We walk the userspace PTs to discover what mapping size was
used there. However, this can race against the userspace tables
being freed, and we end-up in the weeds.
Thankfully, the mm code is being generous and will IPI us when
doing so. So let's implement our part of the bargain and disable
interrupts around the walk. This ensures that nothing terrible
happens during that time.
We still need to handle the removal of the page tables before
the walk. For that, allow get_user_mapping_size() to return an
error, and make sure this error can be propagated all the way
to the the exit handler.
Signed-off-by: Marc Zyngier <maz(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
arch/arm64/kvm/mmu.c | 45 +++++++++++++++++++++++++++++++++++++-------
1 file changed, 38 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index f54408355d1d..d3d4cdc0f617 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -666,14 +666,33 @@ static int get_user_mapping_size(struct kvm *kvm, u64 addr)
CONFIG_PGTABLE_LEVELS),
.mm_ops = &kvm_user_mm_ops,
};
+ unsigned long flags;
kvm_pte_t pte = 0; /* Keep GCC quiet... */
u32 level = ~0;
int ret;
+ /*
+ * Disable IRQs so that we hazard against a concurrent
+ * teardown of the userspace page tables (which relies on
+ * IPI-ing threads).
+ */
+ local_irq_save(flags);
ret = kvm_pgtable_get_leaf(&pgt, addr, &pte, &level);
- VM_BUG_ON(ret);
- VM_BUG_ON(level >= KVM_PGTABLE_MAX_LEVELS);
- VM_BUG_ON(!(pte & PTE_VALID));
+ local_irq_restore(flags);
+
+ if (ret)
+ return ret;
+
+ /*
+ * Not seeing an error, but not updating level? Something went
+ * deeply wrong...
+ */
+ if (WARN_ON(level >= KVM_PGTABLE_MAX_LEVELS))
+ return -EFAULT;
+
+ /* Oops, the userspace PTs are gone... Replay the fault */
+ if (!(pte & PTE_VALID))
+ return -EAGAIN;
return BIT(ARM64_HW_PGTABLE_LEVEL_SHIFT(level));
}
@@ -1079,7 +1098,7 @@ static bool fault_supports_stage2_huge_mapping(struct kvm_memory_slot *memslot,
*
* Returns the size of the mapping.
*/
-static unsigned long
+static long
transparent_hugepage_adjust(struct kvm *kvm, struct kvm_memory_slot *memslot,
unsigned long hva, kvm_pfn_t *pfnp,
phys_addr_t *ipap)
@@ -1091,8 +1110,15 @@ transparent_hugepage_adjust(struct kvm *kvm, struct kvm_memory_slot *memslot,
* sure that the HVA and IPA are sufficiently aligned and that the
* block map is contained within the memslot.
*/
- if (fault_supports_stage2_huge_mapping(memslot, hva, PMD_SIZE) &&
- get_user_mapping_size(kvm, hva) >= PMD_SIZE) {
+ if (fault_supports_stage2_huge_mapping(memslot, hva, PMD_SIZE)) {
+ int sz = get_user_mapping_size(kvm, hva);
+
+ if (sz < 0)
+ return sz;
+
+ if (sz < PMD_SIZE)
+ return PAGE_SIZE;
+
/*
* The address we faulted on is backed by a transparent huge
* page. However, because we map the compound huge page and
@@ -1203,7 +1229,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
kvm_pfn_t pfn;
bool logging_active = memslot_is_logging(memslot);
unsigned long fault_level = kvm_vcpu_trap_get_fault_level(vcpu);
- unsigned long vma_pagesize, fault_granule;
+ long vma_pagesize, fault_granule;
enum kvm_pgtable_prot prot = KVM_PGTABLE_PROT_R;
struct kvm_pgtable *pgt;
@@ -1344,6 +1370,11 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
vma_pagesize = transparent_hugepage_adjust(kvm, memslot,
hva, &pfn,
&fault_ipa);
+
+ if (vma_pagesize < 0) {
+ ret = vma_pagesize;
+ goto out_unlock;
+ }
}
if (fault_status != ESR_ELx_FSC_PERM && !device && kvm_has_mte(kvm)) {
--
2.34.1
From: Arnd Bergmann <arnd(a)arndb.de>
commit 4b692e861619353ce069e547a67c8d0e32d9ef3d upstream.
