..5c7ce5aaaf6f 100644 --- a/drivers/char/tpm/tpm_crb.c +++ b/drivers/char/tpm/tpm_crb.c @@ -137,7 +137,7 @@ static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value, } /** - * crb_go_idle - request tpm crb device to go the idle state + * __crb_go_idle - request tpm crb device to go the idle state * * @dev: crb device * @priv: crb private data @@ -151,7 +151,7 @@ static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value, * * Return: 0 always */ -static int crb_go_idle(struct device *dev, struct crb_priv *priv) +static int __crb_go_idle(struct device *dev, struct crb_priv *priv) { if ((priv->flags & CRB_FL_ACPI_START) || (priv->flags & CRB_FL_CRB_SMC_START)) @@ -166,11 +166,20 @@ static int crb_go_idle(struct device *dev, struct crb_priv *priv) dev_warn(dev, "goIdle timed out\n"); return -ETIME; } + return 0; } +static int crb_go_idle(struct tpm_chip *chip) +{ + struct device *dev = &chip->dev; + struct crb_priv *priv = dev_get_drvdata(dev); + + return __crb_go_idle(dev, priv); +} + /** - * crb_cmd_ready - request tpm crb device to enter ready state + * __crb_cmd_ready - request tpm crb device to enter ready state * * @dev: crb device * @priv: crb private data @@ -183,7 +192,7 @@ static int crb_go_idle(struct device *dev, struct crb_priv *priv) * * Return: 0 on success -ETIME on timeout; */ -static int crb_cmd_ready(struct device *dev, struct crb_priv *priv) +static int __crb_cmd_ready(struct device *dev, struct crb_priv *priv) { if ((priv->flags & CRB_FL_ACPI_START) || (priv->flags & CRB_FL_CRB_SMC_START)) @@ -201,6 +210,14 @@ static int crb_cmd_ready(struct device *dev, struct crb_priv *priv) return 0; } +static int crb_cmd_ready(struct tpm_chip *chip) +{ + struct device *dev = &chip->dev; + struct crb_priv *priv = dev_get_drvdata(dev); + + return __crb_cmd_ready(dev, priv); +} + static int __crb_request_locality(struct device *dev, struct crb_priv *priv, int loc) { @@ -393,6 +410,8 @@ static const struct tpm_class_ops tpm_crb = { .send = crb_send, .cancel = crb_cancel, .req_canceled = crb_req_canceled, + .go_idle = crb_go_idle, + .cmd_ready = crb_cmd_ready, .request_locality = crb_request_locality, .relinquish_locality = crb_relinquish_locality, .req_complete_mask = CRB_DRV_STS_COMPLETE, @@ -508,7 +527,7 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv, * PTT HW bug w/a: wake up the device to access * possibly not retained registers. */ - ret = crb_cmd_ready(dev, priv); + ret = __crb_cmd_ready(dev, priv); if (ret) return ret; @@ -553,7 +572,7 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv, if (!ret) priv->cmd_size = cmd_size; - crb_go_idle(dev, priv); + __crb_go_idle(dev, priv); __crb_relinquish_locality(dev, priv, 0); @@ -624,32 +643,7 @@ static int crb_acpi_add(struct acpi_device *device) chip->acpi_dev_handle = device->handle; chip->flags = TPM_CHIP_FLAG_TPM2; - rc = __crb_request_locality(dev, priv, 0); - if (rc) - return rc; - - rc = crb_cmd_ready(dev, priv); - if (rc) - goto out; - - pm_runtime_get_noresume(dev); - pm_runtime_set_active(dev); - pm_runtime_enable(dev); - - rc = tpm_chip_register(chip); - if (rc) { - crb_go_idle(dev, priv); - pm_runtime_put_noidle(dev); - pm_runtime_disable(dev); - goto out; - } - - pm_runtime_put_sync(dev); - -out: - __crb_relinquish_locality(dev, priv, 0); - - return rc; + return tpm_chip_register(chip); } static int crb_acpi_remove(struct acpi_device *device) @@ -659,52 +653,11 @@ static int crb_acpi_remove(struct acpi_device *device) tpm_chip_unregister(chip); - pm_runtime_disable(dev); - return 0; } -static int __maybe_unused crb_pm_runtime_suspend(struct device *dev) -{ - struct tpm_chip *chip = dev_get_drvdata(dev); - struct crb_priv *priv = dev_get_drvdata(&chip->dev); - - return crb_go_idle(dev, priv); -} - -static int __maybe_unused crb_pm_runtime_resume(struct device *dev) -{ - struct tpm_chip *chip = dev_get_drvdata(dev); - struct crb_priv *priv = dev_get_drvdata(&chip->dev); - - return crb_cmd_ready(dev, priv); -} - -static int __maybe_unused crb_pm_suspend(struct device *dev) -{ - int ret; - - ret = tpm_pm_suspend(dev); - if (ret) - return ret; - - return crb_pm_runtime_suspend(dev); -} - -static int __maybe_unused crb_pm_resume(struct device *dev) -{ - int ret; - - ret = crb_pm_runtime_resume(dev); - if (ret) - return ret; - - return tpm_pm_resume(dev); -} - static const struct dev_pm_ops crb_pm = { - SET_SYSTEM_SLEEP_PM_OPS(crb_pm_suspend, crb_pm_resume) - SET_RUNTIME_PM_OPS(crb_pm_runtime_suspend, crb_pm_runtime_resume, NULL) + SET_SYSTEM_SLEEP_PM_OPS(tpm_pm_suspend, tpm_pm_resume) }; static const struct acpi_device_id crb_device_ids[] = { diff --git a/include/linux/tpm.h b/include/linux/tpm.h index 2a6c3d96b31f..7f7b29f86c59 100644 --- a/include/linux/tpm.h +++ b/include/linux/tpm.h @@ -48,6 +48,8 @@ struct tpm_class_ops { u8 (*status) (struct tpm_chip *chip); bool (*update_timeouts)(struct tpm_chip *chip, unsigned long *timeout_cap); + int (*go_idle)(struct tpm_chip *chip); + int (*cmd_ready)(struct tpm_chip *chip); int (*request_locality)(struct tpm_chip *chip, int loc); int (*relinquish_locality)(struct tpm_chip *chip, int loc); void (*clk_enable)(struct tpm_chip *chip, bool value); -- 2.17.1

7 years, 3 months

Re: Patch "x86/kexec: Allocate 8k PGDs for PTI" has been added to the 3.18-stable tree

by Hugh Dickins

On Mon, 17 Sep 2018, gregkh(a)linuxfoundation.org wrote: > > This is a note to let you know that I've just added the patch titled > > x86/kexec: Allocate 8k PGDs for PTI > > to the 3.18-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > x86-kexec-allocate-8k-pgds-for-pti.patch > and it can be found in the queue-3.18 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. I believe this commit is an example of the auto-selector being too eager, and this should not be in *any* of the stable trees. As the commit message indicates, it's a fix by Joerg for his PTI-x86-32 implementation - which has not been backported to any of the stable trees (yet), has it? In several of the recent stable trees, I think this will not do any actual harm; but it looks as if it will prevent relevant x86-32 configs from building on 3.18 (I see no definition of PGD_ALLOCATION_ORDER in linux-3.18.y - you preferred not to have any PTI in that tree), and I haven't checked whether its definition in older backports will build correctly here or not. Hugh > > > From foo@baz Mon Sep 17 11:45:57 CEST 2018 > From: Joerg Roedel <jroedel(a)suse.de> > Date: Wed, 25 Jul 2018 17:48:03 +0200 > Subject: x86/kexec: Allocate 8k PGDs for PTI > > From: Joerg Roedel <jroedel(a)suse.de> > > [ Upstream commit ca38dc8f2724d101038b1205122c93a1c7f38f11 ] > > Fuzzing the PTI-x86-32 code with trinity showed unhandled > kernel paging request oops-messages that looked a lot like > silent data corruption. > > Lot's of debugging and testing lead to the kexec-32bit code, > which is still allocating 4k PGDs when PTI is enabled. But > since it uses native_set_pud() to build the page-table, it > will unevitably call into __pti_set_user_pgtbl(), which > writes beyond the allocated 4k page. > > Use PGD_ALLOCATION_ORDER to allocate PGDs in the kexec code > to fix the issue. > > Signed-off-by: Joerg Roedel <jroedel(a)suse.de> > Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> > Tested-by: David H. Gutteridge <dhgutteridge(a)sympatico.ca> > Cc: "H . Peter Anvin" <hpa(a)zytor.com> > Cc: linux-mm(a)kvack.org > Cc: Linus Torvalds <torvalds(a)linux-foundation.org> > Cc: Andy Lutomirski <luto(a)kernel.org> > Cc: Dave Hansen <dave.hansen(a)intel.com> > Cc: Josh Poimboeuf <jpoimboe(a)redhat.com> > Cc: Juergen Gross <jgross(a)suse.com> > Cc: Peter Zijlstra <peterz(a)infradead.org> > Cc: Borislav Petkov <bp(a)alien8.de> > Cc: Jiri Kosina <jkosina(a)suse.cz> > Cc: Boris Ostrovsky <boris.ostrovsky(a)oracle.com> > Cc: Brian Gerst <brgerst(a)gmail.com> > Cc: David Laight <David.Laight(a)aculab.com> > Cc: Denys Vlasenko <dvlasenk(a)redhat.com> > Cc: Eduardo Valentin <eduval(a)amazon.com> > Cc: Greg KH <gregkh(a)linuxfoundation.org> > Cc: Will Deacon <will.deacon(a)arm.com> > Cc: aliguori(a)amazon.com > Cc: daniel.gruss(a)iaik.tugraz.at > Cc: hughd(a)google.com > Cc: keescook(a)google.com > Cc: Andrea Arcangeli <aarcange(a)redhat.com> > Cc: Waiman Long <llong(a)redhat.com> > Cc: Pavel Machek <pavel(a)ucw.cz> > Cc: Arnaldo Carvalho de Melo <acme(a)kernel.org> > Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> > Cc: Jiri Olsa <jolsa(a)redhat.com> > Cc: Namhyung Kim <namhyung(a)kernel.org> > Cc: joro(a)8bytes.org > Link: https://lkml.kernel.org/r/1532533683-5988-4-git-send-email-joro@8bytes.org > Signed-off-by: Sasha Levin <alexander.levin(a)microsoft.com> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > --- > arch/x86/kernel/machine_kexec_32.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > --- a/arch/x86/kernel/machine_kexec_32.c > +++ b/arch/x86/kernel/machine_kexec_32.c > @@ -69,7 +69,7 @@ static void load_segments(void) > > static void machine_kexec_free_page_tables(struct kimage *image) > { > - free_page((unsigned long)image->arch.pgd); > + free_pages((unsigned long)image->arch.pgd, PGD_ALLOCATION_ORDER); > image->arch.pgd = NULL; > #ifdef CONFIG_X86_PAE > free_page((unsigned long)image->arch.pmd0); > @@ -85,7 +85,8 @@ static void machine_kexec_free_page_tabl > > static int machine_kexec_alloc_page_tables(struct kimage *image) > { > - image->arch.pgd = (pgd_t *)get_zeroed_page(GFP_KERNEL); > + image->arch.pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, > + PGD_ALLOCATION_ORDER); > #ifdef CONFIG_X86_PAE > image->arch.pmd0 = (pmd_t *)get_zeroed_page(GFP_KERNEL); > image->arch.pmd1 = (pmd_t *)get_zeroed_page(GFP_KERNEL); > > > Patches currently in stable-queue which might be from jroedel(a)suse.de are > > queue-3.18/x86-kexec-allocate-8k-pgds-for-pti.patch > queue-3.18/x86-mm-remove-in_nmi-warning-from-vmalloc_fault.patch >

7 years, 3 months

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror