From patchwork Tue Jun 9 17:44:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224620 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9599C433DF for ; Tue, 9 Jun 2020 18:19:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 98A2F2067B for ; Tue, 9 Jun 2020 18:19:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726772; bh=et9YtkaNWCi90vne3IgotzdPWzrupwfZhlFMkeqow5o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=V8pFZLySyHGztBv8P8VgWkq7FO309WhxgUaknwyDELIvCIsdej+fRJnUyMGrULIXJ 4bvRsIVRkekgHDyjQBc2MHbr/c/wYTWIQAeX6M29PbEHf+C9gAmLYzoULDTHrGI/2u szF7MyKPHkS0Y8w7hbHmw/7akfIXIZUfIXhQtGl8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732538AbgFIRth (ORCPT ); Tue, 9 Jun 2020 13:49:37 -0400 Received: from mail.kernel.org ([198.145.29.99]:35832 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730925AbgFIRtg (ORCPT ); Tue, 9 Jun 2020 13:49:36 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AAC0B2081A; Tue, 9 Jun 2020 17:49:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724976; bh=et9YtkaNWCi90vne3IgotzdPWzrupwfZhlFMkeqow5o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WlrXtT38WxwU8GtocmYUUTododx/JW2+wN/q4vvCrn6gSFX2j7U46a8xis5yFy8nD iHhO7ojic/9u0PNVxdXhv4nQq+Id9kyK+I1ka9WpsGgQnWUooH5YIhcul5cHUZqkoH GS87bEMHMGhejZ7UoxpwEIneOyyYuL+pfBixsw2o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vishal Verma , "Aneesh Kumar K.V" , Dan Williams , Guenter Roeck Subject: =?utf-8?q?=5BPATCH_4=2E14_02/46=5D_libnvdimm=3A_Fix_endian_conve?= =?utf-8?q?rsion_issues=C2=A0?= Date: Tue, 9 Jun 2020 19:44:18 +0200 Message-Id: <20200609174023.128836157@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Aneesh Kumar K.V commit 86aa66687442ef45909ff9814b82b4d2bb892294 upstream. nd_label->dpa issue was observed when trying to enable the namespace created with little-endian kernel on a big-endian kernel. That made me run `sparse` on the rest of the code and other changes are the result of that. Fixes: d9b83c756953 ("libnvdimm, btt: rework error clearing") Fixes: 9dedc73a4658 ("libnvdimm/btt: Fix LBA masking during 'free list' population") Reviewed-by: Vishal Verma Signed-off-by: Aneesh Kumar K.V Link: https://lore.kernel.org/r/20190809074726.27815-1-aneesh.kumar@linux.ibm.com Signed-off-by: Dan Williams Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman --- drivers/nvdimm/btt.c | 8 ++++---- drivers/nvdimm/namespace_devs.c | 7 ++++--- 2 files changed, 8 insertions(+), 7 deletions(-) --- a/drivers/nvdimm/btt.c +++ b/drivers/nvdimm/btt.c @@ -399,9 +399,9 @@ static int btt_flog_write(struct arena_i arena->freelist[lane].sub = 1 - arena->freelist[lane].sub; if (++(arena->freelist[lane].seq) == 4) arena->freelist[lane].seq = 1; - if (ent_e_flag(ent->old_map)) + if (ent_e_flag(le32_to_cpu(ent->old_map))) arena->freelist[lane].has_err = 1; - arena->freelist[lane].block = le32_to_cpu(ent_lba(ent->old_map)); + arena->freelist[lane].block = ent_lba(le32_to_cpu(ent->old_map)); return ret; } @@ -567,8 +567,8 @@ static int btt_freelist_init(struct aren * FIXME: if error clearing fails during init, we want to make * the BTT read-only */ - if (ent_e_flag(log_new.old_map) && - !ent_normal(log_new.old_map)) { + if (ent_e_flag(le32_to_cpu(log_new.old_map)) && + !ent_normal(le32_to_cpu(log_new.old_map))) { arena->freelist[i].has_err = 1; ret = arena_clear_freelist_error(arena, i); if (ret) --- a/drivers/nvdimm/namespace_devs.c +++ b/drivers/nvdimm/namespace_devs.c @@ -1978,7 +1978,7 @@ struct device *create_namespace_pmem(str nd_mapping = &nd_region->mapping[i]; label_ent = list_first_entry_or_null(&nd_mapping->labels, typeof(*label_ent), list); - label0 = label_ent ? label_ent->label : 0; + label0 = label_ent ? label_ent->label : NULL; if (!label0) { WARN_ON(1); @@ -2315,8 +2315,9 @@ static struct device **scan_labels(struc continue; /* skip labels that describe extents outside of the region */ - if (nd_label->dpa < nd_mapping->start || nd_label->dpa > map_end) - continue; + if (__le64_to_cpu(nd_label->dpa) < nd_mapping->start || + __le64_to_cpu(nd_label->dpa) > map_end) + continue; i = add_namespace_resource(nd_region, nd_label, devs, count); if (i < 0) From patchwork Tue Jun 9 17:44:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 187699 Delivered-To: patch@linaro.org Received: by 2002:a54:30ca:0:0:0:0:0 with SMTP id e10csp639677ecs; Tue, 9 Jun 2020 11:19:44 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwMypWq0C8ITI1elKQfQs7QhOrD9ykg9fnNqLb1ia5QuSfFRcPDawCBkuzcj4+r6UamY507 X-Received: by 2002:aa7:d290:: with SMTP id w16mr28770052edq.178.1591726784265; Tue, 09 Jun 2020 11:19:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1591726784; cv=none; d=google.com; s=arc-20160816; b=WoIK55kEuoXCfKhH0S8AY1ClzNJyYI6FAWJxakaQ7e9Tn5YbW1HperPw1GwwBpUqUB c3j5gLglBEBIM+Snq2WQG3r9ItY6fPg+iAfVfFKGd7aqegeNg+eYS2becO6Htu8k3e4O UC4/8rRG5w4X2qgHvK2Fzod1B9O0hp5lz/wLn+yCgrSnfW0ErMfK/eQMBmceP/fS6Rpo PegNHXHistdcvKBa8p1F4DX2CWoXmJqNhKmqvO5GFrBiKa+jhBsjpLjxE9/3E4yrKl7c LsdcnjLS4LGQ49FM4dM3Ucs8ZLhxdlTf8f1dPg7VIPFlUB4X/FOZOI/SN4MDZQwxmOrU xWVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=FeK00y+UNYPXHViSZ0XKJy/quSL0PYbx/sw+RyGXbBU=; b=JFWLVmquJEfH/P0TGerCyt92s3rw80Ev33ZOl5Lls4MxLseKHUH131scutUfrVzFAk vkQsWLwSjH07197Mq2h0srsxGFHY0g7MGa4TKbqrJuXdnluxl0EFuLTeaOhtcB0vee22 2IBcyleehzkXkR7QvnU61TJV+TOeDk0lTg2we36vom3XbZjKxtdvnk22MlGeQ1o2ycRs /9YvwBoBPbRbhPptQQhHHz54BOhFdJu07NYUskxCjRYTuz4Q196E0/Yg//gbKdalm3hS 4AI86n4QUp80DvR/yb9g3WYZTVWJjSCeWO1I0VUu9PSPRB60Ypk7SZCu/uvS2VcnB6Ck 16Gg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Eoc7WEJs; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id l10si11034008ejb.576.2020.06.09.11.19.44; Tue, 09 Jun 2020 11:19:44 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Eoc7WEJs; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731234AbgFISTc (ORCPT + 15 others); Tue, 9 Jun 2020 14:19:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:36004 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732544AbgFIRtl (ORCPT ); Tue, 9 Jun 2020 13:49:41 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3C2FE20812; Tue, 9 Jun 2020 17:49:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724980; bh=mVl9YgrtiKcOe6VHrWSY6aDgR5QeahVoj7ufwEgl4dc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Eoc7WEJsKPYfJ9bXd/KhhCwt/DzXPurbyHNWKvsIDHj/Z8OjaunU/BNBgLoZAjtCm vV4Itxi15HHobzqSb3jN8MIXR3REadk0V40NPmRxfVOARfkf2UnQELvGvsK6m2Ik48 Ha6Mg/7MdEK7tLHeGLjsitKGjZ9Dhh8O0+lyhPJQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, fengsheng , Xinwei Kong , Mark Brown , Sasha Levin Subject: [PATCH 4.14 04/46] spi: dw: use "smp_mb()" to avoid sending spi data error Date: Tue, 9 Jun 2020 19:44:20 +0200 Message-Id: <20200609174023.282147985@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Xinwei Kong [ Upstream commit bfda044533b213985bc62bd7ca96f2b984d21b80 ] Because of out-of-order execution about some CPU architecture, In this debug stage we find Completing spi interrupt enable -> prodrucing TXEI interrupt -> running "interrupt_transfer" function will prior to set "dw->rx and dws->rx_end" data, so this patch add memory barrier to enable dw->rx and dw->rx_end to be visible and solve to send SPI data error. eg: it will fix to this following low possibility error in testing environment which using SPI control to connect TPM Modules kernel: tpm tpm0: Operation Timed out kernel: tpm tpm0: tpm_relinquish_locality: : error -1 Signed-off-by: fengsheng Signed-off-by: Xinwei Kong Link: https://lore.kernel.org/r/1578019930-55858-1-git-send-email-kong.kongxinwei@hisilicon.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- drivers/spi/spi-dw.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.25.1 diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c index b461200871f8..cbdad3c4930f 100644 --- a/drivers/spi/spi-dw.c +++ b/drivers/spi/spi-dw.c @@ -305,6 +305,9 @@ static int dw_spi_transfer_one(struct spi_master *master, dws->len = transfer->len; spin_unlock_irqrestore(&dws->buf_lock, flags); + /* Ensure dw->rx and dw->rx_end are visible */ + smp_mb(); + spi_enable_chip(dws, 0); /* Handle per transfer options for bpw and speed */ From patchwork Tue Jun 9 17:44:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224619 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34265C433E1 for ; Tue, 9 Jun 2020 18:19:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0B2602068D for ; Tue, 9 Jun 2020 18:19:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726784; bh=3XDvXZld3h/2dX04iqm+4ls4antOHtFKxEtomIO23CY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=C4XV3N84jeyIfaImgq8XW5g6WpOdcoxcYMPcgNaoF7YUkQGzPC6+UiNzaSxTcIYWv aJ2hzctuPam2pK0kwsFCojENAf+HhyeydEYd8HOSH3/Qu9kKCo4uYntaLl8ALsEHBX 3UuKSvjD8gQO2cT4qIvzj7ayvfkL2f2uMHZJJHqk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388856AbgFISTb (ORCPT ); Tue, 9 Jun 2020 14:19:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:36092 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732550AbgFIRtn (ORCPT ); Tue, 9 Jun 2020 13:49:43 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 864C720801; Tue, 9 Jun 2020 17:49:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724983; bh=3XDvXZld3h/2dX04iqm+4ls4antOHtFKxEtomIO23CY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pjw3OcJcp6+hlROmUQVnu8ab/cPVtlGkapfORifQ6YWtpIJikZDEzuPmsWQaaTNxs AG+zcD3VuxO4Y65OBgSNcRgc2wsh4uN6JBsNDo99Z8n91JGETcpl+/KjSt+0qJdyQK jRxCecL5G3GtmObbwFVy6ciYbZiQmqkJXhJvYCqs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sven Schnelle , Vasily Gorbik , Sasha Levin Subject: [PATCH 4.14 05/46] s390/ftrace: save traced function caller Date: Tue, 9 Jun 2020 19:44:21 +0200 Message-Id: <20200609174023.361913754@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vasily Gorbik [ Upstream commit b4adfe55915d8363e244e42386d69567db1719b9 ] A typical backtrace acquired from ftraced function currently looks like the following (e.g. for "path_openat"): arch_stack_walk+0x15c/0x2d8 stack_trace_save+0x50/0x68 stack_trace_call+0x15a/0x3b8 ftrace_graph_caller+0x0/0x1c 0x3e0007e3c98 <- ftraced function caller (should be do_filp_open+0x7c/0xe8) do_open_execat+0x70/0x1b8 __do_execve_file.isra.0+0x7d8/0x860 __s390x_sys_execve+0x56/0x68 system_call+0xdc/0x2d8 Note random "0x3e0007e3c98" stack value as ftraced function caller. This value causes either imprecise unwinder result or unwinding failure. That "0x3e0007e3c98" comes from r14 of ftraced function stack frame, which it haven't had a chance to initialize since the very first instruction calls ftrace code ("ftrace_caller"). (ftraced function might never save r14 as well). Nevertheless according to s390 ABI any function is called with stack frame allocated for it and r14 contains return address. "ftrace_caller" itself is called with "brasl %r0,ftrace_caller". So, to fix this issue simply always save traced function caller onto ftraced function stack frame. Reported-by: Sven Schnelle Signed-off-by: Vasily Gorbik Signed-off-by: Sasha Levin --- arch/s390/kernel/mcount.S | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S index 0cfd5a83a1da..151f001a90ff 100644 --- a/arch/s390/kernel/mcount.S +++ b/arch/s390/kernel/mcount.S @@ -40,6 +40,7 @@ EXPORT_SYMBOL(_mcount) ENTRY(ftrace_caller) .globl ftrace_regs_caller .set ftrace_regs_caller,ftrace_caller + stg %r14,(__SF_GPRS+8*8)(%r15) # save traced function caller lgr %r1,%r15 #ifndef CC_USING_HOTPATCH aghi %r0,MCOUNT_RETURN_FIXUP From patchwork Tue Jun 9 17:44:23 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224621 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EEC15C433DF for ; Tue, 9 Jun 2020 18:19:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C030220737 for ; Tue, 9 Jun 2020 18:19:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726766; bh=Ha8hus8kNUcxNjEXYLlcqZknjg8ABCTXWAqD0vvPCzk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=njlCmfQUyVXUDx68T+b0cgzcJeOvYIPJ+JaR18AHW6JMVuCRLttGdBgA4civgQnAE bOj4OB19IetHJDYvm6kYFHJnPz+yGjRTLts53cUPsvSwHI0D8CMThGmQXHlZWR3lGX JQxzn6D2FKdbjYrJ8ZhTM2xLllYXYTq1yjzA7Ah4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388773AbgFISTI (ORCPT ); Tue, 9 Jun 2020 14:19:08 -0400 Received: from mail.kernel.org ([198.145.29.99]:36302 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730749AbgFIRts (ORCPT ); Tue, 9 Jun 2020 13:49:48 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2E36D207F9; Tue, 9 Jun 2020 17:49:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724987; bh=Ha8hus8kNUcxNjEXYLlcqZknjg8ABCTXWAqD0vvPCzk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GWXGqHRJLgG9jfZpH8WrEp/Esf0h0n705o3l2S5r5kb5rTqQdZvzD8/8AK4q/nUX9 lADE2QjRwkpCF7lqRePdxCDTF/PzhbQHzAK9f57rdgHtsE9it1RG1pMrByuljtzT2W oytYTUGnVnCYaywlwB02PYVT+poyHRqXq8RLIOKM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paul Greco , Eugeniy Paltsev , Vineet Gupta , Sasha Levin Subject: [PATCH 4.14 07/46] ARC: Fix ICCM & DCCM runtime size checks Date: Tue, 9 Jun 2020 19:44:23 +0200 Message-Id: <20200609174023.542770029@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eugeniy Paltsev [ Upstream commit 43900edf67d7ef3ac8909854d75b8a1fba2d570c ] As of today the ICCM and DCCM size checks are incorrectly using mismatched units (KiB checked against bytes). The CONFIG_ARC_DCCM_SZ and CONFIG_ARC_ICCM_SZ are in KiB, but the size calculated in runtime and stored in cpu->dccm.sz and cpu->iccm.sz is in bytes. Fix that. Reported-by: Paul Greco Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta Signed-off-by: Sasha Levin --- arch/arc/kernel/setup.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c index 6b8d106e0d53..11c2c4a3fe69 100644 --- a/arch/arc/kernel/setup.c +++ b/arch/arc/kernel/setup.c @@ -15,6 +15,7 @@ #include #include #include +#include #include #include #include @@ -355,12 +356,12 @@ static void arc_chk_core_config(void) if ((unsigned int)__arc_dccm_base != cpu->dccm.base_addr) panic("Linux built with incorrect DCCM Base address\n"); - if (CONFIG_ARC_DCCM_SZ != cpu->dccm.sz) + if (CONFIG_ARC_DCCM_SZ * SZ_1K != cpu->dccm.sz) panic("Linux built with incorrect DCCM Size\n"); #endif #ifdef CONFIG_ARC_HAS_ICCM - if (CONFIG_ARC_ICCM_SZ != cpu->iccm.sz) + if (CONFIG_ARC_ICCM_SZ * SZ_1K != cpu->iccm.sz) panic("Linux built with incorrect ICCM Size\n"); #endif From patchwork Tue Jun 9 17:44:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224698 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43FBFC433DF for ; Tue, 9 Jun 2020 17:49:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1957A207ED for ; Tue, 9 Jun 2020 17:49:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724995; bh=8su1/yDtzEiYTbiR3qLGi+y6W6cRci67Qbj9Nl2n2BQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=a5WV+nIb3dX0jaCNsvrX99cv4lzCc8JF+vQJzKthVKLiTqfoYZCt8+M4Rg/LVSPvZ 3Kq7WzbA6/Vfgj8YYkUljd4Xk+3ZWYjpoGe6VsHtBKyUlNTA7xSPTIgYaZO1ahXdvn dquuGsEwttdvqbvEMi7+NIfAOyV7wmMB1Ek846CQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732584AbgFIRtx (ORCPT ); Tue, 9 Jun 2020 13:49:53 -0400 Received: from mail.kernel.org ([198.145.29.99]:36548 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730956AbgFIRtx (ORCPT ); Tue, 9 Jun 2020 13:49:53 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CA212208B6; Tue, 9 Jun 2020 17:49:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724992; bh=8su1/yDtzEiYTbiR3qLGi+y6W6cRci67Qbj9Nl2n2BQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C775qNLb4y3lR9pr3ja8SfxNqmBqjnBHuFIWdjDCo+JcCEeV2mi6MhiIbGFDlsrzk d1FaWvuO7uAlqTfDy5hSVTBTAN+5WdEp/OP4UHm942Ixm+ks/eOicfIIHVOdBYAeKR XwJ4s+k81kilb8zihS6HRR7c+YrW6m9ZqVxQ3OBo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Atsushi Nemoto , Thor Thayer , Wolfram Sang , Sasha Levin Subject: [PATCH 4.14 09/46] i2c: altera: Fix race between xfer_msg and isr thread Date: Tue, 9 Jun 2020 19:44:25 +0200 Message-Id: <20200609174023.715903677@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Atsushi Nemoto [ Upstream commit 5d4c7977499a736f3f80826bdc9744344ad55589 ] Use a mutex to protect access to idev->msg_len, idev->buf, etc. which are modified by both altr_i2c_xfer_msg() and altr_i2c_isr(). This is the minimal fix for easy backporting. A cleanup to remove the spinlock will be added later. Signed-off-by: Atsushi Nemoto Acked-by: Thor Thayer [wsa: updated commit message] Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin --- drivers/i2c/busses/i2c-altera.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-altera.c b/drivers/i2c/busses/i2c-altera.c index 8915ee30a5b4..1d59eede537b 100644 --- a/drivers/i2c/busses/i2c-altera.c +++ b/drivers/i2c/busses/i2c-altera.c @@ -81,6 +81,7 @@ * @isr_mask: cached copy of local ISR enables. * @isr_status: cached copy of local ISR status. * @lock: spinlock for IRQ synchronization. + * @isr_mutex: mutex for IRQ thread. */ struct altr_i2c_dev { void __iomem *base; @@ -97,6 +98,7 @@ struct altr_i2c_dev { u32 isr_mask; u32 isr_status; spinlock_t lock; /* IRQ synchronization */ + struct mutex isr_mutex; }; static void @@ -256,10 +258,11 @@ static irqreturn_t altr_i2c_isr(int irq, void *_dev) struct altr_i2c_dev *idev = _dev; u32 status = idev->isr_status; + mutex_lock(&idev->isr_mutex); if (!idev->msg) { dev_warn(idev->dev, "unexpected interrupt\n"); altr_i2c_int_clear(idev, ALTR_I2C_ALL_IRQ); - return IRQ_HANDLED; + goto out; } read = (idev->msg->flags & I2C_M_RD) != 0; @@ -312,6 +315,8 @@ static irqreturn_t altr_i2c_isr(int irq, void *_dev) complete(&idev->msg_complete); dev_dbg(idev->dev, "Message Complete\n"); } +out: + mutex_unlock(&idev->isr_mutex); return IRQ_HANDLED; } @@ -323,6 +328,7 @@ static int altr_i2c_xfer_msg(struct altr_i2c_dev *idev, struct i2c_msg *msg) u32 value; u8 addr = i2c_8bit_addr_from_msg(msg); + mutex_lock(&idev->isr_mutex); idev->msg = msg; idev->msg_len = msg->len; idev->buf = msg->buf; @@ -347,6 +353,7 @@ static int altr_i2c_xfer_msg(struct altr_i2c_dev *idev, struct i2c_msg *msg) altr_i2c_int_enable(idev, imask, true); altr_i2c_fill_tx_fifo(idev); } + mutex_unlock(&idev->isr_mutex); time_left = wait_for_completion_timeout(&idev->msg_complete, ALTR_I2C_XFER_TIMEOUT); @@ -420,6 +427,7 @@ static int altr_i2c_probe(struct platform_device *pdev) idev->dev = &pdev->dev; init_completion(&idev->msg_complete); spin_lock_init(&idev->lock); + mutex_init(&idev->isr_mutex); ret = device_property_read_u32(idev->dev, "fifo-size", &idev->fifo_size); From patchwork Tue Jun 9 17:44:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224700 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5ABEC433E2 for ; Tue, 9 Jun 2020 17:49:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 996BF20835 for ; Tue, 9 Jun 2020 17:49:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724960; bh=oneoTHrWpzNqI69GqpPe4DfpOYXgyNGWsMPEeL0cg/Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=FX0IOwKk57S6nyVOUrZf1QWTwL5MhEKB6kMa9TG8LKTF4Bl/ShyUnk05dAZxIrp7B dHhMxT990tcU4ebefaMRWGDP6ZNWrwGqyw4ejkgb2jAEcb+kLma0G7ByubENnOGa6q OjoVUbr9w2G7KAwMpB7VRnZ/OSQ0L6CMz5DkDVZw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732494AbgFIRtT (ORCPT ); Tue, 9 Jun 2020 13:49:19 -0400 Received: from mail.kernel.org ([198.145.29.99]:35030 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730631AbgFIRtS (ORCPT ); Tue, 9 Jun 2020 13:49:18 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1CA3E20814; Tue, 9 Jun 2020 17:49:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724957; bh=oneoTHrWpzNqI69GqpPe4DfpOYXgyNGWsMPEeL0cg/Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KHitHh/TCcxeJv0kzsjokHYK4jF2tKxEg8MM9+3EOL6uk/KinpM4f9zdCY7mCF45W Zh2pVsZhpMMt8742hWW4I2MBAG9HxkuHVWAkEHjO2sjvkj5Q2DyUEK688OJ8bvkVjQ Zl8E5dckq4LXn3VKj0y6qGnF0SaTQkd8GHn/mTNs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sedat Dilek , Nathan Chancellor , Borislav Petkov , Nick Desaulniers , "Steven Rostedt (VMware)" , Sasha Levin Subject: [PATCH 4.14 10/46] x86/mmiotrace: Use cpumask_available() for cpumask_var_t variables Date: Tue, 9 Jun 2020 19:44:26 +0200 Message-Id: <20200609174023.806117500@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Nathan Chancellor [ Upstream commit d7110a26e5905ec2fe3fc88bc6a538901accb72b ] When building with Clang + -Wtautological-compare and CONFIG_CPUMASK_OFFSTACK unset: arch/x86/mm/mmio-mod.c:375:6: warning: comparison of array 'downed_cpus' equal to a null pointer is always false [-Wtautological-pointer-compare] if (downed_cpus == NULL && ^~~~~~~~~~~ ~~~~ arch/x86/mm/mmio-mod.c:405:6: warning: comparison of array 'downed_cpus' equal to a null pointer is always false [-Wtautological-pointer-compare] if (downed_cpus == NULL || cpumask_weight(downed_cpus) == 0) ^~~~~~~~~~~ ~~~~ 2 warnings generated. Commit f7e30f01a9e2 ("cpumask: Add helper cpumask_available()") added cpumask_available() to fix warnings of this nature. Use that here so that clang does not warn regardless of CONFIG_CPUMASK_OFFSTACK's value. Reported-by: Sedat Dilek Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov Reviewed-by: Nick Desaulniers Acked-by: Steven Rostedt (VMware) Link: https://github.com/ClangBuiltLinux/linux/issues/982 Link: https://lkml.kernel.org/r/20200408205323.44490-1-natechancellor@gmail.com Signed-off-by: Sasha Levin --- arch/x86/mm/mmio-mod.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c index 4d434ddb75db..f140b2d39319 100644 --- a/arch/x86/mm/mmio-mod.c +++ b/arch/x86/mm/mmio-mod.c @@ -385,7 +385,7 @@ static void enter_uniprocessor(void) int cpu; int err; - if (downed_cpus == NULL && + if (!cpumask_available(downed_cpus) && !alloc_cpumask_var(&downed_cpus, GFP_KERNEL)) { pr_notice("Failed to allocate mask\n"); goto out; @@ -415,7 +415,7 @@ static void leave_uniprocessor(void) int cpu; int err; - if (downed_cpus == NULL || cpumask_weight(downed_cpus) == 0) + if (!cpumask_available(downed_cpus) || cpumask_weight(downed_cpus) == 0) return; pr_notice("Re-enabling CPUs...\n"); for_each_cpu(cpu, downed_cpus) { From patchwork Tue Jun 9 17:44:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224617 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0658EC433DF for ; Tue, 9 Jun 2020 18:20:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CE8312068D for ; Tue, 9 Jun 2020 18:20:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726801; bh=ZX1tnruJSvdsfDaH4vcNnaq0VG75PQYjQCUTI1CB0R4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=q/ahLM1ankG1Y6SFWXVBqgsWVjmYwIsfIQMovHWZN2KJwIf6Rz0n7vXs2t8Q8WL+C 6Phi8hsssTvEKJIcmI9ufNUOdP/XzS4JmDAwvPfLi6sAzoar2Alccguk12WG+f9sdt 5VQLK3n8d27tScRj9otpru40RSDcAZj7mxYDdsMw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388496AbgFISUB (ORCPT ); Tue, 9 Jun 2020 14:20:01 -0400 Received: from mail.kernel.org ([198.145.29.99]:35422 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730975AbgFIRt2 (ORCPT ); Tue, 9 Jun 2020 13:49:28 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 820E22081A; Tue, 9 Jun 2020 17:49:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724967; bh=ZX1tnruJSvdsfDaH4vcNnaq0VG75PQYjQCUTI1CB0R4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ClNiBmRto52E88aFrVt7R6vReqUcdBEw3e7fD+xiDbj2K1vjj3VrJJ/ilQ/aEYQE/ 6caoU5HdBiiZ7D93CXg200uF5ELeURhsigsGXbC79kI8m5HQQvJXGx+9L4TKV+E4OY +aB6l6RtWARBmQwkNi9xma+lfEOHM90SMO8ehnHc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dinghao Liu , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 14/46] net: smsc911x: Fix runtime PM imbalance on error Date: Tue, 9 Jun 2020 19:44:30 +0200 Message-Id: <20200609174024.222420538@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dinghao Liu [ Upstream commit 539d39ad0c61b35f69565a037d7586deaf6d6166 ] Remove runtime PM usage counter decrement when the increment function has not been called to keep the counter balanced. Signed-off-by: Dinghao Liu Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/ethernet/smsc/smsc911x.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c index ce4bfecc26c7..ae80a223975d 100644 --- a/drivers/net/ethernet/smsc/smsc911x.c +++ b/drivers/net/ethernet/smsc/smsc911x.c @@ -2515,20 +2515,20 @@ static int smsc911x_drv_probe(struct platform_device *pdev) retval = smsc911x_init(dev); if (retval < 0) - goto out_disable_resources; + goto out_init_fail; netif_carrier_off(dev); retval = smsc911x_mii_init(pdev, dev); if (retval) { SMSC_WARN(pdata, probe, "Error %i initialising mii", retval); - goto out_disable_resources; + goto out_init_fail; } retval = register_netdev(dev); if (retval) { SMSC_WARN(pdata, probe, "Error %i registering device", retval); - goto out_disable_resources; + goto out_init_fail; } else { SMSC_TRACE(pdata, probe, "Network interface: \"%s\"", dev->name); @@ -2569,9 +2569,10 @@ static int smsc911x_drv_probe(struct platform_device *pdev) return 0; -out_disable_resources: +out_init_fail: pm_runtime_put(&pdev->dev); pm_runtime_disable(&pdev->dev); +out_disable_resources: (void)smsc911x_disable_resources(pdev); out_enable_resources_fail: smsc911x_free_resources(pdev); From patchwork Tue Jun 9 17:44:32 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224618 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6540C433DF for ; Tue, 9 Jun 2020 18:19:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 792792068D for ; Tue, 9 Jun 2020 18:19:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726798; bh=SY18GA+tIARb2YcCuYXnUlMY8ORXBTCf1RfbNoTV/5g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=VwPP7HNnLwW8oa7wqcz0ey6ieB6H8M7rDnyVis6V2+j3znx73bC+RP8Yb/iujvIq2 cPg/JK0hBIuyNRAjNkhAuN9OYki4Jft7gEPZgqWQ15TxkIM64N+0SmcreKtp0Ips5X Pu0M3QpWBtXMtvmnY6p1k+vCRrmAk46h1TeLv5DA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732544AbgFISTp (ORCPT ); Tue, 9 Jun 2020 14:19:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:35600 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732521AbgFIRtc (ORCPT ); Tue, 9 Jun 2020 13:49:32 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 13FA320825; Tue, 9 Jun 2020 17:49:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724971; bh=SY18GA+tIARb2YcCuYXnUlMY8ORXBTCf1RfbNoTV/5g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0EEVdbA5XtZf+u1K1ilcVksiHy3r9xnhndS73XgikRuxJn8iddoknyqH+OxfOOJ0S xl1H6BdqcPao/U43gC2hfa2sfhDhq3KiihkT+R5lB0QUpZcetNHObbH0D43cY3zXVv 4rxH39J30Hda4yoweyIQknWyYa2kn3nkZBifnFJ4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Scott Shumate , Jiri Kosina Subject: [PATCH 4.14 16/46] HID: sony: Fix for broken buttons on DS3 USB dongles Date: Tue, 9 Jun 2020 19:44:32 +0200 Message-Id: <20200609174024.450732239@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Scott Shumate commit e72455b898ac678667c5674668186b4670d87d11 upstream. Fix for non-working buttons on knock-off USB dongles for Sony controllers. These USB dongles are used to connect older Sony DA/DS1/DS2 controllers via USB and are common on Amazon, AliExpress, etc. Without the patch, the square, X, and circle buttons do not function. These dongles used to work prior to kernel 4.10 but removing the global DS3 report fixup in commit e19a267b9987 ("HID: sony: DS3 comply to Linux gamepad spec") exposed the problem. Many people reported the problem on the Ubuntu forums and are working around the problem by falling back to the 4.9 hid-sony driver. The problem stems from these dongles incorrectly reporting their button count as 13 instead of 16. This patch fixes up the report descriptor by changing the button report count to 16 and removing 3 padding bits. Cc: stable@vger.kernel.org Fixes: e19a267b9987 ("HID: sony: DS3 comply to Linux gamepad spec") Signed-off-by: Scott Shumate Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hid-sony.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) --- a/drivers/hid/hid-sony.c +++ b/drivers/hid/hid-sony.c @@ -837,6 +837,23 @@ static u8 *sony_report_fixup(struct hid_ if (sc->quirks & PS3REMOTE) return ps3remote_fixup(hdev, rdesc, rsize); + /* + * Some knock-off USB dongles incorrectly report their button count + * as 13 instead of 16 causing three non-functional buttons. + */ + if ((sc->quirks & SIXAXIS_CONTROLLER_USB) && *rsize >= 45 && + /* Report Count (13) */ + rdesc[23] == 0x95 && rdesc[24] == 0x0D && + /* Usage Maximum (13) */ + rdesc[37] == 0x29 && rdesc[38] == 0x0D && + /* Report Count (3) */ + rdesc[43] == 0x95 && rdesc[44] == 0x03) { + hid_info(hdev, "Fixing up USB dongle report descriptor\n"); + rdesc[24] = 0x10; + rdesc[38] = 0x10; + rdesc[44] = 0x00; + } + return rdesc; } From patchwork Tue Jun 9 17:44:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224699 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2D19C433DF for ; Tue, 9 Jun 2020 17:49:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6E26B2083B for ; Tue, 9 Jun 2020 17:49:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724976; bh=yoGrA38esDLQ8SgY4VYMWUjj6qYv8c6hWJsXS2aZk1c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=LkEuLq1rBlATL11sP/EqRMPGuP1IcH2okRoL2LRQxY6z1QhGI5/p0XQEgdGDkC/lW jlLZO3v9eYn1YfoWxTvf8Gv+RPpduCYlCBhDZJdk4+ECvx6kP/eKMZgpAGspy7Tkxb ny1qjYsRW3JDPT2B4iLl3jA6p/pAMH70i8/aYL8A= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732531AbgFIRtf (ORCPT ); Tue, 9 Jun 2020 13:49:35 -0400 Received: from mail.kernel.org ([198.145.29.99]:35724 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732529AbgFIRte (ORCPT ); Tue, 9 Jun 2020 13:49:34 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 50FB020814; Tue, 9 Jun 2020 17:49:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724973; bh=yoGrA38esDLQ8SgY4VYMWUjj6qYv8c6hWJsXS2aZk1c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hCMkEJLnisxt3hpYRHht94gwVcquTiTyP6BtfTrLu0Ag3rjtPoj4dG0EmGfwKLt6T yg6ZAuprllygMuqm3huOCGam31svz7tL8aOZoaHdzxfMrja+TZTbWKAPk+Z03GNVXv L0SfdfXRVA5l5og7SVhDMIF9V/cfPl31Kd3AFDlI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julian Sax , Jiri Kosina Subject: [PATCH 4.14 17/46] HID: i2c-hid: add Schneider SCL142ALM to descriptor override Date: Tue, 9 Jun 2020 19:44:33 +0200 Message-Id: <20200609174024.569127744@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Julian Sax commit 6507ef10660efdfee93f0f3b9fac24b5e4d83e56 upstream. This device uses the SIPODEV SP1064 touchpad, which does not supply descriptors, so it has to be added to the override list. Cc: stable@vger.kernel.org Signed-off-by: Julian Sax Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c @@ -381,6 +381,14 @@ static const struct dmi_system_id i2c_hi }, .driver_data = (void *)&sipodev_desc }, + { + .ident = "Schneider SCL142ALM", + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SCHNEIDER"), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SCL142ALM"), + }, + .driver_data = (void *)&sipodev_desc + }, { } /* Terminate list */ }; From patchwork Tue Jun 9 17:44:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224697 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D839C433DF for ; Tue, 9 Jun 2020 17:50:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4CE8720842 for ; Tue, 9 Jun 2020 17:50:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725003; bh=Kz3s+85aToSNZor3lNSzTXgUCRi49bWyg4iRofM0lvo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=hy3jFlheDssS4DKDYLim3/EMiaHlvUXYPZUFr8qrze3ma2Q560mVhz0Qq59ZrYjkH H8eTt1BuyeG2ALH5cdAstDVlZmLMKnzZuJ6F60Rih2AXQmpzJn2mbaLNZyQqswl5Wf EdKwf77zj+LZ5qHpB2CBzyQt16J5dCXUAP6DUbbM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730817AbgFIRt7 (ORCPT ); Tue, 9 Jun 2020 13:49:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:36744 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729535AbgFIRt5 (ORCPT ); Tue, 9 Jun 2020 13:49:57 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 346D7207F9; Tue, 9 Jun 2020 17:49:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724996; bh=Kz3s+85aToSNZor3lNSzTXgUCRi49bWyg4iRofM0lvo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zFmEIFo+hSYbHCScOYzZDvDii7UhQ2AOwvxCvQyXERc9nXywbTZTikgfuGMft1kfx 2LLYKYDdKHYRyqiiA9nDHoJ39MBlzGfe5MXSFpT5oNg6WO85yAQ9Ccgxdg5Xgz7jIT ATS4284aLkjl9+xwhjBl1XsnSVXT94s+vEXqy5sw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+1e925b4b836afe85a1c6@syzkaller-ppc64.appspotmail.com, syzbot+587b2421926808309d21@syzkaller-ppc64.appspotmail.com, syzbot+58320b7171734bf79d26@syzkaller.appspotmail.com, syzbot+d6074fb08bdb2e010520@syzkaller.appspotmail.com, Daniel Axtens , Andrew Morton , Michael Ellerman , Andrew Donnellan , David Rientjes , Akash Goel , Guenter Roeck , Salvatore Bonaccorso , Linus Torvalds Subject: [PATCH 4.14 19/46] kernel/relay.c: handle alloc_percpu returning NULL in relay_open Date: Tue, 9 Jun 2020 19:44:35 +0200 Message-Id: <20200609174024.806888793@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Daniel Axtens commit 54e200ab40fc14c863bcc80a51e20b7906608fce upstream. alloc_percpu() may return NULL, which means chan->buf may be set to NULL. In that case, when we do *per_cpu_ptr(chan->buf, ...), we dereference an invalid pointer: BUG: Unable to handle kernel data access at 0x7dae0000 Faulting instruction address: 0xc0000000003f3fec ... NIP relay_open+0x29c/0x600 LR relay_open+0x270/0x600 Call Trace: relay_open+0x264/0x600 (unreliable) __blk_trace_setup+0x254/0x600 blk_trace_setup+0x68/0xa0 sg_ioctl+0x7bc/0x2e80 do_vfs_ioctl+0x13c/0x1300 ksys_ioctl+0x94/0x130 sys_ioctl+0x48/0xb0 system_call+0x5c/0x68 Check if alloc_percpu returns NULL. This was found by syzkaller both on x86 and powerpc, and the reproducer it found on powerpc is capable of hitting the issue as an unprivileged user. Fixes: 017c59c042d0 ("relay: Use per CPU constructs for the relay channel buffer pointers") Reported-by: syzbot+1e925b4b836afe85a1c6@syzkaller-ppc64.appspotmail.com Reported-by: syzbot+587b2421926808309d21@syzkaller-ppc64.appspotmail.com Reported-by: syzbot+58320b7171734bf79d26@syzkaller.appspotmail.com Reported-by: syzbot+d6074fb08bdb2e010520@syzkaller.appspotmail.com Signed-off-by: Daniel Axtens Signed-off-by: Andrew Morton Reviewed-by: Michael Ellerman Reviewed-by: Andrew Donnellan Acked-by: David Rientjes Cc: Akash Goel Cc: Andrew Donnellan Cc: Guenter Roeck Cc: Salvatore Bonaccorso Cc: [4.10+] Link: http://lkml.kernel.org/r/20191219121256.26480-1-dja@axtens.net Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- kernel/relay.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/kernel/relay.c +++ b/kernel/relay.c @@ -580,6 +580,11 @@ struct rchan *relay_open(const char *bas return NULL; chan->buf = alloc_percpu(struct rchan_buf *); + if (!chan->buf) { + kfree(chan); + return NULL; + } + chan->version = RELAYFS_CHANNEL_VERSION; chan->n_subbufs = n_subbufs; chan->subbuf_size = subbuf_size; From patchwork Tue Jun 9 17:44:37 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224630 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83A8BC433E0 for ; Tue, 9 Jun 2020 18:14:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 56E0C2068D for ; Tue, 9 Jun 2020 18:14:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726463; bh=1D1atwDSzipyEayBvq/aWajeGTfkEWw1Y6rBLxAEMoI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rzyHuYTw3QhK6ppHySW+/R1hJ+P2ihCfuFUXLt552WXkLbgEh8rodRveKYdsq+dSr uc24snMtoe9vROzzYvDB62bf37fB2LBDbKAd+4LyiRImrxJZnhnOGH5aToAOqsY95x zff7LskSxma5WKB3EMwldjsVPStlux79kO09tEkQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731078AbgFISOC (ORCPT ); Tue, 9 Jun 2020 14:14:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:38682 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731193AbgFIRup (ORCPT ); Tue, 9 Jun 2020 13:50:45 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B4DD120734; Tue, 9 Jun 2020 17:50:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725045; bh=1D1atwDSzipyEayBvq/aWajeGTfkEWw1Y6rBLxAEMoI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xYIox7UM36XVvY3r+UhuG3ivncnClQ8/OeTfw3BMrrTtUZMxJuR/njrtOsef2NrSP q0lUIVZwafvNJUjvRucyvkzG9eX+SmEdCpi2ITppV6Ew7WIuhMd2N4xKNTJHCEX/Wy xHRyYegrSVqRrC/OAvuhKrUlzlFcTwQqFLV9jfh0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bean Huo , Can Guo , "Martin K. Petersen" , Eric Biggers Subject: [PATCH 4.14 21/46] scsi: ufs: Release clock if DMA map fails Date: Tue, 9 Jun 2020 19:44:37 +0200 Message-Id: <20200609174026.103882129@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Can Guo commit 17c7d35f141ef6158076adf3338f115f64fcf760 upstream. In queuecommand path, if DMA map fails, it bails out with clock held. In this case, release the clock to keep its usage paired. [mkp: applied by hand] Link: https://lore.kernel.org/r/0101016ed3d66395-1b7e7fce-b74d-42ca-a88a-4db78b795d3b-000000@us-west-2.amazonses.com Reviewed-by: Bean Huo Signed-off-by: Can Guo Signed-off-by: Martin K. Petersen [EB: resolved cherry-pick conflict caused by newer kernels not having the clear_bit_unlock() line] Signed-off-by: Eric Biggers Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/ufs/ufshcd.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -2365,6 +2365,7 @@ static int ufshcd_queuecommand(struct Sc err = ufshcd_map_sg(hba, lrbp); if (err) { + ufshcd_release(hba); lrbp->cmd = NULL; clear_bit_unlock(tag, &hba->lrb_in_use); goto out; From patchwork Tue Jun 9 17:44:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224631 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F861C433E1 for ; Tue, 9 Jun 2020 18:13:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3E7E42068D for ; Tue, 9 Jun 2020 18:13:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726437; bh=VoaD/XTRncZS6bnl7xCCz9ihPmtnsZ9t4uWmP7GKdEo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=uvJZYHjqo3v6hyJ0Gr9ae8A3m4HJXHlyQPBvBNVmIhyPaJoPOTJAXJbMZJBLf6/fu kYZMgsRJNlKWDKAnTfzGWLfcq+hX3yCDACThKdiQcnnf4fNlvKgZlCncr9n3hWfObz PAb1C0NccFNNbNJzCWwH1qhQye+kAWFkHXeUUunk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732748AbgFIRuy (ORCPT ); Tue, 9 Jun 2020 13:50:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:39030 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732739AbgFIRux (ORCPT ); Tue, 9 Jun 2020 13:50:53 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A775D2074B; Tue, 9 Jun 2020 17:50:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725052; bh=VoaD/XTRncZS6bnl7xCCz9ihPmtnsZ9t4uWmP7GKdEo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=me5aXjcPjcKcMtUmUOAAOVu+LtXMn5Puc5J6TCgl2Ua5a12ghP57q3zbneg23iJvr GQ4L/ZKjYVyIATE67D0o/N294Pe7umnCyr6WiBVaFGRlKlxavhGTlwvORuVEVtYXG+ n/Nea3ItB66Nul13EM9f9oVNwvd4FkQWOpPfYsMk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , James Chapman , Andrii Nakryiko , syzbot+3610d489778b57cc8031@syzkaller.appspotmail.com Subject: [PATCH 4.14 24/46] l2tp: do not use inet_hash()/inet_unhash() Date: Tue, 9 Jun 2020 19:44:40 +0200 Message-Id: <20200609174026.834939467@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Dumazet [ Upstream commit 02c71b144c811bcdd865e0a1226d0407d11357e8 ] syzbot recently found a way to crash the kernel [1] Issue here is that inet_hash() & inet_unhash() are currently only meant to be used by TCP & DCCP, since only these protocols provide the needed hashinfo pointer. L2TP uses a single list (instead of a hash table) This old bug became an issue after commit 610236587600 ("bpf: Add new cgroup attach type to enable sock modifications") since after this commit, sk_common_release() can be called while the L2TP socket is still considered 'hashed'. general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 7063 Comm: syz-executor654 Not tainted 5.7.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:inet_unhash+0x11f/0x770 net/ipv4/inet_hashtables.c:600 Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e dd 04 00 00 48 8d 7d 08 44 8b 73 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 55 05 00 00 48 8d 7d 14 4c 8b 6d 08 48 b8 00 00 RSP: 0018:ffffc90001777d30 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff88809a6df940 RCX: ffffffff8697c242 RDX: 0000000000000001 RSI: ffffffff8697c251 RDI: 0000000000000008 RBP: 0000000000000000 R08: ffff88809f3ae1c0 R09: fffffbfff1514cc1 R10: ffffffff8a8a6607 R11: fffffbfff1514cc0 R12: ffff88809a6df9b0 R13: 0000000000000007 R14: 0000000000000000 R15: ffffffff873a4d00 FS: 0000000001d2b880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000006cd090 CR3: 000000009403a000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: sk_common_release+0xba/0x370 net/core/sock.c:3210 inet_create net/ipv4/af_inet.c:390 [inline] inet_create+0x966/0xe00 net/ipv4/af_inet.c:248 __sock_create+0x3cb/0x730 net/socket.c:1428 sock_create net/socket.c:1479 [inline] __sys_socket+0xef/0x200 net/socket.c:1521 __do_sys_socket net/socket.c:1530 [inline] __se_sys_socket net/socket.c:1528 [inline] __x64_sys_socket+0x6f/0xb0 net/socket.c:1528 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x441e29 Code: e8 fc b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffdce184148 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441e29 RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000402c30 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace 23b6578228ce553e ]--- RIP: 0010:inet_unhash+0x11f/0x770 net/ipv4/inet_hashtables.c:600 Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e dd 04 00 00 48 8d 7d 08 44 8b 73 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 55 05 00 00 48 8d 7d 14 4c 8b 6d 08 48 b8 00 00 RSP: 0018:ffffc90001777d30 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff88809a6df940 RCX: ffffffff8697c242 RDX: 0000000000000001 RSI: ffffffff8697c251 RDI: 0000000000000008 RBP: 0000000000000000 R08: ffff88809f3ae1c0 R09: fffffbfff1514cc1 R10: ffffffff8a8a6607 R11: fffffbfff1514cc0 R12: ffff88809a6df9b0 R13: 0000000000000007 R14: 0000000000000000 R15: ffffffff873a4d00 FS: 0000000001d2b880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000006cd090 CR3: 000000009403a000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 0d76751fad77 ("l2tp: Add L2TPv3 IP encapsulation (no UDP) support") Signed-off-by: Eric Dumazet Cc: James Chapman Cc: Andrii Nakryiko Reported-by: syzbot+3610d489778b57cc8031@syzkaller.appspotmail.com Signed-off-by: Greg Kroah-Hartman --- net/l2tp/l2tp_ip.c | 29 ++++++++++++++++++++++------- net/l2tp/l2tp_ip6.c | 30 ++++++++++++++++++++++-------- 2 files changed, 44 insertions(+), 15 deletions(-) --- a/net/l2tp/l2tp_ip.c +++ b/net/l2tp/l2tp_ip.c @@ -24,7 +24,6 @@ #include #include #include -#include #include #include #include @@ -215,15 +214,31 @@ discard: return 0; } -static int l2tp_ip_open(struct sock *sk) +static int l2tp_ip_hash(struct sock *sk) { - /* Prevent autobind. We don't have ports. */ - inet_sk(sk)->inet_num = IPPROTO_L2TP; + if (sk_unhashed(sk)) { + write_lock_bh(&l2tp_ip_lock); + sk_add_node(sk, &l2tp_ip_table); + write_unlock_bh(&l2tp_ip_lock); + } + return 0; +} +static void l2tp_ip_unhash(struct sock *sk) +{ + if (sk_unhashed(sk)) + return; write_lock_bh(&l2tp_ip_lock); - sk_add_node(sk, &l2tp_ip_table); + sk_del_node_init(sk); write_unlock_bh(&l2tp_ip_lock); +} + +static int l2tp_ip_open(struct sock *sk) +{ + /* Prevent autobind. We don't have ports. */ + inet_sk(sk)->inet_num = IPPROTO_L2TP; + l2tp_ip_hash(sk); return 0; } @@ -605,8 +620,8 @@ static struct proto l2tp_ip_prot = { .sendmsg = l2tp_ip_sendmsg, .recvmsg = l2tp_ip_recvmsg, .backlog_rcv = l2tp_ip_backlog_recv, - .hash = inet_hash, - .unhash = inet_unhash, + .hash = l2tp_ip_hash, + .unhash = l2tp_ip_unhash, .obj_size = sizeof(struct l2tp_ip_sock), #ifdef CONFIG_COMPAT .compat_setsockopt = compat_ip_setsockopt, --- a/net/l2tp/l2tp_ip6.c +++ b/net/l2tp/l2tp_ip6.c @@ -24,8 +24,6 @@ #include #include #include -#include -#include #include #include #include @@ -229,15 +227,31 @@ discard: return 0; } -static int l2tp_ip6_open(struct sock *sk) +static int l2tp_ip6_hash(struct sock *sk) { - /* Prevent autobind. We don't have ports. */ - inet_sk(sk)->inet_num = IPPROTO_L2TP; + if (sk_unhashed(sk)) { + write_lock_bh(&l2tp_ip6_lock); + sk_add_node(sk, &l2tp_ip6_table); + write_unlock_bh(&l2tp_ip6_lock); + } + return 0; +} +static void l2tp_ip6_unhash(struct sock *sk) +{ + if (sk_unhashed(sk)) + return; write_lock_bh(&l2tp_ip6_lock); - sk_add_node(sk, &l2tp_ip6_table); + sk_del_node_init(sk); write_unlock_bh(&l2tp_ip6_lock); +} + +static int l2tp_ip6_open(struct sock *sk) +{ + /* Prevent autobind. We don't have ports. */ + inet_sk(sk)->inet_num = IPPROTO_L2TP; + l2tp_ip6_hash(sk); return 0; } @@ -742,8 +756,8 @@ static struct proto l2tp_ip6_prot = { .sendmsg = l2tp_ip6_sendmsg, .recvmsg = l2tp_ip6_recvmsg, .backlog_rcv = l2tp_ip6_backlog_recv, - .hash = inet6_hash, - .unhash = inet_unhash, + .hash = l2tp_ip6_hash, + .unhash = l2tp_ip6_unhash, .obj_size = sizeof(struct l2tp_ip6_sock), #ifdef CONFIG_COMPAT .compat_setsockopt = compat_ipv6_setsockopt, From patchwork Tue Jun 9 17:44:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224632 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B51AC433E0 for ; Tue, 9 Jun 2020 18:13:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2B8092068D for ; Tue, 9 Jun 2020 18:13:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726411; bh=YUQ3zE6gHknWLZQ8cWA+ZL/A4ox6L2Wm10Hf9XSjg5U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=XYaM1Uswi5BBkif+zkOH5/oj33xcxEYn5KHkXYKO6yzrLfi5488oRuj5K4GHxxhDi P79cLn7kUDBbjcLO7aawSxiY5yby4Q+lV4tGfWJuznsmCpWcTlsYBLjy//N84H7Y8/ aKc922VV12L3qIheJa4SMmVOipOcZkvigqGIuT9s= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732778AbgFISN2 (ORCPT ); Tue, 9 Jun 2020 14:13:28 -0400 Received: from mail.kernel.org ([198.145.29.99]:39216 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731220AbgFIRu5 (ORCPT ); Tue, 9 Jun 2020 13:50:57 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 424852074B; Tue, 9 Jun 2020 17:50:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725056; bh=YUQ3zE6gHknWLZQ8cWA+ZL/A4ox6L2Wm10Hf9XSjg5U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DHdEXvNbNXAEOtDZdIW12oiJgEUA81Zms3FTUBzA4WQferM5NtzVfJBbUN0bdIP3S /2yIwucRVF8/fw9Bh/bwpNcJaolc8q8zHJJxCnQ8IqOr7AZD5pswlqLFf44malJWXB V0YusCjXqhUunn3qGGW2iBcd/e547GZ5TkGurKQ8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chuhong Yuan , "David S. Miller" Subject: [PATCH 4.14 26/46] NFC: st21nfca: add missed kfree_skb() in an error path Date: Tue, 9 Jun 2020 19:44:42 +0200 Message-Id: <20200609174027.260635491@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Chuhong Yuan [ Upstream commit 3decabdc714ca56c944f4669b4cdec5c2c1cea23 ] st21nfca_tm_send_atr_res() misses to call kfree_skb() in an error path. Add the missed function call to fix it. Fixes: 1892bf844ea0 ("NFC: st21nfca: Adding P2P support to st21nfca in Initiator & Target mode") Signed-off-by: Chuhong Yuan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/nfc/st21nfca/dep.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/nfc/st21nfca/dep.c +++ b/drivers/nfc/st21nfca/dep.c @@ -184,8 +184,10 @@ static int st21nfca_tm_send_atr_res(stru memcpy(atr_res->gbi, atr_req->gbi, gb_len); r = nfc_set_remote_general_bytes(hdev->ndev, atr_res->gbi, gb_len); - if (r < 0) + if (r < 0) { + kfree_skb(skb); return r; + } } info->dep_info.curr_nfc_dep_pni = 0; From patchwork Tue Jun 9 17:44:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224694 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36E86C433E1 for ; Tue, 9 Jun 2020 17:51:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 074A02074B for ; Tue, 9 Jun 2020 17:51:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725062; bh=dneXgUP1hvA/ZLqtJEfa5ZryFKN8+0iq70e7wX8rxDU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ZVgv9JpiIMfOT2qjuioEWYY1FyadOu6VtdlO3QAKQBv7oQ1VkRcFcrc6mUV8TToEt wa2cBUArX8PkYFisEgewIVu4GanTIJyrAbjv0LV7RI6Ww9N0Gi8upDjSpuN7bVO16W QviBkCe18wGPxo2b2gIWjFsGqtEn7ntl/rgLo9+k= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731361AbgFIRvA (ORCPT ); Tue, 9 Jun 2020 13:51:00 -0400 Received: from mail.kernel.org ([198.145.29.99]:39288 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732760AbgFIRu7 (ORCPT ); Tue, 9 Jun 2020 13:50:59 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 906472074B; Tue, 9 Jun 2020 17:50:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725059; bh=dneXgUP1hvA/ZLqtJEfa5ZryFKN8+0iq70e7wX8rxDU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rZVGqPR+O+8qDt9JtgnohGDCRp8YTdgtmAtGiK+MUEPkfRRoqTWy3gLD4WktF1icA 60Uc/Lxv3RBjjGPluvehXGVwp/7RvXG8QmVvIMElMApTqFSa+czZ7GPvGhrA6bdMZB UmDktNyL2Zo94EEMby1DBPJSGaRIWTUs4Dd3JY1c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefano Garzarella , Jorgen Hansen , "David S. Miller" Subject: [PATCH 4.14 27/46] vsock: fix timeout in vsock_accept() Date: Tue, 9 Jun 2020 19:44:43 +0200 Message-Id: <20200609174027.453089041@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Stefano Garzarella [ Upstream commit 7e0afbdfd13d1e708fe96e31c46c4897101a6a43 ] The accept(2) is an "input" socket interface, so we should use SO_RCVTIMEO instead of SO_SNDTIMEO to set the timeout. So this patch replace sock_sndtimeo() with sock_rcvtimeo() to use the right timeout in the vsock_accept(). Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Signed-off-by: Stefano Garzarella Reviewed-by: Jorgen Hansen Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/vmw_vsock/af_vsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1290,7 +1290,7 @@ static int vsock_accept(struct socket *s /* Wait for children sockets to appear; these are the new sockets * created upon connection establishment. */ - timeout = sock_sndtimeo(listener, flags & O_NONBLOCK); + timeout = sock_rcvtimeo(listener, flags & O_NONBLOCK); prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE); while ((connected = vsock_dequeue_accept(listener)) == NULL && From patchwork Tue Jun 9 17:44:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224622 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68037C433DF for ; Tue, 9 Jun 2020 18:18:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4D1B02067B for ; Tue, 9 Jun 2020 18:18:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726736; bh=VMfeFiVfnefWCA1tQkBq53HIAe43nKZj1VYQE+v3HNg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rGmhJzFa/YBD5tD13bglWWqb5HYRSb2N1YwGsoF8ZPBW7+NumB9TVHC3VzhEXyqMh sC5naNxw5lv/vO9UFFe0kQ2EQqkDjNiEOvwwzDFbd/eFpse835wi/AuAwOkxqB5GmF 9pjioktDpTZNY5xdJU56hcxwrjCQxyyzzb1gvfcI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388763AbgFISSy (ORCPT ); Tue, 9 Jun 2020 14:18:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:36838 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730963AbgFIRt7 (ORCPT ); Tue, 9 Jun 2020 13:49:59 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6CAA820801; Tue, 9 Jun 2020 17:49:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591724998; bh=VMfeFiVfnefWCA1tQkBq53HIAe43nKZj1VYQE+v3HNg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XmGzQD82FaBxG/Pi0T2kzXLDcL8mu1rJpdiP6bvsoWAOGwM5TXLKejdbdaaR8kLYh Ph2jEQSl1a+O2fKc90oWNi5aQomDGOHWkVURPiUWbJnPZYArkQ7ODWBfhTGg7cwEVS 1WRes+y8Pnn7WXp5yUA8HNLbPonM7r/mo6R6Qujk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Willem de Bruijn , "David S. Miller" Subject: [PATCH 4.14 28/46] net: check untrusted gso_size at kernel entry Date: Tue, 9 Jun 2020 19:44:44 +0200 Message-Id: <20200609174028.165000124@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Willem de Bruijn [ Upstream commit 6dd912f82680761d8fb6b1bb274a69d4c7010988 ] Syzkaller again found a path to a kernel crash through bad gso input: a packet with gso size exceeding len. These packets are dropped in tcp_gso_segment and udp[46]_ufo_fragment. But they may affect gso size calculations earlier in the path. Now that we have thlen as of commit 9274124f023b ("net: stricter validation of untrusted gso packets"), check gso_size at entry too. Fixes: bfd5f4a3d605 ("packet: Add GSO/csum offload support.") Reported-by: syzbot Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/linux/virtio_net.h | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -31,6 +31,7 @@ static inline int virtio_net_hdr_to_skb( { unsigned int gso_type = 0; unsigned int thlen = 0; + unsigned int p_off = 0; unsigned int ip_proto; if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { @@ -68,7 +69,8 @@ static inline int virtio_net_hdr_to_skb( if (!skb_partial_csum_set(skb, start, off)) return -EINVAL; - if (skb_transport_offset(skb) + thlen > skb_headlen(skb)) + p_off = skb_transport_offset(skb) + thlen; + if (p_off > skb_headlen(skb)) return -EINVAL; } else { /* gso packets without NEEDS_CSUM do not set transport_offset. @@ -90,17 +92,25 @@ retry: return -EINVAL; } - if (keys.control.thoff + thlen > skb_headlen(skb) || + p_off = keys.control.thoff + thlen; + if (p_off > skb_headlen(skb) || keys.basic.ip_proto != ip_proto) return -EINVAL; skb_set_transport_header(skb, keys.control.thoff); + } else if (gso_type) { + p_off = thlen; + if (p_off > skb_headlen(skb)) + return -EINVAL; } } if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); + if (skb->len - p_off <= gso_size) + return -EINVAL; + skb_shinfo(skb)->gso_size = gso_size; skb_shinfo(skb)->gso_type = gso_type; From patchwork Tue Jun 9 17:44:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224623 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 501FBC433E0 for ; Tue, 9 Jun 2020 18:18:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2FE932067B for ; Tue, 9 Jun 2020 18:18:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726734; bh=5IN/lGGbzu1eRrZ/kosjpWT3H5V83nkEOUQyBgm4mx8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=f+ej/w6yfhWDcVulIm2TBvTTe2QOf/4CqEZrhMayZ21hHveLeG5xtqeWh1uRYLHhO qazz+4zrq8oHzlDd4dX0zvCay9XeCypamt/eiTUyIXrUYrr9KbNf2X6KHpCA4QGk1+ aF7HIhkVfZ2gEFDXCHG1q8T61rnEDhIE/+FGdVGw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732542AbgFIRuG (ORCPT ); Tue, 9 Jun 2020 13:50:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:36916 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732602AbgFIRuD (ORCPT ); Tue, 9 Jun 2020 13:50:03 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C8F152081A; Tue, 9 Jun 2020 17:50:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725001; bh=5IN/lGGbzu1eRrZ/kosjpWT3H5V83nkEOUQyBgm4mx8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NBwSnUtOspouG0RPCEPQhOyHAEj9J5C5FaNM4nZzwX4Blyid+P7a4V/ssm0bRoU1E e8WZtUYF2oLgxZEeC33Y7IdViqflXkvhd8zPkV6p4yS8xVMx0yu20ut+m3Z1Cniz6S YmlHQ8w/CTqZNDNC5LD38UHNYqAvoONpqGD6Fudg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , James Chapman , Guillaume Nault , syzbot , "David S. Miller" Subject: [PATCH 4.14 29/46] l2tp: add sk_family checks to l2tp_validate_socket Date: Tue, 9 Jun 2020 19:44:45 +0200 Message-Id: <20200609174028.506720599@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Dumazet [ Upstream commit d9a81a225277686eb629938986d97629ea102633 ] syzbot was able to trigger a crash after using an ISDN socket and fool l2tp. Fix this by making sure the UDP socket is of the proper family. BUG: KASAN: slab-out-of-bounds in setup_udp_tunnel_sock+0x465/0x540 net/ipv4/udp_tunnel.c:78 Write of size 1 at addr ffff88808ed0c590 by task syz-executor.5/3018 CPU: 0 PID: 3018 Comm: syz-executor.5 Not tainted 5.7.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:382 __kasan_report.cold+0x20/0x38 mm/kasan/report.c:511 kasan_report+0x33/0x50 mm/kasan/common.c:625 setup_udp_tunnel_sock+0x465/0x540 net/ipv4/udp_tunnel.c:78 l2tp_tunnel_register+0xb15/0xdd0 net/l2tp/l2tp_core.c:1523 l2tp_nl_cmd_tunnel_create+0x4b2/0xa60 net/l2tp/l2tp_netlink.c:249 genl_family_rcv_msg_doit net/netlink/genetlink.c:673 [inline] genl_family_rcv_msg net/netlink/genetlink.c:718 [inline] genl_rcv_msg+0x627/0xdf0 net/netlink/genetlink.c:735 netlink_rcv_skb+0x15a/0x410 net/netlink/af_netlink.c:2469 genl_rcv+0x24/0x40 net/netlink/genetlink.c:746 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x537/0x740 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x882/0xe10 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:672 ____sys_sendmsg+0x6e6/0x810 net/socket.c:2352 ___sys_sendmsg+0x100/0x170 net/socket.c:2406 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x45ca29 Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007effe76edc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004fe1c0 RCX: 000000000045ca29 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000094e R14: 00000000004d5d00 R15: 00007effe76ee6d4 Allocated by task 3018: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468 __do_kmalloc mm/slab.c:3656 [inline] __kmalloc+0x161/0x7a0 mm/slab.c:3665 kmalloc include/linux/slab.h:560 [inline] sk_prot_alloc+0x223/0x2f0 net/core/sock.c:1612 sk_alloc+0x36/0x1100 net/core/sock.c:1666 data_sock_create drivers/isdn/mISDN/socket.c:600 [inline] mISDN_sock_create+0x272/0x400 drivers/isdn/mISDN/socket.c:796 __sock_create+0x3cb/0x730 net/socket.c:1428 sock_create net/socket.c:1479 [inline] __sys_socket+0xef/0x200 net/socket.c:1521 __do_sys_socket net/socket.c:1530 [inline] __se_sys_socket net/socket.c:1528 [inline] __x64_sys_socket+0x6f/0xb0 net/socket.c:1528 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Freed by task 2484: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] kasan_set_free_info mm/kasan/common.c:317 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456 __cache_free mm/slab.c:3426 [inline] kfree+0x109/0x2b0 mm/slab.c:3757 kvfree+0x42/0x50 mm/util.c:603 __free_fdtable+0x2d/0x70 fs/file.c:31 put_files_struct fs/file.c:420 [inline] put_files_struct+0x248/0x2e0 fs/file.c:413 exit_files+0x7e/0xa0 fs/file.c:445 do_exit+0xb04/0x2dd0 kernel/exit.c:791 do_group_exit+0x125/0x340 kernel/exit.c:894 get_signal+0x47b/0x24e0 kernel/signal.c:2739 do_signal+0x81/0x2240 arch/x86/kernel/signal.c:784 exit_to_usermode_loop+0x26c/0x360 arch/x86/entry/common.c:161 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:279 [inline] do_syscall_64+0x6b1/0x7d0 arch/x86/entry/common.c:305 entry_SYSCALL_64_after_hwframe+0x49/0xb3 The buggy address belongs to the object at ffff88808ed0c000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1424 bytes inside of 2048-byte region [ffff88808ed0c000, ffff88808ed0c800) The buggy address belongs to the page: page:ffffea00023b4300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea0002838208 ffffea00015ba288 ffff8880aa000e00 raw: 0000000000000000 ffff88808ed0c000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808ed0c480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88808ed0c500: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88808ed0c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88808ed0c600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88808ed0c680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Fixes: 6b9f34239b00 ("l2tp: fix races in tunnel creation") Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Signed-off-by: Eric Dumazet Cc: James Chapman Cc: Guillaume Nault Reported-by: syzbot Acked-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/l2tp/l2tp_core.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1589,6 +1589,8 @@ int l2tp_tunnel_create(struct net *net, tunnel_id, fd); goto err; } + if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6) + goto err; switch (encap) { case L2TP_ENCAPTYPE_UDP: if (sk->sk_protocol != IPPROTO_UDP) { From patchwork Tue Jun 9 17:44:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224624 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AA3BBC433DF for ; Tue, 9 Jun 2020 18:18:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 75CDB2067B for ; Tue, 9 Jun 2020 18:18:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726720; bh=Qji0P9ZYJP6rjevkptNRCSR27VQwxRHmmnnhzSFH4Xs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=hRvyEPL0fbrd+5VyEfv+ettY+axBGn6MfRVRTaqHF80UlY1OjxVO9fKhmkeCZusiT ueaFEbjM9UOLKDhh4F6i294zFkpV6Xjm+nq8UwiPVvhyh3fDeQeoCiUNNqFKzmY+Gj 498fQN/gvPSuNuKvugKZ32QujUqjJrB4hLqbReOY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732631AbgFISSc (ORCPT ); Tue, 9 Jun 2020 14:18:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:37322 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730807AbgFIRuM (ORCPT ); Tue, 9 Jun 2020 13:50:12 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3D0C22081A; Tue, 9 Jun 2020 17:50:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725012; bh=Qji0P9ZYJP6rjevkptNRCSR27VQwxRHmmnnhzSFH4Xs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hNySvtecEUw2gbZ2AkseH6njtf2xaa/MRciuj4++u6nzSlqZ29vcpHRQh7TorQhLB TqxVisPoybCBsx3ySMRA166n4Q+4C6YMo6jcVOl1EdGIwBC/Bdz0xaHv+n/lcfofnJ Cuzb3ARtuSyXRJZS3J/v786LXMJ0WPS+iVmNDu+I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dinghao Liu , Bin Liu Subject: [PATCH 4.14 34/46] usb: musb: Fix runtime PM imbalance on error Date: Tue, 9 Jun 2020 19:44:50 +0200 Message-Id: <20200609174029.578394791@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dinghao Liu commit e4befc121df03dc8ed2ac1031c98f9538e244bae upstream. When copy_from_user() returns an error code, there is a runtime PM usage counter imbalance. Fix this by moving copy_from_user() to the beginning of this function. Fixes: 7b6c1b4c0e1e ("usb: musb: fix runtime PM in debugfs") Signed-off-by: Dinghao Liu Cc: stable@vger.kernel.org Signed-off-by: Bin Liu Link: https://lore.kernel.org/r/20200525025049.3400-7-b-liu@ti.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_debugfs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/drivers/usb/musb/musb_debugfs.c +++ b/drivers/usb/musb/musb_debugfs.c @@ -206,6 +206,11 @@ static ssize_t musb_test_mode_write(stru u8 test; char buf[24]; + memset(buf, 0x00, sizeof(buf)); + + if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) + return -EFAULT; + pm_runtime_get_sync(musb->controller); test = musb_readb(musb->mregs, MUSB_TESTMODE); if (test) { @@ -214,11 +219,6 @@ static ssize_t musb_test_mode_write(stru goto ret; } - memset(buf, 0x00, sizeof(buf)); - - if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) - return -EFAULT; - if (strstarts(buf, "force host full-speed")) test = MUSB_TEST_FORCE_HOST | MUSB_TEST_FORCE_FS; From patchwork Tue Jun 9 17:44:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224625 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34E64C433E0 for ; Tue, 9 Jun 2020 18:18:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 17A822068D for ; Tue, 9 Jun 2020 18:18:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726691; bh=0ctzlTivcvYKVK0qXh7I1nTlH3cJHR+nkz97FZGU0Ds=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=BP3EVWWWT/ceN+BHnJQFsY6+QakVWrXCEJ0urNiTc5kcwV111Wtryzv9Lk53BLYSJ V+J62uLPJv371b+uo37ji9sH+f9CNsE8VESDYRRh4uoJBOkNeClxz4hLav5AUH2nXB kuZ1O/cRmw+n83vnji+vUn6DLbo89cgzjptn0dSc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732685AbgFISSJ (ORCPT ); Tue, 9 Jun 2020 14:18:09 -0400 Received: from mail.kernel.org ([198.145.29.99]:37448 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732631AbgFIRuP (ORCPT ); Tue, 9 Jun 2020 13:50:15 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 824D9207C3; Tue, 9 Jun 2020 17:50:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725015; bh=0ctzlTivcvYKVK0qXh7I1nTlH3cJHR+nkz97FZGU0Ds=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JsMcIERQNS2yedDcA7d6zj8f/+ptKfzsdywLcDl0/xlnq0sdULEhZb00EhWPw53R8 w5Ad8sImKe/66sh+Md8OAj4vYkBuMS4tAwSZ/4lZ0wP39E/Z4yg2gkUSBXs9yvLV4+ q0BjDWGmHv/4M/bHgMdKRUF6yY+BAdBxZ3QZr2zg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kyungtae Kim , Dmitry Torokhov Subject: [PATCH 4.14 35/46] vt: keyboard: avoid signed integer overflow in k_ascii Date: Tue, 9 Jun 2020 19:44:51 +0200 Message-Id: <20200609174029.735837494@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dmitry Torokhov commit b86dab054059b970111b5516ae548efaae5b3aae upstream. When k_ascii is invoked several times in a row there is a potential for signed integer overflow: UBSAN: Undefined behaviour in drivers/tty/vt/keyboard.c:888:19 signed integer overflow: 10 * 1111111111 cannot be represented in type 'int' CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.11 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 ubsan_epilogue+0xe/0x30 lib/ubsan.c:154 handle_overflow+0xdc/0xf0 lib/ubsan.c:184 __ubsan_handle_mul_overflow+0x2a/0x40 lib/ubsan.c:205 k_ascii+0xbf/0xd0 drivers/tty/vt/keyboard.c:888 kbd_keycode drivers/tty/vt/keyboard.c:1477 [inline] kbd_event+0x888/0x3be0 drivers/tty/vt/keyboard.c:1495 While it can be worked around by using check_mul_overflow()/ check_add_overflow(), it is better to introduce a separate flag to signal that number pad is being used to compose a symbol, and change type of the accumulator from signed to unsigned, thus avoiding undefined behavior when it overflows. Reported-by: Kyungtae Kim Signed-off-by: Dmitry Torokhov Cc: stable Link: https://lore.kernel.org/r/20200525232740.GA262061@dtor-ws Signed-off-by: Greg Kroah-Hartman --- drivers/tty/vt/keyboard.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -126,7 +126,11 @@ static DEFINE_SPINLOCK(func_buf_lock); / static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */ static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */ static bool dead_key_next; -static int npadch = -1; /* -1 or number assembled on pad */ + +/* Handles a number being assembled on the number pad */ +static bool npadch_active; +static unsigned int npadch_value; + static unsigned int diacr; static char rep; /* flag telling character repeat */ @@ -816,12 +820,12 @@ static void k_shift(struct vc_data *vc, shift_state &= ~(1 << value); /* kludge */ - if (up_flag && shift_state != old_state && npadch != -1) { + if (up_flag && shift_state != old_state && npadch_active) { if (kbd->kbdmode == VC_UNICODE) - to_utf8(vc, npadch); + to_utf8(vc, npadch_value); else - put_queue(vc, npadch & 0xff); - npadch = -1; + put_queue(vc, npadch_value & 0xff); + npadch_active = false; } } @@ -839,7 +843,7 @@ static void k_meta(struct vc_data *vc, u static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag) { - int base; + unsigned int base; if (up_flag) return; @@ -853,10 +857,12 @@ static void k_ascii(struct vc_data *vc, base = 16; } - if (npadch == -1) - npadch = value; - else - npadch = npadch * base + value; + if (!npadch_active) { + npadch_value = 0; + npadch_active = true; + } + + npadch_value = npadch_value * base + value; } static void k_lock(struct vc_data *vc, unsigned char value, char up_flag) From patchwork Tue Jun 9 17:44:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224626 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24613C433DF for ; Tue, 9 Jun 2020 18:17:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ED9652068D for ; Tue, 9 Jun 2020 18:17:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726665; bh=A8/2DMt2DlV627jgZn/LmE7bO5UtcIiyT4fVmDE37ak=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ennswFaJ5g7MF4dIshy6NSIKDBX3EbcEscbU+IQsHx+8v60k+tRdJceFcePbtmxB5 4QOYX85H8Enk7f6eybaCoYQS7iSD1kFz4PSttGm5gzZolBfH93xMR9r5rn1G+HvLTT XVdqogEYAhHW1y9JlJyV1IEMat19vyzpUwBLeaM8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730953AbgFISRl (ORCPT ); Tue, 9 Jun 2020 14:17:41 -0400 Received: from mail.kernel.org ([198.145.29.99]:37620 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730956AbgFIRuU (ORCPT ); Tue, 9 Jun 2020 13:50:20 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8C66520774; Tue, 9 Jun 2020 17:50:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725020; bh=A8/2DMt2DlV627jgZn/LmE7bO5UtcIiyT4fVmDE37ak=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C/2fPriWkUmBT90g8kIyIg8RddpD2pb8RUbnJp3IQ5L6MkE6i0V9wNEq2n236VgTC 7fk0F9bpSVVhRq48mMbvDY5wty449M6nqp9mPwIcpY3DHw5bMrDpVKLbZcm843KC6n ANT/tDSjgtI7geG2i838FWBabG87Dzr6QBZ6UvAo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pascal Terjan Subject: [PATCH 4.14 37/46] staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK Date: Tue, 9 Jun 2020 19:44:53 +0200 Message-Id: <20200609174030.070675162@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pascal Terjan commit 15ea976a1f12b5fd76b1bd6ff3eb5132fd28047f upstream. The value in shared headers was fixed 9 years ago in commit 8d661f1e462d ("ieee80211: correct IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK macro") and while looking at using shared headers for other duplicated constants I noticed this driver uses the old value. The macros are also defined twice in this file so I am deleting the second definition. Signed-off-by: Pascal Terjan Cc: stable Link: https://lore.kernel.org/r/20200523211247.23262-1-pterjan@google.com Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8712/wifi.h | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) --- a/drivers/staging/rtl8712/wifi.h +++ b/drivers/staging/rtl8712/wifi.h @@ -468,7 +468,7 @@ static inline unsigned char *get_hdr_bss /* block-ack parameters */ #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0 +#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800 @@ -562,13 +562,6 @@ struct ieee80211_ht_addt_info { #define IEEE80211_HT_IE_NON_GF_STA_PRSNT 0x0004 #define IEEE80211_HT_IE_NON_HT_STA_PRSNT 0x0010 -/* block-ack parameters */ -#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002 -#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0 -#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000 -#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800 - /* * A-PMDU buffer sizes * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2) From patchwork Tue Jun 9 17:44:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224627 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0952C433E2 for ; Tue, 9 Jun 2020 18:16:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A31D720691 for ; Tue, 9 Jun 2020 18:16:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726578; bh=kcyUeXcnckAw1S9JTu+FGshxg9h3RZJNhUTDrPla1uY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=zUSbXjDR2UPyeZloltheJgp5xgWYJC/tLtPst2ogWKhJcUEvkOtpmsaHr1EXqK1IS ZfhOX62G9V3X2zRarePCDHoOemXJejHmVLFTh7mDXofzbwF9icFWbF0inpw9Wrlae5 xADrr3pTUA9UkVr+Hq20VIq1wcJc3tmUUXRCZx7E= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387982AbgFISQP (ORCPT ); Tue, 9 Jun 2020 14:16:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:37822 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732650AbgFIRuY (ORCPT ); Tue, 9 Jun 2020 13:50:24 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1D8AD2074B; Tue, 9 Jun 2020 17:50:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725024; bh=kcyUeXcnckAw1S9JTu+FGshxg9h3RZJNhUTDrPla1uY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0LZR61jIW0vcGmzWCGFvHbDDFhogcRGCqlu6QiHQ1GG5miOmvjCZz0kAlvhuBudq3 k8sArOWmMtg7CEEacY7XgT01EPsLA+wIgSW2WqdMpnsrOjvUwfAxmdaNnoiPTlWooP fT2rOca/1NncwJAC15LahEJnFy0v2y8OE1SvHraw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , Jean Rene Dawin Subject: [PATCH 4.14 38/46] CDC-ACM: heed quirk also in error handling Date: Tue, 9 Jun 2020 19:44:54 +0200 Message-Id: <20200609174030.192334563@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Oliver Neukum commit 97fe809934dd2b0b37dfef3a2fc70417f485d7af upstream. If buffers are iterated over in the error case, the lower limits for quirky devices must be heeded. Signed-off-by: Oliver Neukum Reported-by: Jean Rene Dawin Fixes: a4e7279cd1d19 ("cdc-acm: introduce a cool down") Cc: stable Link: https://lore.kernel.org/r/20200526124420.22160-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/class/cdc-acm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -602,7 +602,7 @@ static void acm_softint(struct work_stru } if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) { - for (i = 0; i < ACM_NR; i++) + for (i = 0; i < acm->rx_buflimit; i++) if (test_and_clear_bit(i, &acm->urbs_in_error_delay)) acm_submit_read_urb(acm, i, GFP_NOIO); } From patchwork Tue Jun 9 17:44:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 187698 Delivered-To: patch@linaro.org Received: by 2002:a92:d6c9:0:0:0:0:0 with SMTP id z9csp784377ilp; Tue, 9 Jun 2020 11:15:09 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxxNcV1u52qbQr2PQgr4L8IyPABcWaZDEL1O8YhXXk2nErsyrCGhLTGSvT5ln0XHra/01/y