mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-06 20:03:33 -04:00
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Andrey Konovalov
|
75579189e9 |
UPSTREAM: kcov: remote coverage support
(Upstream commit eec028c9386ed1a692aa01a85b55952202b41619.) Patch series " kcov: collect coverage from usb and vhost", v3. This patchset extends kcov to allow collecting coverage from backgound kernel threads. This extension requires custom annotations for each of the places where coverage collection is desired. This patchset implements this for hub events in the USB subsystem and for vhost workers. See the first patch description for details about the kcov extension. The other two patches apply this kcov extension to USB and vhost. Examples of other subsystems that might potentially benefit from this when custom annotations are added (the list is based on process_one_work() callers for bugs recently reported by syzbot): 1. fs: writeback wb_workfn() worker, 2. net: addrconf_dad_work()/addrconf_verify_work() workers, 3. net: neigh_periodic_work() worker, 4. net/p9: p9_write_work()/p9_read_work() workers, 5. block: blk_mq_run_work_fn() worker. These patches have been used to enable coverage-guided USB fuzzing with syzkaller for the last few years, see the details here: https://github.com/google/syzkaller/blob/master/docs/linux/external_fuzzing_usb.md This patchset has been pushed to the public Linux kernel Gerrit instance: https://linux-review.googlesource.com/c/linux/kernel/git/torvalds/linux/+/1524 This patch (of 3): Add background thread coverage collection ability to kcov. With KCOV_ENABLE coverage is collected only for syscalls that are issued from the current process. With KCOV_REMOTE_ENABLE it's possible to collect coverage for arbitrary parts of the kernel code, provided that those parts are annotated with kcov_remote_start()/kcov_remote_stop(). This allows to collect coverage from two types of kernel background threads: the global ones, that are spawned during kernel boot in a limited number of instances (e.g. one USB hub_event() worker thread is spawned per USB HCD); and the local ones, that are spawned when a user interacts with some kernel interface (e.g. vhost workers). To enable collecting coverage from a global background thread, a unique global handle must be assigned and passed to the corresponding kcov_remote_start() call. Then a userspace process can pass a list of such handles to the KCOV_REMOTE_ENABLE ioctl in the handles array field of the kcov_remote_arg struct. This will attach the used kcov device to the code sections, that are referenced by those handles. Since there might be many local background threads spawned from different userspace processes, we can't use a single global handle per annotation. Instead, the userspace process passes a non-zero handle through the common_handle field of the kcov_remote_arg struct. This common handle gets saved to the kcov_handle field in the current task_struct and needs to be passed to the newly spawned threads via custom annotations. Those threads should in turn be annotated with kcov_remote_start()/kcov_remote_stop(). Internally kcov stores handles as u64 integers. The top byte of a handle is used to denote the id of a subsystem that this handle belongs to, and the lower 4 bytes are used to denote the id of a thread instance within that subsystem. A reserved value 0 is used as a subsystem id for common handles as they don't belong to a particular subsystem. The bytes 4-7 are currently reserved and must be zero. In the future the number of bytes used for the subsystem or handle ids might be increased. When a particular userspace process collects coverage by via a common handle, kcov will collect coverage for each code section that is annotated to use the common handle obtained as kcov_handle from the current task_struct. However non common handles allow to collect coverage selectively from different subsystems. Link: http://lkml.kernel.org/r/e90e315426a384207edbec1d6aa89e43008e4caf.1572366574.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Alan Stern <stern@rowland.harvard.edu> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: David Windsor <dwindsor@gmail.com> Cc: Elena Reshetova <elena.reshetova@intel.com> Cc: Anders Roxell <anders.roxell@linaro.org> Cc: Alexander Potapenko <glider@google.com> Cc: Marco Elver <elver@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Bug: 147413187 Change-Id: I868c4846a412bfbae16086017e113813571df377 |
||
Greg Kroah-Hartman
|
fde6e0c654 |
This is the 5.4.11 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl4bAaMACgkQONu9yGCS aT6WThAApG5Lt+rOIIbb0JsTgiqzRs/5VkxQLDsDkn8QXMDDX44eY+cW3XLA+3nv UAU7wXraFCq7SznsQADHj4edAQN/urNXcIlLCIfoWCuq4Yk6DIgHNDZcC5a1PPiz ri96mrxHq24XDbRcXZFN4usC6Q1Q40W/N2NyZ7gIfCsYOeiaZzNhvw1Sh6Pkajb+ jKe9Yzjolj2XJxrNgJxfsTJLnCEPwoQ/QoBIp1ffHqhhCjR/7tHm611Pj0q260Fj H6OGZaRNMoc4I+2dQXsYUfyPH5aMwx2/Nym4FNHye9LaoQl07m+uR0LqmytPQ0GL j6mQuMv+kdeVOOXO+zRJH8A2yq4mwvr80s15myhG9HvAzmcGAvagsCl19yy9/fJx 6M2Sn8qDwJXRaxTc1e7figXkTZu5+sX7th3sUk0KbCHZ+UkJiCjXpJDgBK/HQkC3 EsVFZGeIBySbWk2yYKzQkb4ZA32qbzUKW88Rjago3BOV96WHfnAhJDQPssDJqlcs cgK+UTQOJb9U1V+Kd4Z8uhlCeboaRj4yOFt2EGxkK2sqJse05eaTN0GPbP/3X6Be TyD17Cnv18Ltk2qf2DXanJSlrCUcHEfEDoQQTqJATxV4NLzTcwmVAscsv1aRmcot ii1ZTwqi04MLgaNla+6tqqZ/VufUtWVIbN73q2UdU8zZh5PHJ18= =cKx6 -----END PGP SIGNATURE----- Merge 5.4.11 into android-5.4 Changes in 5.4.11 USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein bpf: Fix passing modified ctx to ld/abs/ind instruction ASoC: rt5682: fix i2c arbitration lost issue spi: pxa2xx: Add support for Intel Jasper Lake regulator: fix use after free issue ASoC: max98090: fix possible race conditions spi: fsl: Fix GPIO descriptor support gpio: Handle counting of Freescale chipselects spi: fsl: Handle the single hardwired chipselect case locking/spinlock/debug: Fix various data races netfilter: ctnetlink: netns exit must wait for callbacks x86/intel: Disable HPET on Intel Ice Lake platforms netfilter: nf_tables_offload: Check for the NETDEV_UNREGISTER event mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() libtraceevent: Fix lib installation with O= libtraceevent: Copy pkg-config file to output folder when using O= regulator: core: fix regulator_register() error paths to properly release rdev x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89 selftests: netfilter: use randomized netns names efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs efi/gop: Return EFI_SUCCESS if a usable GOP was found efi/gop: Fix memory leak in __gop_query32/64() efi/earlycon: Remap entire framebuffer after page initialization ARM: dts: imx6ul: imx6ul-14x14-evk.dtsi: Fix SPI NOR probing ARM: vexpress: Set-up shared OPP table instead of individual for each CPU netfilter: uapi: Avoid undefined left-shift in xt_sctp.h netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() netfilter: nf_tables: skip module reference count bump on object updates netfilter: nf_tables_offload: return EOPNOTSUPP if rule specifies no actions ARM: dts: BCM5301X: Fix MDIO node address/size cells selftests/ftrace: Fix to check the existence of set_ftrace_filter selftests/ftrace: Fix ftrace test cases to check unsupported selftests/ftrace: Do not to use absolute debugfs path selftests/ftrace: Fix multiple kprobe testcase selftests: safesetid: Move link library to LDLIBS selftests: safesetid: Check the return value of setuid/setgid selftests: safesetid: Fix Makefile to set correct test program ARM: exynos_defconfig: Restore debugfs support ARM: dts: Cygnus: Fix MDIO node address/size cells spi: spi-cavium-thunderx: Add missing pci_release_regions() reset: Do not register resource data for missing resets ASoC: topology: Check return value for snd_soc_add_dai_link() ASoC: topology: Check return value for soc_tplg_pcm_create() ASoC: SOF: loader: snd_sof_fw_parse_ext_data log warning on unknown header ASoC: SOF: Intel: split cht and byt debug window sizes ARM: dts: am335x-sancloud-bbe: fix phy mode ARM: omap2plus_defconfig: Add back DEBUG_FS ARM: dts: bcm283x: Fix critical trip point arm64: dts: ls1028a: fix typo in TMU calibration data bpf, riscv: Limit to 33 tail calls bpf, mips: Limit to 33 tail calls bpftool: Don't crash on missing jited insns or ksyms perf metricgroup: Fix printing event names of metric group with multiple events perf header: Fix false warning when there are no duplicate cache entries spi: spi-ti-qspi: Fix a bug when accessing non default CS ARM: dts: am437x-gp/epos-evm: fix panel compatible kselftest/runner: Print new line in print of timeout log kselftest: Support old perl versions samples: bpf: Replace symbol compare of trace_event samples: bpf: fix syscall_tp due to unused syscall arm64: dts: ls1028a: fix reboot node ARM: imx_v6_v7_defconfig: Explicitly restore CONFIG_DEBUG_FS pinctrl: aspeed-g6: Fix LPC/eSPI mux configuration bus: ti-sysc: Fix missing reset delay handling clk: walk orphan list on clock provider registration mac80211: fix TID field in monitor mode transmit cfg80211: fix double-free after changing network namespace pinctrl: pinmux: fix a possible null pointer in pinmux_can_be_used_for_gpio powerpc: Ensure that swiotlb buffer is allocated from low memory btrfs: Fix error messages in qgroup_rescan_init Btrfs: fix cloning range with a hole when using the NO_HOLES feature powerpc/vcpu: Assume dedicated processors as non-preempt powerpc/spinlocks: Include correct header for static key btrfs: handle error in btrfs_cache_block_group Btrfs: fix hole extent items with a zero size after range cloning ocxl: Fix potential memory leak on context creation bpf: Clear skb->tstamp in bpf_redirect when necessary habanalabs: rate limit error msg on waiting for CS habanalabs: remove variable 'val' set but not used bnx2x: Do not handle requests from VFs after parity bnx2x: Fix logic to get total no. of PFs per engine cxgb4: Fix kernel panic while accessing sge_info net: usb: lan78xx: Fix error message format specifier parisc: fix compilation when KEXEC=n and KEXEC_FILE=y parisc: add missing __init annotation rfkill: Fix incorrect check to avoid NULL pointer dereference ASoC: wm8962: fix lambda value regulator: rn5t618: fix module aliases spi: nxp-fspi: Ensure width is respected in spi-mem operations clk: at91: fix possible deadlock staging: axis-fifo: add unspecified HAS_IOMEM dependency iommu/iova: Init the struct iova to fix the possible memleak kconfig: don't crash on NULL expressions in expr_eq() scripts: package: mkdebian: add missing rsync dependency perf/x86: Fix potential out-of-bounds access perf/x86/intel: Fix PT PMI handling sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime psi: Fix a division error in psi poll() usb: typec: fusb302: Fix an undefined reference to 'extcon_get_state' block: end bio with BLK_STS_AGAIN in case of non-mq devs and REQ_NOWAIT fs: avoid softlockups in s_inodes iterators fs: call fsnotify_sb_delete after evict_inodes perf/smmuv3: Remove the leftover put_cpu() in error path iommu/dma: Relax locking in iommu_dma_prepare_msi() io_uring: don't wait when under-submitting clk: Move clk_core_reparent_orphans() under CONFIG_OF net: stmmac: selftests: Needs to check the number of Multicast regs net: stmmac: Determine earlier the size of RX buffer net: stmmac: Do not accept invalid MTU values net: stmmac: xgmac: Clear previous RX buffer size net: stmmac: RX buffer size must be 16 byte aligned net: stmmac: Always arm TX Timer at end of transmission start s390/purgatory: do not build purgatory with kcov, kasan and friends drm/exynos: gsc: add missed component_del tpm/tpm_ftpm_tee: add shutdown call back xsk: Add rcu_read_lock around the XSK wakeup net/mlx5e: Fix concurrency issues between config flow and XSK net/i40e: Fix concurrency issues between config flow and XSK net/ixgbe: Fix concurrency issues between config flow and XSK platform/x86: pcengines-apuv2: fix simswap GPIO assignment arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list block: Fix a lockdep complaint triggered by request queue flushing s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly s390/dasd: fix memleak in path handling error case block: fix memleak when __blk_rq_map_user_iov() is failed parisc: Fix compiler warnings in debug_core.c sbitmap: only queue kyber's wait callback if not already active s390/qeth: handle error due to unsupported transport mode s390/qeth: fix promiscuous mode after reset s390/qeth: don't return -ENOTSUPP to userspace llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c) hv_netvsc: Fix unwanted rx_table reset selftests: pmtu: fix init mtu value in description tracing: Do not create directories if lockdown is in affect gtp: fix bad unlock balance in gtp_encap_enable_socket macvlan: do not assume mac_header is set in macvlan_broadcast() net: dsa: mv88e6xxx: Preserve priority when setting CPU port. net: freescale: fec: Fix ethtool -d runtime PM net: stmmac: dwmac-sun8i: Allow all RGMII modes net: stmmac: dwmac-sunxi: Allow all RGMII modes net: stmmac: Fixed link does not need MDIO Bus net: usb: lan78xx: fix possible skb leak pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM sch_cake: avoid possible divide by zero in cake_enqueue() sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK vxlan: fix tos value before xmit mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO net: sch_prio: When ungrafting, replace with FIFO vlan: fix memory leak in vlan_dev_set_egress_priority vlan: vlan_changelink() should propagate errors macb: Don't unregister clks unconditionally net/mlx5: Move devlink registration before interfaces load net: dsa: mv88e6xxx: force cmode write on 6141/6341 net/mlx5e: Always print health reporter message to dmesg net/mlx5: DR, No need for atomic refcount for internal SW steering resources net/mlx5e: Fix hairpin RSS table size net/mlx5: DR, Init lists that are used in rule's member usb: dwc3: gadget: Fix request complete check USB: core: fix check for duplicate endpoints USB: serial: option: add Telit ME910G1 0x110a composition usb: missing parentheses in USE_NEW_SCHEME Linux 5.4.11 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Idb9985bebc97203fa305f881fd98a62ac08e66d9 |
||
Steven Rostedt (VMware)
|
b301cb2f19 |
tracing: Do not create directories if lockdown is in affect
commit a356646a56857c2e5ad875beec734d7145ecd49a upstream.
If lockdown is disabling tracing on boot up, it prevents the tracing files
from even bering created. But when that happens, there's several places that
will give a warning that the files were not created as that is usually a
sign of a bug.
Add in strategic locations where a check is made to see if tracing is
disabled by lockdown, and if it is, do not go further, and fail silently
(but print that tracing is disabled by lockdown, without doing a WARN_ON()).
Cc: Matthew Garrett <mjg59@google.com>
Fixes:
|
||
Johannes Weiner
|
4e38135180 |
psi: Fix a division error in psi poll()
[ Upstream commit c3466952ca1514158d7c16c9cfc48c27d5c5dc0f ] The psi window size is a u64 an can be up to 10 seconds right now, which exceeds the lower 32 bits of the variable. We currently use div_u64 for it, which is meant only for 32-bit divisors. The result is garbage pressure sampling values and even potential div0 crashes. Use div64_u64. Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Suren Baghdasaryan <surenb@google.com> Cc: Jingfeng Xie <xiejingfeng@linux.alibaba.com> Link: https://lkml.kernel.org/r/20191203183524.41378-3-hannes@cmpxchg.org Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Johannes Weiner
|
74e2bdcb7d |
sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime
[ Upstream commit 3dfbe25c27eab7c90c8a7e97b4c354a9d24dd985 ] Jingfeng reports rare div0 crashes in psi on systems with some uptime: [58914.066423] divide error: 0000 [#1] SMP [58914.070416] Modules linked in: ipmi_poweroff ipmi_watchdog toa overlay fuse tcp_diag inet_diag binfmt_misc aisqos(O) aisqos_hotfixes(O) [58914.083158] CPU: 94 PID: 140364 Comm: kworker/94:2 Tainted: G W OE K 4.9.151-015.ali3000.alios7.x86_64 #1 [58914.093722] Hardware name: Alibaba Alibaba Cloud ECS/Alibaba Cloud ECS, BIOS 3.23.34 02/14/2019 [58914.102728] Workqueue: events psi_update_work [58914.107258] task: ffff8879da83c280 task.stack: ffffc90059dcc000 [58914.113336] RIP: 0010:[] [] psi_update_stats+0x1c1/0x330 [58914.122183] RSP: 0018:ffffc90059dcfd60 EFLAGS: 00010246 [58914.127650] RAX: 0000000000000000 RBX: ffff8858fe98be50 RCX: 000000007744d640 [58914.134947] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00003594f700648e [58914.142243] RBP: ffffc90059dcfdf8 R08: 0000359500000000 R09: 0000000000000000 [58914.149538] R10: 0000000000000000 R11: 0000000000000000 R12: 0000359500000000 [58914.156837] R13: 0000000000000000 R14: 0000000000000000 R15: ffff8858fe98bd78 [58914.164136] FS: 0000000000000000(0000) GS:ffff887f7f380000(0000) knlGS:0000000000000000 [58914.172529] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [58914.178467] CR2: 00007f2240452090 CR3: 0000005d5d258000 CR4: 00000000007606f0 [58914.185765] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [58914.193061] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [58914.200360] PKRU: 55555554 [58914.203221] Stack: [58914.205383] ffff8858fe98bd48 00000000000002f0 0000002e81036d09 ffffc90059dcfde8 [58914.213168] ffff8858fe98bec8 0000000000000000 0000000000000000 0000000000000000 [58914.220951] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [58914.228734] Call Trace: [58914.231337] [] psi_update_work+0x22/0x60 [58914.237067] [] process_one_work+0x189/0x420 [58914.243063] [] worker_thread+0x4e/0x4b0 [58914.248701] [] ? process_one_work+0x420/0x420 [58914.254869] [] kthread+0xe6/0x100 [58914.259994] [] ? kthread_park+0x60/0x60 [58914.265640] [] ret_from_fork+0x39/0x50 [58914.271193] Code: 41 29 c3 4d 39 dc 4d 0f 42 dc <49> f7 f1 48 8b 13 48 89 c7 48 c1 [58914.279691] RIP [] psi_update_stats+0x1c1/0x330 The crashing instruction is trying to divide the observed stall time by the sampling period. The period, stored in R8, is not 0, but we are dividing by the lower 32 bits only, which are all 0 in this instance. We could switch to a 64-bit division, but the period shouldn't be that big in the first place. It's the time between the last update and the next scheduled one, and so should always be around 2s and comfortably fit into 32 bits. The bug is in the initialization of new cgroups: we schedule the first sampling event in a cgroup as an offset of sched_clock(), but fail to initialize the last_update timestamp, and it defaults to 0. That results in a bogusly large sampling period the first time we run the sampling code, and consequently we underreport pressure for the first 2s of a cgroup's life. But worse, if sched_clock() is sufficiently advanced on the system, and the user gets unlucky, the period's lower 32 bits can all be 0 and the sampling division will crash. Fix this by initializing the last update timestamp to the creation time of the cgroup, thus correctly marking the start of the first pressure sampling period in a new cgroup. Reported-by: Jingfeng Xie <xiejingfeng@linux.alibaba.com> Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Suren Baghdasaryan <surenb@google.com> Link: https://lkml.kernel.org/r/20191203183524.41378-2-hannes@cmpxchg.org Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
Marco Elver
|
c120c3dbeb |
locking/spinlock/debug: Fix various data races
[ Upstream commit 1a365e822372ba24c9da0822bc583894f6f3d821 ] This fixes various data races in spinlock_debug. By testing with KCSAN, it is observable that the console gets spammed with data races reports, suggesting these are extremely frequent. Example data race report: read to 0xffff8ab24f403c48 of 4 bytes by task 221 on cpu 2: debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline] do_raw_spin_lock+0x9b/0x210 kernel/locking/spinlock_debug.c:112 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_lock+0x39/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] get_partial_node.isra.0.part.0+0x32/0x2f0 mm/slub.c:1873 get_partial_node mm/slub.c:1870 [inline] <snip> write to 0xffff8ab24f403c48 of 4 bytes by task 167 on cpu 3: debug_spin_unlock kernel/locking/spinlock_debug.c:103 [inline] do_raw_spin_unlock+0xc9/0x1a0 kernel/locking/spinlock_debug.c:138 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:159 [inline] _raw_spin_unlock_irqrestore+0x2d/0x50 kernel/locking/spinlock.c:191 spin_unlock_irqrestore include/linux/spinlock.h:393 [inline] free_debug_processing+0x1b3/0x210 mm/slub.c:1214 __slab_free+0x292/0x400 mm/slub.c:2864 <snip> As a side-effect, with KCSAN, this eventually locks up the console, most likely due to deadlock, e.g. .. -> printk lock -> spinlock_debug -> KCSAN detects data race -> kcsan_print_report() -> printk lock -> deadlock. This fix will 1) avoid the data races, and 2) allow using lock debugging together with KCSAN. Reported-by: Qian Cai <cai@lca.pw> Signed-off-by: Marco Elver <elver@google.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Paul E. McKenney <paulmck@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Will Deacon <will.deacon@arm.com> Link: https://lkml.kernel.org/r/20191120155715.28089-1-elver@google.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
Daniel Borkmann
|
b2eccb43aa |
bpf: Fix passing modified ctx to ld/abs/ind instruction
commit 6d4f151acf9a4f6fab09b615f246c717ddedcf0c upstream. Anatoly has been fuzzing with kBdysch harness and reported a KASAN slab oob in one of the outcomes: [...] [ 77.359642] BUG: KASAN: slab-out-of-bounds in bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.360463] Read of size 4 at addr ffff8880679bac68 by task bpf/406 [ 77.361119] [ 77.361289] CPU: 2 PID: 406 Comm: bpf Not tainted 5.5.0-rc2-xfstests-00157-g2187f215eba #1 [ 77.362134] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 77.362984] Call Trace: [ 77.363249] dump_stack+0x97/0xe0 [ 77.363603] print_address_description.constprop.0+0x1d/0x220 [ 77.364251] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.365030] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.365860] __kasan_report.cold+0x37/0x7b [ 77.366365] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.366940] kasan_report+0xe/0x20 [ 77.367295] bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.367821] ? bpf_skb_load_helper_8+0xf0/0xf0 [ 77.368278] ? mark_lock+0xa3/0x9b0 [ 77.368641] ? kvm_sched_clock_read+0x14/0x30 [ 77.369096] ? sched_clock+0x5/0x10 [ 77.369460] ? sched_clock_cpu+0x18/0x110 [ 77.369876] ? bpf_skb_load_helper_8+0xf0/0xf0 [ 77.370330] ___bpf_prog_run+0x16c0/0x28f0 [ 77.370755] __bpf_prog_run32+0x83/0xc0 [ 77.371153] ? __bpf_prog_run64+0xc0/0xc0 [ 77.371568] ? match_held_lock+0x1b/0x230 [ 77.371984] ? rcu_read_lock_held+0xa1/0xb0 [ 77.372416] ? rcu_is_watching+0x34/0x50 [ 77.372826] sk_filter_trim_cap+0x17c/0x4d0 [ 77.373259] ? sock_kzfree_s+0x40/0x40 [ 77.373648] ? __get_filter+0x150/0x150 [ 77.374059] ? skb_copy_datagram_from_iter+0x80/0x280 [ 77.374581] ? do_raw_spin_unlock+0xa5/0x140 [ 77.375025] unix_dgram_sendmsg+0x33a/0xa70 [ 77.375459] ? do_raw_spin_lock+0x1d0/0x1d0 [ 77.375893] ? unix_peer_get+0xa0/0xa0 [ 77.376287] ? __fget_light+0xa4/0xf0 [ 77.376670] __sys_sendto+0x265/0x280 [ 77.377056] ? __ia32_sys_getpeername+0x50/0x50 [ 77.377523] ? lock_downgrade+0x350/0x350 [ 77.377940] ? __sys_setsockopt+0x2a6/0x2c0 [ 77.378374] ? sock_read_iter+0x240/0x240 [ 77.378789] ? __sys_socketpair+0x22a/0x300 [ 77.379221] ? __ia32_sys_socket+0x50/0x50 [ 77.379649] ? mark_held_locks+0x1d/0x90 [ 77.380059] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 77.380536] __x64_sys_sendto+0x74/0x90 [ 77.380938] do_syscall_64+0x68/0x2a0 [ 77.381324] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 77.381878] RIP: 0033:0x44c070 [...] After further debugging, turns out while in case of other helper functions we disallow passing modified ctx, the special case of ld/abs/ind instruction which has similar semantics (except r6 being the ctx argument) is missing such check. Modified ctx is impossible here as bpf_skb_load_helper_8_no_cache() and others are expecting skb fields in original position, hence, add check_ctx_reg() to reject any modified ctx. Issue was first introduced back in |
||
Leonard Crestez
|
c1b81da251 |
UPSTREAM: PM / QoS: Restore DEV_PM_QOS_MIN/MAX_FREQUENCY
Support for adding per-device frequency limits was removed in
commit
|
||
Joel Fernandes (Google)
|
ad70668a3d |
BACKPORT: perf_event: Add support for LSM and SELinux checks
In current mainline, the degree of access to perf_event_open(2) system call depends on the perf_event_paranoid sysctl. This has a number of limitations: 1. The sysctl is only a single value. Many types of accesses are controlled based on the single value thus making the control very limited and coarse grained. 2. The sysctl is global, so if the sysctl is changed, then that means all processes get access to perf_event_open(2) opening the door to security issues. This patch adds LSM and SELinux access checking which will be used in Android to access perf_event_open(2) for the purposes of attaching BPF programs to tracepoints, perf profiling and other operations from userspace. These operations are intended for production systems. 5 new LSM hooks are added: 1. perf_event_open: This controls access during the perf_event_open(2) syscall itself. The hook is called from all the places that the perf_event_paranoid sysctl is checked to keep it consistent with the systctl. The hook gets passed a 'type' argument which controls CPU, kernel and tracepoint accesses (in this context, CPU, kernel and tracepoint have the same semantics as the perf_event_paranoid sysctl). Additionally, I added an 'open' type which is similar to perf_event_paranoid sysctl == 3 patch carried in Android and several other distros but was rejected in mainline [1] in 2016. 2. perf_event_alloc: This allocates a new security object for the event which stores the current SID within the event. It will be useful when the perf event's FD is passed through IPC to another process which may try to read the FD. Appropriate security checks will limit access. 3. perf_event_free: Called when the event is closed. 4. perf_event_read: Called from the read(2) and mmap(2) syscalls for the event. 5. perf_event_write: Called from the ioctl(2) syscalls for the event. [1] https://lwn.net/Articles/696240/ Since Peter had suggest LSM hooks in 2016 [1], I am adding his Suggested-by tag below. To use this patch, we set the perf_event_paranoid sysctl to -1 and then apply selinux checking as appropriate (default deny everything, and then add policy rules to give access to domains that need it). In the future we can remove the perf_event_paranoid sysctl altogether. Suggested-by: Peter Zijlstra <peterz@infradead.org> Co-developed-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: James Morris <jmorris@namei.org> Cc: Arnaldo Carvalho de Melo <acme@kernel.org> Cc: rostedt@goodmis.org Cc: Yonghong Song <yhs@fb.com> Cc: Kees Cook <keescook@chromium.org> Cc: Ingo Molnar <mingo@redhat.com> Cc: Alexei Starovoitov <ast@kernel.org> Cc: jeffv@google.com Cc: Jiri Olsa <jolsa@redhat.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: primiano@google.com Cc: Song Liu <songliubraving@fb.com> Cc: rsavitski@google.com Cc: Namhyung Kim <namhyung@kernel.org> Cc: Matthew Garrett <matthewgarrett@google.com> Link: https://lkml.kernel.org/r/20191014170308.70668-1-joel@joelfernandes.org Bug: 137092007 (cherry picked from commit da97e18458fb42d7c00fac5fd1c56a3896ec666e) [ Ryan Savitski: resolved merge conflicts with perf_event_paranoid=3 code ] Signed-off-by: Ryan Savitski <rsavitski@google.com> [ Ryan Savitski: Folded in upstream ae79d5588a04 (perf/core: Fix !CONFIG_PERF_EVENTS build warnings and failures). This should fix the build errors from the previous backport attempt, where certain configurations would end up with functions referring to the perf_event struct prior to its declaration (and therefore declaring it with a different scope). ] Signed-off-by: Ryan Savitski <rsavitski@google.com> Change-Id: I50769ede23fbfd8996657c6dae99cab98a3042bc |
||
|
Greg Kroah-Hartman
|
813bf83282 |
This is the 5.4.9 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl4W8EgACgkQONu9yGCS aT4szA//fqXI1OQ3xcCt5s9MYZYYa6IpX/VZ0H7lNC/7pkJzccKo+aSer7ppEn4o ND8sHNx/lhfZorhvLdqJK4PLThC+fXmXnLvFOzqvZeUVyesnv9zlhd/5JNu18Fvc RNjcIRIAHFwanZLAw8uft1DIZXcZ8wNkAAugn/WQV3FN/TG+FsrDzWYnmbBhRIQS XC/2jSlFpMTKoExNzEdbduG0XH5plWeE+AdY3a+DQsOBUO2XrAuk5HTEByM1jzPV W7U9vMqvw3OyrERcA0lmjs37Waw1e0qzfUaa8Bman5Uc0StOTq0UwschX21SB5yP MvbAKhqaKtSff7b4lNrDP9Kj1O/lH84WPSn/aao9D083m/ZYdkkd4AWMlS480lL5 oJ28tFbgwLayIqDbwCggHluTsNUdQSTwahVbnp4GMqxfjWrApdLPCqloSb+x9JCF 9pWJf3awI53mA864pH/uOM7pDOz5/c/oJ4QzVmOmR48dsddorY+gPcwk+YpElJcZ +xCBQDN5JkNC7lwqu2lvaoq/5cMC5lO/v6aeTfsYCRVnlNY12TY8z352zzMZfCKG GRkNvDqWZ5ZmQ+LblWRVbgdGxU42wIYXUS1jUdFd+5DRzz17+ZKUy7YbLNmZMcpY UyiM2Ij7X7HsNGrYDKFq0lZPw6k7v3FshvMwQ8C6dNk+l3o9oCA= =M+hs -----END PGP SIGNATURE----- Merge 5.4.9 into android-5.4 Changes in 5.4.9 drm/mcde: dsi: Fix invalid pointer dereference if panel cannot be found nvme_fc: add module to ops template to allow module references nvme-fc: fix double-free scenarios on hw queues drm/amdgpu: add check before enabling/disabling broadcast mode drm/amdgpu: add header line for power profile on Arcturus drm/amdgpu: add cache flush workaround to gfx8 emit_fence drm/amd/display: Map DSC resources 1-to-1 if numbers of OPPs and DSCs are equal drm/amd/display: Fixed kernel panic when booting with DP-to-HDMI dongle drm/amd/display: Change the delay time before enabling FEC drm/amd/display: Reset steer fifo before unblanking the stream drm/amd/display: update dispclk and dppclk vco frequency nvme/pci: Fix write and poll queue types nvme/pci: Fix read queue count iio: st_accel: Fix unused variable warning iio: adc: max9611: Fix too short conversion time delay PM / devfreq: Fix devfreq_notifier_call returning errno PM / devfreq: Set scaling_max_freq to max on OPP notifier error PM / devfreq: Don't fail devfreq_dev_release if not in list afs: Fix afs_find_server lookups for ipv4 peers afs: Fix SELinux setting security label on /afs RDMA/cma: add missed unregister_pernet_subsys in init failure rxe: correctly calculate iCRC for unaligned payloads scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func scsi: qla2xxx: Use explicit LOGO in target mode scsi: qla2xxx: Drop superfluous INIT_WORK of del_work scsi: qla2xxx: Don't call qlt_async_event twice scsi: qla2xxx: Fix PLOGI payload and ELS IOCB dump length scsi: qla2xxx: Configure local loop for N2N target scsi: qla2xxx: Send Notify ACK after N2N PLOGI scsi: qla2xxx: Don't defer relogin unconditonally scsi: qla2xxx: Ignore PORT UPDATE after N2N PLOGI scsi: iscsi: qla4xxx: fix double free in probe scsi: libsas: stop discovering if oob mode is disconnected scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func staging/wlan-ng: add CRC32 dependency in Kconfig drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit drm/nouveau: Fix drm-core using atomic code-paths on pre-nv50 hardware drm/nouveau/kms/nv50-: fix panel scaling usb: gadget: fix wrong endpoint desc net: make socket read/write_iter() honor IOCB_NOWAIT afs: Fix mountpoint parsing afs: Fix creation calls in the dynamic root to fail with EOPNOTSUPP raid5: need to set STRIPE_HANDLE for batch head md: raid1: check rdev before reference in raid1_sync_request func s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits s390/cpum_sf: Avoid SBD overflow condition in irq handler RDMA/counter: Prevent auto-binding a QP which are not tracked with res IB/mlx4: Follow mirror sequence of device add during device removal IB/mlx5: Fix steering rule of drop and count xen-blkback: prevent premature module unload xen/balloon: fix ballooned page accounting without hotplug enabled PM / hibernate: memory_bm_find_bit(): Tighten node optimisation ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC PCI: Add a helper to check Power Resource Requirements _PR3 existence ALSA: hda: Allow HDA to be runtime suspended when dGPU is not bound to a driver PCI: Fix missing inline for pci_pr3_present() ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen tcp: fix data-race in tcp_recvmsg() shmem: pin the file in shmem_fault() if mmap_sem is dropped taskstats: fix data-race ALSA: hda - Downgrade error message for single-cmd fallback netfilter: nft_tproxy: Fix port selector on Big Endian block: add bio_truncate to fix guard_bio_eod mm: drop mmap_sem before calling balance_dirty_pages() in write fault ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code ALSA: usb-audio: fix set_format altsetting sanity check ALSA: usb-audio: set the interface format after resume on Dell WD19 ALSA: hda - Apply sync-write workaround to old Intel platforms, too ALSA: hda/realtek - Add headset Mic no shutup for ALC283 drm/sun4i: hdmi: Remove duplicate cleanup calls drm/amdgpu/smu: add metrics table lock drm/amdgpu/smu: add metrics table lock for arcturus (v2) drm/amdgpu/smu: add metrics table lock for navi (v2) drm/amdgpu/smu: add metrics table lock for vega20 (v2) MIPS: BPF: Disable MIPS32 eBPF JIT MIPS: BPF: eBPF JIT: check for MIPS ISA compliance in Kconfig MIPS: Avoid VDSO ABI breakage due to global register variable media: pulse8-cec: fix lost cec_transmit_attempt_done() call media: cec: CEC 2.0-only bcast messages were ignored media: cec: avoid decrementing transmit_queue_sz if it is 0 media: cec: check 'transmit_in_progress', not 'transmitting' mm/memory_hotplug: shrink zones when offlining memory mm/zsmalloc.c: fix the migrated zspage statistics. memcg: account security cred as well to kmemcg mm: move_pages: return valid node id in status if the page is already on the target node mm/oom: fix pgtables units mismatch in Killed process message ocfs2: fix the crash due to call ocfs2_get_dlm_debug once less pstore/ram: Write new dumps to start of recycled zones pstore/ram: Fix error-path memory leak in persistent_ram_new() callers gcc-plugins: make it possible to disable CONFIG_GCC_PLUGINS again locks: print unsigned ino in /proc/locks selftests/seccomp: Zero out seccomp_notif seccomp: Check that seccomp_notif is zeroed out by the user samples/seccomp: Zero out members based on seccomp_notif_sizes selftests/seccomp: Catch garbage on SECCOMP_IOCTL_NOTIF_RECV dmaengine: Fix access to uninitialized dma_slave_caps dmaengine: dma-jz4780: Also break descriptor chains on JZ4725B Btrfs: fix infinite loop during nocow writeback due to race compat_ioctl: block: handle Persistent Reservations compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE compat_ioctl: block: handle BLKGETZONESZ/BLKGETNRZONES bpf: Fix precision tracking for unbounded scalars ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys() ata: ahci_brcm: Fix AHCI resources management ata: ahci_brcm: Add missing clock management during recovery ata: ahci_brcm: BCM7425 AHCI requires AHCI_HFLAG_DELAY_ENGINE libata: Fix retrieving of active qcs gpio: xtensa: fix driver build gpiolib: fix up emulated open drain outputs clocksource: riscv: add notrace to riscv_sched_clock riscv: ftrace: correct the condition logic in function graph tracer rseq/selftests: Fix: Namespace gettid() for compatibility with glibc 2.30 tracing: Fix lock inversion in trace_event_enable_tgid_record() tracing: Avoid memory leak in process_system_preds() tracing: Have the histogram compare functions convert to u64 first tracing: Fix endianness bug in histogram trigger samples/trace_printk: Wait for IRQ work to finish io_uring: use current task creds instead of allocating a new one mm/gup: fix memory leak in __gup_benchmark_ioctl apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock dmaengine: virt-dma: Fix access after free in vchan_complete() gen_initramfs_list.sh: fix 'bad variable name' error ALSA: cs4236: fix error return comparison of an unsigned integer ALSA: pcm: Yet another missing check of non-cached buffer type ALSA: firewire-motu: Correct a typo in the clock proc string scsi: lpfc: Fix rpi release when deleting vport exit: panic before exit_mm() on global init exit arm64: Revert support for execute-only user mappings ftrace: Avoid potential division by zero in function profiler spi: spi-fsl-dspi: Fix 16-bit word order in 32-bit XSPI mode drm/msm: include linux/sched/task.h PM / devfreq: Check NULL governor in available_governors_show sunrpc: fix crash when cache_head become valid before update arm64: dts: qcom: msm8998-clamshell: Remove retention idle state nfsd4: fix up replay_matches_cache() powerpc: Chunk calls to flush_dcache_range in arch_*_memory HID: i2c-hid: Reset ALPS touchpads on resume net/sched: annotate lockless accesses to qdisc->empty kernel/module.c: wakeup processes in module_wq on module unload ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100 perf callchain: Fix segfault in thread__resolve_callchain_sample() iommu/vt-d: Remove incorrect PSI capability check of: overlay: add_changeset_property() memory leak cifs: Fix potential softlockups while refreshing DFS cache firmware: arm_scmi: Avoid double free in error flow xfs: don't check for AG deadlock for realtime files in bunmapi platform/x86: pmc_atom: Add Siemens CONNECT X300 to critclk_systems DMI table netfilter: nf_queue: enqueue skbs with NULL dst net, sysctl: Fix compiler warning when only cBPF is present watchdog: tqmx86_wdt: Fix build error regulator: axp20x: Fix axp20x_set_ramp_delay regulator: bd70528: Remove .set_ramp_delay for bd70528_ldo_ops spi: uniphier: Fix FIFO threshold regulator: axp20x: Fix AXP22x ELDO2 regulator enable bitmask powerpc/mm: Mark get_slice_psize() & slice_addr_is_low() as notrace Bluetooth: btusb: fix PM leak in error case of setup Bluetooth: delete a stray unlock Bluetooth: Fix memory leak in hci_connect_le_scan arm64: dts: meson-gxl-s905x-khadas-vim: fix uart_A bluetooth node arm64: dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node media: flexcop-usb: ensure -EIO is returned on error condition regulator: ab8500: Remove AB8505 USB regulator media: usb: fix memory leak in af9005_identify_state dt-bindings: clock: renesas: rcar-usb2-clock-sel: Fix typo in example arm64: dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed warning phy: renesas: rcar-gen3-usb2: Use platform_get_irq_optional() for optional irq tty: serial: msm_serial: Fix lockup for sysrq and oops cifs: Fix lookup of root ses in DFS referral cache fs: cifs: Fix atime update check vs mtime fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP ath9k_htc: Modify byte order for an error message ath9k_htc: Discard undersized packets drm/i915/execlists: Fix annotation for decoupling virtual request xfs: periodically yield scrub threads to the scheduler net: add annotations on hh->hh_len lockless accesses ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps btrfs: get rid of unique workqueue helper functions Btrfs: only associate the locked page with one async_chunk struct s390/smp: fix physical to logical CPU map for SMT mm/sparse.c: mark populate_section_memmap as __meminit xen/blkback: Avoid unmapping unmapped grant pages lib/ubsan: don't serialize UBSAN report efi: Don't attempt to map RCI2 config table if it doesn't exist perf/x86/intel/bts: Fix the use of page_private() net: annotate lockless accesses to sk->sk_pacing_shift hsr: avoid debugfs warning message when module is remove hsr: fix error handling routine in hsr_dev_finalize() hsr: fix a race condition in node list insertion and deletion mm/hugetlb: defer freeing of huge pages if in non-task context Linux 5.4.9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8eebcdac421faf74f70af8e8666abfdcdc45c86b |
||
|
Greg Kroah-Hartman
|
49a04248ba |
Revert "BACKPORT: perf_event: Add support for LSM and SELinux checks"
This reverts commit
|
||
Konstantin Khorenko
|
1e102037f8 |
kernel/module.c: wakeup processes in module_wq on module unload
commit 5d603311615f612320bb77bd2a82553ef1ced5b7 upstream.
Fix the race between load and unload a kernel module.
sys_delete_module()
try_stop_module()
mod->state = _GOING
add_unformed_module()
old = find_module_all()
(old->state == _GOING =>
wait_event_interruptible())
During pre-condition
finished_loading() rets 0
schedule()
(never gets waken up later)
free_module()
mod->state = _UNFORMED
list_del_rcu(&mod->list)
(dels mod from "modules" list)
return
The race above leads to modprobe hanging forever on loading
a module.
Error paths on loading module call wake_up_all(&module_wq) after
freeing module, so let's do the same on straight module unload.
Fixes:
|
||
Wen Yang
|
f0629ee392 |
ftrace: Avoid potential division by zero in function profiler
commit e31f7939c1c27faa5d0e3f14519eaf7c89e8a69d upstream. The ftrace_profile->counter is unsigned long and do_div truncates it to 32 bits, which means it can test non-zero and be truncated to zero for division. Fix this issue by using div64_ul() instead. Link: http://lkml.kernel.org/r/20200103030248.14516-1-wenyang@linux.alibaba.com Cc: stable@vger.kernel.org Fixes: |
||
chenqiwu
|
66d9052e6c |
exit: panic before exit_mm() on global init exit
commit 43cf75d96409a20ef06b756877a2e72b10a026fc upstream.
Currently, when global init and all threads in its thread-group have exited
we panic via:
do_exit()
-> exit_notify()
-> forget_original_parent()
-> find_child_reaper()
This makes it hard to extract a useable coredump for global init from a
kernel crashdump because by the time we panic exit_mm() will have already
released global init's mm.
This patch moves the panic futher up before exit_mm() is called. As was the
case previously, we only panic when global init and all its threads in the
thread-group have exited.
Signed-off-by: chenqiwu <chenqiwu@xiaomi.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
[christian.brauner@ubuntu.com: fix typo, rewrite commit message]
Link: https://lore.kernel.org/r/1576736993-10121-1-git-send-email-qiwuchen55@gmail.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Sven Schnelle
|
09f80e915f |
tracing: Fix endianness bug in histogram trigger
commit fe6e096a5bbf73a142f09c72e7aa2835026eb1a3 upstream.
At least on PA-RISC and s390 synthetic histogram triggers are failing
selftests because trace_event_raw_event_synth() always writes a 64 bit
values, but the reader expects a field->size sized value. On little endian
machines this doesn't hurt, but on big endian this makes the reader always
read zero values.
Link: http://lore.kernel.org/linux-trace-devel/20191218074427.96184-4-svens@linux.ibm.com
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Steven Rostedt (VMware)
|
038840ff78 |
tracing: Have the histogram compare functions convert to u64 first
commit 106f41f5a302cb1f36c7543fae6a05de12e96fa4 upstream.
The compare functions of the histogram code would be specific for the size
of the value being compared (byte, short, int, long long). It would
reference the value from the array via the type of the compare, but the
value was stored in a 64 bit number. This is fine for little endian
machines, but for big endian machines, it would end up comparing zeros or
all ones (depending on the sign) for anything but 64 bit numbers.
To fix this, first derference the value as a u64 then convert it to the type
being compared.
Link: http://lkml.kernel.org/r/20191211103557.7bed6928@gandalf.local.home
Cc: stable@vger.kernel.org
Fixes:
|
||
Keita Suzuki
|
d50bc5758e |
tracing: Avoid memory leak in process_system_preds()
commit 79e65c27f09683fbb50c33acab395d0ddf5302d2 upstream.
When failing in the allocation of filter_item, process_system_preds()
goes to fail_mem, where the allocated filter is freed.
However, this leads to memory leak of filter->filter_string and
filter->prog, which is allocated before and in process_preds().
This bug has been detected by kmemleak as well.
Fix this by changing kfree to __free_fiter.
unreferenced object 0xffff8880658007c0 (size 32):
comm "bash", pid 579, jiffies 4295096372 (age 17.752s)
hex dump (first 32 bytes):
63 6f 6d 6d 6f 6e 5f 70 69 64 20 20 3e 20 31 30 common_pid > 10
00 00 00 00 00 00 00 00 65 73 00 00 00 00 00 00 ........es......
backtrace:
[<0000000067441602>] kstrdup+0x2d/0x60
[<00000000141cf7b7>] apply_subsystem_event_filter+0x378/0x932
[<000000009ca32334>] subsystem_filter_write+0x5a/0x90
[<0000000072da2bee>] vfs_write+0xe1/0x240
[<000000004f14f473>] ksys_write+0xb4/0x150
[<00000000a968b4a0>] do_syscall_64+0x6d/0x1e0
[<000000001a189f40>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
unreferenced object 0xffff888060c22d00 (size 64):
comm "bash", pid 579, jiffies 4295096372 (age 17.752s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 e8 d7 41 80 88 ff ff ...........A....
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000b8c1b109>] process_preds+0x243/0x1820
[<000000003972c7f0>] apply_subsystem_event_filter+0x3be/0x932
[<000000009ca32334>] subsystem_filter_write+0x5a/0x90
[<0000000072da2bee>] vfs_write+0xe1/0x240
[<000000004f14f473>] ksys_write+0xb4/0x150
[<00000000a968b4a0>] do_syscall_64+0x6d/0x1e0
[<000000001a189f40>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
unreferenced object 0xffff888041d7e800 (size 512):
comm "bash", pid 579, jiffies 4295096372 (age 17.752s)
hex dump (first 32 bytes):
70 bc 85 97 ff ff ff ff 0a 00 00 00 00 00 00 00 p...............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000001e04af34>] process_preds+0x71a/0x1820
[<000000003972c7f0>] apply_subsystem_event_filter+0x3be/0x932
[<000000009ca32334>] subsystem_filter_write+0x5a/0x90
[<0000000072da2bee>] vfs_write+0xe1/0x240
[<000000004f14f473>] ksys_write+0xb4/0x150
[<00000000a968b4a0>] do_syscall_64+0x6d/0x1e0
[<000000001a189f40>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Link: http://lkml.kernel.org/r/20191211091258.11310-1-keitasuzuki.park@sslab.ics.keio.ac.jp
Cc: Ingo Molnar <mingo@redhat.com>
Cc: stable@vger.kernel.org
Fixes:
|
||
Prateek Sood
|
c5361afa0e |
tracing: Fix lock inversion in trace_event_enable_tgid_record()
commit 3a53acf1d9bea11b57c1f6205e3fe73f9d8a3688 upstream.
Task T2 Task T3
trace_options_core_write() subsystem_open()
mutex_lock(trace_types_lock) mutex_lock(event_mutex)
set_tracer_flag()
trace_event_enable_tgid_record() mutex_lock(trace_types_lock)
mutex_lock(event_mutex)
This gives a circular dependency deadlock between trace_types_lock and
event_mutex. To fix this invert the usage of trace_types_lock and
event_mutex in trace_options_core_write(). This keeps the sequence of
lock usage consistent.
Link: http://lkml.kernel.org/r/0101016eef175e38-8ca71caf-a4eb-480d-a1e6-6f0bbc015495-000000@us-west-2.amazonses.com
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Daniel Borkmann
|
abaf57360e |
bpf: Fix precision tracking for unbounded scalars
commit f54c7898ed1c3c9331376c0337a5049c38f66497 upstream. Anatoly has been fuzzing with kBdysch harness and reported a hang in one of the outcomes. Upon closer analysis, it turns out that precise scalar value tracking is missing a few precision markings for unknown scalars: 0: R1=ctx(id=0,off=0,imm=0) R10=fp0 0: (b7) r0 = 0 1: R0_w=invP0 R1=ctx(id=0,off=0,imm=0) R10=fp0 1: (35) if r0 >= 0xf72e goto pc+0 --> only follow fallthrough 2: R0_w=invP0 R1=ctx(id=0,off=0,imm=0) R10=fp0 2: (35) if r0 >= 0x80fe0000 goto pc+0 --> only follow fallthrough 3: R0_w=invP0 R1=ctx(id=0,off=0,imm=0) R10=fp0 3: (14) w0 -= -536870912 4: R0_w=invP536870912 R1=ctx(id=0,off=0,imm=0) R10=fp0 4: (0f) r1 += r0 5: R0_w=invP536870912 R1_w=inv(id=0) R10=fp0 5: (55) if r1 != 0x104c1500 goto pc+0 --> push other branch for later analysis R0_w=invP536870912 R1_w=inv273421568 R10=fp0 6: R0_w=invP536870912 R1_w=inv273421568 R10=fp0 6: (b7) r0 = 0 7: R0=invP0 R1=inv273421568 R10=fp0 7: (76) if w1 s>= 0xffffff00 goto pc+3 --> only follow goto 11: R0=invP0 R1=inv273421568 R10=fp0 11: (95) exit 6: R0_w=invP536870912 R1_w=inv(id=0) R10=fp0 6: (b7) r0 = 0 propagating r0 7: safe processed 11 insns [...] In the analysis of the second path coming after the successful exit above, the path is being pruned at line 7. Pruning analysis found that both r0 are precise P0 and both R1 are non-precise scalars and given prior path with R1 as non-precise scalar succeeded, this one is therefore safe as well. However, problem is that given condition at insn 7 in the first run, we only followed goto and didn't push the other branch for later analysis, we've never walked the few insns in there and therefore dead-code sanitation rewrites it as goto pc-1, causing the hang depending on the skb address hitting these conditions. The issue is that R1 should have been marked as precise as well such that pruning enforces range check and conluded that new R1 is not in range of old R1. In insn 4, we mark R1 (skb) as unknown scalar via __mark_reg_unbounded() but not mark_reg_unbounded() and therefore regs->precise remains as false. Back in |
||
Sargun Dhillon
|
f75e60d239 |
seccomp: Check that seccomp_notif is zeroed out by the user
commit 2882d53c9c6f3b8311d225062522f03772cf0179 upstream.
This patch is a small change in enforcement of the uapi for
SECCOMP_IOCTL_NOTIF_RECV ioctl. Specifically, the datastructure which
is passed (seccomp_notif) must be zeroed out. Previously any of its
members could be set to nonsense values, and we would ignore it.
This ensures all fields are set to their zero value.
Signed-off-by: Sargun Dhillon <sargun@sargun.me>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>
Reviewed-by: Aleksa Sarai <cyphar@cyphar.com>
Acked-by: Tycho Andersen <tycho@tycho.ws>
Link: https://lore.kernel.org/r/20191229062451.9467-2-sargun@sargun.me
Fixes:
|
||
Shakeel Butt
|
a54454d5d6 |
memcg: account security cred as well to kmemcg
commit 84029fd04c201a4c7e0b07ba262664900f47c6f5 upstream. The cred_jar kmem_cache is already memcg accounted in the current kernel but cred->security is not. Account cred->security to kmemcg. Recently we saw high root slab usage on our production and on further inspection, we found a buggy application leaking processes. Though that buggy application was contained within its memcg but we observe much more system memory overhead, couple of GiBs, during that period. This overhead can adversely impact the isolation on the system. One source of high overhead we found was cred->security objects, which have a lifetime of at least the life of the process which allocated them. Link: http://lkml.kernel.org/r/20191205223721.40034-1-shakeelb@google.com Signed-off-by: Shakeel Butt <shakeelb@google.com> Acked-by: Chris Down <chris@chrisdown.name> Reviewed-by: Roman Gushchin <guro@fb.com> Acked-by: Michal Hocko <mhocko@suse.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Christian Brauner
|
d25bf5a341 |
taskstats: fix data-race
[ Upstream commit 0b8d616fb5a8ffa307b1d3af37f55c15dae14f28 ]
When assiging and testing taskstats in taskstats_exit() there's a race
when setting up and reading sig->stats when a thread-group with more
than one thread exits:
write to 0xffff8881157bbe10 of 8 bytes by task 7951 on cpu 0:
taskstats_tgid_alloc kernel/taskstats.c:567 [inline]
taskstats_exit+0x6b7/0x717 kernel/taskstats.c:596
do_exit+0x2c2/0x18e0 kernel/exit.c:864
do_group_exit+0xb4/0x1c0 kernel/exit.c:983
get_signal+0x2a2/0x1320 kernel/signal.c:2734
do_signal+0x3b/0xc00 arch/x86/kernel/signal.c:815
exit_to_usermode_loop+0x250/0x2c0 arch/x86/entry/common.c:159
prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
do_syscall_64+0x2d7/0x2f0 arch/x86/entry/common.c:299
entry_SYSCALL_64_after_hwframe+0x44/0xa9
read to 0xffff8881157bbe10 of 8 bytes by task 7949 on cpu 1:
taskstats_tgid_alloc kernel/taskstats.c:559 [inline]
taskstats_exit+0xb2/0x717 kernel/taskstats.c:596
do_exit+0x2c2/0x18e0 kernel/exit.c:864
do_group_exit+0xb4/0x1c0 kernel/exit.c:983
__do_sys_exit_group kernel/exit.c:994 [inline]
__se_sys_exit_group kernel/exit.c:992 [inline]
__x64_sys_exit_group+0x2e/0x30 kernel/exit.c:992
do_syscall_64+0xcf/0x2f0 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fix this by using smp_load_acquire() and smp_store_release().
Reported-by: syzbot+c5d03165a1bd1dead0c1@syzkaller.appspotmail.com
Fixes:
|
||
Andy Whitcroft
|
0360ce1eaf |
PM / hibernate: memory_bm_find_bit(): Tighten node optimisation
[ Upstream commit da6043fe85eb5ec621e34a92540735dcebbea134 ] When looking for a bit by number we make use of the cached result from the preceding lookup to speed up operation. Firstly we check if the requested pfn is within the cached zone and if not lookup the new zone. We then check if the offset for that pfn falls within the existing cached node. This happens regardless of whether the node is within the zone we are now scanning. With certain memory layouts it is possible for this to false trigger creating a temporary alias for the pfn to a different bit. This leads the hibernation code to free memory which it was never allocated with the expected fallout. Ensure the zone we are scanning matches the cached zone before considering the cached node. Deep thanks go to Andrea for many, many, many hours of hacking and testing that went into cornering this bug. Reported-by: Andrea Righi <andrea.righi@canonical.com> Tested-by: Andrea Righi <andrea.righi@canonical.com> Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Joel Fernandes (Google)
|
3605586e90 |
BACKPORT: perf_event: Add support for LSM and SELinux checks
In current mainline, the degree of access to perf_event_open(2) system call depends on the perf_event_paranoid sysctl. This has a number of limitations: 1. The sysctl is only a single value. Many types of accesses are controlled based on the single value thus making the control very limited and coarse grained. 2. The sysctl is global, so if the sysctl is changed, then that means all processes get access to perf_event_open(2) opening the door to security issues. This patch adds LSM and SELinux access checking which will be used in Android to access perf_event_open(2) for the purposes of attaching BPF programs to tracepoints, perf profiling and other operations from userspace. These operations are intended for production systems. 5 new LSM hooks are added: 1. perf_event_open: This controls access during the perf_event_open(2) syscall itself. The hook is called from all the places that the perf_event_paranoid sysctl is checked to keep it consistent with the systctl. The hook gets passed a 'type' argument which controls CPU, kernel and tracepoint accesses (in this context, CPU, kernel and tracepoint have the same semantics as the perf_event_paranoid sysctl). Additionally, I added an 'open' type which is similar to perf_event_paranoid sysctl == 3 patch carried in Android and several other distros but was rejected in mainline [1] in 2016. 2. perf_event_alloc: This allocates a new security object for the event which stores the current SID within the event. It will be useful when the perf event's FD is passed through IPC to another process which may try to read the FD. Appropriate security checks will limit access. 3. perf_event_free: Called when the event is closed. 4. perf_event_read: Called from the read(2) and mmap(2) syscalls for the event. 5. perf_event_write: Called from the ioctl(2) syscalls for the event. [1] https://lwn.net/Articles/696240/ Since Peter had suggest LSM hooks in 2016 [1], I am adding his Suggested-by tag below. To use this patch, we set the perf_event_paranoid sysctl to -1 and then apply selinux checking as appropriate (default deny everything, and then add policy rules to give access to domains that need it). In the future we can remove the perf_event_paranoid sysctl altogether. Suggested-by: Peter Zijlstra <peterz@infradead.org> Co-developed-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: James Morris <jmorris@namei.org> Cc: Arnaldo Carvalho de Melo <acme@kernel.org> Cc: rostedt@goodmis.org Cc: Yonghong Song <yhs@fb.com> Cc: Kees Cook <keescook@chromium.org> Cc: Ingo Molnar <mingo@redhat.com> Cc: Alexei Starovoitov <ast@kernel.org> Cc: jeffv@google.com Cc: Jiri Olsa <jolsa@redhat.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: primiano@google.com Cc: Song Liu <songliubraving@fb.com> Cc: rsavitski@google.com Cc: Namhyung Kim <namhyung@kernel.org> Cc: Matthew Garrett <matthewgarrett@google.com> Link: https://lkml.kernel.org/r/20191014170308.70668-1-joel@joelfernandes.org Bug: 137092007 Change-Id: I5df32b668e2dd5f2dd3ab472dfc74f533bc4d8db (cherry picked from commit da97e18458fb42d7c00fac5fd1c56a3896ec666e) [ Ryan Savitski: resolved merge conflicts with perf_event_paranoid=3 code ] Signed-off-by: Ryan Savitski <rsavitski@google.com> |
||
Dmitry Torokhov
|
aa1d9ad521 |
CHROMIUM: cgroups: relax permissions on moving tasks between cgroups
Android expects system_server to be able to move tasks between different
cgroups/cpusets, but does not want to be running as root. Let's relax
permission check so that processes can move other tasks if they have
CAP_SYS_NICE in the affected task's user namespace.
BUG=b:31790445,chromium:647994
Bug: 147109865
TEST=Boot android container, examine logcat
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/394927
Reviewed-by: Ricky Zhou <rickyz@chromium.org>
[AmitP: Refactored original changes to align with upstream commit
|
||
|
Greg Kroah-Hartman
|
de197c5a4f |
This is the 5.4.8 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl4Q1ycACgkQONu9yGCS
aT5YRg//SPO6yX/WxWjac/ZHnKrarTqnIF1jxK++pLYZLpBeSHs/n5BhguJoL37s
KVhCEdilnp1Fb49nuM65RJKqgvGyKxn9p380vNTkU6VUf/6O2lFN28nWVqWaSJqj
kjb+7Jkn0iJ4LTHwGPeFSqvxG66SsjOJfFsR6bqXaGGFZgSwC4yVTqYhkuCV6TGP
hEEcy7IgB9LT3lXHSQelG7cuc2Zs5MJSeLx+Ji+UQYyRIZwsMHJ1M8BvAI5Zd1J4
WrdJIVpyNAh5b65cXGuDYmSSIiqIFDNY43JbTII5RVEj/SjnJfnxDZ3+joJswJlo
noty2f7cg7GiKH8BhNXvuVopFu3Ycz1/deMIu3S8boWBVFawwECb0akLuB7Ms1n1
QHeXFExZyHxhPnBPfJ2dYwXMIgImvVS/3nPW4CcBsRbBjqUKhQeImoqk41+gfGDb
cZ0F7VUZ7Mq5O4raNYICMWoANqQTrXF9DUuA1e909CufP7BQBpw1X5XjITUBa0Gs
gvFrAU4oyqkX9xUVNb+n5qR6X1OjBTTNhaet6l06fuDNeWf7T0gVoVlKOf4dLCqP
uKy62Ps9QZsTsjgnjbdKuSFwlbu8S/qKrEqCnUS6vRYbrM2bUxkJL3D1xr6JHnGS
aMzPOxdt4JvrppYtBCJQr+/ETQzv2A1l3IeIujldiKzNnsoIUeY=
=mI67
-----END PGP SIGNATURE-----
Merge 5.4.8 into android-5.4
Changes in 5.4.8
Revert "MIPS: futex: Restore \n after sync instructions"
Revert "MIPS: futex: Emit Loongson3 sync workarounds within asm"
scsi: lpfc: Fix spinlock_irq issues in lpfc_els_flush_cmd()
scsi: lpfc: Fix discovery failures when target device connectivity bounces
scsi: mpt3sas: Fix clear pending bit in ioctl status
scsi: lpfc: Fix locking on mailbox command completion
scsi: mpt3sas: Reject NVMe Encap cmnds to unsupported HBA
gpio: mxc: Only get the second IRQ when there is more than one IRQ
scsi: lpfc: Fix list corruption in lpfc_sli_get_iocbq
Input: atmel_mxt_ts - disable IRQ across suspend
f2fs: fix to update time in lazytime mode
powerpc/papr_scm: Fix an off-by-one check in papr_scm_meta_{get, set}
tools/power/x86/intel-speed-select: Remove warning for unused result
platform/x86: peaq-wmi: switch to using polled mode of input devices
iommu: rockchip: Free domain on .domain_free
iommu/tegra-smmu: Fix page tables in > 4 GiB memory
dmaengine: xilinx_dma: Clear desc_pendingcount in xilinx_dma_reset
scsi: target: compare full CHAP_A Algorithm strings
scsi: lpfc: Fix hardlockup in lpfc_abort_handler
scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
scsi: csiostor: Don't enable IRQs too early
scsi: hisi_sas: Replace in_softirq() check in hisi_sas_task_exec()
scsi: hisi_sas: Delete the debugfs folder of hisi_sas when the probe fails
powerpc/pseries: Mark accumulate_stolen_time() as notrace
powerpc/pseries: Don't fail hash page table insert for bolted mapping
Input: st1232 - do not reset the chip too early
selftests/powerpc: Fixup clobbers for TM tests
powerpc/tools: Don't quote $objdump in scripts
dma-debug: add a schedule point in debug_dma_dump_mappings()
dma-mapping: Add vmap checks to dma_map_single()
dma-mapping: fix handling of dma-ranges for reserved memory (again)
dmaengine: fsl-qdma: Handle invalid qdma-queue0 IRQ
leds: lm3692x: Handle failure to probe the regulator
leds: an30259a: add a check for devm_regmap_init_i2c
leds: trigger: netdev: fix handling on interface rename
clocksource/drivers/asm9260: Add a check for of_clk_get
clocksource/drivers/timer-of: Use unique device name instead of timer
dtc: Use pkg-config to locate libyaml
selftests/powerpc: Skip tm-signal-sigreturn-nt if TM not available
powerpc/security/book3s64: Report L1TF status in sysfs
powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning
ext4: update direct I/O read lock pattern for IOCB_NOWAIT
ext4: iomap that extends beyond EOF should be marked dirty
jbd2: Fix statistics for the number of logged blocks
scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
scsi: lpfc: Fix unexpected error messages during RSCN handling
scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
f2fs: fix to update dir's i_pino during cross_rename
clk: qcom: smd: Add missing pnoc clock
clk: qcom: Allow constant ratio freq tables for rcg
clk: clk-gpio: propagate rate change to parent
irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
irqchip: ingenic: Error out if IRQ domain creation failed
dma-direct: check for overflows on 32 bit DMA addresses
fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
iommu/arm-smmu-v3: Don't display an error when IRQ lines are missing
i2c: stm32f7: fix & reorder remove & probe error handling
iomap: fix return value of iomap_dio_bio_actor on 32bit systems
Input: ili210x - handle errors from input_mt_init_slots()
scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
scsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on Fastlane)
PCI: rpaphp: Fix up pointer to first drc-info entry
scsi: ufs: fix potential bug which ends in system hang
powerpc/pseries/cmm: Implement release() function for sysfs device
PCI: rpaphp: Don't rely on firmware feature to imply drc-info support
PCI: rpaphp: Annotate and correctly byte swap DRC properties
PCI: rpaphp: Correctly match ibm, my-drc-index to drc-name when using drc-info
powerpc/security: Fix wrong message when RFI Flush is disable
powerpc/eeh: differentiate duplicate detection message
powerpc/book3s/mm: Update Oops message to print the correct translation in use
scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
clk: pxa: fix one of the pxa RTC clocks
bcache: at least try to shrink 1 node in bch_mca_scan()
HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse
dt-bindings: Improve validation build error handling
HID: logitech-hidpp: Silence intermittent get_battery_capacity errors
HID: i2c-hid: fix no irq after reset on raydium 3118
ARM: 8937/1: spectre-v2: remove Brahma-B53 from hardening
libnvdimm/btt: fix variable 'rc' set but not used
HID: Improve Windows Precision Touchpad detection.
HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device
watchdog: imx7ulp: Fix reboot hang
watchdog: prevent deferral of watchdogd wakeup on RT
watchdog: Fix the race between the release of watchdog_core_data and cdev
powerpc/fixmap: Use __fix_to_virt() instead of fix_to_virt()
scsi: pm80xx: Fix for SATA device discovery
scsi: ufs: Fix error handing during hibern8 enter
scsi: scsi_debug: num_tgts must be >= 0
scsi: NCR5380: Add disconnect_mask module parameter
scsi: target: core: Release SPC-2 reservations when closing a session
scsi: ufs: Fix up auto hibern8 enablement
scsi: iscsi: Don't send data to unbound connection
scsi: target: iscsi: Wait for all commands to finish before freeing a session
f2fs: Fix deadlock in f2fs_gc() context during atomic files handling
habanalabs: skip VA block list update in reset flow
gpio/mpc8xxx: fix qoriq GPIO reading
platform/x86: intel_pmc_core: Fix the SoC naming inconsistency
platform/x86: intel_pmc_core: Add Comet Lake (CML) platform support to intel_pmc_core driver
gpio: mpc8xxx: Don't overwrite default irq_set_type callback
gpio: lynxpoint: Setup correct IRQ handlers
tools/power/x86/intel-speed-select: Ignore missing config level
Drivers: hv: vmbus: Fix crash handler reset of Hyper-V synic
apparmor: fix unsigned len comparison with less than zero
drm/amdgpu: Call find_vma under mmap_sem
scripts/kallsyms: fix definitely-lost memory leak
powerpc: Don't add -mabi= flags when building with Clang
cifs: Fix use-after-free bug in cifs_reconnect()
um: virtio: Keep reading on -EAGAIN
io_uring: io_allocate_scq_urings() should return a sane state
of: unittest: fix memory leak in attach_node_and_children
cdrom: respect device capabilities during opening action
cifs: move cifsFileInfo_put logic into a work-queue
perf diff: Use llabs() with 64-bit values
perf script: Fix brstackinsn for AUXTRACE
perf regs: Make perf_reg_name() return "unknown" instead of NULL
s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
mailbox: imx: Clear the right interrupts at shutdown
libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
s390/unwind: filter out unreliable bogus %r14
s390/cpum_sf: Check for SDBT and SDB consistency
ocfs2: fix passing zero to 'PTR_ERR' warning
mailbox: imx: Fix Tx doorbell shutdown path
s390: disable preemption when switching to nodat stack with CALL_ON_STACK
selftests: vm: add fragment CONFIG_TEST_VMALLOC
mm/hugetlbfs: fix error handling when setting up mounts
kernel: sysctl: make drop_caches write-only
userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
Revert "powerpc/vcpu: Assume dedicated processors as non-preempt"
sctp: fix err handling of stream initialization
md: make sure desc_nr less than MD_SB_DISKS
Revert "iwlwifi: assign directly to iwl_trans->cfg in QuZ detection"
netfilter: ebtables: compat: reject all padding in matches/watchers
6pack,mkiss: fix possible deadlock
powerpc: Fix __clear_user() with KUAP enabled
net/smc: add fallback check to connect()
netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
inetpeer: fix data-race in inet_putpeer / inet_putpeer
net: add a READ_ONCE() in skb_peek_tail()
net: icmp: fix data-race in cmp_global_allow()
hrtimer: Annotate lockless access to timer->state
tomoyo: Don't use nifty names on sockets.
uaccess: disallow > INT_MAX copy sizes
drm: limit to INT_MAX in create_blob ioctl
xfs: fix mount failure crash on invalid iclog memory access
cxgb4/cxgb4vf: fix flow control display for auto negotiation
net: dsa: bcm_sf2: Fix IP fragment location and behavior
net/mlxfw: Fix out-of-memory error in mfa2 flash burning
net: phy: aquantia: add suspend / resume ops for AQR105
net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device
net/sched: add delete_empty() to filters and use it in cls_flower
net_sched: sch_fq: properly set sk->sk_pacing_status
net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs
ptp: fix the race between the release of ptp_clock and cdev
tcp: Fix highest_sack and highest_sack_seq
udp: fix integer overflow while computing available space in sk_rcvbuf
bnxt_en: Fix MSIX request logic for RDMA driver.
bnxt_en: Free context memory in the open path if firmware has been reset.
bnxt_en: Return error if FW returns more data than dump length
bnxt_en: Fix bp->fw_health allocation and free logic.
bnxt_en: Remove unnecessary NULL checks for fw_health
bnxt_en: Fix the logic that creates the health reporters.
bnxt_en: Add missing devlink health reporters for VFs.
mlxsw: spectrum_router: Skip loopback RIFs during MAC validation
mlxsw: spectrum: Use dedicated policer for VRRP packets
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
ip6_gre: do not confirm neighbor when do pmtu update
gtp: do not confirm neighbor when do pmtu update
net/dst: add new function skb_dst_update_pmtu_no_confirm
tunnel: do not confirm neighbor when do pmtu update
vti: do not confirm neighbor when do pmtu update
sit: do not confirm neighbor when do pmtu update
net/dst: do not confirm neighbor for vxlan and geneve pmtu update
net: dsa: sja1105: Reconcile the meaning of TPID and TPID2 for E/T and P/Q/R/S
net: marvell: mvpp2: phylink requires the link interrupt
gtp: fix wrong condition in gtp_genl_dump_pdp()
gtp: avoid zero size hashtable
bonding: fix active-backup transition after link failure
tcp: do not send empty skb from tcp_write_xmit()
tcp/dccp: fix possible race __inet_lookup_established()
hv_netvsc: Fix tx_table init in rndis_set_subchannel()
gtp: fix an use-after-free in ipv4_pdp_find()
gtp: do not allow adding duplicate tid and ms_addr pdp context
bnxt: apply computed clamp value for coalece parameter
ipv6/addrconf: only check invalid header values when NETLINK_F_STRICT_CHK is set
net: phylink: fix interface passed to mac_link_up
net: ena: fix napi handler misbehavior when the napi budget is zero
vhost/vsock: accept only packets with the right dst_cid
mmc: sdhci-of-esdhc: fix up erratum A-008171 workaround
mmc: sdhci-of-esdhc: re-implement erratum A-009204 workaround
mm/hugetlbfs: fix for_each_hstate() loop in init_hugetlbfs_fs()
Linux 5.4.8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9962505e7207f0004499de4666df6862105e990d
|
||
Vladis Dronov
|
bfa2e0cd3d |
ptp: fix the race between the release of ptp_clock and cdev
[ Upstream commit a33121e5487b424339636b25c35d3a180eaa5f5e ]
In a case when a ptp chardev (like /dev/ptp0) is open but an underlying
device is removed, closing this file leads to a race. This reproduces
easily in a kvm virtual machine:
ts# cat openptp0.c
int main() { ... fp = fopen("/dev/ptp0", "r"); ... sleep(10); }
ts# uname -r
5.5.0-rc3-46cf053e
ts# cat /proc/cmdline
... slub_debug=FZP
ts# modprobe ptp_kvm
ts# ./openptp0 &
[1] 670
opened /dev/ptp0, sleeping 10s...
ts# rmmod ptp_kvm
ts# ls /dev/ptp*
ls: cannot access '/dev/ptp*': No such file or directory
ts# ...woken up
[ 48.010809] general protection fault: 0000 [#1] SMP
[ 48.012502] CPU: 6 PID: 658 Comm: openptp0 Not tainted 5.5.0-rc3-46cf053e #25
[ 48.014624] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ...
[ 48.016270] RIP: 0010:module_put.part.0+0x7/0x80
[ 48.017939] RSP: 0018:ffffb3850073be00 EFLAGS: 00010202
[ 48.018339] RAX: 000000006b6b6b6b RBX: 6b6b6b6b6b6b6b6b RCX: ffff89a476c00ad0
[ 48.018936] RDX: fffff65a08d3ea08 RSI: 0000000000000247 RDI: 6b6b6b6b6b6b6b6b
[ 48.019470] ... ^^^ a slub poison
[ 48.023854] Call Trace:
[ 48.024050] __fput+0x21f/0x240
[ 48.024288] task_work_run+0x79/0x90
[ 48.024555] do_exit+0x2af/0xab0
[ 48.024799] ? vfs_write+0x16a/0x190
[ 48.025082] do_group_exit+0x35/0x90
[ 48.025387] __x64_sys_exit_group+0xf/0x10
[ 48.025737] do_syscall_64+0x3d/0x130
[ 48.026056] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 48.026479] RIP: 0033:0x7f53b12082f6
[ 48.026792] ...
[ 48.030945] Modules linked in: ptp i6300esb watchdog [last unloaded: ptp_kvm]
[ 48.045001] Fixing recursive fault but reboot is needed!
This happens in:
static void __fput(struct file *file)
{ ...
if (file->f_op->release)
file->f_op->release(inode, file); <<< cdev is kfree'd here
if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL &&
!(mode & FMODE_PATH))) {
cdev_put(inode->i_cdev); <<< cdev fields are accessed here
Namely:
__fput()
posix_clock_release()
kref_put(&clk->kref, delete_clock) <<< the last reference
delete_clock()
delete_ptp_clock()
kfree(ptp) <<< cdev is embedded in ptp
cdev_put
module_put(p->owner) <<< *p is kfree'd, bang!
Here cdev is embedded in posix_clock which is embedded in ptp_clock.
The race happens because ptp_clock's lifetime is controlled by two
refcounts: kref and cdev.kobj in posix_clock. This is wrong.
Make ptp_clock's sysfs device a parent of cdev with cdev_device_add()
created especially for such cases. This way the parent device with its
ptp_clock is not released until all references to the cdev are released.
This adds a requirement that an initialized but not exposed struct
device should be provided to posix_clock_register() by a caller instead
of a simple dev_t.
This approach was adopted from the commit 72139dfa2464 ("watchdog: Fix
the race between the release of watchdog_core_data and cdev"). See
details of the implementation in the commit
|
||
Eric Dumazet
|
2cd7c5f23f |
hrtimer: Annotate lockless access to timer->state
commit 56144737e67329c9aaed15f942d46a6302e2e3d8 upstream. syzbot reported various data-race caused by hrtimer_is_queued() reading timer->state. A READ_ONCE() is required there to silence the warning. Also add the corresponding WRITE_ONCE() when timer->state is set. In remove_hrtimer() the hrtimer_is_queued() helper is open coded to avoid loading timer->state twice. KCSAN reported these cases: BUG: KCSAN: data-race in __remove_hrtimer / tcp_pacing_check write to 0xffff8880b2a7d388 of 1 bytes by interrupt on cpu 0: __remove_hrtimer+0x52/0x130 kernel/time/hrtimer.c:991 __run_hrtimer kernel/time/hrtimer.c:1496 [inline] __hrtimer_run_queues+0x250/0x600 kernel/time/hrtimer.c:1576 hrtimer_run_softirq+0x10e/0x150 kernel/time/hrtimer.c:1593 __do_softirq+0x115/0x33f kernel/softirq.c:292 run_ksoftirqd+0x46/0x60 kernel/softirq.c:603 smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 read to 0xffff8880b2a7d388 of 1 bytes by task 24652 on cpu 1: tcp_pacing_check net/ipv4/tcp_output.c:2235 [inline] tcp_pacing_check+0xba/0x130 net/ipv4/tcp_output.c:2225 tcp_xmit_retransmit_queue+0x32c/0x5a0 net/ipv4/tcp_output.c:3044 tcp_xmit_recovery+0x7c/0x120 net/ipv4/tcp_input.c:3558 tcp_ack+0x17b6/0x3170 net/ipv4/tcp_input.c:3717 tcp_rcv_established+0x37e/0xf50 net/ipv4/tcp_input.c:5696 tcp_v4_do_rcv+0x381/0x4e0 net/ipv4/tcp_ipv4.c:1561 sk_backlog_rcv include/net/sock.h:945 [inline] __release_sock+0x135/0x1e0 net/core/sock.c:2435 release_sock+0x61/0x160 net/core/sock.c:2951 sk_stream_wait_memory+0x3d7/0x7c0 net/core/stream.c:145 tcp_sendmsg_locked+0xb47/0x1f30 net/ipv4/tcp.c:1393 tcp_sendmsg+0x39/0x60 net/ipv4/tcp.c:1434 inet_sendmsg+0x6d/0x90 net/ipv4/af_inet.c:807 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg+0x9f/0xc0 net/socket.c:657 BUG: KCSAN: data-race in __remove_hrtimer / __tcp_ack_snd_check write to 0xffff8880a3a65588 of 1 bytes by interrupt on cpu 0: __remove_hrtimer+0x52/0x130 kernel/time/hrtimer.c:991 __run_hrtimer kernel/time/hrtimer.c:1496 [inline] __hrtimer_run_queues+0x250/0x600 kernel/time/hrtimer.c:1576 hrtimer_run_softirq+0x10e/0x150 kernel/time/hrtimer.c:1593 __do_softirq+0x115/0x33f kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0xbb/0xe0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 read to 0xffff8880a3a65588 of 1 bytes by task 22891 on cpu 1: __tcp_ack_snd_check+0x415/0x4f0 net/ipv4/tcp_input.c:5265 tcp_ack_snd_check net/ipv4/tcp_input.c:5287 [inline] tcp_rcv_established+0x750/0xf50 net/ipv4/tcp_input.c:5708 tcp_v4_do_rcv+0x381/0x4e0 net/ipv4/tcp_ipv4.c:1561 sk_backlog_rcv include/net/sock.h:945 [inline] __release_sock+0x135/0x1e0 net/core/sock.c:2435 release_sock+0x61/0x160 net/core/sock.c:2951 sk_stream_wait_memory+0x3d7/0x7c0 net/core/stream.c:145 tcp_sendmsg_locked+0xb47/0x1f30 net/ipv4/tcp.c:1393 tcp_sendmsg+0x39/0x60 net/ipv4/tcp.c:1434 inet_sendmsg+0x6d/0x90 net/ipv4/af_inet.c:807 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg+0x9f/0xc0 net/socket.c:657 __sys_sendto+0x21f/0x320 net/socket.c:1952 __do_sys_sendto net/socket.c:1964 [inline] __se_sys_sendto net/socket.c:1960 [inline] __x64_sys_sendto+0x89/0xb0 net/socket.c:1960 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 24652 Comm: syz-executor.3 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ tglx: Added comments ] Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lkml.kernel.org/r/20191106174804.74723-1-edumazet@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Johannes Weiner
|
ead87f1165 |
kernel: sysctl: make drop_caches write-only
[ Upstream commit 204cb79ad42f015312a5bbd7012d09c93d9b46fb ]
Currently, the drop_caches proc file and sysctl read back the last value
written, suggesting this is somehow a stateful setting instead of a
one-time command. Make it write-only, like e.g. compact_memory.
While mitigating a VM problem at scale in our fleet, there was confusion
about whether writing to this file will permanently switch the kernel into
a non-caching mode. This influences the decision making in a tense
situation, where tens of people are trying to fix tens of thousands of
affected machines: Do we need a rollback strategy? What are the
performance implications of operating in a non-caching state for several
days? It also caused confusion when the kernel team said we may need to
write the file several times to make sure it's effective ("But it already
reads back 3?").
Link: http://lkml.kernel.org/r/20191031221602.9375-1-hannes@cmpxchg.org
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Chris Down <chris@chrisdown.name>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
Vladimir Murzin
|
fee76d84ba |
dma-mapping: fix handling of dma-ranges for reserved memory (again)
[ Upstream commit a445e940ea686fc60475564009821010eb213be3 ] Daniele reported that issue previously fixed in |
||
|
Eric Dumazet
|
34205ed59e |
dma-debug: add a schedule point in debug_dma_dump_mappings()
[ Upstream commit 9ff6aa027dbb98755f0265695354f2dd07c0d1ce ] debug_dma_dump_mappings() can take a lot of cpu cycles : lpk43:/# time wc -l /sys/kernel/debug/dma-api/dump 163435 /sys/kernel/debug/dma-api/dump real 0m0.463s user 0m0.003s sys 0m0.459s Let's add a cond_resched() to avoid holding cpu for too long. Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Corentin Labbe <clabbe@baylibre.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
chenqiwu
|
4e24886ec0 |
UPSTREAM: exit: panic before exit_mm() on global init exit
Currently, when global init and all threads in its thread-group have exited
we panic via:
do_exit()
-> exit_notify()
-> forget_original_parent()
-> find_child_reaper()
This makes it hard to extract a useable coredump for global init from a
kernel crashdump because by the time we panic exit_mm() will have already
released global init's mm.
This patch moves the panic futher up before exit_mm() is called. As was the
case previously, we only panic when global init and all its threads in the
thread-group have exited.
Signed-off-by: chenqiwu <chenqiwu@xiaomi.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
[christian.brauner@ubuntu.com: fix typo, rewrite commit message]
Link: https://lore.kernel.org/r/1576736993-10121-1-git-send-email-qiwuchen55@gmail.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
(cherry picked from commit 43cf75d96409a20ef06b756877a2e72b10a026fc)
Bug: 146789558
Change-Id: Icff81267e8c49bf1d332773351d1b47cb8cbac4a
Signed-off-by: Alistair Delva <adelva@google.com>
|
||
|
Greg Kroah-Hartman
|
861433ef01 |
This is the 5.4.7 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl4LbVwACgkQONu9yGCS aT6zdhAAkTwLWNfzyk1cSPKzWdguZWoqAuddmIeCUaDmyPwI6TE5a2J8IfZ7upYU 4U2J4nO4I9WxVuTUgJpE0wnDidkvL6U7YfbMbqjVkxAfbFboxN8dJYDNTISehK2A WgpIpJadhj1M8Akxq0MLxuCMg11UJU2PP5Tc7K5aKgiVVneDodupjY8Ddksuw8SZ 5Mus33uOjpCvtxt3GZIRgAdduhL3s3h2Vp+dyAzV2eBvSGwd9Rz4/p0OGZytH780 oywFYzIU7CxtI7pxIQKBxegb4incjWnlRpP3Dk80CNXHzcuU6WGXARoHjgXmWYcu b9hX+/fM76qxbxojM1vI9QVuwy5uB++4NMVsX3e0xFxdvkTo2+Y/vbO3sBMmAy5i L0S0sftTuE6bg1XCWoeFbLUaXIWF7g0Xbc91VP7Wv5VolpIrwZsVHJNT4Nf8KHM4 DuRLmrANhU7ax2E26Bbt17/otCFvjyeQj5fggw/1rkEN8fJSY1YU/SWOxizDY6GZ S3ovivhqhLIaDPzW+qmphYRGnBDkTq7HxHal8eJoy/cgvFxBOYAbfXiHuPuNP4Kj zbIThujSlbI0gNGymoHH8EoVOJeNcK8L2PsilIZdlPDWi45v5tqYIgiYIA7mqqu+ 6O2plNGWbYK2+ARPkCJ08XTdDFSm+B6Cm0+KFvsdjuQ6xNkhMwc= =HvEl -----END PGP SIGNATURE----- Merge 5.4.7 into android-5.4 Changes in 5.4.7 af_packet: set defaule value for tmo fjes: fix missed check in fjes_acpi_add mod_devicetable: fix PHY module format net: dst: Force 4-byte alignment of dst_metrics net: gemini: Fix memory leak in gmac_setup_txqs net: hisilicon: Fix a BUG trigered by wrong bytes_compl net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive() net: phy: ensure that phy IDs are correctly typed net: qlogic: Fix error paths in ql_alloc_large_buffers() net-sysfs: Call dev_hold always in rx_queue_add_kobject net: usb: lan78xx: Fix suspend/resume PHY register access error nfp: flower: fix stats id allocation qede: Disable hardware gro when xdp prog is installed qede: Fix multicast mac configuration sctp: fix memleak on err handling of stream initialization sctp: fully initialize v4 addr in some functions selftests: forwarding: Delete IPv6 address at the end neighbour: remove neigh_cleanup() method bonding: fix bond_neigh_init() net: ena: fix default tx interrupt moderation interval net: ena: fix issues in setting interrupt moderation params in ethtool dpaa2-ptp: fix double free of the ptp_qoriq IRQ mlxsw: spectrum_router: Remove unlikely user-triggerable warning net: ethernet: ti: davinci_cpdma: fix warning "device driver frees DMA memory with different size" net: stmmac: platform: Fix MDIO init for platforms without PHY net: dsa: b53: Fix egress flooding settings NFC: nxp-nci: Fix probing without ACPI btrfs: don't double lock the subvol_sem for rename exchange btrfs: do not call synchronize_srcu() in inode_tree_del Btrfs: make tree checker detect checksum items with overlapping ranges btrfs: return error pointer from alloc_test_extent_buffer Btrfs: fix missing data checksums after replaying a log tree btrfs: send: remove WARN_ON for readonly mount btrfs: abort transaction after failed inode updates in create_subvol btrfs: skip log replay on orphaned roots btrfs: do not leak reloc root if we fail to read the fs root btrfs: handle ENOENT in btrfs_uuid_tree_iterate Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues ALSA: pcm: Avoid possible info leaks from PCM stream buffers ALSA: hda/ca0132 - Keep power on during processing DSP response ALSA: hda/ca0132 - Avoid endless loop ALSA: hda/ca0132 - Fix work handling in delayed HP detection drm/vc4/vc4_hdmi: fill in connector info drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper. drm: mst: Fix query_payload ack reply struct drm/mipi-dbi: fix a loop in debugfs code drm/panel: Add missing drm_panel_init() in panel drivers drm: exynos: exynos_hdmi: use cec_notifier_conn_(un)register drm: Use EOPNOTSUPP, not ENOTSUPP drm/amd/display: verify stream link before link test drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings drm/amd/display: OTC underflow fix iio: max31856: add missing of_node and parent references to iio_dev iio: light: bh1750: Resolve compiler warning and make code more readable drm/amdgpu/sriov: add ring_stop before ring_create in psp v11 code drm/amdgpu: grab the id mgr lock while accessing passid_mapping drm/ttm: return -EBUSY on pipelining with no_gpu_wait (v2) drm/amd/display: Rebuild mapped resources after pipe split ath10k: add cleanup in ath10k_sta_state() drm/amd/display: Handle virtual signal type in disable_link() ath10k: Check if station exists before forwarding tx airtime report spi: Add call to spi_slave_abort() function when spidev driver is released drm/meson: vclk: use the correct G12A frac max value staging: rtl8192u: fix multiple memory leaks on error path staging: rtl8188eu: fix possible null dereference rtlwifi: prevent memory leak in rtl_usb_probe libertas: fix a potential NULL pointer dereference Revert "pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit30 when using SSI_SCK2 and SSI_WS2" Revert "pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit31 when using SIM0_D" ath10k: fix backtrace on coredump IB/iser: bound protection_sg size by data_sg size drm/komeda: Workaround for broken FLIP_COMPLETE timestamps spi: gpio: prevent memory leak in spi_gpio_probe media: am437x-vpfe: Setting STD to current value is not an error media: cedrus: fill in bus_info for media device media: seco-cec: Add a missing 'release_region()' in an error handling path media: vim2m: Fix abort issue media: vim2m: Fix BUG_ON in vim2m_device_release() media: max2175: Fix build error without CONFIG_REGMAP_I2C media: ov6650: Fix control handler not freed on init error media: i2c: ov2659: fix s_stream return value media: ov6650: Fix crop rectangle alignment not passed back media: i2c: ov2659: Fix missing 720p register config media: ov6650: Fix stored frame format not in sync with hardware media: ov6650: Fix stored crop rectangle not in sync with hardware tools/power/cpupower: Fix initializer override in hsw_ext_cstates media: venus: core: Fix msm8996 frequency table ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq media: vimc: Fix gpf in rmmod path when stream is active drm/amd/display: Set number of pipes to 1 if the second pipe was disabled pinctrl: devicetree: Avoid taking direct reference to device name string drm/sun4i: dsi: Fix TCON DRQ set bits drm/amdkfd: fix a potential NULL pointer dereference (v2) x86/math-emu: Check __copy_from_user() result drm/amd/powerplay: A workaround to GPU RESET on APU selftests/bpf: Correct path to include msg + path drm/amd/display: set minimum abm backlight level media: venus: Fix occasionally failures to suspend rtw88: fix NSS of hw_cap drm/amd/display: fix struct init in update_bounding_box usb: renesas_usbhs: add suspend event support in gadget mode crypto: aegis128-neon - use Clang compatible cflags for ARM hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe() tools/memory-model: Fix data race detection for unordered store and load media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init() media: cec-funcs.h: add status_req checks media: meson/ao-cec: move cec_notifier_cec_adap_register after hw setup drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C controller samples: pktgen: fix proc_cmd command result check logic block: Fix writeback throttling W=1 compiler warnings drm/amdkfd: Fix MQD size calculation MIPS: futex: Emit Loongson3 sync workarounds within asm mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring drm/drm_vblank: Change EINVAL by the correct errno selftests/bpf: Fix btf_dump padding test case libbpf: Fix struct end padding in btf_dump libbpf: Fix passing uninitialized bytes to setsockopt net/smc: increase device refcount for added link group team: call RCU read lock when walking the port_list media: cx88: Fix some error handling path in 'cx8800_initdev()' crypto: inside-secure - Fix a maybe-uninitialized warning crypto: aegis128/simd - build 32-bit ARM for v8 architecture explicitly misc: fastrpc: fix memory leak from miscdev->name ASoC: SOF: enable sync_write in hdac_bus media: ti-vpe: vpe: Fix Motion Vector vpdma stride media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number media: ti-vpe: vpe: Make sure YUYV is set as default format media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort cases drm/amd/display: Properly round nominal frequency for SPD drm/amd/display: wait for set pipe mcp command completion media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid sizeimage drm/amd/display: add new active dongle to existent w/a syscalls/x86: Use the correct function type in SYSCALL_DEFINE0 drm/amd/display: Fix dongle_caps containing stale information. extcon: sm5502: Reset registers during initialization drm/amd/display: Program DWB watermarks from correct state x86/mm: Use the correct function type for native_set_fixmap() ath10k: Correct error handling of dma_map_single() rtw88: coex: Set 4 slot mode for A2DP drm/bridge: dw-hdmi: Restore audio when setting a mode perf test: Report failure for mmap events perf report: Add warning when libunwind not compiled in perf test: Avoid infinite loop for task exit case perf vendor events arm64: Fix Hisi hip08 DDRC PMU eventname usb: usbfs: Suppress problematic bind and unbind uevents. drm/amd/powerplay: avoid disabling ECC if RAS is enabled for VEGA20 iio: adc: max1027: Reset the device at probe time Bluetooth: btusb: avoid unused function warning Bluetooth: missed cpu_to_le16 conversion in hci_init4_req Bluetooth: Workaround directed advertising bug in Broadcom controllers Bluetooth: hci_core: fix init for HCI_USER_CHANNEL bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack() x86/mce: Lower throttling MCE messages' priority to warning drm/amd/display: enable hostvm based on roimmu active for dcn2.1 drm/amd/display: fix header for RN clk mgr drm/amdgpu: fix amdgpu trace event print string format error staging: iio: ad9834: add a check for devm_clk_get power: supply: cpcap-battery: Check voltage before orderly_poweroff perf tests: Disable bp_signal testing for arm64 selftests/bpf: Make a copy of subtest name net: hns3: log and clear hardware error after reset complete RDMA/hns: Fix wrong parameters when initial mtt of srq->idx_que drm/gma500: fix memory disclosures due to uninitialized bytes ASoC: soc-pcm: fixup dpcm_prune_paths() loop continue rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot RDMA/siw: Fix SQ/RQ drain logic ipmi: Don't allow device module unload when in use x86/ioapic: Prevent inconsistent state when moving an interrupt media: cedrus: Fix undefined shift with a SHIFT_AND_MASK_BITS macro media: aspeed: set hsync and vsync polarities to normal before starting mode detection drm/nouveau: Don't grab runtime PM refs for HPD IRQs media: ov6650: Fix stored frame interval not in sync with hardware media: ad5820: Define entity function media: ov5640: Make 2592x1944 mode only available at 15 fps media: st-mipid02: add a check for devm_gpiod_get_optional media: imx7-mipi-csis: Add a check for devm_regulator_get media: aspeed: clear garbage interrupts media: smiapp: Register sensor after enabling runtime PM on the device md: no longer compare spare disk superblock events in super_load staging: wilc1000: potential corruption in wilc_parse_join_bss_param() md/bitmap: avoid race window between md_bitmap_resize and bitmap_file_clear_bit drm: Don't free jobs in wait_event_interruptible() EDAC/amd64: Set grain per DIMM arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() drm/amd/display: setting the DIG_MODE to the correct value. i40e: initialize ITRN registers with correct values drm/amd/display: correctly populate dpp refclk in fpga i40e: Wrong 'Advertised FEC modes' after set FEC to AUTO net: phy: dp83867: enable robust auto-mdix drm/tegra: sor: Use correct SOR index on Tegra210 regulator: core: Release coupled_rdevs on regulator_init_coupling() error ubsan, x86: Annotate and allow __ubsan_handle_shift_out_of_bounds() in uaccess regions spi: sprd: adi: Add missing lock protection when rebooting ACPI: button: Add DMI quirk for Medion Akoya E2215T RDMA/qedr: Fix memory leak in user qp and mr RDMA/hns: Fix memory leak on 'context' on error return path RDMA/qedr: Fix srqs xarray initialization RDMA/core: Set DMA parameters correctly staging: wilc1000: check if device is initialzied before changing vif gpu: host1x: Allocate gather copy for host1x net: dsa: LAN9303: select REGMAP when LAN9303 enable phy: renesas: phy-rcar-gen2: Fix the array off by one warning phy: qcom-usb-hs: Fix extcon double register after power cycle s390/time: ensure get_clock_monotonic() returns monotonic values s390: add error handling to perf_callchain_kernel s390/mm: add mm_pxd_folded() checks to pxd_free() net: hns3: add struct netdev_queue debug info for TX timeout libata: Ensure ata_port probe has completed before detach loop: fix no-unmap write-zeroes request behavior net/mlx5e: Verify that rule has at least one fwd/drop action pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B ALSA: bebob: expand sleep just after breaking connections for protocol version 1 iio: dln2-adc: fix iio_triggered_buffer_postenable() position libbpf: Fix error handling in bpf_map__reuse_fd() Bluetooth: Fix advertising duplicated flags ALSA: pcm: Fix missing check of the new non-cached buffer type spi: sifive: disable clk when probe fails and remove ASoC: SOF: imx: fix reverse CONFIG_SND_SOC_SOF_OF dependency pinctrl: qcom: sc7180: Add missing tile info in SDC_QDSD_PINGROUP/UFS_RESET pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler() ixgbe: protect TX timestamping from API misuse cpufreq: sun50i: Fix CPU speed bin detection media: rcar_drif: fix a memory disclosure media: v4l2-core: fix touch support in v4l_g_fmt nvme: introduce "Command Aborted By host" status code media: staging/imx: Use a shorter name for driver nvmem: imx-ocotp: reset error status on probe nvmem: core: fix nvmem_cell_write inline function ASoC: SOF: topology: set trigger order for FE DAI link media: vivid: media_device_cleanup was called too early spi: dw: Fix Designware SPI loopback bnx2x: Fix PF-VF communication over multi-cos queues. spi: img-spfi: fix potential double release ALSA: timer: Limit max amount of slave instances RDMA/core: Fix return code when modify_port isn't supported drm: msm: a6xx: fix debug bus register configuration rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt() perf probe: Fix to find range-only function instance perf cs-etm: Fix definition of macro TO_CS_QUEUE_NR perf probe: Fix to list probe event with correct line number perf jevents: Fix resource leak in process_mapfile() and main() perf probe: Walk function lines in lexical blocks perf probe: Fix to probe an inline function which has no entry pc perf probe: Fix to show ranges of variables in functions without entry_pc perf probe: Fix to show inlined function callsite without entry_pc libsubcmd: Use -O0 with DEBUG=1 perf probe: Fix to probe a function which has no entry pc perf tools: Fix cross compile for ARM64 perf tools: Splice events onto evlist even on error drm/amdgpu: disallow direct upload save restore list from gfx driver drm/amd/powerplay: fix struct init in renoir_print_clk_levels drm/amdgpu: fix potential double drop fence reference ice: Check for null pointer dereference when setting rings xen/gntdev: Use select for DMA_SHARED_BUFFER perf parse: If pmu configuration fails free terms perf probe: Skip overlapped location on searching variables net: avoid potential false sharing in neighbor related code perf probe: Return a better scope DIE if there is no best scope perf probe: Fix to show calling lines of inlined functions perf probe: Skip end-of-sequence and non statement lines perf probe: Filter out instances except for inlined subroutine and subprogram libbpf: Fix negative FD close() in xsk_setup_xdp_prog() s390/bpf: Use kvcalloc for addrs array cgroup: freezer: don't change task and cgroups status unnecessarily selftests: proc: Make va_max 1MB drm/amdgpu: Avoid accidental thread reactivation. media: exynos4-is: fix wrong mdev and v4l2 dev order in error path ath10k: fix get invalid tx rate for Mesh metric fsi: core: Fix small accesses and unaligned offsets via sysfs selftests: net: Fix printf format warnings on arm media: pvrusb2: Fix oops on tear-down when radio support is not present soundwire: intel: fix PDI/stream mapping for Bulk crypto: atmel - Fix authenc support when it is set to m ice: delay less media: si470x-i2c: add missed operations in remove media: cedrus: Use helpers to access capture queue media: v4l2-ctrl: Lock main_hdl on operations of requests_queued. iio: cros_ec_baro: set info_mask_shared_by_all_available field EDAC/ghes: Fix grain calculation media: vicodec: media_device_cleanup was called too early media: vim2m: media_device_cleanup was called too early spi: pxa2xx: Add missed security checks ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile iio: dac: ad5446: Add support for new AD5600 DAC bpf, testing: Workaround a verifier failure for test_progs ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format constraint net: dsa: sja1105: Disallow management xmit during switch reset r8169: respect EEE user setting when restarting network s390/disassembler: don't hide instruction addresses net: ethernet: ti: Add dependency for TI_DAVINCI_EMAC nvme: Discard workaround for non-conformant devices parport: load lowlevel driver if ports not found bcache: fix static checker warning in bcache_device_free() cpufreq: Register drivers only after CPU devices have been registered qtnfmac: fix debugfs support for multiple cards qtnfmac: fix invalid channel information output x86/crash: Add a forward declaration of struct kimage qtnfmac: fix using skb after free RDMA/efa: Clear the admin command buffer prior to its submission tracing: use kvcalloc for tgid_map array allocation MIPS: ralink: enable PCI support only if driver for mt7621 SoC is selected tracing/kprobe: Check whether the non-suffixed symbol is notrace bcache: fix deadlock in bcache_allocator iwlwifi: mvm: fix unaligned read of rx_pkt_status ASoC: wm8904: fix regcache handling regulator: core: Let boot-on regulators be powered off spi: tegra20-slink: add missed clk_unprepare tun: fix data-race in gro_normal_list() xhci-pci: Allow host runtime PM as default also for Intel Ice Lake xHCI crypto: virtio - deal with unsupported input sizes mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests btrfs: don't prematurely free work in end_workqueue_fn() btrfs: don't prematurely free work in run_ordered_work() sched/uclamp: Fix overzealous type replacement ASoC: wm2200: add missed operations in remove and probe failure spi: st-ssc4: add missed pm_runtime_disable ASoC: wm5100: add missed pm_runtime_disable perf/core: Fix the mlock accounting, again selftests, bpf: Fix test_tc_tunnel hanging selftests, bpf: Workaround an alu32 sub-register spilling issue bnxt_en: Return proper error code for non-existent NVM variable net: phy: avoid matching all-ones clause 45 PHY IDs firmware_loader: Fix labels with comma for builtin firmware ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012 2-in-1 x86/insn: Add some Intel instructions to the opcode map net-af_xdp: Use correct number of channels from ethtool brcmfmac: remove monitor interface when detaching perf session: Fix decompression of PERF_RECORD_COMPRESSED records perf probe: Fix to show function entry line as probe-able s390/crypto: Fix unsigned variable compared with zero s390/kasan: support memcpy_real with TRACE_IRQFLAGS bnxt_en: Improve RX buffer error handling. iwlwifi: check kasprintf() return value fbtft: Make sure string is NULL terminated ASoC: soc-pcm: check symmetry before hw_params net: ethernet: ti: ale: clean ale tbl on init and intf restart mt76: fix possible out-of-bound access in mt7615_fill_txs/mt7603_fill_txs s390/cpumf: Adjust registration of s390 PMU device drivers crypto: sun4i-ss - Fix 64-bit size_t warnings crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED crypto: vmx - Avoid weird build failures libtraceevent: Fix memory leakage in copy_filter_type mips: fix build when "48 bits virtual memory" is enabled drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2 ice: Only disable VF state when freeing each VF resources ice: Fix setting coalesce to handle DCB configuration net: phy: initialise phydev speed and duplex sanely tools, bpf: Fix build for 'make -s tools/bpf O=<dir>' RDMA/bnxt_re: Fix missing le16_to_cpu RDMA/bnxt_re: Fix stat push into dma buffer on gen p5 devices bpf: Provide better register bounds after jmp32 instructions RDMA/bnxt_re: Fix chip number validation Broadcom's Gen P5 series ibmvnic: Fix completion structure initialization net: wireless: intel: iwlwifi: fix GRO_NORMAL packet stalling MIPS: futex: Restore \n after sync instructions btrfs: don't prematurely free work in reada_start_machine_worker() btrfs: don't prematurely free work in scrub_missing_raid56_worker() Revert "mmc: sdhci: Fix incorrect switch to HS mode" mmc: mediatek: fix CMD_TA to 2 for MT8173 HS200/HS400 mode tpm_tis: reserve chip for duration of tpm_tis_core_init tpm: fix invalid locking in NONBLOCKING mode iommu: fix KASAN use-after-free in iommu_insert_resv_region iommu: set group default domain before creating direct mappings iommu/vt-d: Fix dmar pte read access not set error iommu/vt-d: Set ISA bridge reserved region as relaxable iommu/vt-d: Allocate reserved region for ISA with correct permission can: xilinx_can: Fix missing Rx can packets on CANFD2.0 can: m_can: tcan4x5x: add required delay after reset can: j1939: j1939_sk_bind(): take priv after lock is held can: flexcan: fix possible deadlock and out-of-order reception after wakeup can: flexcan: poll MCR_LPM_ACK instead of GPR ACK for stop mode acknowledgment can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices selftests: net: tls: remove recv_rcvbuf test spi: dw: Correct handling of native chipselect spi: cadence: Correct handling of native chipselect usb: xhci: Fix build warning seen with CONFIG_PM=n drm/amdgpu: fix uninitialized variable pasid_mapping_needed ath10k: Revert "ath10k: add cleanup in ath10k_sta_state()" RDMA/siw: Fix post_recv QP state locking md: avoid invalid memory access for array sb->dev_roles s390/ftrace: fix endless recursion in function_graph tracer ARM: dts: Fix vcsi regulator to be always-on for droid4 to prevent hangs can: flexcan: add low power enter/exit acknowledgment helper usbip: Fix receive error in vhci-hcd when using scatter-gather usbip: Fix error path of vhci_recv_ret_submit() spi: fsl: don't map irq during probe spi: fsl: use platform_get_irq() instead of of_irq_to_resource() efi/memreserve: Register reservations as 'reserved' in /proc/iomem cpufreq: Avoid leaving stale IRQ work items during CPU offline KEYS: asymmetric: return ENOMEM if akcipher_request_alloc() fails mm: vmscan: protect shrinker idr replace with CONFIG_MEMCG USB: EHCI: Do not return -EPIPE when hub is disconnected intel_th: pci: Add Comet Lake PCH-V support intel_th: pci: Add Elkhart Lake SOC support intel_th: Fix freeing IRQs intel_th: msu: Fix window switching without windows platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value tty/serial: atmel: fix out of range clock divider handling serial: sprd: Add clearing break interrupt operation pinctrl: baytrail: Really serialize all register accesses clk: imx: clk-imx7ulp: Add missing sentinel of ulp_div_table clk: imx: clk-composite-8m: add lock to gate/mux clk: imx: pll14xx: fix clk_pll14xx_wait_lock ext4: fix ext4_empty_dir() for directories with holes ext4: check for directory entries too close to block end ext4: unlock on error in ext4_expand_extra_isize() ext4: validate the debug_want_extra_isize mount option at parse time iocost: over-budget forced IOs should schedule async delay KVM: PPC: Book3S HV: Fix regression on big endian hosts kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD kvm: x86: Host feature SSBD doesn't imply guest feature AMD_SSBD KVM: arm/arm64: Properly handle faulting of device mappings KVM: arm64: Ensure 'params' is initialised when looking up sys register x86/intel: Disable HPET on Intel Coffee Lake H platforms x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] x86/mce: Fix possibly incorrect severity calculation on AMD powerpc/vcpu: Assume dedicated processors as non-preempt powerpc/irq: fix stack overflow verification ocxl: Fix concurrent AFU open and device removal mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG register mmc: sdhci-of-esdhc: Revert "mmc: sdhci-of-esdhc: add erratum A-009204 support" mmc: sdhci: Update the tuning failed messages to pr_debug level mmc: sdhci-of-esdhc: fix P2020 errata handling mmc: sdhci: Workaround broken command queuing on Intel GLK mmc: sdhci: Add a quirk for broken command queuing nbd: fix shutdown and recv work deadlock v2 iwlwifi: pcie: move power gating workaround earlier in the flow Linux 5.4.7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3585238149235bf73bb453e25861d9a6b9193dfa |
||
Rafael J. Wysocki
|
da06508bcb |
cpufreq: Avoid leaving stale IRQ work items during CPU offline
commit 85572c2c4a45a541e880e087b5b17a48198b2416 upstream.
The scheduler code calling cpufreq_update_util() may run during CPU
offline on the target CPU after the IRQ work lists have been flushed
for it, so the target CPU should be prevented from running code that
may queue up an IRQ work item on it at that point.
Unfortunately, that may not be the case if dvfs_possible_from_any_cpu
is set for at least one cpufreq policy in the system, because that
allows the CPU going offline to run the utilization update callback
of the cpufreq governor on behalf of another (online) CPU in some
cases.
If that happens, the cpufreq governor callback may queue up an IRQ
work on the CPU running it, which is going offline, and the IRQ work
may not be flushed after that point. Moreover, that IRQ work cannot
be flushed until the "offlining" CPU goes back online, so if any
other CPU calls irq_work_sync() to wait for the completion of that
IRQ work, it will have to wait until the "offlining" CPU is back
online and that may not happen forever. In particular, a system-wide
deadlock may occur during CPU online as a result of that.
The failing scenario is as follows. CPU0 is the boot CPU, so it
creates a cpufreq policy and becomes the "leader" of it
(policy->cpu). It cannot go offline, because it is the boot CPU.
Next, other CPUs join the cpufreq policy as they go online and they
leave it when they go offline. The last CPU to go offline, say CPU3,
may queue up an IRQ work while running the governor callback on
behalf of CPU0 after leaving the cpufreq policy because of the
dvfs_possible_from_any_cpu effect described above. Then, CPU0 is
the only online CPU in the system and the stale IRQ work is still
queued on CPU3. When, say, CPU1 goes back online, it will run
irq_work_sync() to wait for that IRQ work to complete and so it
will wait for CPU3 to go back online (which may never happen even
in principle), but (worse yet) CPU0 is waiting for CPU1 at that
point too and a system-wide deadlock occurs.
To address this problem notice that CPUs which cannot run cpufreq
utilization update code for themselves (for example, because they
have left the cpufreq policies that they belonged to), should also
be prevented from running that code on behalf of the other CPUs that
belong to a cpufreq policy with dvfs_possible_from_any_cpu set and so
in that case the cpufreq_update_util_data pointer of the CPU running
the code must not be NULL as well as for the CPU which is the target
of the cpufreq utilization update in progress.
Accordingly, change cpufreq_this_cpu_can_update() into a regular
function in kernel/sched/cpufreq.c (instead of a static inline in a
header file) and make it check the cpufreq_update_util_data pointer
of the local CPU if dvfs_possible_from_any_cpu is set for the target
cpufreq policy.
Also update the schedutil governor to do the
cpufreq_this_cpu_can_update() check in the non-fast-switch
case too to avoid the stale IRQ work issues.
Fixes:
|
||
Yonghong Song
|
b4de258ded |
bpf: Provide better register bounds after jmp32 instructions
[ Upstream commit 581738a681b6faae5725c2555439189ca81c0f1f ] With latest llvm (trunk https://github.com/llvm/llvm-project), test_progs, which has +alu32 enabled, failed for strobemeta.o. The verifier output looks like below with edit to replace large decimal numbers with hex ones. 193: (85) call bpf_probe_read_user_str#114 R0=inv(id=0) 194: (26) if w0 > 0x1 goto pc+4 R0_w=inv(id=0,umax_value=0xffffffff00000001) 195: (6b) *(u16 *)(r7 +80) = r0 196: (bc) w6 = w0 R6_w=inv(id=0,umax_value=0xffffffff,var_off=(0x0; 0xffffffff)) 197: (67) r6 <<= 32 R6_w=inv(id=0,smax_value=0x7fffffff00000000,umax_value=0xffffffff00000000, var_off=(0x0; 0xffffffff00000000)) 198: (77) r6 >>= 32 R6=inv(id=0,umax_value=0xffffffff,var_off=(0x0; 0xffffffff)) ... 201: (79) r8 = *(u64 *)(r10 -416) R8_w=map_value(id=0,off=40,ks=4,vs=13872,imm=0) 202: (0f) r8 += r6 R8_w=map_value(id=0,off=40,ks=4,vs=13872,umax_value=0xffffffff,var_off=(0x0; 0xffffffff)) 203: (07) r8 += 9696 R8_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=0xffffffff,var_off=(0x0; 0xffffffff)) ... 255: (bf) r1 = r8 R1_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=0xffffffff,var_off=(0x0; 0xffffffff)) ... 257: (85) call bpf_probe_read_user_str#114 R1 unbounded memory access, make sure to bounds check any array access into a map The value range for register r6 at insn 198 should be really just 0/1. The umax_value=0xffffffff caused later verification failure. After jmp instructions, the current verifier already tried to use just obtained information to get better register range. The current mechanism is for 64bit register only. This patch implemented to tighten the range for 32bit sub-registers after jmp32 instructions. With the patch, we have the below range ranges for the above code sequence: 193: (85) call bpf_probe_read_user_str#114 R0=inv(id=0) 194: (26) if w0 > 0x1 goto pc+4 R0_w=inv(id=0,smax_value=0x7fffffff00000001,umax_value=0xffffffff00000001, var_off=(0x0; 0xffffffff00000001)) 195: (6b) *(u16 *)(r7 +80) = r0 196: (bc) w6 = w0 R6_w=inv(id=0,umax_value=0xffffffff,var_off=(0x0; 0x1)) 197: (67) r6 <<= 32 R6_w=inv(id=0,umax_value=0x100000000,var_off=(0x0; 0x100000000)) 198: (77) r6 >>= 32 R6=inv(id=0,umax_value=1,var_off=(0x0; 0x1)) ... 201: (79) r8 = *(u64 *)(r10 -416) R8_w=map_value(id=0,off=40,ks=4,vs=13872,imm=0) 202: (0f) r8 += r6 R8_w=map_value(id=0,off=40,ks=4,vs=13872,umax_value=1,var_off=(0x0; 0x1)) 203: (07) r8 += 9696 R8_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=1,var_off=(0x0; 0x1)) ... 255: (bf) r1 = r8 R1_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=1,var_off=(0x0; 0x1)) ... 257: (85) call bpf_probe_read_user_str#114 ... At insn 194, the register R0 has better var_off.mask and smax_value. Especially, the var_off.mask ensures later lshift and rshift maintains proper value range. Suggested-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20191121170650.449030-1-yhs@fb.com Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
Alexander Shishkin
|
83e561d6cc |
perf/core: Fix the mlock accounting, again
[ Upstream commit 36b3db03b4741b8935b68fffc7e69951d8d70a89 ]
Commit:
|
||
Valentin Schneider
|
c598c8a46d |
sched/uclamp: Fix overzealous type replacement
[ Upstream commit 7763baace1b738d65efa46d68326c9406311c6bf ] Some uclamp helpers had their return type changed from 'unsigned int' to 'enum uclamp_id' by commit |
||
Masami Hiramatsu
|
4ff039ca44 |
tracing/kprobe: Check whether the non-suffixed symbol is notrace
[ Upstream commit c7411a1a126f649be71526a36d4afac9e5aefa13 ]
Check whether the non-suffixed symbol is notrace, since suffixed
symbols are generated by the compilers for optimization. Based on
these suffixed symbols, notrace check might not work because
some of them are just a partial code of the original function.
(e.g. cold-cache (unlikely) code is separated from original
function as FUNCTION.cold.XX)
For example, without this fix,
# echo p device_add.cold.67 > /sys/kernel/debug/tracing/kprobe_events
sh: write error: Invalid argument
# cat /sys/kernel/debug/tracing/error_log
[ 135.491035] trace_kprobe: error: Failed to register probe event
Command: p device_add.cold.67
^
# dmesg | tail -n 1
[ 135.488599] trace_kprobe: Could not probe notrace function device_add.cold.67
With this,
# echo p device_add.cold.66 > /sys/kernel/debug/tracing/kprobe_events
# cat /sys/kernel/debug/kprobes/list
ffffffff81599de9 k device_add.cold.66+0x0 [DISABLED]
Actually, kprobe blacklist already did similar thing,
see within_kprobe_blacklist().
Link: http://lkml.kernel.org/r/157233790394.6706.18243942030937189679.stgit@devnote2
Fixes:
|
||
Yuming Han
|
519a279894 |
tracing: use kvcalloc for tgid_map array allocation
[ Upstream commit 6ee40511cb838f9ced002dff7131bca87e3ccbdd ] Fail to allocate memory for tgid_map, because it requires order-6 page. detail as: c3 sh: page allocation failure: order:6, mode:0x140c0c0(GFP_KERNEL), nodemask=(null) c3 sh cpuset=/ mems_allowed=0 c3 CPU: 3 PID: 5632 Comm: sh Tainted: G W O 4.14.133+ #10 c3 Hardware name: Generic DT based system c3 Backtrace: c3 [<c010bdbc>] (dump_backtrace) from [<c010c08c>](show_stack+0x18/0x1c) c3 [<c010c074>] (show_stack) from [<c0993c54>](dump_stack+0x84/0xa4) c3 [<c0993bd0>] (dump_stack) from [<c0229858>](warn_alloc+0xc4/0x19c) c3 [<c0229798>] (warn_alloc) from [<c022a6e4>](__alloc_pages_nodemask+0xd18/0xf28) c3 [<c02299cc>] (__alloc_pages_nodemask) from [<c0248344>](kmalloc_order+0x20/0x38) c3 [<c0248324>] (kmalloc_order) from [<c0248380>](kmalloc_order_trace+0x24/0x108) c3 [<c024835c>] (kmalloc_order_trace) from [<c01e6078>](set_tracer_flag+0xb0/0x158) c3 [<c01e5fc8>] (set_tracer_flag) from [<c01e6404>](trace_options_core_write+0x7c/0xcc) c3 [<c01e6388>] (trace_options_core_write) from [<c0278b1c>](__vfs_write+0x40/0x14c) c3 [<c0278adc>] (__vfs_write) from [<c0278e10>](vfs_write+0xc4/0x198) c3 [<c0278d4c>] (vfs_write) from [<c027906c>](SyS_write+0x6c/0xd0) c3 [<c0279000>] (SyS_write) from [<c01079a0>](ret_fast_syscall+0x0/0x54) Switch to use kvcalloc to avoid unexpected allocation failures. Link: http://lkml.kernel.org/r/1571888070-24425-1-git-send-email-chunyan.zhang@unisoc.com Signed-off-by: Yuming Han <yuming.han@unisoc.com> Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
Honglei Wang
|
20832ebf91 |
cgroup: freezer: don't change task and cgroups status unnecessarily
[ Upstream commit 742e8cd3e1ba6f19cad6d912f8d469df5557d0fd ] It's not necessary to adjust the task state and revisit the state of source and destination cgroups if the cgroups are not in freeze state and the task itself is not frozen. And in this scenario, it wakes up the task who's not supposed to be ready to run. Don't do the unnecessary task state adjustment can help stop waking up the task without a reason. Signed-off-by: Honglei Wang <honglei.wang@oracle.com> Acked-by: Roman Gushchin <guro@fb.com> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
Song Liu
|
f1838da73c |
bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()
[ Upstream commit eac9153f2b584c702cea02c1f1a57d85aa9aea42 ]
bpf stackmap with build-id lookup (BPF_F_STACK_BUILD_ID) can trigger A-A
deadlock on rq_lock():
rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
[...]
Call Trace:
try_to_wake_up+0x1ad/0x590
wake_up_q+0x54/0x80
rwsem_wake+0x8a/0xb0
bpf_get_stack+0x13c/0x150
bpf_prog_fbdaf42eded9fe46_on_event+0x5e3/0x1000
bpf_overflow_handler+0x60/0x100
__perf_event_overflow+0x4f/0xf0
perf_swevent_overflow+0x99/0xc0
___perf_sw_event+0xe7/0x120
__schedule+0x47d/0x620
schedule+0x29/0x90
futex_wait_queue_me+0xb9/0x110
futex_wait+0x139/0x230
do_futex+0x2ac/0xa50
__x64_sys_futex+0x13c/0x180
do_syscall_64+0x42/0x100
entry_SYSCALL_64_after_hwframe+0x44/0xa9
This can be reproduced by:
1. Start a multi-thread program that does parallel mmap() and malloc();
2. taskset the program to 2 CPUs;
3. Attach bpf program to trace_sched_switch and gather stackmap with
build-id, e.g. with trace.py from bcc tools:
trace.py -U -p <pid> -s <some-bin,some-lib> t:sched:sched_switch
A sample reproducer is attached at the end.
This could also trigger deadlock with other locks that are nested with
rq_lock.
Fix this by checking whether irqs are disabled. Since rq_lock and all
other nested locks are irq safe, it is safe to do up_read() when irqs are
not disable. If the irqs are disabled, postpone up_read() in irq_work.
Fixes:
|
||
Amit Kucheria
|
98117f2abf |
UPSTREAM: cpufreq: Initialize the governors in core_initcall
Initialize the cpufreq governors earlier to allow for earlier performance control during the boot process. Signed-off-by: Amit Kucheria <amit.kucheria@linaro.org> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/b98eae9b44eb2f034d7f5d12a161f5f831be1eb7.1571656015.git.amit.kucheria@linaro.org (cherry picked from commit 3f6ec871e1c2b360aaf022e90bb99dcc016b3874) Signed-off-by: John Stultz <john.stultz@linaro.org> Bug: 146449535 Change-Id: Ib5599ade3811fb44a15cda6ee3791d997207cad5 |
||
|
Greg Kroah-Hartman
|
7dc1159904 |
This is the 5.4.4 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl35Ju4ACgkQONu9yGCS aT7IMQ//Vs+kE7VCDeHfzNu4ivh3+X0bleYWo/OPxNQRFx7IL4Lb2jVjWrMnAGld u8H31nVaL28bhJAcQJg+O/OD3AXWQ8nzRKixfVfwd669Zv1ggaLM8MW9xuTBwmQs ciFrQ4GirfjvUP0VdkpsSLp+bbi61nkqGB4WHgX3gL+8LWxtpE8nFlh+8P+3TT9Z h4BuYQHhGF8JyhOFKhfWbWAFUoHLsR7Aa7TPOeQPXGfzWBaSfISA/UVo6N7QGpVw 4DP5rc4Wb+tzNAJHkkgzbSDzuM6L6BHrO3SQCisd0Viw9XYO9M0U9NVbExtu9x9l M/sqE61cX1AxUmjstdgca37vyHCntJ+wMT7WRnOBVJfodZDjB/6wzPz8rWIZrSX+ +uXSJF8Xpp5FuvB0td0CQoyUsnrMDnwWbjnMnlVXY6mPcgD5fgB9dTDJN3FEQ8t6 MixN3JBy1KseY9ihe9cINaR0CBKqyogOwbGrqqw3XJNWzpJ5xgxhLuSc2PyuDLwZ bDaj7K9Ukx4n0QzXWvW5pZTQi+yNVc7DUVOKFDXTf2xR2/KvEVNW25gL7oBxrTTu q5gw4bBkO0KsbgofTMWUyUfO3aYhDqc7H4yfRRbc/Q08hiJHORFC2jhLXG9oubNN QrZ4AxJvzRSYl5vwrVpHW9vnlPe5SuJvRbkMN8164togc9BMNbc= =qUmE -----END PGP SIGNATURE----- Merge 5.4.4 into android-5.4 Changes in 5.4.4 usb: gadget: configfs: Fix missing spin_lock_init() usb: gadget: pch_udc: fix use after free nvme: Namepace identification descriptor list is optional Revert "nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T" scsi: lpfc: Fix bad ndlp ptr in xri aborted handling scsi: zfcp: trace channel log even for FCP command responses scsi: qla2xxx: Do command completion on abort timeout scsi: qla2xxx: Fix driver unload hang scsi: qla2xxx: Fix double scsi_done for abort path scsi: qla2xxx: Fix memory leak when sending I/O fails compat_ioctl: add compat_ptr_ioctl() ceph: fix compat_ioctl for ceph_dir_operations media: venus: remove invalid compat_ioctl32 handler USB: uas: honor flag to avoid CAPACITY16 USB: uas: heed CAPACITY_HEURISTICS USB: documentation: flags on usb-storage versus UAS usb: Allow USB device to be warm reset in suspended state usb: host: xhci-tegra: Correct phy enable sequence binder: fix incorrect calculation for num_valid staging: exfat: fix multiple definition error of `rename_file' staging: rtl8188eu: fix interface sanity check staging: rtl8712: fix interface sanity check staging: vchiq: call unregister_chrdev_region() when driver registration fails staging: gigaset: fix general protection fault on probe staging: gigaset: fix illegal free on probe errors staging: gigaset: add endpoint-type sanity check usb: xhci: only set D3hot for pci device xhci: Fix memory leak in xhci_add_in_port() xhci: fix USB3 device initiated resume race with roothub autosuspend xhci: Increase STS_HALT timeout in xhci_suspend() xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour. xhci: make sure interrupts are restored to correct state interconnect: qcom: sdm845: Walk the list safely on node removal interconnect: qcom: qcs404: Walk the list safely on node removal usb: common: usb-conn-gpio: Don't log an error on probe deferral ARM: dts: pandora-common: define wl1251 as child node of mmc3 iio: adis16480: Add debugfs_reg_access entry iio: imu: st_lsm6dsx: fix ODR check in st_lsm6dsx_write_raw iio: adis16480: Fix scales factors iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting iio: imu: inv_mpu6050: fix temperature reporting using bad unit iio: adc: ad7606: fix reading unnecessary data from device iio: adc: ad7124: Enable internal reference USB: atm: ueagle-atm: add missing endpoint check USB: idmouse: fix interface sanity checks USB: serial: io_edgeport: fix epic endpoint lookup usb: roles: fix a potential use after free USB: adutux: fix interface sanity check usb: core: urb: fix URB structure initialization function usb: mon: Fix a deadlock in usbmon between mmap and read tpm: add check after commands attribs tab allocation tpm: Switch to platform_get_irq_optional() EDAC/altera: Use fast register IO for S10 IRQs brcmfmac: disable PCIe interrupts before bus reset mtd: spear_smi: Fix Write Burst mode mtd: rawnand: Change calculating of position page containing BBM virt_wifi: fix use-after-free in virt_wifi_newlink() virtio-balloon: fix managed page counts when migrating pages between zones usb: dwc3: pci: add ID for the Intel Comet Lake -H variant usb: dwc3: gadget: Fix logical condition usb: dwc3: gadget: Clear started flag for non-IOC usb: dwc3: ep0: Clear started flag on completion phy: renesas: rcar-gen3-usb2: Fix sysfs interface of "role" usb: typec: fix use after free in typec_register_port() iwlwifi: pcie: fix support for transmitting SKBs with fraglist btrfs: check page->mapping when loading free space cache btrfs: use btrfs_block_group_cache_done in update_block_group btrfs: use refcount_inc_not_zero in kill_all_nodes Btrfs: fix metadata space leak on fixup worker failure to set range as delalloc Btrfs: fix negative subv_writers counter and data space leak after buffered write btrfs: Avoid getting stuck during cyclic writebacks btrfs: Remove btrfs_bio::flags member Btrfs: send, skip backreference walking for extents with many references btrfs: record all roots for rename exchange on a subvol rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer rtlwifi: rtl8192de: Fix missing enable interrupt flag lib: raid6: fix awk build warnings ovl: fix lookup failure on multi lower squashfs ovl: fix corner case of non-unique st_dev;st_ino ovl: relax WARN_ON() on rename to self hwrng: omap - Fix RNG wait loop timeout dm writecache: handle REQ_FUA dm zoned: reduce overhead of backing device checks workqueue: Fix spurious sanity check failures in destroy_workqueue() workqueue: Fix pwq ref leak in rescuer_thread() ASoC: rt5645: Fixed buddy jack support. ASoC: rt5645: Fixed typo for buddy jack support. ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report ASoC: fsl_audmix: Add spin lock to protect tdms md: improve handling of bio with REQ_PREFLUSH in md_flush_request() blk-mq: avoid sysfs buffer overflow with too many CPU cores cgroup: pids: use atomic64_t for pids->limit wil6210: check len before memcpy() calls ar5523: check NULL before memcpy() in ar5523_cmd() s390/mm: properly clear _PAGE_NOEXEC bit when it is not supported media: hantro: Fix s_fmt for dynamic resolution changes media: hantro: Fix motion vectors usage condition media: hantro: Fix picture order count table enable media: vimc: sen: remove unused kthread_sen field media: bdisp: fix memleak on release media: radio: wl1273: fix interrupt masking on release media: cec.h: CEC_OP_REC_FLAG_ values were swapped cpuidle: Do not unset the driver if it is there already cpuidle: teo: Ignore disabled idle states that are too deep cpuidle: teo: Rename local variable in teo_select() cpuidle: teo: Consider hits and misses metrics of disabled states cpuidle: teo: Fix "early hits" handling for disabled idle states cpuidle: use first valid target residency as poll time erofs: zero out when listxattr is called with no xattr perf tests: Fix out of bounds memory access drm/panfrost: Open/close the perfcnt BO powerpc/perf: Disable trace_imc pmu intel_th: Fix a double put_device() in error path intel_th: pci: Add Ice Lake CPU support intel_th: pci: Add Tiger Lake CPU support PM / devfreq: Lock devfreq in trans_stat_show cpufreq: powernv: fix stack bloat and hard limit on number of CPUs ALSA: fireface: fix return value in error path of isochronous resources reservation ALSA: oxfw: fix return value in error path of isochronous resources reservation ALSA: hda/realtek - Line-out jack doesn't work on a Dell AIO ACPI / utils: Move acpi_dev_get_first_match_dev() under CONFIG_ACPI ACPI: LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links ACPI: LPSS: Add LNXVIDEO -> BYT I2C1 to lpss_device_links ACPI: LPSS: Add dmi quirk for skipping _DEP check for some device-links ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug bridge ACPI: OSL: only free map once in osl.c ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() ACPI: EC: Rework flushing of pending work ACPI: PM: Avoid attaching ACPI PM domain to certain devices pinctrl: rza2: Fix gpio name typos pinctrl: armada-37xx: Fix irq mask access in armada_37xx_irq_set_type() pinctrl: samsung: Add of_node_put() before return in error path pinctrl: samsung: Fix device node refcount leaks in Exynos wakeup controller init pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init pinctrl: samsung: Fix device node refcount leaks in init code pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init mmc: host: omap_hsmmc: add code for special init of wl1251 to get rid of pandora_wl1251_init_card ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity RDMA/core: Fix ib_dma_max_seg_size() ppdev: fix PPGETTIME/PPSETTIME ioctls stm class: Lose the protocol driver when dropping its reference coresight: Serialize enabling/disabling a link device. powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB powerpc/xive: Prevent page fault issues in the machine crash handler powerpc: Allow flush_icache_range to work across ranges >4GB powerpc/xive: Skip ioremap() of ESB pages for LSI interrupts video/hdmi: Fix AVI bar unpack quota: Check that quota is not dirty before release ext2: check err when partial != NULL seccomp: avoid overflow in implicit constant conversion quota: fix livelock in dquot_writeback_dquots ext4: Fix credit estimate for final inode freeing reiserfs: fix extended attributes on the root directory scsi: qla2xxx: Fix SRB leak on switch command timeout scsi: qla2xxx: Fix a dma_pool_free() call Revert "scsi: qla2xxx: Fix memory leak when sending I/O fails" iio: ad7949: kill pointless "readback"-handling code iio: ad7949: fix channels mixups omap: pdata-quirks: revert pandora specific gpiod additions omap: pdata-quirks: remove openpandora quirks for mmc3 and wl1251 powerpc: Avoid clang warnings around setjmp and longjmp powerpc: Fix vDSO clock_getres() mm, memfd: fix COW issue on MAP_PRIVATE and F_SEAL_FUTURE_WRITE mappings mfd: rk808: Fix RK818 ID template mm: memcg/slab: wait for !root kmem_cache refcnt killing on root kmem_cache destruction ext4: work around deleting a file with i_nlink == 0 safely firmware: qcom: scm: Ensure 'a0' status code is treated as signed s390/smp,vdso: fix ASCE handling s390/kaslr: store KASLR offset for early dumps mm/shmem.c: cast the type of unmap_start to u64 powerpc: Define arch_is_kernel_initmem_freed() for lockdep USB: dummy-hcd: increase max number of devices to 32 rtc: disable uie before setting time and enable after splice: only read in as much information as there is pipe buffer space ext4: fix a bug in ext4_wait_for_tail_page_commit ext4: fix leak of quota reservations blk-mq: make sure that line break can be printed workqueue: Fix missing kfree(rescuer) in destroy_workqueue() r8169: fix rtl_hw_jumbo_disable for RTL8168evl EDAC/ghes: Do not warn when incrementing refcount on 0 Linux 5.4.4 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8949a5fb2fbd836ce34907e70906e3aeb8a58b7c |
||
Tejun Heo
|
26ba4f73a0 |
workqueue: Fix missing kfree(rescuer) in destroy_workqueue()
commit 8efe1223d73c218ce7e8b2e0e9aadb974b582d7f upstream.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Qian Cai <cai@lca.pw>
Fixes: def98c84b6cd ("workqueue: Fix spurious sanity check failures in destroy_workqueue()")
Cc: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Aleksa Sarai
|
2539f282e4 |
cgroup: pids: use atomic64_t for pids->limit
commit a713af394cf382a30dd28a1015cbe572f1b9ca75 upstream.
Because pids->limit can be changed concurrently (but we don't want to
take a lock because it would be needlessly expensive), use atomic64_ts
instead.
Fixes: commit
|
||
|
Tejun Heo
|
470e77ea87 |
workqueue: Fix pwq ref leak in rescuer_thread()
commit e66b39af00f426b3356b96433d620cb3367ba1ff upstream.
|
||
|
Tejun Heo
|
20caa355f3 |
workqueue: Fix spurious sanity check failures in destroy_workqueue()
commit def98c84b6cdf2eeea19ec5736e90e316df5206b upstream. Before actually destrying a workqueue, destroy_workqueue() checks whether it's actually idle. If it isn't, it prints out a bunch of warning messages and leaves the workqueue dangling. It unfortunately has a couple issues. * Mayday list queueing increments pwq's refcnts which gets detected as busy and fails the sanity checks. However, because mayday list queueing is asynchronous, this condition can happen without any actual work items left in the workqueue. * Sanity check failure leaves the sysfs interface behind too which can lead to init failure of newer instances of the workqueue. This patch fixes the above two by * If a workqueue has a rescuer, disable and kill the rescuer before sanity checks. Disabling and killing is guaranteed to flush the existing mayday list. * Remove sysfs interface before sanity checks. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Marcin Pawlowski <mpawlowski@fb.com> Reported-by: "Williams, Gerald S" <gerald.s.williams@intel.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
7e59225e4e |
This is the 5.4.3 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl3zQekACgkQONu9yGCS aT4v0xAAi39hk/9NMVQkOVJEAw7KtrqaidZ21c8DIZKwEEdmh5cgVTKjuF+PggXR VrSPSMuvCK9Xp4p4ZUPNr6WFYATxfUINZFvRc5gh1c9XtHrxjlWX9oi4XQ4a3zWC 56Ak17gCt42eWcArHUslPQLFnq3XBDARs7qK8gv+6Vxt8w/3EaPkm4MKB8nGkdnK ItfkxGWnkKyUnwsE/01p1iR+LrbxnALXS+OM1izWBBA6ex2Zl6QDmmwZXXgKHOVt RAdO04t8k9jKrydo43DF/icUrYZuLbpIHaKIV6T0YH1Hco5qTZAz5+REmZelcEDH /vBNVxTVma5vAdYQsztEITv+qKNEkM2i+xoSoGierE8EPbRqo/ed3tDNdNxTmMcq zku+yztWm5VGicSbsGKRElwXt8+eyduIyEHyGKt5AON7n0NRDBmGl+HCnEU7Agoy XKJ+aDHjWK4AAYZL9osZ0MQ3QF55Dpaylijjnihc9VlMTVOTDY49MD8XSfoj0VFq pOdH7NWNDvh5eJfd+DQQHMtlMxN2dMppRlclh/ecXZ+2r6oKB/E11D9lzCguFZtQ HR1vDHl6HpnP08MXn++AZj0/hCx+zS/GzXJccGqjP5GWH10BAA+Kfig+ooo/t9We SJc8WcySU+0lmJN8yegcEintDyv/HkPQzJApRw3P0iL0t8oN8Ac= =8yzT -----END PGP SIGNATURE----- Merge 5.4.3 into android-5.4 Changes in 5.4.3 rsi: release skb if rsi_prepare_beacon fails arm64: tegra: Fix 'active-low' warning for Jetson TX1 regulator arm64: tegra: Fix 'active-low' warning for Jetson Xavier regulator perf scripts python: exported-sql-viewer.py: Fix use of TRUE with SQLite sparc64: implement ioremap_uc lp: fix sparc64 LPSETTIMEOUT ioctl time: Zero the upper 32-bits in __kernel_timespec on 32-bit mailbox: tegra: Fix superfluous IRQ error message staging/octeon: Use stubs for MIPS && !CAVIUM_OCTEON_SOC usb: gadget: u_serial: add missing port entry locking serial: 8250-mtk: Use platform_get_irq_optional() for optional irq tty: serial: fsl_lpuart: use the sg count from dma_map_sg tty: serial: msm_serial: Fix flow control serial: pl011: Fix DMA ->flush_buffer() serial: serial_core: Perform NULL checks for break_ctl ops serial: stm32: fix clearing interrupt error flags serial: 8250_dw: Avoid double error messaging when IRQ absent serial: ifx6x60: add missed pm_runtime_disable mwifiex: Re-work support for SDIO HW reset io_uring: fix dead-hung for non-iter fixed rw io_uring: transform send/recvmsg() -ERESTARTSYS to -EINTR fuse: fix leak of fuse_io_priv fuse: verify nlink fuse: verify write return fuse: verify attributes io_uring: fix missing kmap() declaration on powerpc io_uring: ensure req->submit is copied when req is deferred SUNRPC: Avoid RPC delays when exiting suspend ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 ALSA: hda/realtek - Fix inverted bass GPIO pin on Acer 8951G ALSA: pcm: oss: Avoid potential buffer overflows ALSA: hda - Add mute led support for HP ProBook 645 G4 ALSA: hda: Modify stream stripe mask only when needed soc: mediatek: cmdq: fixup wrong input order of write api Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers Input: goodix - add upside-down quirk for Teclast X89 tablet coresight: etm4x: Fix input validation for sysfs. Input: Fix memory leak in psxpad_spi_probe media: rc: mark input device as pointing stick x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all() x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks CIFS: Fix SMB2 oplock break processing tty: vt: keyboard: reject invalid keycodes can: slcan: Fix use-after-free Read in slcan_open nfsd: Ensure CLONE persists data and metadata changes to the target file nfsd: restore NFSv3 ACL support kernfs: fix ino wrap-around detection jbd2: Fix possible overflow in jbd2_log_space_left() drm/msm: fix memleak on release drm: damage_helper: Fix race checking plane->state->fb drm/i810: Prevent underflow in ioctl arm64: Validate tagged addresses in access_ok() called from kernel threads arm64: dts: exynos: Revert "Remove unneeded address space mapping for soc node" KVM: PPC: Book3S HV: XIVE: Free previous EQ page when setting up a new one KVM: PPC: Book3S HV: XIVE: Fix potential page leak on error path KVM: PPC: Book3S HV: XIVE: Set kvm->arch.xive when VPs are allocated KVM: nVMX: Always write vmcs02.GUEST_CR3 during nested VM-Enter KVM: arm/arm64: vgic: Don't rely on the wrong pending table KVM: x86: do not modify masked bits of shared MSRs KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES KVM: x86: Remove a spurious export of a static function KVM: x86: Grab KVM's srcu lock when setting nested state crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr crypto: atmel-aes - Fix IV handling when req->nbytes < ivsize crypto: af_alg - cast ki_complete ternary op to int crypto: geode-aes - switch to skcipher for cbc(aes) fallback crypto: ccp - fix uninitialized list head crypto: ecdh - fix big endian bug in ECC library crypto: user - fix memory leak in crypto_report crypto: user - fix memory leak in crypto_reportstat spi: spi-fsl-qspi: Clear TDH bits in FLSHCR register spi: stm32-qspi: Fix kernel oops when unbinding driver spi: atmel: Fix CS high support spi: Fix SPI_CS_HIGH setting when using native and GPIO CS spi: Fix NULL pointer when setting SPI_CS_HIGH for GPIO CS can: ucan: fix non-atomic allocation in completion handler RDMA/qib: Validate ->show()/store() callbacks before calling them rfkill: allocate static minor bdev: Factor out bdev revalidation into a common helper bdev: Refresh bdev size for disks without partitioning iomap: Fix pipe page leakage during splicing thermal: Fix deadlock in thermal thermal_zone_device_check vcs: prevent write access to vcsu devices Revert "serial/8250: Add support for NI-Serial PXI/PXIe+485 devices" binder: Fix race between mmap() and binder_alloc_print_pages() binder: Prevent repeated use of ->mmap() via NULL mapping binder: Handle start==NULL in binder_update_page_range() KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) ALSA: hda - Fix pending unsol events at shutdown cpufreq: imx-cpufreq-dt: Correct i.MX8MN's default speed grade value md/raid0: Fix an error message in raid0_make_request() drm/mcde: Fix an error handling path in 'mcde_probe()' watchdog: aspeed: Fix clock behaviour for ast2600 EDAC/ghes: Fix locking and memory barrier issues perf script: Fix invalid LBR/binary mismatch error kselftest: Fix NULL INSTALL_PATH for TARGETS runlist Linux 5.4.3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I4dabe2d29ae191e3c99ade22b1c385f68b5a77d4 |
||
Dmitry Safonov
|
05ee6e46a2 |
time: Zero the upper 32-bits in __kernel_timespec on 32-bit
commit 7b8474466ed97be458c825f34a85f2c2b84c3f95 upstream.
On compat interfaces, the high order bits of nanoseconds should be zeroed
out. This is because the application code or the libc do not guarantee
zeroing of these. If used without zeroing, kernel might be at risk of using
timespec values incorrectly.
Originally it was handled correctly, but lost during is_compat_syscall()
cleanup. Revert the condition back to check CONFIG_64BIT.
Fixes:
|
||
|
Greg Kroah-Hartman
|
c32aefc014 |
This is the 5.4.1 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl3g4IgACgkQONu9yGCS aT67PhAAm6Ee49V6f6imspR7PUZHuO85Sd54eegpOQ9VYDvNn89EylEoLIv0Vcfg eIVk8M6L0YxIlQraezP/7+XyHtv40url/ccseqD3o1ialftL1/RbcSL6MST5IdFY KWRq6TT84rihsUg6/Ev5NnDJIu8khgVJWO7voTlz+7nHr+RnhQoDNlQX4So28Gnd db2i+kxYN/wXXGn2R5ZkV2ny43bzXBBrO7NWHihnWNbkXDeF+ixHEURkM2wJCPNS r+rOlEeUuBOM/YgyvNtHLDnVHfIbJzU62EVq6XAffMqQ2/wA4nfpT1qEpMpK7df9 LdLC2fWmC/Tplc4DSAVtkTbyRTgvj0QGZkg6UNH2Z3gOEiPCnsQY5oE2VcQ3FkZM x0YeDvZ4JUm1w+KikhFZw2dUWWjb4nxzj6p2PHgWA6nOU9JrdIVJeONp+Em7mpSx DcYfJeMzOG70s7Vv93JGgFai5R0300DByA4/xh/mlWD/1SeMfF5HTx6O/J9k19VK R7UhoUD+AHTqDAU1VkrXY2la5esNBZKCnTCgDBaXf7FUiddPcWCgvHrSJy1B00YS l19eQ9u+ip6ONmK5gEg+dMfkyf6A3RY2VGrBvQ7Ba63IaZY54DFcTPvwMYbexa9c 2joWXl4hPRMInqLWvYbYtrT+utuydSDRl2Y0ZxNjHjg8pL57ttE= =Mvcj -----END PGP SIGNATURE----- Merge 5.4.1 into android-5.4 Changes in 5.4.1 Bluetooth: Fix invalid-free in bcsp_close() ath9k_hw: fix uninitialized variable data ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe ath10k: Fix HOST capability QMI incompatibility ath10k: restore QCA9880-AR1A (v1) detection Revert "Bluetooth: hci_ll: set operational frequency earlier" Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues" md/raid10: prevent access of uninitialized resync_pages offset x86/insn: Fix awk regexp warnings x86/speculation: Fix incorrect MDS/TAA mitigation status x86/speculation: Fix redundant MDS mitigation message nbd: prevent memory leak x86/stackframe/32: Repair 32-bit Xen PV x86/xen/32: Make xen_iret_crit_fixup() independent of frame layout x86/xen/32: Simplify ring check in xen_iret_crit_fixup() x86/doublefault/32: Fix stack canaries in the double fault handler x86/pti/32: Size initial_page_table correctly x86/cpu_entry_area: Add guard page for entry stack on 32bit x86/entry/32: Fix IRET exception x86/entry/32: Use %ss segment where required x86/entry/32: Move FIXUP_FRAME after pushing %fs in SAVE_ALL x86/entry/32: Unwind the ESPFIX stack earlier on exception entry x86/entry/32: Fix NMI vs ESPFIX selftests/x86/mov_ss_trap: Fix the SYSENTER test selftests/x86/sigreturn/32: Invalidate DS and ES when abusing the kernel x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise x86/entry/32: Fix FIXUP_ESPFIX_STACK with user CR3 futex: Prevent robust futex exit race ALSA: usb-audio: Fix NULL dereference at parsing BADD ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port data media: vivid: Set vid_cap_streaming and vid_out_streaming to true media: vivid: Fix wrong locking that causes race conditions on streaming stop media: usbvision: Fix invalid accesses after device disconnect media: usbvision: Fix races among open, close, and disconnect cpufreq: Add NULL checks to show() and store() methods of cpufreq futex: Move futex exit handling into futex code futex: Replace PF_EXITPIDONE with a state exit/exec: Seperate mm_release() futex: Split futex_mm_release() for exit/exec futex: Set task::futex_state to DEAD right after handling futex exit futex: Mark the begin of futex exit explicitly futex: Sanitize exit state handling futex: Provide state handling for exec() as well futex: Add mutex around futex exit futex: Provide distinct return value when owner is exiting futex: Prevent exit livelock media: uvcvideo: Fix error path in control parsing failure media: b2c2-flexcop-usb: add sanity checking media: cxusb: detect cxusb_ctrl_msg error in query media: imon: invalid dereference in imon_touch_event media: mceusb: fix out of bounds read in MCE receiver buffer ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs USBIP: add config dependency for SGL_ALLOC usbip: tools: fix fd leakage in the function of read_attr_usbip_status usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit() usb-serial: cp201x: support Mark-10 digital force gauge USB: chaoskey: fix error case of a timeout appledisplay: fix error handling in the scheduled work USB: serial: mos7840: add USB ID to support Moxa UPort 2210 USB: serial: mos7720: fix remote wakeup USB: serial: mos7840: fix remote wakeup USB: serial: option: add support for DW5821e with eSIM support USB: serial: option: add support for Foxconn T77W968 LTE modules staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error powerpc/book3s64: Fix link stack flush on context switch KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel Linux 5.4.1 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Id50109953b5638956d150e4fc648a94b6e347fb5 |