- Linux-stable-mirror - lists.linaro.org

[Linux-stable-mirror] [PATCH] staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl

by Greg Hackmann

From: Viktor Slavkovic <viktors(a)google.com> A lock-unlock is missing in ASHMEM_SET_SIZE ioctl which can result in a race condition when mmap is called. After the !asma->file check, before setting asma->size, asma->file can be set in mmap. That would result in having different asma->size than the mapped memory size. Combined with ASHMEM_UNPIN ioctl and shrinker invocation, this can result in memory corruption. Signed-off-by: Viktor Slavkovic <viktors(a)google.com> Cc: stable(a)vger.kernel.org --- drivers/staging/android/ashmem.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c index 0f695df14c9d..372ce9913e6d 100644 --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -765,10 +765,12 @@ static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg) break; case ASHMEM_SET_SIZE: ret = -EINVAL; + mutex_lock(&ashmem_mutex); if (!asma->file) { ret = 0; asma->size = (size_t)arg; } + mutex_unlock(&ashmem_mutex); break; case ASHMEM_GET_SIZE: ret = asma->size; -- 2.16.0.rc0.223.g4a4ac83678-goog

7 years, 6 months

1
0
0 0

Re: [Linux-stable-mirror] Feedback on 4.9 performance after PTI fixes

by Willy Tarreau

Hi Yves-Alexis, On Mon, Jan 08, 2018 at 06:07:54PM +0100, Yves-Alexis Perez wrote: > On Sun, 2018-01-07 at 11:18 +0100, Willy Tarreau wrote: > > - the highest performance impact on VMs comes from having PTI on the > > guest kernel (-45%). At this point it makes no difference whether > > the host kernel has it or not. > > Hi Willy, > > out of curiosity, is the pcid/invpcid flags exposed to and used by your guest > CPU? It might very well that the PCID optimisations are not used by the guests > here, and it might be worth either checking on bare metal or with the PCID > optimisations enabled. You're totally right, I discovered during my later developments that indeed PCID is not exposed there. So we take the hit of a full TLB flush twice per syscall. Willy

7 years, 6 months

1
0
0 0

Re: [Linux-stable-mirror] stable-rc/linux-4.4.y build: 178 builds: 7 failed, 171 passed, 8 errors (v4.4.110-23-g49278737d445)

by Arnd Bergmann

On Mon, Jan 8, 2018 at 3:05 PM, kernelci.org bot <bot(a)kernelci.org> wrote: > > stable-rc/linux-4.4.y build: 178 builds: 7 failed, 171 passed, 8 errors (v4.4.110-23-g49278737d445) > Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.4.y/kernel/v4.4.110-23-… > Tree: stable-rc > Branch: linux-4.4.y > Git Describe: v4.4.110-23-g49278737d445 > Git Commit: 49278737d4458032fb523dfe5451b441c04c5b73 > Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git > Built: 4 unique architectures > > Build Failures Detected: > > x86: gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.5) > allnoconfig FAIL > i386_defconfig FAIL > tinyconfig FAIL I missed these earlier, since the kernelci summary output doesn't print link errors: arch/x86/kernel/setup.o: In function `vsyscall_enabled': setup.c:(.text+0x10): multiple definition of `vsyscall_enabled' arch/x86/kernel/time.o:time.c:(.text+0x10): first defined here arch/x86/kernel/rtc.o: In function `vsyscall_enabled': rtc.c:(.text+0x0): multiple definition of `vsyscall_enabled' arch/x86/kernel/time.o:time.c:(.text+0x10): first defined here arch/x86/kernel/cpu/built-in.o: In function `vsyscall_enabled': (.text+0xbc0): multiple definition of `vsyscall_enabled' This comes from 0cbf2b590bea ("Map the vsyscall page with _PAGE_USER") which adds a line 'bool vsyscall_enabled(void) { return false; }' that presumably should have been 'static inline'. Arnd

7 years, 6 months

4
4
0 0

Re: [Linux-stable-mirror] [kaiser-discuss] KPTI backport to 3.16

by Dave Hansen

On 01/08/2018 01:05 AM, Yves-Alexis Perez wrote: > On Mon, 2018-01-08 at 03:25 +0000, Ben Hutchings wrote: >> This is with the full patch set applied (and a fix for NMI handling >> that wasn't in 3.16.53-rc1): >> https://www.decadent.org.uk/ben/tmp/linux-image-3.16.52_3.16.52-50_amd64.deb I booted this. It crashes in *secondary* CPU startup when it sets CR4.PCIDE while still in 32-bit protected mode. That's illegal. Plain 3.16 doesn't do this: https://git.kernel.org/pub/scm/linux/kernel/git/daveh/x86-kaiser.git/tree/a… > /* Enable PAE mode and PGE */ > movl $(X86_CR4_PAE | X86_CR4_PGE), %ecx > movq %rcx, %cr4 So I suspect the "Enable PAE and PGE" area is wrong.

7 years, 6 months

1
0
0 0

Re: [Linux-stable-mirror] stable-rc/linux-4.4.y build: 178 builds: 4 failed, 174 passed, 8 errors (v4.4.110-18-g5da3d9af3a4b)

by Arnd Bergmann

On Mon, Jan 8, 2018 at 12:25 PM, kernelci.org bot <bot(a)kernelci.org> wrote: > > stable-rc/linux-4.4.y build: 178 builds: 4 failed, 174 passed, 8 errors (v4.4.110-18-g5da3d9af3a4b) > Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.4.y/kernel/v4.4.110-18-… > Tree: stable-rc > Branch: linux-4.4.y > Git Describe: v4.4.110-18-g5da3d9af3a4b > Git Commit: 5da3d9af3a4b90d3c5ab19f9ad1dbb7d237edcf9 > Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git > Built: 4 unique architectures > > Build Failures Detected: > > arm: gcc version 5.3.1 20160412 (Linaro GCC 5.3-2016.05) > cm_x300_defconfig FAIL > mvebu_v7_defconfig FAIL > pxa3xx_defconfig FAIL > raumfeld_defconfig FAIL > > mvebu_v7_defconfig (arm) — FAIL, 2 errors, 0 warnings, 0 section mismatches > > Errors: > drivers/mtd/nand/pxa3xx_nand.c:918:2: error: duplicate case value > drivers/mtd/nand/pxa3xx_nand.c:915:2: error: previously used here Hi Greg, Commit fee4380f368e ("mtd: nand: pxa3xx: Fix READOOB implementation") was apparently backported in error, it looks like it should just be dropped here in 4.4.y. The commit lists 'Fixes: 43bcfd2bb24a ("mtd: nand: pxa3xx: Add driver-specific ECC BCH support")', that commit was merged into v4.14, so backporting the fix further is probably not appropriate for 4.9 or earlier kernels either. The duplicate case statement only happens before linux-4.6, as commit c2cdace755b5 ("mtd: nand: pxa3xx_nand: add support for partial chunks")' removed a previous 'case READOOB' statement in this driver, so the build regression appears only in 4.4 but not 4.9. Arnd

7 years, 6 months

3
5
0 0

[Linux-stable-mirror] Patch "mtd: nand: pxa3xx: Fix READOOB implementation" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled mtd: nand: pxa3xx: Fix READOOB implementation to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: mtd-nand-pxa3xx-fix-readoob-implementation.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From fee4380f368e84ed216b62ccd2fbc4126f2bf40b Mon Sep 17 00:00:00 2001 From: Boris Brezillon <boris.brezillon(a)free-electrons.com> Date: Mon, 18 Dec 2017 11:32:45 +0100 Subject: mtd: nand: pxa3xx: Fix READOOB implementation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Boris Brezillon <boris.brezillon(a)free-electrons.com> commit fee4380f368e84ed216b62ccd2fbc4126f2bf40b upstream. In the current driver, OOB bytes are accessed in raw mode, and when a page access is done with NDCR_SPARE_EN set and NDCR_ECC_EN cleared, the driver must read the whole spare area (64 bytes in case of a 2k page, 16 bytes for a 512 page). The driver was only reading the free OOB bytes, which was leaving some unread data in the FIFO and was somehow leading to a timeout. We could patch the driver to read ->spare_size + ->ecc_size instead of just ->spare_size when READOOB is requested, but we'd better make in-band and OOB accesses consistent. Since the driver is always accessing in-band data in non-raw mode (with the ECC engine enabled), we should also access OOB data in this mode. That's particularly useful when using the BCH engine because in this mode the free OOB bytes are also ECC protected. Fixes: 43bcfd2bb24a ("mtd: nand: pxa3xx: Add driver-specific ECC BCH support") Reported-by: Sean Nyekjær <sean.nyekjaer(a)prevas.dk> Tested-by: Willy Tarreau <w(a)1wt.eu> Signed-off-by: Boris Brezillon <boris.brezillon(a)free-electrons.com> Acked-by: Ezequiel Garcia <ezequiel(a)vanguardiasur.com.ar> Tested-by: Sean Nyekjaer <sean.nyekjaer(a)prevas.dk> Acked-by: Robert Jarzmik <robert.jarzmik(a)free.fr> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/mtd/nand/pxa3xx_nand.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/mtd/nand/pxa3xx_nand.c +++ b/drivers/mtd/nand/pxa3xx_nand.c @@ -950,6 +950,7 @@ static void prepare_start_command(struct switch (command) { case NAND_CMD_READ0: + case NAND_CMD_READOOB: case NAND_CMD_PAGEPROG: info->use_ecc = 1; break; Patches currently in stable-queue which might be from boris.brezillon(a)free-electrons.com are queue-4.9/mtd-nand-pxa3xx-fix-readoob-implementation.patch

7 years, 6 months

1
0
0 0

Re: [Linux-stable-mirror] 4.14 LTS build not listed in kernel releases feed

by Willy Tarreau

Hi Pavlos! On Mon, Jan 08, 2018 at 04:19:17PM +0100, Pavlos Parissis wrote: > Hi, > > The 4.14 kernel is listed as a 'Stable' but not as 'Longterm' in the kernel releases feed[1], is > this expected? Normally kernels are only listed as LTS once they leave their regular "stable" status, often after next kernel version is issued. I think this leaves a last minute chance to Greg to change his mind if the kernel he elected is too damaged ;-) Cheers, Willy

7 years, 6 months

2
1
0 0

Re: [Linux-stable-mirror] Linux 4.9.75

by Thomas Deutschmann

Hi Greg, sorry, I lost the overview -- the KPTI 4.14, 4.9 and 4.4 patch set is diverging... I am missing patches like x86/pti: Switch to kernel CR3 at early in entry_SYSCALL_compat() x86/pti: Make sure the user/kernel PTEs match in 4.9. The first one was really important but the problem might be hidden now due to x86/cpu, x86/pti: Do not enable PTI on AMD processors -- Regards, Thomas Deutschmann / Gentoo Linux Developer C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5

7 years, 6 months

2
1
0 0

[Linux-stable-mirror] Applied "ASoC: rockchip: i2s: fix playback after runtime resume" to the asoc tree

by Mark Brown

The patch ASoC: rockchip: i2s: fix playback after runtime resume has been applied to the asoc tree at https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark >From c66234cfedfc3e6e3b62563a5f2c1562be09a35d Mon Sep 17 00:00:00 2001 From: John Keeping <john(a)metanate.com> Date: Mon, 8 Jan 2018 16:01:04 +0000 Subject: [PATCH] ASoC: rockchip: i2s: fix playback after runtime resume When restoring registers during runtime resume, we must not write to I2S_TXDR which is the transmit FIFO as this queues up a sample to be output and pushes all of the output channels down by one. This can be demonstrated with the speaker-test utility: for i in a b c; do speaker-test -c 2 -s 1; done which should play a test through the left speaker three times but if the I2S hardware starts runtime suspended the first sample will be played through the right speaker. Fix this by marking I2S_TXDR as volatile (which also requires marking it as readble, even though it technically isn't). This seems to be the most robust fix, the alternative of giving I2S_TXDR a default value is more fragile since it does not prevent regcache writing to the register in all circumstances. While here, also fix the configuration of I2S_RXDR and I2S_FIFOLR; these are not writable so they do not suffer from the same problem as I2S_TXDR but reading from I2S_RXDR does suffer from a similar problem. Fixes: f0447f6cbb20 ("ASoC: rockchip: i2s: restore register during runtime_suspend/resume cycle", 2016-09-07) Signed-off-by: John Keeping <john(a)metanate.com> Signed-off-by: Mark Brown <broonie(a)kernel.org> Cc: stable(a)vger.kernel.org --- sound/soc/rockchip/rockchip_i2s.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c index 908211e1d6fc..eb27f6c24bf7 100644 --- a/sound/soc/rockchip/rockchip_i2s.c +++ b/sound/soc/rockchip/rockchip_i2s.c @@ -504,6 +504,7 @@ static bool rockchip_i2s_rd_reg(struct device *dev, unsigned int reg) case I2S_INTCR: case I2S_XFER: case I2S_CLR: + case I2S_TXDR: case I2S_RXDR: case I2S_FIFOLR: case I2S_INTSR: @@ -518,6 +519,9 @@ static bool rockchip_i2s_volatile_reg(struct device *dev, unsigned int reg) switch (reg) { case I2S_INTSR: case I2S_CLR: + case I2S_FIFOLR: + case I2S_TXDR: + case I2S_RXDR: return true; default: return false; @@ -527,6 +531,8 @@ static bool rockchip_i2s_volatile_reg(struct device *dev, unsigned int reg) static bool rockchip_i2s_precious_reg(struct device *dev, unsigned int reg) { switch (reg) { + case I2S_RXDR: + return true; default: return false; } -- 2.15.1