X-Received: by 2002:a17:906:f189:: with SMTP id gs9mr26097955ejb.203.1591726508931; Tue, 09 Jun 2020 11:15:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1591726508; cv=none; d=google.com; s=arc-20160816; b=rnnde7MAzGGLZSLBJ8xkCxzTJBc2ljJJRB4SPrSMm7Brd/oo3RuKvBeiei+aH/izHr StJ7hz0B/ohP/31kIV+QcC0fSj94dqxM/jThGpQ341JdouqcclyiOZSeAcKowN/H+us/ RVrtiCqTw0XxztQ8zBlcCPI1QXCpV483Ip7OfsQFIvjC5RL/n9QMKnJ7N785Mg2lhJNT 3xEgGNBIs9T9+BUfCRhljFe4AYAUWZUHGL5wnlUY+Bp/GbeBEwnvuhu8B11xugR5RdEy AbHwEJLXl2xhTuXAMsNAyn/SlncOh96YnfLwUyht5UZr0eTUlULZy76qX2zhe8++lg4/ x8QA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=k7hMpwLWWbWrOKFN5Q272UymqoQoHsP4GxhWCnig0v4=; b=laDcRQ0SKvYp5AD1lZ+AGIomUJBhlmsrXt10VcnQ5cyblKyrP6HAspRkO35chK8/B/ J7s5OysXSrKW+YoJaIjx7xknHk/J+PyA6CFcghetEsGy5R7REUXyLp1ZyXpZkwBvc7QP U3fJJQvyJz8/w6fiUwZgmDilABfk+k3Ba0yex0FUgco0xfelsKZEuXctPslEHIboWtWG MBkNMlagYsArH3E5boPirX5M3wep0pBNi2+9fn1G99K6DPjwAWanzsTvTA/yjxh2t5hC SpQjGaFy2UzNhp02QDvpxm0hjK9wf6mE9jzud0hSZdNq73eV0wkrDAmzA5zJXCdeFzBi UrYQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=lwYixYoh; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id ay19si11361955ejb.372.2020.06.09.11.15.08; Tue, 09 Jun 2020 11:15:08 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=lwYixYoh; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732689AbgFIRub (ORCPT + 15 others); Tue, 9 Jun 2020 13:50:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:37916 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732655AbgFIRu2 (ORCPT ); Tue, 9 Jun 2020 13:50:28 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7204120734; Tue, 9 Jun 2020 17:50:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725026; bh=GEoeqiGrpGRe3rSrKqJTatBUEbBd+QnjdommEb2Bwuw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lwYixYohIHahTjfQ7SUozri52kGI85vpuSi97noRoWhZ2ZQeBJUA2JcCJHxtH6//l bJNy7Gti0rxGYHg7a15da5dI6qAPUPmHRkGs/+HAAhglowIEQPpOat2YppRN6AlzY/ zsaZap6sBa4D0dJzYXNbdt/bl2b5y6EhnkQGlx7I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Srinivas Kandagatla , Douglas Anderson Subject: [PATCH 4.14 39/46] nvmem: qfprom: remove incorrect write support Date: Tue, 9 Jun 2020 19:44:55 +0200 Message-Id: <20200609174030.310539358@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Srinivas Kandagatla commit 8d9eb0d6d59a5d7028c80a30831143d3e75515a7 upstream. qfprom has different address spaces for read and write. Reads are always done from corrected address space, where as writes are done on raw address space. Writing to corrected address space is invalid and ignored, so it does not make sense to have this support in the driver which only supports corrected address space regions at the moment. Fixes: 4ab11996b489 ("nvmem: qfprom: Add Qualcomm QFPROM support.") Signed-off-by: Srinivas Kandagatla Reviewed-by: Douglas Anderson Cc: stable Link: https://lore.kernel.org/r/20200522113341.7728-1-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/nvmem/qfprom.c | 14 -------------- 1 file changed, 14 deletions(-) --- a/drivers/nvmem/qfprom.c +++ b/drivers/nvmem/qfprom.c @@ -30,19 +30,6 @@ static int qfprom_reg_read(void *context return 0; } -static int qfprom_reg_write(void *context, - unsigned int reg, void *_val, size_t bytes) -{ - void __iomem *base = context; - u8 *val = _val; - int i = 0, words = bytes; - - while (words--) - writeb(*val++, base + reg + i++); - - return 0; -} - static int qfprom_remove(struct platform_device *pdev) { struct nvmem_device *nvmem = platform_get_drvdata(pdev); @@ -56,7 +43,6 @@ static struct nvmem_config econfig = { .stride = 1, .word_size = 1, .reg_read = qfprom_reg_read, - .reg_write = qfprom_reg_write, }; static int qfprom_probe(struct platform_device *pdev) From patchwork Tue Jun 9 17:44:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224696 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DEBFC433E1 for ; Tue, 9 Jun 2020 17:50:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F0650207C3 for ; Tue, 9 Jun 2020 17:50:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725034; bh=ptMIwntJnMGbrD0v5s0o+uuIc2+29HxsaQvIIRbjF1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=AaJU0mnE7gYuv5yvOB6Ij24LCaS47+mTnuq7cXi8jC4hz8j99T+O0QfODcqn/CR/r 69JS3CSngjnDQeFDmJbXdPQfuO6c29Um5Em4IEVZOVWLC+1m/ddMo636iI0/hPifNa R34RlGMXTrrwQWjt6gcrCW+qCUcvmDd0X4KvuLJs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732699AbgFIRuc (ORCPT ); Tue, 9 Jun 2020 13:50:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:38104 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732690AbgFIRuc (ORCPT ); Tue, 9 Jun 2020 13:50:32 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id F02CC20774; Tue, 9 Jun 2020 17:50:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725031; bh=ptMIwntJnMGbrD0v5s0o+uuIc2+29HxsaQvIIRbjF1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MZiG4/UxjQkE1bfvdHBifW0sJAF950TfPaX6hbqDQVBQG6SjVdN4QIS8J57PcVsKU hm0Emqf4VhnMyRBl4/JyuAld67AUaYQGehnZTRIf4V5WPu3TkJBI6dunsH/l/qxfQb IHuspCD6r8wl+dcktn8SzEUWtNrQheheX8y4bQVc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Gross , Borislav Petkov , Thomas Gleixner , Josh Poimboeuf Subject: [PATCH 4.14 41/46] x86/cpu: Add table argument to cpu_matches() Date: Tue, 9 Jun 2020 19:44:57 +0200 Message-Id: <20200609174030.541493657@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mark Gross commit 93920f61c2ad7edb01e63323832585796af75fc9 upstream To make cpu_matches() reusable for other matching tables, have it take a pointer to a x86_cpu_id table as an argument. [ bp: Flip arguments order. ] Signed-off-by: Mark Gross Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Reviewed-by: Josh Poimboeuf Signed-off-by: Greg Kroah-Hartman --- arch/x86/kernel/cpu/common.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -964,9 +964,9 @@ static const __initconst struct x86_cpu_ {} }; -static bool __init cpu_matches(unsigned long which) +static bool __init cpu_matches(const struct x86_cpu_id *table, unsigned long which) { - const struct x86_cpu_id *m = x86_match_cpu(cpu_vuln_whitelist); + const struct x86_cpu_id *m = x86_match_cpu(table); return m && !!(m->driver_data & which); } @@ -986,29 +986,32 @@ static void __init cpu_set_bug_bits(stru u64 ia32_cap = x86_read_arch_cap_msr(); /* Set ITLB_MULTIHIT bug if cpu is not in the whitelist and not mitigated */ - if (!cpu_matches(NO_ITLB_MULTIHIT) && !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO)) + if (!cpu_matches(cpu_vuln_whitelist, NO_ITLB_MULTIHIT) && + !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO)) setup_force_cpu_bug(X86_BUG_ITLB_MULTIHIT); - if (cpu_matches(NO_SPECULATION)) + if (cpu_matches(cpu_vuln_whitelist, NO_SPECULATION)) return; setup_force_cpu_bug(X86_BUG_SPECTRE_V1); setup_force_cpu_bug(X86_BUG_SPECTRE_V2); - if (!cpu_matches(NO_SSB) && !(ia32_cap & ARCH_CAP_SSB_NO) && + if (!cpu_matches(cpu_vuln_whitelist, NO_SSB) && + !(ia32_cap & ARCH_CAP_SSB_NO) && !cpu_has(c, X86_FEATURE_AMD_SSB_NO)) setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS); if (ia32_cap & ARCH_CAP_IBRS_ALL) setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED); - if (!cpu_matches(NO_MDS) && !(ia32_cap & ARCH_CAP_MDS_NO)) { + if (!cpu_matches(cpu_vuln_whitelist, NO_MDS) && + !(ia32_cap & ARCH_CAP_MDS_NO)) { setup_force_cpu_bug(X86_BUG_MDS); - if (cpu_matches(MSBDS_ONLY)) + if (cpu_matches(cpu_vuln_whitelist, MSBDS_ONLY)) setup_force_cpu_bug(X86_BUG_MSBDS_ONLY); } - if (!cpu_matches(NO_SWAPGS)) + if (!cpu_matches(cpu_vuln_whitelist, NO_SWAPGS)) setup_force_cpu_bug(X86_BUG_SWAPGS); /* @@ -1026,7 +1029,7 @@ static void __init cpu_set_bug_bits(stru (ia32_cap & ARCH_CAP_TSX_CTRL_MSR))) setup_force_cpu_bug(X86_BUG_TAA); - if (cpu_matches(NO_MELTDOWN)) + if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) return; /* Rogue Data Cache Load? No! */ @@ -1035,7 +1038,7 @@ static void __init cpu_set_bug_bits(stru setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN); - if (cpu_matches(NO_L1TF)) + if (cpu_matches(cpu_vuln_whitelist, NO_L1TF)) return; setup_force_cpu_bug(X86_BUG_L1TF); From patchwork Tue Jun 9 17:44:58 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224629 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DFA3C433E1 for ; Tue, 9 Jun 2020 18:14:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6C7E920691 for ; Tue, 9 Jun 2020 18:14:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591726480; bh=nhYA8Z/vTxR9HENdL+3l6y0qCpv3vfNRiCUoJUzoO/w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=sFcjYnC/VgX/PefHP7B7b51askuBIzW9/SQ14TaPAaxig50BzXi05HASzzFuYBdbP 3NT3XujwFjsn6wDDlmLZ+Bq42oBQkOr5YFqB8Ujq6ZUgupE/RgZou1oRy8lIoVi2Kq RM7RJ7HS/mVmKrwt/qrqTuSPaBWkYKDWG8eysNbc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732709AbgFIRuh (ORCPT ); Tue, 9 Jun 2020 13:50:37 -0400 Received: from mail.kernel.org ([198.145.29.99]:38182 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732703AbgFIRuf (ORCPT ); Tue, 9 Jun 2020 13:50:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3F33C20734; Tue, 9 Jun 2020 17:50:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725033; bh=nhYA8Z/vTxR9HENdL+3l6y0qCpv3vfNRiCUoJUzoO/w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2tbW9ACu6HK5HOGn8xUHBtzOnfBcnYGpPFQLi1g5p8JkDXbdmOM9igbJew/q0kDqD CxDwUe/lpH0KVzz+8oE6udQ1UpKFv8wlX8HPPzpO14xNoX3jegr1a6tHujQaUY08Zp T0Xk6C2GOcROPzIH9GS3QJ7zk35mNeA7wo/k+wes= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Gross , Borislav Petkov , Thomas Gleixner , Tony Luck , Pawan Gupta , Josh Poimboeuf , Neelima Krishnan Subject: [PATCH 4.14 42/46] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation Date: Tue, 9 Jun 2020 19:44:58 +0200 Message-Id: <20200609174030.652264799@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mark Gross commit 7e5b3c267d256822407a22fdce6afdf9cd13f9fb upstream SRBDS is an MDS-like speculative side channel that can leak bits from the random number generator (RNG) across cores and threads. New microcode serializes the processor access during the execution of RDRAND and RDSEED. This ensures that the shared buffer is overwritten before it is released for reuse. While it is present on all affected CPU models, the microcode mitigation is not needed on models that enumerate ARCH_CAPABILITIES[MDS_NO] in the cases where TSX is not supported or has been disabled with TSX_CTRL. The mitigation is activated by default on affected processors and it increases latency for RDRAND and RDSEED instructions. Among other effects this will reduce throughput from /dev/urandom. * Enable administrator to configure the mitigation off when desired using either mitigations=off or srbds=off. * Export vulnerability status via sysfs * Rename file-scoped macros to apply for non-whitelist table initializations. [ bp: Massage, - s/VULNBL_INTEL_STEPPING/VULNBL_INTEL_STEPPINGS/g, - do not read arch cap MSR a second time in tsx_fused_off() - just pass it in, - flip check in cpu_set_bug_bits() to save an indentation level, - reflow comments. jpoimboe: s/Mitigated/Mitigation/ in user-visible strings tglx: Dropped the fused off magic for now ] Signed-off-by: Mark Gross Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Reviewed-by: Tony Luck Reviewed-by: Pawan Gupta Reviewed-by: Josh Poimboeuf Tested-by: Neelima Krishnan Signed-off-by: Greg Kroah-Hartman --- Documentation/ABI/testing/sysfs-devices-system-cpu | 1 Documentation/admin-guide/kernel-parameters.txt | 20 +++ arch/x86/include/asm/cpufeatures.h | 2 arch/x86/include/asm/msr-index.h | 4 arch/x86/kernel/cpu/bugs.c | 106 +++++++++++++++++++++ arch/x86/kernel/cpu/common.c | 31 ++++++ arch/x86/kernel/cpu/cpu.h | 1 drivers/base/cpu.c | 8 + 8 files changed, 173 insertions(+) --- a/Documentation/ABI/testing/sysfs-devices-system-cpu +++ b/Documentation/ABI/testing/sysfs-devices-system-cpu @@ -381,6 +381,7 @@ What: /sys/devices/system/cpu/vulnerabi /sys/devices/system/cpu/vulnerabilities/spec_store_bypass /sys/devices/system/cpu/vulnerabilities/l1tf /sys/devices/system/cpu/vulnerabilities/mds + /sys/devices/system/cpu/vulnerabilities/srbds /sys/devices/system/cpu/vulnerabilities/tsx_async_abort /sys/devices/system/cpu/vulnerabilities/itlb_multihit Date: January 2018 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -4234,6 +4234,26 @@ spia_pedr= spia_peddr= + srbds= [X86,INTEL] + Control the Special Register Buffer Data Sampling + (SRBDS) mitigation. + + Certain CPUs are vulnerable to an MDS-like + exploit which can leak bits from the random + number generator. + + By default, this issue is mitigated by + microcode. However, the microcode fix can cause + the RDRAND and RDSEED instructions to become + much slower. Among other effects, this will + result in reduced throughput from /dev/urandom. + + The microcode mitigation can be disabled with + the following option: + + off: Disable mitigation and remove + performance impact to RDRAND and RDSEED + srcutree.counter_wrap_check [KNL] Specifies how frequently to check for grace-period sequence counter wrap for the --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -346,6 +346,7 @@ /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */ #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */ #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */ +#define X86_FEATURE_SRBDS_CTRL (18*32+ 9) /* "" SRBDS mitigation MSR available */ #define X86_FEATURE_TSX_FORCE_ABORT (18*32+13) /* "" TSX_FORCE_ABORT */ #define X86_FEATURE_MD_CLEAR (18*32+10) /* VERW clears CPU buffers */ #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */ @@ -390,5 +391,6 @@ #define X86_BUG_SWAPGS X86_BUG(21) /* CPU is affected by speculation through SWAPGS */ #define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */ #define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */ +#define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */ #endif /* _ASM_X86_CPUFEATURES_H */ --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -110,6 +110,10 @@ #define TSX_CTRL_RTM_DISABLE BIT(0) /* Disable RTM feature */ #define TSX_CTRL_CPUID_CLEAR BIT(1) /* Disable TSX enumeration */ +/* SRBDS support */ +#define MSR_IA32_MCU_OPT_CTRL 0x00000123 +#define RNGDS_MITG_DIS BIT(0) + #define MSR_IA32_SYSENTER_CS 0x00000174 #define MSR_IA32_SYSENTER_ESP 0x00000175 #define MSR_IA32_SYSENTER_EIP 0x00000176 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -41,6 +41,7 @@ static void __init l1tf_select_mitigatio static void __init mds_select_mitigation(void); static void __init mds_print_mitigation(void); static void __init taa_select_mitigation(void); +static void __init srbds_select_mitigation(void); /* The base value of the SPEC_CTRL MSR that always has to be preserved. */ u64 x86_spec_ctrl_base; @@ -108,6 +109,7 @@ void __init check_bugs(void) l1tf_select_mitigation(); mds_select_mitigation(); taa_select_mitigation(); + srbds_select_mitigation(); /* * As MDS and TAA mitigations are inter-related, print MDS @@ -391,6 +393,97 @@ static int __init tsx_async_abort_parse_ early_param("tsx_async_abort", tsx_async_abort_parse_cmdline); #undef pr_fmt +#define pr_fmt(fmt) "SRBDS: " fmt + +enum srbds_mitigations { + SRBDS_MITIGATION_OFF, + SRBDS_MITIGATION_UCODE_NEEDED, + SRBDS_MITIGATION_FULL, + SRBDS_MITIGATION_TSX_OFF, + SRBDS_MITIGATION_HYPERVISOR, +}; + +static enum srbds_mitigations srbds_mitigation __ro_after_init = SRBDS_MITIGATION_FULL; + +static const char * const srbds_strings[] = { + [SRBDS_MITIGATION_OFF] = "Vulnerable", + [SRBDS_MITIGATION_UCODE_NEEDED] = "Vulnerable: No microcode", + [SRBDS_MITIGATION_FULL] = "Mitigation: Microcode", + [SRBDS_MITIGATION_TSX_OFF] = "Mitigation: TSX disabled", + [SRBDS_MITIGATION_HYPERVISOR] = "Unknown: Dependent on hypervisor status", +}; + +static bool srbds_off; + +void update_srbds_msr(void) +{ + u64 mcu_ctrl; + + if (!boot_cpu_has_bug(X86_BUG_SRBDS)) + return; + + if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) + return; + + if (srbds_mitigation == SRBDS_MITIGATION_UCODE_NEEDED) + return; + + rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl); + + switch (srbds_mitigation) { + case SRBDS_MITIGATION_OFF: + case SRBDS_MITIGATION_TSX_OFF: + mcu_ctrl |= RNGDS_MITG_DIS; + break; + case SRBDS_MITIGATION_FULL: + mcu_ctrl &= ~RNGDS_MITG_DIS; + break; + default: + break; + } + + wrmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl); +} + +static void __init srbds_select_mitigation(void) +{ + u64 ia32_cap; + + if (!boot_cpu_has_bug(X86_BUG_SRBDS)) + return; + + /* + * Check to see if this is one of the MDS_NO systems supporting + * TSX that are only exposed to SRBDS when TSX is enabled. + */ + ia32_cap = x86_read_arch_cap_msr(); + if ((ia32_cap & ARCH_CAP_MDS_NO) && !boot_cpu_has(X86_FEATURE_RTM)) + srbds_mitigation = SRBDS_MITIGATION_TSX_OFF; + else if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) + srbds_mitigation = SRBDS_MITIGATION_HYPERVISOR; + else if (!boot_cpu_has(X86_FEATURE_SRBDS_CTRL)) + srbds_mitigation = SRBDS_MITIGATION_UCODE_NEEDED; + else if (cpu_mitigations_off() || srbds_off) + srbds_mitigation = SRBDS_MITIGATION_OFF; + + update_srbds_msr(); + pr_info("%s\n", srbds_strings[srbds_mitigation]); +} + +static int __init srbds_parse_cmdline(char *str) +{ + if (!str) + return -EINVAL; + + if (!boot_cpu_has_bug(X86_BUG_SRBDS)) + return 0; + + srbds_off = !strcmp(str, "off"); + return 0; +} +early_param("srbds", srbds_parse_cmdline); + +#undef pr_fmt #define pr_fmt(fmt) "Spectre V1 : " fmt enum spectre_v1_mitigation { @@ -1491,6 +1584,11 @@ static char *ibpb_state(void) return ""; } +static ssize_t srbds_show_state(char *buf) +{ + return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]); +} + static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, char *buf, unsigned int bug) { @@ -1532,6 +1630,9 @@ static ssize_t cpu_show_common(struct de case X86_BUG_ITLB_MULTIHIT: return itlb_multihit_show_state(buf); + case X86_BUG_SRBDS: + return srbds_show_state(buf); + default: break; } @@ -1578,4 +1679,9 @@ ssize_t cpu_show_itlb_multihit(struct de { return cpu_show_common(dev, attr, buf, X86_BUG_ITLB_MULTIHIT); } + +ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *buf) +{ + return cpu_show_common(dev, attr, buf, X86_BUG_SRBDS); +} #endif --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -964,6 +964,27 @@ static const __initconst struct x86_cpu_ {} }; +#define VULNBL_INTEL_STEPPINGS(model, steppings, issues) \ + X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, \ + INTEL_FAM6_##model, steppings, \ + X86_FEATURE_ANY, issues) + +#define SRBDS BIT(0) + +static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = { + VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(HASWELL_CORE, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(HASWELL_ULT, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(HASWELL_GT3E, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(BROADWELL_GT3E, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(BROADWELL_CORE, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPING_ANY, SRBDS), + VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPINGS(0x0, 0xC), SRBDS), + VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x0, 0xD), SRBDS), + {} +}; + static bool __init cpu_matches(const struct x86_cpu_id *table, unsigned long which) { const struct x86_cpu_id *m = x86_match_cpu(table); @@ -1029,6 +1050,15 @@ static void __init cpu_set_bug_bits(stru (ia32_cap & ARCH_CAP_TSX_CTRL_MSR))) setup_force_cpu_bug(X86_BUG_TAA); + /* + * SRBDS affects CPUs which support RDRAND or RDSEED and are listed + * in the vulnerability blacklist. + */ + if ((cpu_has(c, X86_FEATURE_RDRAND) || + cpu_has(c, X86_FEATURE_RDSEED)) && + cpu_matches(cpu_vuln_blacklist, SRBDS)) + setup_force_cpu_bug(X86_BUG_SRBDS); + if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) return; @@ -1454,6 +1484,7 @@ void identify_secondary_cpu(struct cpuin mtrr_ap_init(); validate_apic_and_package_id(c); x86_spec_ctrl_setup_ap(); + update_srbds_msr(); } static __init int setup_noclflush(char *arg) --- a/arch/x86/kernel/cpu/cpu.h +++ b/arch/x86/kernel/cpu/cpu.h @@ -69,6 +69,7 @@ extern int detect_ht_early(struct cpuinf unsigned int aperfmperf_get_khz(int cpu); extern void x86_spec_ctrl_setup_ap(void); +extern void update_srbds_msr(void); extern u64 x86_read_arch_cap_msr(void); --- a/drivers/base/cpu.c +++ b/drivers/base/cpu.c @@ -552,6 +552,12 @@ ssize_t __weak cpu_show_itlb_multihit(st return sprintf(buf, "Not affected\n"); } +ssize_t __weak cpu_show_srbds(struct device *dev, + struct device_attribute *attr, char *buf) +{ + return sprintf(buf, "Not affected\n"); +} + static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); @@ -560,6 +566,7 @@ static DEVICE_ATTR(l1tf, 0444, cpu_show_ static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL); static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL); static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL); +static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL); static struct attribute *cpu_root_vulnerabilities_attrs[] = { &dev_attr_meltdown.attr, @@ -570,6 +577,7 @@ static struct attribute *cpu_root_vulner &dev_attr_mds.attr, &dev_attr_tsx_async_abort.attr, &dev_attr_itlb_multihit.attr, + &dev_attr_srbds.attr, NULL }; From patchwork Tue Jun 9 17:45:00 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224695 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0080C433E0 for ; Tue, 9 Jun 2020 17:50:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9DA3D207C3 for ; Tue, 9 Jun 2020 17:50:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725046; bh=KBJDsnC/ruZzhFkAosuSNvcMKVC5aIEuK5TDQj8MtJI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=oL1qE3q2dzH52+vLKgBy/oNA+lpsG1ify/EUKKZbKsB5KS076XQmT6yBj94paUEo/ x6FPTww668Kh3IwSkSUn+T5dYG2lO7Rv8fYm9L+fIuBENx2fTJwf8MtEcRh+Uew2OG tHmmTS6SY2uMjKOKsPoV2wHIWxkxIVRFHj/iU3RE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731143AbgFIRup (ORCPT ); Tue, 9 Jun 2020 13:50:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:38376 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732714AbgFIRui (ORCPT ); Tue, 9 Jun 2020 13:50:38 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id BF92E2074B; Tue, 9 Jun 2020 17:50:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725038; bh=KBJDsnC/ruZzhFkAosuSNvcMKVC5aIEuK5TDQj8MtJI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iOA2Ig6hSGa1LbVtfK05wbl6sMs+xS3bCa7n8urh4drnR1OvY9KEbfhyj3TuTXZfu pTmV9yEmM7v0xYgscyxrkwKGRZrFtguWzIiQQaN+LQCbcH2zbpqbo6QEE91C2Fvuly 1XD4kGHL7sSLZlqdxDiAkhjK+IrLBWbPmw7tU73w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josh Poimboeuf , Thomas Gleixner Subject: [PATCH 4.14 44/46] x86/speculation: Add Ivy Bridge to affected list Date: Tue, 9 Jun 2020 19:45:00 +0200 Message-Id: <20200609174030.903153138@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174022.938987501@linuxfoundation.org> References: <20200609174022.938987501@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Josh Poimboeuf commit 3798cc4d106e91382bfe016caa2edada27c2bb3f upstream Make the docs match the code. Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman --- Documentation/admin-guide/hw-vuln/special-register-buffer-data-sampling.rst | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/Documentation/admin-guide/hw-vuln/special-register-buffer-data-sampling.rst +++ b/Documentation/admin-guide/hw-vuln/special-register-buffer-data-sampling.rst @@ -27,6 +27,8 @@ by software using TSX_CTRL_MSR otherwise ============= ============ ======== common name Family_Model Stepping ============= ============ ======== + IvyBridge 06_3AH All + Haswell 06_3CH All Haswell_L 06_45H All Haswell_G 06_46H All @@ -37,9 +39,8 @@ by software using TSX_CTRL_MSR otherwise Skylake_L 06_4EH All Skylake 06_5EH All - Kabylake_L 06_8EH <=0xC - - Kabylake 06_9EH <=0xD + Kabylake_L 06_8EH <= 0xC + Kabylake 06_9EH <= 0xD ============= ============ ======== Related CVEs