Patch series "compat: remove compat_alloc_user_space", v5.
Going through compat_alloc_user_space() to convert indirect system call
arguments tends to add complexity compared to handling the native and
compat logic in the same code.
This patch (of 6):
The locking is the same between the native and compat version of
sys_kexec_load(), so it can be done in the common implementation to reduce
duplication.
Link: https://lkml.kernel.org/r/20210727144859.4150043-1-arnd@kernel.org
Link: https://lkml.kernel.org/r/20210727144859.4150043-2-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Co-developed-by: Eric Biederman <ebiederm(a)xmission.com>
Co-developed-by: Christoph Hellwig <hch(a)infradead.org>
Acked-by: "Eric W. Biederman" <ebiederm(a)xmission.com>
Cc: Catalin Marinas <catalin.marinas(a)arm.com>
Cc: Will Deacon <will(a)kernel.org>
Cc: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de>
Cc: "James E.J. Bottomley" <James.Bottomley(a)HansenPartnership.com>
Cc: Helge Deller <deller(a)gmx.de>
Cc: Michael Ellerman <mpe(a)ellerman.id.au>
Cc: Benjamin Herrenschmidt <benh(a)kernel.crashing.org>
Cc: Paul Mackerras <paulus(a)samba.org>
Cc: Heiko Carstens <hca(a)linux.ibm.com>
Cc: Vasily Gorbik <gor(a)linux.ibm.com>
Cc: Christian Borntraeger <borntraeger(a)de.ibm.com>
Cc: "David S. Miller" <davem(a)davemloft.net>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: Ingo Molnar <mingo(a)redhat.com>
Cc: Borislav Petkov <bp(a)alien8.de>
Cc: "H. Peter Anvin" <hpa(a)zytor.com>
Cc: Al Viro <viro(a)zeniv.linux.org.uk>
Cc: Feng Tang <feng.tang(a)intel.com>
Cc: Christoph Hellwig <hch(a)lst.de>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: stable(a)vger.kernel.org # 5.10+
Signed-off-by: Wen Yang <wenyang.linux(a)foxmail.com>
---
kernel/kexec.c | 44 ++++++++++++++++----------------------------
1 file changed, 16 insertions(+), 28 deletions(-)
diff --git a/kernel/kexec.c b/kernel/kexec.c
index c82c6c06f051..9c7aef8f4bb6 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -110,6 +110,17 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
unsigned long i;
int ret;
+ /*
+ * Because we write directly to the reserved memory region when loading
+ * crash kernels we need a mutex here to prevent multiple crash kernels
+ * from attempting to load simultaneously, and to prevent a crash kernel
+ * from loading over the top of a in use crash kernel.
+ *
+ * KISS: always take the mutex.
+ */
+ if (!mutex_trylock(&kexec_mutex))
+ return -EBUSY;
+
if (flags & KEXEC_ON_CRASH) {
dest_image = &kexec_crash_image;
if (kexec_crash_image)
@@ -121,7 +132,8 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
if (nr_segments == 0) {
/* Uninstall image */
kimage_free(xchg(dest_image, NULL));
- return 0;
+ ret = 0;
+ goto out_unlock;
}
if (flags & KEXEC_ON_CRASH) {
/*
@@ -134,7 +146,7 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
ret = kimage_alloc_init(&image, entry, nr_segments, segments, flags);
if (ret)
- return ret;
+ goto out_unlock;
if (flags & KEXEC_PRESERVE_CONTEXT)
image->preserve_context = 1;
@@ -171,6 +183,8 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
arch_kexec_protect_crashkres();
kimage_free(image);
+out_unlock:
+ mutex_unlock(&kexec_mutex);
return ret;
}
@@ -247,21 +261,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
((flags & KEXEC_ARCH_MASK) != KEXEC_ARCH_DEFAULT))
return -EINVAL;
- /* Because we write directly to the reserved memory
- * region when loading crash kernels we need a mutex here to
- * prevent multiple crash kernels from attempting to load
- * simultaneously, and to prevent a crash kernel from loading
- * over the top of a in use crash kernel.
- *
- * KISS: always take the mutex.
- */
- if (!mutex_trylock(&kexec_mutex))
- return -EBUSY;
-
result = do_kexec_load(entry, nr_segments, segments, flags);
- mutex_unlock(&kexec_mutex);
-
return result;
}
@@ -301,21 +302,8 @@ COMPAT_SYSCALL_DEFINE4(kexec_load, compat_ulong_t, entry,
return -EFAULT;
}
- /* Because we write directly to the reserved memory
- * region when loading crash kernels we need a mutex here to
- * prevent multiple crash kernels from attempting to load
- * simultaneously, and to prevent a crash kernel from loading
- * over the top of a in use crash kernel.
- *
- * KISS: always take the mutex.
- */
- if (!mutex_trylock(&kexec_mutex))
- return -EBUSY;
-
result = do_kexec_load(entry, nr_segments, ksegments, flags);
- mutex_unlock(&kexec_mutex);
-
return result;
}
#endif
--
2.37.2
I'm announcing the release of the 5.4.237 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/admin-guide/kernel-parameters.txt | 51 +++++-
Makefile | 2
arch/alpha/kernel/module.c | 4
arch/mips/include/asm/mach-rc32434/pci.h | 2
arch/powerpc/kernel/vmlinux.lds.S | 6
arch/riscv/kernel/stacktrace.c | 2
arch/s390/kernel/vmlinux.lds.S | 2
arch/sh/kernel/vmlinux.lds.S | 1
arch/um/kernel/vmlinux.lds.S | 2
arch/x86/kernel/cpu/amd.c | 9 +
arch/x86/kernel/vmlinux.lds.S | 2
drivers/char/ipmi/ipmi_ssif.c | 146 ++++++------------
drivers/char/ipmi/ipmi_watchdog.c | 8 -
drivers/gpu/drm/drm_atomic.c | 1
drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 4
drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 4
drivers/iommu/amd_iommu_init.c | 105 ++++++++++---
drivers/iommu/intel-pasid.c | 7
drivers/macintosh/windfarm_lm75_sensor.c | 4
drivers/macintosh/windfarm_smu_sensors.c | 4
drivers/media/i2c/ov5640.c | 2
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 +-
drivers/net/phy/microchip.c | 32 ++++
drivers/net/usb/lan78xx.c | 189 +++++++++---------------
drivers/nfc/fdp/i2c.c | 4
drivers/s390/block/dasd_diag.c | 7
drivers/s390/block/dasd_fba.c | 7
drivers/s390/block/dasd_int.h | 1
drivers/scsi/hosts.c | 2
drivers/scsi/megaraid/megaraid_sas.h | 2
drivers/scsi/megaraid/megaraid_sas_fp.c | 2
fs/cifs/cifsacl.c | 14 -
fs/cifs/cifsfs.c | 2
fs/cifs/cifsglob.h | 6
fs/cifs/cifsproto.h | 8 +
fs/cifs/connect.c | 2
fs/cifs/dir.c | 5
fs/cifs/file.c | 10 -
fs/cifs/inode.c | 8 -
fs/cifs/ioctl.c | 2
fs/cifs/link.c | 18 --
fs/cifs/smb1ops.c | 19 +-
fs/cifs/smb2inode.c | 9 -
fs/cifs/smb2ops.c | 92 ++++-------
fs/cifs/smb2proto.h | 2
fs/ext4/fsmap.c | 2
fs/ext4/inline.c | 1
fs/ext4/inode.c | 7
fs/ext4/ioctl.c | 1
fs/ext4/namei.c | 36 +++-
fs/ext4/xattr.c | 3
fs/file.c | 1
include/asm-generic/vmlinux.lds.h | 16 +-
include/linux/irqdomain.h | 2
include/linux/pci_ids.h | 2
include/net/netfilter/nf_tproxy.h | 7
kernel/bpf/btf.c | 1
kernel/irq/irqdomain.c | 62 +++++--
net/caif/caif_usb.c | 3
net/ipv4/netfilter/nf_tproxy_ipv4.c | 2
net/ipv6/ila/ila_xlat.c | 1
net/ipv6/netfilter/nf_tproxy_ipv6.c | 2
net/nfc/netlink.c | 2
net/smc/af_smc.c | 13 +
tools/testing/selftests/netfilter/nft_nat.sh | 2
65 files changed, 557 insertions(+), 443 deletions(-)
Alexandre Ghiti (1):
riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
Alvaro Karsz (1):
PCI: Add SolidRun vendor ID
Amir Goldstein (1):
SMB3: Backup intent flag missing from some more ops
Andrew Cooper (1):
x86/CPU/AMD: Disable XSAVES on AMD family 0x17
Bart Van Assche (1):
scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
Bixuan Cui (1):
irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent
Chandrakanth Patil (1):
scsi: megaraid_sas: Update max supported LD IDs to 240
Corey Minyard (5):
ipmi:ssif: resend_msg() cannot fail
ipmi:ssif: Remove rtc_us_timer
ipmi:ssif: Increase the message retry time
ipmi:ssif: Add a timer between request retries
ipmi:watchdog: Set panic count to proper value on a panic
D. Wythe (1):
net/smc: fix fallback failed while sendmsg with fastopen
Darrick J. Wong (1):
ext4: fix another off-by-one fsmap error on 1k block filesystems
Dmitry Baryshkov (1):
drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register
Edward Humes (1):
alpha: fix R_ALPHA_LITERAL reloc for large modules
Eric Dumazet (1):
ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
Eric Whitney (1):
ext4: fix RENAME_WHITEOUT handling for inline directories
Fedor Pchelkin (1):
nfc: change order inside nfc_se_io error path
Florian Westphal (1):
netfilter: tproxy: fix deadlock due to missing BH disable
Gavrilov Ilia (1):
iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter
Greg Kroah-Hartman (1):
Linux 5.4.237
H.J. Lu (1):
x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS
Hangbin Liu (1):
selftests: nft_nat: ensuring the listening side is up before starting the client
Harry Wentland (1):
drm/connector: print max_requested_bpc in state debugfs
Jacob Pan (1):
iommu/vt-d: Fix PASID directory pointer coherency
Jan Kara (2):
ext4: Fix possible corruption when moving a directory
ext4: Fix deadlock during directory rename
John Harrison (1):
drm/i915: Don't use BAR mappings for ring buffers with LLC
Kang Chen (1):
nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
Kim Phillips (1):
iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options
Lee Jones (1):
net: usb: lan78xx: Remove lots of set but unused 'ret' variables
Liguang Zhang (1):
ipmi:ssif: make ssif_i2c_send() void
Lorenz Bauer (1):
btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR
Marc Zyngier (1):
irqdomain: Fix domain registration race
Masahiro Yamada (3):
arch: fix broken BuildID for arm64 and riscv
s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
UML: define RUNTIME_DISCARD_EXIT
Michael Chan (1):
bnxt_en: Avoid order-5 memory allocation for TPA data
Michael Ellerman (2):
powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
Nathan Chancellor (1):
macintosh: windfarm: Use unsigned type for 1-bit bitfields
Paul Elder (1):
media: ov5640: Fix analogue gain control
Shigeru Yoshida (1):
net: caif: Fix use-after-free in cfusbl_device_notify()
Stefan Haberland (1):
s390/dasd: add missing discipline function
Suravee Suthikulpanit (1):
iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands
Theodore Ts'o (1):
fs: prevent out-of-bounds array speculation when closing a file descriptor
Tom Saeger (1):
sh: define RUNTIME_DISCARD_EXIT
Volker Lendecke (1):
cifs: Fix uninitialized memory read in smb3_qfs_tcon()
Ye Bin (2):
ext4: move where set the MAY_INLINE_DATA flag is set
ext4: fix WARNING in ext4_update_inline_data
Yejune Deng (1):
ipmi/watchdog: replace atomic_add() and atomic_sub()
Yuiko Oshino (1):
net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver
Zhihao Cheng (1):
ext4: zero i_disksize when initializing the bootloader inode
xurui (1):
MIPS: Fix a compilation issue
I'm announcing the release of the 4.19.278 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/alpha/kernel/module.c | 4 -
arch/mips/include/asm/mach-rc32434/pci.h | 2
arch/x86/kernel/cpu/amd.c | 9 +++
drivers/gpu/drm/i915/intel_ringbuffer.c | 4 -
drivers/macintosh/windfarm_lm75_sensor.c | 4 -
drivers/macintosh/windfarm_smu_sensors.c | 4 -
drivers/media/i2c/ov5640.c | 2
drivers/nfc/fdp/i2c.c | 4 +
drivers/scsi/hosts.c | 2
drivers/staging/mt7621-spi/spi-mt7621.c | 8 ++-
fs/ext4/fsmap.c | 2
fs/ext4/inline.c | 1
fs/ext4/inode.c | 7 ++
fs/ext4/ioctl.c | 1
fs/ext4/namei.c | 13 ++---
fs/ext4/xattr.c | 3 +
fs/file.c | 1
fs/udf/directory.c | 2
fs/udf/file.c | 7 +-
fs/udf/ialloc.c | 14 ++---
fs/udf/inode.c | 76 +++++++++++++++++++++----------
fs/udf/misc.c | 6 +-
fs/udf/namei.c | 7 +-
fs/udf/partition.c | 2
fs/udf/super.c | 12 ++++
fs/udf/symlink.c | 2
fs/udf/udf_i.h | 12 ++--
include/linux/pci_ids.h | 2
net/caif/caif_usb.c | 3 +
net/ipv6/ila/ila_xlat.c | 1
net/nfc/netlink.c | 2
net/tipc/socket.c | 2
scripts/Makefile.build | 4 +
34 files changed, 149 insertions(+), 78 deletions(-)
Alvaro Karsz (1):
PCI: Add SolidRun vendor ID
Andrew Cooper (1):
x86/CPU/AMD: Disable XSAVES on AMD family 0x17
Bart Van Assche (1):
scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
Darrick J. Wong (1):
ext4: fix another off-by-one fsmap error on 1k block filesystems
Edward Humes (1):
alpha: fix R_ALPHA_LITERAL reloc for large modules
Eric Dumazet (1):
ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
Eric Whitney (1):
ext4: fix RENAME_WHITEOUT handling for inline directories
Fedor Pchelkin (1):
nfc: change order inside nfc_se_io error path
Greg Kroah-Hartman (1):
Linux 4.19.278
Jan Kara (4):
udf: Explain handling of load_nls() failure
udf: Remove pointless union in udf_inode_info
udf: Preserve link count of system files
udf: Detect system inodes linked into directory hierarchy
John Harrison (1):
drm/i915: Don't use BAR mappings for ring buffers with LLC
Kang Chen (1):
nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
Masahiro Yamada (2):
kbuild: fix false-positive need-builtin calculation
kbuild: generate modules.order only in directories visited by obj-y/m
Nathan Chancellor (1):
macintosh: windfarm: Use unsigned type for 1-bit bitfields
Nobuhiro Iwamatsu (1):
Revert "spi: mt7621: Fix an error message in mt7621_spi_probe()"
Paul Elder (1):
media: ov5640: Fix analogue gain control
Shigeru Yoshida (1):
net: caif: Fix use-after-free in cfusbl_device_notify()
Steven J. Magnani (1):
udf: reduce leakage of blocks related to named streams
Theodore Ts'o (1):
fs: prevent out-of-bounds array speculation when closing a file descriptor
Tung Nguyen (1):
tipc: improve function tipc_wait_for_cond()
Ye Bin (2):
ext4: move where set the MAY_INLINE_DATA flag is set
ext4: fix WARNING in ext4_update_inline_data
Zhihao Cheng (1):
ext4: zero i_disksize when initializing the bootloader inode
xurui (1):
MIPS: Fix a compilation issue
I'm announcing the release of the 4.14.310 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/alpha/kernel/module.c | 4 +---
arch/mips/include/asm/mach-rc32434/pci.h | 2 +-
arch/x86/kernel/cpu/amd.c | 11 ++++++++++-
drivers/gpu/drm/i915/intel_ringbuffer.c | 4 ++--
drivers/macintosh/windfarm_lm75_sensor.c | 4 ++--
drivers/macintosh/windfarm_smu_sensors.c | 4 ++--
drivers/media/i2c/ov5640.c | 2 +-
drivers/nfc/fdp/i2c.c | 4 ++++
fs/ext4/fsmap.c | 2 ++
fs/ext4/inline.c | 1 -
fs/ext4/inode.c | 7 ++++++-
fs/ext4/ioctl.c | 1 +
fs/ext4/namei.c | 13 +++++++------
fs/ext4/xattr.c | 3 +++
fs/file.c | 1 +
include/linux/pci_ids.h | 2 ++
net/caif/caif_usb.c | 3 +++
net/ipv6/ila/ila_xlat.c | 1 +
net/nfc/netlink.c | 2 +-
net/tipc/socket.c | 2 +-
21 files changed, 52 insertions(+), 23 deletions(-)
Alvaro Karsz (1):
PCI: Add SolidRun vendor ID
Andrew Cooper (1):
x86/CPU/AMD: Disable XSAVES on AMD family 0x17
Darrick J. Wong (1):
ext4: fix another off-by-one fsmap error on 1k block filesystems
Edward Humes (1):
alpha: fix R_ALPHA_LITERAL reloc for large modules
Eric Dumazet (1):
ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
Eric Whitney (1):
ext4: fix RENAME_WHITEOUT handling for inline directories
Fedor Pchelkin (1):
nfc: change order inside nfc_se_io error path
Greg Kroah-Hartman (1):
Linux 4.14.310
John Harrison (1):
drm/i915: Don't use BAR mappings for ring buffers with LLC
Kang Chen (1):
nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
Nathan Chancellor (1):
macintosh: windfarm: Use unsigned type for 1-bit bitfields
Paul Elder (1):
media: ov5640: Fix analogue gain control
Rhythm Mahajan (1):
x86/cpu: Fix LFENCE serialization check in init_amd()
Shigeru Yoshida (1):
net: caif: Fix use-after-free in cfusbl_device_notify()
Theodore Ts'o (1):
fs: prevent out-of-bounds array speculation when closing a file descriptor
Tung Nguyen (1):
tipc: improve function tipc_wait_for_cond()
Ye Bin (2):
ext4: move where set the MAY_INLINE_DATA flag is set
ext4: fix WARNING in ext4_update_inline_data
Zhihao Cheng (1):
ext4: zero i_disksize when initializing the bootloader inode
xurui (1):
MIPS: Fix a compilation issue
From: Eric Biggers <ebiggers(a)google.com>
[No upstream commit because this fixes a bug in a backport.]
Before upstream commit 59bb47985c1d ("mm, sl[aou]b: guarantee natural
alignment for kmalloc(power-of-two)") which went into v5.4, kmalloc did
*not* always guarantee that PAGE_SIZE allocations are PAGE_SIZE-aligned.
Upstream commit 2efc459d06f1 ("sysfs: Add sysfs_emit and sysfs_emit_at
to format sysfs output") added two WARN()s that trigger when PAGE_SIZE
allocations are not PAGE_SIZE-aligned. This was backported to old
kernels that don't guarantee PAGE_SIZE alignment.
Commit 10ddfb495232 ("fs: sysfs_emit: Remove PAGE_SIZE alignment check")
in 4.19.y, and its equivalent in 4.14.y and 4.9.y, tried to fix this
bug. However, only it handled sysfs_emit(), not sysfs_emit_at().
Fix it in sysfs_emit_at() too.
A reproducer is to build the kernel with the following options:
CONFIG_SLUB=y
CONFIG_SLUB_DEBUG=y
CONFIG_SLUB_DEBUG_ON=y
CONFIG_PM=y
CONFIG_SUSPEND=y
CONFIG_PM_WAKELOCKS=y
Then run:
echo foo > /sys/power/wake_lock && cat /sys/power/wake_lock
Fixes: 390881843b4f ("sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output")
Reported-by: kernel test robot <yujie.liu(a)intel.com>
Link: https://lore.kernel.org/r/202303141634.1e64fd76-yujie.liu@intel.com
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
fs/sysfs/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index c41e7f51150fc..cef9a469f73a8 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -592,7 +592,7 @@ int sysfs_emit_at(char *buf, int at, const char *fmt, ...)
va_list args;
int len;
- if (WARN(!buf || offset_in_page(buf) || at < 0 || at >= PAGE_SIZE,
+ if (WARN(!buf || at < 0 || at >= PAGE_SIZE,
"invalid sysfs_emit_at: buf:%p at:%d\n", buf, at))
return 0;
--
2.39.2
From: Eric Biggers <ebiggers(a)google.com>
[No upstream commit because this fixes a bug in a backport.]
Before upstream commit 59bb47985c1d ("mm, sl[aou]b: guarantee natural
alignment for kmalloc(power-of-two)") which went into v5.4, kmalloc did
*not* always guarantee that PAGE_SIZE allocations are PAGE_SIZE-aligned.
Upstream commit 2efc459d06f1 ("sysfs: Add sysfs_emit and sysfs_emit_at
to format sysfs output") added two WARN()s that trigger when PAGE_SIZE
allocations are not PAGE_SIZE-aligned. This was backported to old
kernels that don't guarantee PAGE_SIZE alignment.
Commit 10ddfb495232 ("fs: sysfs_emit: Remove PAGE_SIZE alignment check")
in 4.19.y, and its equivalent in 4.14.y and 4.9.y, tried to fix this
bug. However, only it handled sysfs_emit(), not sysfs_emit_at().
Fix it in sysfs_emit_at() too.
A reproducer is to build the kernel with the following options:
CONFIG_SLUB=y
CONFIG_SLUB_DEBUG=y
CONFIG_SLUB_DEBUG_ON=y
CONFIG_PM=y
CONFIG_SUSPEND=y
CONFIG_PM_WAKELOCKS=y
Then run:
echo foo > /sys/power/wake_lock && cat /sys/power/wake_lock
Fixes: cb1f69d53ac8 ("sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output")
Reported-by: kernel test robot <yujie.liu(a)intel.com>
Link: https://lore.kernel.org/r/202303141634.1e64fd76-yujie.liu@intel.com
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
fs/sysfs/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 011e391497f4e..cd70dbeeab226 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -599,7 +599,7 @@ int sysfs_emit_at(char *buf, int at, const char *fmt, ...)
va_list args;
int len;
- if (WARN(!buf || offset_in_page(buf) || at < 0 || at >= PAGE_SIZE,
+ if (WARN(!buf || at < 0 || at >= PAGE_SIZE,
"invalid sysfs_emit_at: buf:%p at:%d\n", buf, at))
return 0;
--
2.39.2