7 years, 6 months

1
0
0 0

[Linux-stable-mirror] [PATCH v2] x86/mm/pti: remove dead logic during user pagetable population

by Jike Song

Look at one of the code snippets: 162 if (pgd_none(*pgd)) { 163 unsigned long new_p4d_page = __get_free_page(gfp); 164 if (!new_p4d_page) 165 return NULL; 166 167 if (pgd_none(*pgd)) { 168 set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page))); 169 new_p4d_page = 0; 170 } 171 if (new_p4d_page) 172 free_page(new_p4d_page); 173 } There can't be any difference between two pgd_none(*pgd) at L162 and L167, so it's always false at L171. v2: add the commit message above. Signed-off-by: Jike Song <albcamus(a)gmail.com> Cc: David Woodhouse <dwmw(a)amazon.co.uk> Cc: Alan Cox <gnomes(a)lxorguk.ukuu.org.uk> Cc: Jiri Koshina <jikos(a)kernel.org> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Tim Chen <tim.c.chen(a)linux.intel.com> Cc: Andi Lutomirski <luto(a)amacapital.net> Cc: Andi Kleen <ak(a)linux.intel.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Paul Turner <pjt(a)google.com> Cc: Tom Lendacky <thomas.lendacky(a)amd.com> Cc: Greg KH <gregkh(a)linux-foundation.org> Cc: Dave Hansen <dave.hansen(a)intel.com> Cc: Kees Cook <keescook(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Jike Song <albcamus(a)gmail.com> --- arch/x86/mm/pti.c | 28 ++++------------------------ 1 file changed, 4 insertions(+), 24 deletions(-) diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c index 43d4a4a29037..dc611d039bd5 100644 --- a/arch/x86/mm/pti.c +++ b/arch/x86/mm/pti.c @@ -164,12 +164,7 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address) if (!new_p4d_page) return NULL; - if (pgd_none(*pgd)) { - set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page))); - new_p4d_page = 0; - } - if (new_p4d_page) - free_page(new_p4d_page); + set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page))); } BUILD_BUG_ON(pgd_large(*pgd) != 0); @@ -194,12 +189,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) if (!new_pud_page) return NULL; - if (p4d_none(*p4d)) { - set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page))); - new_pud_page = 0; - } - if (new_pud_page) - free_page(new_pud_page); + set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page))); } pud = pud_offset(p4d, address); @@ -213,12 +203,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) if (!new_pmd_page) return NULL; - if (pud_none(*pud)) { - set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page))); - new_pmd_page = 0; - } - if (new_pmd_page) - free_page(new_pmd_page); + set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page))); } return pmd_offset(pud, address); @@ -251,12 +236,7 @@ static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address) if (!new_pte_page) return NULL; - if (pmd_none(*pmd)) { - set_pmd(pmd, __pmd(_KERNPG_TABLE | __pa(new_pte_page))); - new_pte_page = 0; - } - if (new_pte_page) - free_page(new_pte_page); + set_pmd(pmd, __pmd(_KERNPG_TABLE | __pa(new_pte_page))); } pte = pte_offset_kernel(pmd, address); -- 2.14.3

7 years, 6 months

4
4
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror