During checkpoint=disable period, f2fs bypasses all the synchronous IOs such as
sync and fsync. So, when enabling it back, we must flush all of them in order
to keep the data persistent. Otherwise, suddern power-cut right after enabling
checkpoint will cause data loss.
Bug: 171063590
Fixes: 4354994f09 ("f2fs: checkpoint disabling")
Cc: stable@vger.kernel.org
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 8d52dbb373579b48f5758dd0cdd2ac0fb4e5be7f git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev)
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
Change-Id: Iaca2d6fc1841fffa8677d5d592732c94241fb3fb
commit c61404153eb6 upstream.
Once we release compressed blocks, we used to set IMMUTABLE bit. But it turned
out it disallows every fs operations which we don't need for compression.
Let's just prevent writing data only.
Bug: 237904436
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Change-Id: I3f91a67da56fe26e39a776a5bc595aa809dc804b
commit e0fcd01510ad upstream.
This patch ports commit 02b016ca7f ("ext4: enforce the immutable
flag on open files") to f2fs.
According to the chattr man page, "a file with the 'i' attribute
cannot be modified..." Historically, this was only enforced when the
file was opened, per the rest of the description, "... and the file
can not be opened in write mode".
There is general agreement that we should standardize all file systems
to prevent modifications even for files that were opened at the time
the immutable flag is set. Eventually, a change to enforce this at
the VFS layer should be landing in mainline.
Bug: 237904436
Cc: stable@kernel.org
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Change-Id: I9c74498ed3174309ff14158c8c3ad6dee6e1c8ca
commit c2759ebaf7e8 upstream.
writepages() can be concurrently invoked for the same file by different
threads such as a thread fsyncing the file and a kworker kernel thread.
So, changing i_compr_blocks without protection is racy and we need to
protect it by changing it with atomic type value. Plus, we don't need
a 64bit value for i_compr_blocks, so just we will use a atomic value,
not atomic64.
Bug: 237904436
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Change-Id: I11f837249078d1b7ef50ac9c156c375542c714b3
commit 567c4bf54a85 upstream.
When we use F2FS_IOC_RELEASE_COMPRESS_BLOCKS ioctl, if we can't find
any compressed blocks in the file even with large file size, the
ioctl just ends up without changing the file's status as immutable.
It makes the user, who expects that the file is immutable when it
returns successfully, confused.
Bug: 237904436
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Change-Id: I2c96428442e69b69c7064096d2e1ce8e2b99cc09
commit 8f1d49832636 upstream.
We will reserve iblocks for compression saved, so during compressed
cluster overwrite, we don't need to preallocate blocks for later
write.
In addition, it adds a bug_on to detect wrong reserved iblock number
in __f2fs_cluster_blocks().
Bug fix in the original patch by Jaegeuk:
If we released compressed blocks having an immutable bit, we can see less
number of compressed block addresses. Let's fix wrong BUG_ON.
Bug: 237904436
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Change-Id: I673af616581a9e7bf711e60d1588856f24f65dc9
When calling binder_do_set_priority() with the same policy and priority
values as the current task, we exit early since there is nothing to do.
However, the BINDER_PRIO_PENDING state might be set and in this case we
fail to update it. A subsequent call to binder_transaction_priority()
will then read an incorrect state and save the wrong priority. Fix this
by setting thread->prio_state to BINDER_PRIO_SET on our way out.
Bug: 199309216
Fixes: cac827f2619b ("ANDROID: binder: fix race in priority restore")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: I21e906cf4b2ebee908af41fe101ecd458ae1991c
(cherry picked from commit 72193be6d4bd9ad29dacd998c14dff97f7a6c6c9)
During a reply, the target gets woken up and then the priority of the
replier is restored. The order is such to allow the target to process
the reply ASAP. Otherwise, we risk the sender getting scheduled out
before the wakeup happens. This strategy reduces transaction latency.
However, a subsequent transaction from the same target could be started
before the priority of the replier gets restored. At this point we save
the wrong priority and it gets reinstated at the end of the transaction.
This patch allows the incoming transaction to detect the race condition
and save the correct next priority. Additionally, the replier will abort
its pending priority restore which allows the new transaction to always
run at the desired priority.
Bug: 148101660
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: I6fec41ae1a1342023f78212ab1f984e26f068221
(cherry picked from commit cac827f2619b280d418e546a09f25da600dafe5a)
[cmllamas: fixed trivial merge conflict]
Refactor binder priority functions to take in 'struct binder_thread *'
instead of just 'struct task_struct *'. This allows access to other
thread fields used in subsequent patches. In any case, the same task
reference is still available under thread->task.
There is no functional impact from this patch.
Bug: 148101660
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: I67b599884580d957d776500e467827e5035c99f6
(cherry picked from commit 759d98484b5b51932d3d11651fa83c6bb268ce03)
Avoid making unnecessary stack copies of struct binder_priority and pass
the argument by reference instead. Rename 'desired_prio' to 'desired' to
match the usage in other priority functions.
There is no functional impact from this patch.
Bug: 148101660
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: I66ff5305296e7b9dba56ed265236f2af518f66e0
(cherry picked from commit 52d85f8a16467ce0bca374f885de24918f017371)
[cmllamas: fixed minor merge conflict]
The setup of node_prio is always the same, so just fold this logic into
binder_transaction_priority() to avoid duplication. Let's pass the node
reference instead, which also gives access to node->inherit_rt.
There is no functional impact from this patch.
Bug: 148101660
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: Ib390204556e69c4bc8492cd9cd873773f9cdce42
(cherry picked from commit 498bf715b77c68e54d0289fa66e3f112278f87dc)
[cmllamas: fixed minor merge conflicts]
commit d0be8347c623e0ac4202a1d4e0373882821f56b0 upstream.
This fixes the following trace which is caused by hci_rx_work starting up
*after* the final channel reference has been put() during sock_close() but
*before* the references to the channel have been destroyed, so instead
the code now rely on kref_get_unless_zero/l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.
refcount_t: increment on 0; use-after-free.
BUG: KASAN: use-after-free in refcount_dec_and_test+0x20/0xd0
Read of size 4 at addr ffffffc114f5bf18 by task kworker/u17:14/705
CPU: 4 PID: 705 Comm: kworker/u17:14 Tainted: G S W
4.14.234-00003-g1fb6d0bd49a4-dirty #28
Hardware name: Qualcomm Technologies, Inc. SM8150 V2 PM8150
Google Inc. MSM sm8150 Flame DVT (DT)
Workqueue: hci0 hci_rx_work
Call trace:
dump_backtrace+0x0/0x378
show_stack+0x20/0x2c
dump_stack+0x124/0x148
print_address_description+0x80/0x2e8
__kasan_report+0x168/0x188
kasan_report+0x10/0x18
__asan_load4+0x84/0x8c
refcount_dec_and_test+0x20/0xd0
l2cap_chan_put+0x48/0x12c
l2cap_recv_frame+0x4770/0x6550
l2cap_recv_acldata+0x44c/0x7a4
hci_acldata_packet+0x100/0x188
hci_rx_work+0x178/0x23c
process_one_work+0x35c/0x95c
worker_thread+0x4cc/0x960
kthread+0x1a8/0x1c4
ret_from_fork+0x10/0x18
Bug: 165329981
Cc: stable@kernel.org
Reported-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Tested-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I6efae55d8014740aebc8c3534846c2d249068b29
A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the
reference for a node. In this case, the target proc normally releases
the failed reference upon close as expected. However, if the target is
dying in parallel the call will race with binder_deferred_release(), so
the target could have released all of its references by now leaving the
cleanup of the new failed reference unhandled.
The transaction then ends and the target proc gets released making the
ref->proc now a dangling pointer. Later on, ref->node is closed and we
attempt to take spin_lock(&ref->proc->inner_lock), which leads to the
use-after-free bug reported below. Let's fix this by cleaning up the
failed reference on the spot instead of relying on the target to do so.
==================================================================
BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150
Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590
CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10
Hardware name: linux,dummy-virt (DT)
Workqueue: events binder_deferred_func
Call trace:
dump_backtrace.part.0+0x1d0/0x1e0
show_stack+0x18/0x70
dump_stack_lvl+0x68/0x84
print_report+0x2e4/0x61c
kasan_report+0xa4/0x110
kasan_check_range+0xfc/0x1a4
__kasan_check_write+0x3c/0x50
_raw_spin_lock+0xa8/0x150
binder_deferred_func+0x5e0/0x9b0
process_one_work+0x38c/0x5f0
worker_thread+0x9c/0x694
kthread+0x188/0x190
ret_from_fork+0x10/0x20
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Bug: 239630375
Link: https://lore.kernel.org/all/20220801182511.3371447-1-cmllamas@google.com/
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: I5085dd0dc805a780a64c057e5819f82dd8f02868
(cherry picked from commit ae3fa5d16a02ba7c7b170e0e1ab56d6f0ba33964)
[ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ]
This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7.
A non-zero return value from pfkey_broadcast() does not necessarily mean
an error occurred as this function returns -ESRCH when no registered
listener received the message. In particular, a call with
BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return
zero so that this commit in fact prevents processing any PF_KEY message.
One visible effect is that racoon daemon fails to find encryption
algorithms like aes and refuses to start.
Excluding -ESRCH return value would fix this but it's not obvious that
we really want to bail out here and most other callers of
pfkey_broadcast() also ignore the return value. Also, as pointed out by
Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code
should use netlink instead so that we should only disturb the code for
really important fixes.
v2: add a comment explaining why is the return value ignored
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 7df12bee54)
Bug: 235429059
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ica140cb11cd174eded4121d66de6a7239ee4a21d
This is the merge of the upstream LTS release of 5.4.197 into the
android11-5.4 branch.
It contains the following commits:
9eae8fc396 Merge 5.4.197 into android11-5.4-lts
35c6471fd2 Linux 5.4.197
e00c2f22fb bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
a2235bc65a NFSD: Fix possible sleep during nfsd4_release_lockowner()
f5b6bc69a7 NFS: Memory allocation failures are not server fatal errors
0490cd2aee docs: submitting-patches: Fix crossref to 'The canonical patch format'
72ef5d01fe tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
7ecd237e50 tpm: Fix buffer access in tpm2_get_tpm_pt()
396d1f5176 HID: multitouch: Add support for Google Whiskers Touchpad
25f0e9459f raid5: introduce MD_BROKEN
fd2f7e9984 dm verity: set DM_TARGET_IMMUTABLE feature flag
f005973502 dm stats: add cond_resched when looping over entries
65e6282f0d dm crypt: make printing of the key constant-time
a4415f39e3 dm integrity: fix error code in dm_integrity_ctr()
fc658c0839 zsmalloc: fix races between asynchronous zspage free and page migration
7632451ad9 crypto: ecrdsa - Fix incorrect use of vli_cmp
b16bb37398 netfilter: conntrack: re-fetch conntrack after insertion
1fe82bfd9e exec: Force single empty string when argv is empty
241b566e04 drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
3dbab9e37c cfg80211: set custom regdomain after wiphy registration
039fa25d95 assoc_array: Fix BUG_ON during garbage collect
8c668da61b drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers
fdcbdb3d08 i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
827980029d net: ftgmac100: Disable hardware checksum on AST2600
e619506ed0 net: af_key: check encryption module availability consistency
fa77d2a3a7 pinctrl: sunxi: fix f1c100s uart2 function
2208c31d86 ACPI: sysfs: Fix BERT error region memory mapping
92d4b5e148 ACPI: sysfs: Make sparse happy about address space in use
5a73bd4f47 media: vim2m: initialize the media device earlier
b7248281af media: vim2m: Register video device after setting up internals
ab5b00cfe0 secure_seq: use the 64 bits of the siphash for port offset calculation
80cca53a48 tcp: change source port randomizarion at connect() time
9ce35dad5a Input: goodix - fix spurious key release events
bdbc7ef3eb staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
4f07508394 x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
8bb828229d lockdown: also lock down previous kgdb use
0cf7a2be06 Merge 5.4.196 into android11-5.4-lts
04b092e4a0 Linux 5.4.196
dba1941f5b afs: Fix afs_getattr() to refetch file status if callback break occurred
ef5374d532 i2c: mt7621: fix missing clk_disable_unprepare() on error in mtk_i2c_probe()
10a221e2d3 x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
a12884ff43 x86/xen: fix booting 32-bit pv guest
b2f140a9f9 Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
060f38b1df ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk
b38cf3cb17 firmware_loader: use kernel credentials when reading firmware
e14e3856e9 net: stmmac: disable Split Header (SPH) for Intel platforms
9ea8e6a832 block: return ELEVATOR_DISCARD_MERGE if possible
36ac6caf74 Input: ili210x - fix reset timing
1c450bdf2e net: atlantic: verify hw_head_ lies within TX buffer ring
e5307704c4 net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe()
91d8d7edf1 ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one()
dd5de66f5c selftests: add ping test with ping_group_range tuned
9919585e5f mac80211: fix rx reordering with non explicit / psmp ack policy
19e2cd737c scsi: qla2xxx: Fix missed DMA unmap for aborted commands
74168c2207 perf bench numa: Address compiler error on s390
d1915d9c9f gpio: mvebu/pwm: Refuse requests with inverted polarity
3fdd67e83c gpio: gpio-vf610: do not touch other bits when set the target bit
1fe6dc5f5d net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.
622be11fa3 igb: skip phy status check where unavailable
eb92a8ecce ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
463a7b957d ARM: 9196/1: spectre-bhb: enable for Cortex-A15
1b93631c77 net: af_key: add check for pfkey_broadcast in function pfkey_process
c0be5fec78 net/mlx5e: Properly block LRO when XDP is enabled
3277789f33 NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc
b368e07fb4 net/qla3xxx: Fix a test in ql_reset_work()
d672eee9e4 clk: at91: generated: consider range when calculating best rate
8cb1a05fe3 ice: fix possible under reporting of ethtool Tx and Rx statistics
dc64e8874e net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
32f779e6fb net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
1eb2d78581 net/sched: act_pedit: sanitize shift argument before usage
50f70ee302 net: macb: Increment rx bd head after allocating skb and buffer
a42ffe8833 ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group
6493ff94c0 ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi
fe2a9469ec dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace
8cf6c24ed4 drm/dp/mst: fix a possible memory leak in fetch_monitor_name()
8be06f62b4 crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
f4a093215b KVM: x86/mmu: Update number of zapped pages even if page list is stable
de87451827 PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold
3a12b2c413 Fix double fget() in vhost_net_set_backend()
dd0ea88b0a perf: Fix sys_perf_event_open() race against self
c8a5e14cb4 ALSA: wavefront: Proper check of get_user() error
2f8f6c393b SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
975a0f14d5 SUNRPC: Don't call connect() more than once on a TCP socket
aa4d71edd6 SUNRPC: Prevent immediate close+reconnect
2d6f096476 SUNRPC: Clean up scheduling of autoclose
f3fe8d13ac mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch()
def047ae12 mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD
f10260f359 mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC
1e93f93992 nilfs2: fix lockdep warnings during disk space reclamation
307d021b1a nilfs2: fix lockdep warnings in page operations for btree nodes
77b71a4c87 ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame()
54f7358be1 platform/chrome: cros_ec_debugfs: detach log reader wq from devm
232128f6e6 drbd: remove usage of list iterator variable after loop
83abb076f4 MIPS: lantiq: check the return value of kzalloc()
e7947c031f rtc: mc146818-lib: Fix the AltCentury for AMD platforms
7be785032c nvme-multipath: fix hang when disk goes live over reconnect
ee0323cc8b ALSA: hda/realtek: Enable headset mic on Lenovo P360
c0d86f2a3c crypto: x86/chacha20 - Avoid spurious jumps to other functions
f021389433 crypto: stm32 - fix reference leak in stm32_crc_remove
8c015cd524 Input: stmfts - fix reference leak in stmfts_input_open
bb83a744bc Input: add bounds checking to input_set_capability()
4fd3966956 um: Cleanup syscall_handler_t definition/cast, fix warning
0c319b9988 rtc: fix use-after-free on device removal
05df3bdbc2 x86/xen: Make the secondary CPU idle tasks reliable
0d3817cb4e x86/xen: Make the boot CPU idle task reliable
67e2b62461 floppy: use a statically allocated error counter
abcfb6abb7 Merge 5.4.195 into android11-5.4-lts
e44bd11b47 Merge 5.4.194 into android11-5.4-lts
c336f131c4 ANDROID: fix up abi issue with struct snd_pcm_runtime
0187300e6a Linux 5.4.195
8fcefb43ec tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
6d80857c4f ping: fix address binding wrt vrf
7845532adb arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
c0b735fef2 net: phy: Fix race condition on link status change
a60def7568 MIPS: fix build with gcc-12
a3112d5da1 drm/vmwgfx: Initialize drm_mode_fb_cmd2
463c743149 cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
f25145c37c i40e: i40e_main: fix a missing check on list iterator
17c744716a drm/nouveau/tegra: Stop using iommu_present()
c8f567c465 serial: 8250_mtk: Fix register address for XON/XOFF character
aa3ea7451b serial: 8250_mtk: Fix UART_EFR register address
031fda28d0 slimbus: qcom: Fix IRQ check in qcom_slim_probe
7de6f30596 USB: serial: option: add Fibocom MA510 modem
65732f62f7 USB: serial: option: add Fibocom L610 modem
6c78537f3e USB: serial: qcserial: add support for Sierra Wireless EM7590
e40d004947 USB: serial: pl2303: add device id for HP LM930 Display
056a56f8fb usb: typec: tcpci: Don't skip cleanup in .remove() on error
457d9401b8 usb: cdc-wdm: fix reading stuck on device close
4d93303fd8 tty: n_gsm: fix mux activation issues in gsm_config()
6e34ee5b5b tcp: resalt the secret every 10 seconds
39c26fe93c net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
638bfbc84c s390: disable -Warray-bounds
f66d3fa508 ASoC: ops: Validate input values in snd_soc_put_volsw_range()
13b850a6cc ASoC: max98090: Generate notifications on changes for custom control
5c766c000a ASoC: max98090: Reject invalid values in custom control put()
22f6c68b49 hwmon: (f71882fg) Fix negative temperature
208200e573 gfs2: Fix filesystem block deallocation for short writes
42daae7d84 net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
e038c457bd net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
2ec2dd7d51 net/sched: act_pedit: really ensure the skb is writable
48c6a40e2f s390/lcs: fix variable dereferenced before check
467ddbbe7e s390/ctcm: fix potential memory leak
2cbce01100 s390/ctcm: fix variable dereferenced before check
1c40e85d0a hwmon: (ltq-cputemp) restrict it to SOC_XWAY
0a778db931 dim: initialize all struct fields
522986cc39 mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
0729594cb7 netlink: do not reset transport header in netlink_recvmsg()
33ce32587c drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
5809a1c530 ipv4: drop dst in multicast routing path
c9d75e87f4 net: Fix features skip in for_each_netdev_feature()
5c90576705 mac80211: Reset MBSSID parameters upon connection
cfe74fd41f hwmon: (tmp401) Add OF device ID table
3915341a93 batman-adv: Don't skb_split skbuffs with frag_list
00c4652b41 Merge 5.4.193 into android11-5.4-lts
9065948757 Linux 5.4.194
2f4e0bf651 mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic()
e4db0c3ce0 mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
ea9cad1c5d mm: fix missing cache flush for all tail pages of compound page
45c05171d6 Bluetooth: Fix the creation of hdev->name
f52c4c067a KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id
c1bdf1e6e7 x86: kprobes: Prohibit probing on instruction which has emulate prefix
6af6427a96 x86: xen: insn: Decode Xen and KVM emulate-prefix signature
c67a4a91f5 x86: xen: kvm: Gather the definition of emulate prefixes
4c39e1ace3 x86/asm: Allow to pass macros to __ASM_FORM()
29afcd5af0 KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
ea65a7d76c arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
5755f946a8 can: grcan: only use the NAPI poll budget for RX
caba5c13a8 can: grcan: grcan_probe(): fix broken system id check for errata workaround needs
76b64c690f nfp: bpf: silence bitwise vs. logical OR warning
86ccefb83e drm/i915: Cast remain to unsigned long in eb_relocate_vma
de542bd765 drm/amd/display/dc/gpio/gpio_service: Pass around correct dce_{version, environment} types
e6ff94d31c block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
f668da98ad MIPS: Use address-of operator on section symbols
44a1f2e6dc ANDROID: GKI: update the abi .xml file
52509afded Revert "tcp: ensure to use the most recently sent skb when filling the rate sample"
01565c91b7 Linux 5.4.193
8a7f92053d mmc: rtsx: add 74 Clocks in power on flow
d789b98917 PCI: aardvark: Fix reading MSI interrupt number
253bc43ca5 PCI: aardvark: Clear all MSIs at setup
786dc86c84 dm: interlock pending dm_io and dm_wait_for_bios_completion
ad1393b92e dm: fix mempool NULL pointer race when completing IO
40bcd39a00 tcp: make sure treq->af_specific is initialized
9661bf674d ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
37b12c16be ALSA: pcm: Fix races among concurrent prealloc proc writes
2a559eec81 ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
08d1807f09 ALSA: pcm: Fix races among concurrent read/write and buffer changes
fbeb492694 ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
f098f8b982 mm: fix unexpected zeroed page mapping with zram swap
c7337efd1d block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
9588ac2edd net: ipv6: ensure we call ipv6_mc_down() at most once
367b49086b KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised
c2fadf2d0a x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
8b78939f4b kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
f455c8e657 NFSv4: Don't invalidate inode attributes on delegation return
89e7a625ec drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu
1d14c1c7a3 net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
2b99ff4c3e btrfs: always log symlinks in full mode
dc47844894 smsc911x: allow using IRQ0
cff6cb162f bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
64ece01adb selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational
52401926c8 net: emaclite: Add error handling for of_address_to_resource()
354cac1e39 net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux()
0510b6ccfb net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init()
102986592f RDMA/siw: Fix a condition race issue in MPA request processing
e6ae21eb94 ASoC: dmaengine: Restore NULL prepare_slave_config() callback
df3ea6cc1a hwmon: (adt7470) Fix warning on module removal
01d4363dd7 NFC: netlink: fix sleep in atomic bug when firmware download timeout
33d3e76fc7 nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
85aecdef77 nfc: replace improper check device_is_registered() in netlink related functions
da9eb43b9a can: grcan: use ofdev->dev when allocating DMA memory
8b451b7d7e can: grcan: grcan_close(): fix deadlock
8f4246450a s390/dasd: Fix read inconsistency for ESE DASD devices
91193a2c2f s390/dasd: Fix read for ESE with blksize < 4k
1aa75808ed s390/dasd: prevent double format of tracks for ESE devices
061a424dd1 s390/dasd: fix data corruption for ESE devices
860db6cdc5 ASoC: meson: Fix event generation for G12A tohdmi mux
d4864e8c4b ASoC: wm8958: Fix change notifications for DSP controls
6723ab2ed8 ASoC: da7219: Fix change notifications for tone generator frequency
ac5894fb86 genirq: Synchronize interrupt thread startup
8624e2c5af ACPICA: Always create namespace nodes using acpi_ns_create_node()
27183539cf firewire: core: extend card->lock in fw_core_handle_bus_reset
2fefc62598 firewire: remove check of list iterator against head past the loop body
34b9b91829 firewire: fix potential uaf in outbound_phy_packet_callback()
f6b6e93369 Revert "SUNRPC: attempt AF_LOCAL connect on setup"
d403ff32e5 gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
94842485b4 ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
73ce49fa59 parisc: Merge model and model name into one line in /proc/cpuinfo
0d5bb59858 MIPS: Fix CP0 counter erratum detection for R4k CPUs
aa172204d5 Merge 5.4.192 into android11-5.4-lts
1d72b776f6 Linux 5.4.192
aa2a047b58 mm, hugetlb: allow for "high" userspace addresses
6a79b2433e hugetlbfs: get unmapped area below TASK_UNMAPPED_BASE for hugetlbfs
b69e60f6fc tty: n_gsm: fix incorrect UA handling
0f4be29feb tty: n_gsm: fix wrong command frame length field encoding
21cc640385 tty: n_gsm: fix wrong command retry handling
49c40febd4 tty: n_gsm: fix missing explicit ldisc flush
85522dcf00 tty: n_gsm: fix insufficient txframe size
563bb0f794 netfilter: nft_socket: only do sk lookups when indev is available
fae2095210 tty: n_gsm: fix malformed counter for out of frame data
cec2d0782a tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
a6d9847a4f x86/cpu: Load microcode during restore_processor_state()
9e9d12b81d net: ethernet: stmmac: fix write to sgmii_adapter_base
10ba1ac9a2 drivers: net: hippi: Fix deadlock in rr_close()
a827521975 cifs: destage any unwritten data to the server before calling copychunk_write
5335370366 x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
0ecc5304e8 ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit()
7815710349 ASoC: wm8731: Disable the regulator when probing fails
a71df406a6 tcp: fix F-RTO may not work correctly when receiving DSACK
a4ed61e30e ixgbe: ensure IPsec VF<->PF compatibility
406aaef0fe bnx2x: fix napi API usage sequence
c3e7ea5860 tls: Skip tls_append_frag on zero copy size
cd5cec3a0c drm/amd/display: Fix memory leak in dcn21_clock_source_create
ffce11a391 net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK
3a179538bf net: bcmgenet: hide status block before TX timestamping
8ef6d60aa2 clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource()
194f474ad9 bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
e80054ea0c tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
685ff7d244 ip_gre: Make o_seqno start from 0 in native mode
69555bb27b net/smc: sync err code when tcp connection was refused
daca23846e net: hns3: add validity check for message data length
7763a79566 cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe
f5bb5940d7 pinctrl: pistachio: fix use of irq_of_parse_and_map()
d22fc60369 arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock
68f5200a1f ARM: dts: imx6ull-colibri: fix vqmmc regulator
c45180375a sctp: check asoc strreset_chunk in sctp_generate_reconf_event
2cba635570 tcp: ensure to use the most recently sent skb when filling the rate sample
3ea6190be9 tcp: md5: incorrect tcp_header_len for incoming connections
2b9a13d98d bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook
2e7f70d324 mtd: rawnand: Fix return value check of wait_for_completion_timeout
2a36ba067b ipvs: correctly print the memory size of ip_vs_conn_tab
abe86a10dc ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35
54212850e3 ARM: dts: am3517-evm: Fix misc pinmuxing
bba67fe6b0 ARM: dts: Fix mmc order for omap3-gta04
416e0f8907 phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe
6ff7c1b827 phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe
59bdaed5dd ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek
dbce8fc16a phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks
b7fc45354b ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
dd99939b70 phy: samsung: exynos5250-sata: fix missing device put in probe error paths
6331b77fdc phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
fccbc3168e ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue
b8f0c19d48 USB: Fix xhci event ring dequeue pointer ERDP update issue
1f47c26257 mtd: rawnand: fix ecc parameters for mt7622
0405bd7f18 arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards
5f80b5c5f4 arm64: dts: meson: remove CPU opps below 1GHz for G12B boards
f6db63819d video: fbdev: udlfb: properly check endpoint type
c00f3892f4 hex2bin: fix access beyond string end
15b78a8e38 hex2bin: make the function hex_to_bin constant-time
73f4668ee8 arch_topology: Do not set llc_sibling if llc_id is invalid
a3cdd33ca1 serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
89a5728b05 serial: 8250: Also set sticky MCR bits in console restoration
42f749f223 serial: imx: fix overrun interrupts in DMA mode
d29c197df7 usb: dwc3: gadget: Return proper request status
0f3d081315 usb: dwc3: core: Fix tx/rx threshold settings
e2ec7b1f6a usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
debb276670 usb: gadget: uvc: Fix crash when encoding data for usb request
324e67c3b2 usb: typec: ucsi: Fix role swapping
0366beb402 usb: misc: fix improper handling of refcount in uss720_probe()
2c97a2b5ef iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
e82c726c94 iio: dac: ad5446: Fix read_raw not returning set value
1aea30f87c iio: dac: ad5592r: Fix the missing return value.
1e8716a5c0 xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms
b8d3a4681f xhci: stop polling roothubs after shutdown
c8fbc2f875 USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
68088dec9b USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
56cbdb9d95 USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
6b10dd966c USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
890fc65448 USB: quirks: add STRING quirk for VCOM device
c4b31d41f5 USB: quirks: add a Realtek card reader
5666334ce3 usb: mtu3: fix USB 3.0 dual-role-switch from device to host
b258964700 lightnvm: disable the subsystem
c9af90f0c6 hamradio: remove needs_free_netdev to avoid UAF
7361a35bf3 hamradio: defer 6pack kfree after unregister_netdev
7dea591300 floppy: disable FDRAWCMD by default
Update the .xml file with the following needed changes that came in from
the -lts branch to handle ABI issues with LTS security fixes:
Leaf changes summary: 2 artifacts changed
Changed leaf types summary: 1 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 1 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
1 function with some sub-type change:
[C] 'function int hex_to_bin(char)' at hexdump.c:52:1 has some sub-type changes:
parameter 1 of type 'char' changed:
type name changed from 'char' to 'unsigned char'
type size hasn't changed
'struct snd_pcm_runtime at pcm.h:342:1' changed:
type size changed from 6336 to 6400 (in bits)
1 data member insertion:
'atomic_t buffer_accessing', at offset 6336 (in bits) at pcm.h:429:1
107 impacted interfaces
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2cc9bdcc4c587e34362082b93990bf9837241a37
emulation_proc_handler() changes table->data for proc_dointvec_minmax
and can generate the following Oops if called concurrently with itself:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
| Internal error: Oops: 96000006 [#1] SMP
| Call trace:
| update_insn_emulation_mode+0xc0/0x148
| emulation_proc_handler+0x64/0xb8
| proc_sys_call_handler+0x9c/0xf8
| proc_sys_write+0x18/0x20
| __vfs_write+0x20/0x48
| vfs_write+0xe4/0x1d0
| ksys_write+0x70/0xf8
| __arm64_sys_write+0x20/0x28
| el0_svc_common.constprop.0+0x7c/0x1c0
| el0_svc_handler+0x2c/0xa0
| el0_svc+0x8/0x200
To fix this issue, keep the table->data as &insn->current_mode and
use container_of() to retrieve the insn pointer. Another mutex is
used to protect against the current_mode update but not for retrieving
insn_emulation as table->data is no longer changing.
Bug: 237540956
Co-developed-by: hewenliang <hewenliang4@huawei.com>
Signed-off-by: hewenliang <hewenliang4@huawei.com>
Signed-off-by: Haibin Zhang <haibinzhang@tencent.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20220128090324.2727688-1-hewenliang4@huawei.com
Link: https://lore.kernel.org/r/9A004C03-250B-46C5-BF39-782D7551B00E@tencent.com
Signed-off-by: Will Deacon <will@kernel.org>
[Lee: Added Fixes: tag]
(cherry picked from commit af483947d472eccb79e42059276c4deed76f99a6
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-next/core)
Fixes: 587064b610 ("arm64: Add framework for legacy instruction emulation")
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If9b96bb79c79903f9d8292e719b06fdef57ef1c5
Add vmemdup_user so we can duplicate on non physically contiguous
memory. No need to update the .xml file, as it is already updated.
Bug: 238705448
Change-Id: I93f0161117d25adff0ead7b33ab319d4ca28c3c7
Signed-off-by: Jairaj Solanki <quic_jsolanki@quicinc.com>
Commit 09854ba94c6a ("mm: do_wp_page() simplification") reorganized all
the code around the page re-use vs copy, but in the process also moved
the final unlock_page() around to after the wp_page_reuse() call.
That normally doesn't matter - but it means that the unlock_page() is
now done after releasing the page table lock. Again, not a big deal,
you'd think.
But it turns out that it's very wrong indeed, because once we've
released the page table lock, we've basically lost our only reference to
the page - the page tables - and it could now be free'd at any time. We
do hold the mmap_sem, so no actual unmap() can happen, but madvise can
come in and a MADV_DONTNEED will zap the page range - and free the page.
So now the page may be free'd just as we're unlocking it, which in turn
will usually trigger a "Bad page state" error in the freeing path. To
make matters more confusing, by the time the debug code prints out the
page state, the unlock has typically completed and everything looks fine
again.
This all doesn't happen in any normal situations, but it does trigger
with the dirtyc0w_child LTP test. And it seems to trigger much more
easily (but not expclusively) on s390 than elsewhere, probably because
s390 doesn't do the "batch pages up for freeing after the TLB flush"
that gives the unlock_page() more time to complete and makes the race
harder to hit.
Fixes: 09854ba94c6a ("mm: do_wp_page() simplification")
Link: https://lore.kernel.org/lkml/a46e9bbef2ed4e17778f5615e818526ef848d791.camel@redhat.com/
Link: https://lore.kernel.org/linux-mm/c41149a8-211e-390b-af1d-d5eee690fecb@linux.alibaba.com/
Reported-by: Qian Cai <cai@redhat.com>
Reported-by: Alex Shi <alex.shi@linux.alibaba.com>
Bisected-and-analyzed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Tested-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit be068f29034fb00530a053d18b8cf140c32b12b3)
Bug: 176847924
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I85ea395b6b722fbfc63036041d11615dacf96a7b
How about we just make sure we're the only possible valid user fo the
page before we bother to reuse it?
Simplify, simplify, simplify.
And get rid of the nasty serialization on the page lock at the same time.
[peterx: add subject prefix]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 09854ba94c6aad7886996bfbee2530b3d8a7f4f4)
[Kalesh Singh: Resolve conflict in mm/memory.c]
Bug: 176847924
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I0b855b305332564670b8cbea9660405fed89a044
Remove the function as the last reference has gone away with the do_wp_page()
changes.
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 1a0cf26323c80e2f1c58fc04f15686de61bfab0c)
Bug: 176847924
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I70e5938a046d0fc449288ae46c83cb7c39d7de48
commit 69534c48ba8ce552ce383b3dfdb271ffe51820c3 upstream.
We have no protection against concurrent PCM buffer preallocation
changes via proc files, and it may potentially lead to UAF or some
weird problem. This patch applies the PCM open_mutex to the proc
write operation for avoiding the racy proc writes and the PCM stream
open (and further operations).
Bug: 232293337
Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-5-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[OP: backport to 5.4: adjusted context]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I52d0347c440b87c700b28e082eee9ab9d3ec4910
commit 3c3201f8c7bb77eb53b08a3ca8d9a4ddc500b4c0 upstream.
Like the previous fixes to hw_params and hw_free ioctl races, we need
to paper over the concurrent prepare ioctl calls against hw_params and
hw_free, too.
This patch implements the locking with the existing
runtime->buffer_mutex for prepare ioctls. Unlike the previous case
for snd_pcm_hw_hw_params() and snd_pcm_hw_free(), snd_pcm_prepare() is
performed to the linked streams, hence the lock can't be applied
simply on the top. For tracking the lock in each linked substream, we
modify snd_pcm_action_group() slightly and apply the buffer_mutex for
the case stream_lock=false (formerly there was no lock applied)
there.
Bug: 232293337
Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: Idcb26b8b178b9617e44443f2ca093074b76068b0
commit dca947d4d26dbf925a64a6cfb2ddbc035e831a3d upstream.
In the current PCM design, the read/write syscalls (as well as the
equivalent ioctls) are allowed before the PCM stream is running, that
is, at PCM PREPARED state. Meanwhile, we also allow to re-issue
hw_params and hw_free ioctl calls at the PREPARED state that may
change or free the buffers, too. The problem is that there is no
protection against those mix-ups.
This patch applies the previously introduced runtime->buffer_mutex to
the read/write operations so that the concurrent hw_params or hw_free
call can no longer interfere during the operation. The mutex is
unlocked before scheduling, so we don't take it too long.
Bug: 232293337
Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I4ec9ab14347e88de6b51025b845d13514ac289e9
A portion of the fix for CVE-2022-1048, commit 0f6947f5f520 ("ALSA: pcm:
Fix races among concurrent hw_params and hw_free calls"), caused an ABI
break by adding a new field to struct snd_pcm_runtime. Because we have
to keep this new addition, it is safe to move it to the end of the
structure because this is only ever created by the sound core, and
referenced as a pointer everywhere else.
This does require a .xml update also to handle the increased structure
size:
Leaf changes summary: 1 artifact changed
Changed leaf types summary: 1 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
'struct snd_pcm_runtime at pcm.h:342:1' changed:
type size changed from 6080 to 6336 (in bits)
1 data member insertion:
'mutex buffer_mutex', at offset 6080 (in bits) at pcm.h:428:1
92 impacted interfaces
Bug: 161946584
Fixes: 0f6947f5f520 ("ALSA: pcm: Fix races among concurrent hw_params and hw_free calls")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[Lee: Update XML files for this branch]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I20340387fbe85fb82676517a93bb0184c8c1eb65
commit 92ee3c60ec9fe64404dc035e7c41277d74aa26cb upstream.
Currently we have neither proper check nor protection against the
concurrent calls of PCM hw_params and hw_free ioctls, which may result
in a UAF. Since the existing PCM stream lock can't be used for
protecting the whole ioctl operations, we need a new mutex to protect
those racy calls.
This patch introduced a new mutex, runtime->buffer_mutex, and applies
it to both hw_params and hw_free ioctl code paths. Along with it, the
both functions are slightly modified (the mmap_count check is moved
into the state-check block) for code simplicity.
Bug: 5d95acffca4c
Reported-by: Hu Jiahui <kirin.say@gmail.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[OP: backport to 5.4: adjusted context]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I33b5ed3d1f38904e215692a236fe39e8b3ee1f15
commit d270453a0d9ec10bb8a802a142fb1b3601a83098 upstream.
There are destructive operations such as nfcmrvl_fw_dnld_abort and
gpio_free in nfcmrvl_nci_unregister_dev. The resources such as firmware,
gpio and so on could be destructed while the upper layer functions such as
nfcmrvl_fw_dnld_start and nfcmrvl_nci_recv_frame is executing, which leads
to double-free, use-after-free and null-ptr-deref bugs.
There are three situations that could lead to double-free bugs.
The first situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_fw_dnld_start |
... | nfcmrvl_nci_unregister_dev
release_firmware() | nfcmrvl_fw_dnld_abort
kfree(fw) //(1) | fw_dnld_over
| release_firmware
... | kfree(fw) //(2)
| ...
The second situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_fw_dnld_start |
... |
mod_timer |
(wait a time) |
fw_dnld_timeout | nfcmrvl_nci_unregister_dev
fw_dnld_over | nfcmrvl_fw_dnld_abort
release_firmware | fw_dnld_over
kfree(fw) //(1) | release_firmware
... | kfree(fw) //(2)
The third situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_nci_recv_frame |
if(..->fw_download_in_progress)|
nfcmrvl_fw_dnld_recv_frame |
queue_work |
|
fw_dnld_rx_work | nfcmrvl_nci_unregister_dev
fw_dnld_over | nfcmrvl_fw_dnld_abort
release_firmware | fw_dnld_over
kfree(fw) //(1) | release_firmware
| kfree(fw) //(2)
The firmware struct is deallocated in position (1) and deallocated
in position (2) again.
The crash trace triggered by POC is like below:
BUG: KASAN: double-free or invalid-free in fw_dnld_over
Call Trace:
kfree
fw_dnld_over
nfcmrvl_nci_unregister_dev
nci_uart_tty_close
tty_ldisc_kill
tty_ldisc_hangup
__tty_hangup.part.0
tty_release
...
What's more, there are also use-after-free and null-ptr-deref bugs
in nfcmrvl_fw_dnld_start. If we deallocate firmware struct, gpio or
set null to the members of priv->fw_dnld in nfcmrvl_nci_unregister_dev,
then, we dereference firmware, gpio or the members of priv->fw_dnld in
nfcmrvl_fw_dnld_start, the UAF or NPD bugs will happen.
This patch reorders destructive operations after nci_unregister_device
in order to synchronize between cleanup routine and firmware download
routine.
The nci_unregister_device is well synchronized. If the device is
detaching, the firmware download routine will goto error. If firmware
download routine is executing, nci_unregister_device will wait until
firmware download routine is finished.
Bug: 234690530
Fixes: 3194c68701 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I8cc1f6450c7fecf5f5994033931da1d23a522282
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmKdn9MACgkQONu9yGCS
aT4bpg//X6xA3rkYaTO2ymBqhqwvZ47OvS5M6dL4N5wTKhkuGk89Ij4XDI/z65lm
WeaRbVhvFbmnjm44lLvP8Ly5rHk/PTOVWqtGkbsFe05CStZb9VThJ9Eqrl2RfY1h
QswWZe1V3QquBCMaXVP85VjvsUmqxRz1Sq1XL7u3DE56LRzzjgBBFO6Iu3+tfI4X
6e1FOQec9nn2TRT3EQdYWy11EZawnoir5YF7wz1ao3epUu57xRLJogsaovA8Zu1l
xJPpss0wro+9aB1VSwrpSggDtYqDOnarKBst0Q2i43wSPOlcjy7DcqYpnn9JaTKf
zGchCQf/Zz0GrAuASqkwtc9ap3OhGNMv2x6RTtiH2MrKs8bH8/iQAhwwAvkgxQQg
yAUw7DxB4L069dOYXoQQw+jPH1YIsqY4k6w9KtmyjcA8S5FJh2jHuhOw5lWL9y4+
0Gz1LjoF59ZZZh49cNmKKuSmfFN3xO8CpWvz3qvd/2kjzus/dJXs7gq9+PS9uCC6
e6SccW9vp0RZ9yhSy59xHuyhEZQdeU2Wp5RGcyUEN0mXdXFGaj0asWouu2H/gm1y
coWZpcOlALk+uaP9+tYc+kLFCash98xhX10mNzb+nHODM/Mwxh+tzGbtOmQ8UuNX
KkUqXjGz3AXQZzxKOUePvq9mrAFkEkdIKZDOjdwQvoEq+iQg9Lc=
=JE5x
-----END PGP SIGNATURE-----
Merge 5.4.197 into android11-5.4-lts
Changes in 5.4.197
lockdown: also lock down previous kgdb use
x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
Input: goodix - fix spurious key release events
tcp: change source port randomizarion at connect() time
secure_seq: use the 64 bits of the siphash for port offset calculation
media: vim2m: Register video device after setting up internals
media: vim2m: initialize the media device earlier
ACPI: sysfs: Make sparse happy about address space in use
ACPI: sysfs: Fix BERT error region memory mapping
pinctrl: sunxi: fix f1c100s uart2 function
net: af_key: check encryption module availability consistency
net: ftgmac100: Disable hardware checksum on AST2600
i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers
assoc_array: Fix BUG_ON during garbage collect
cfg80211: set custom regdomain after wiphy registration
drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
exec: Force single empty string when argv is empty
netfilter: conntrack: re-fetch conntrack after insertion
crypto: ecrdsa - Fix incorrect use of vli_cmp
zsmalloc: fix races between asynchronous zspage free and page migration
dm integrity: fix error code in dm_integrity_ctr()
dm crypt: make printing of the key constant-time
dm stats: add cond_resched when looping over entries
dm verity: set DM_TARGET_IMMUTABLE feature flag
raid5: introduce MD_BROKEN
HID: multitouch: Add support for Google Whiskers Touchpad
tpm: Fix buffer access in tpm2_get_tpm_pt()
tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
docs: submitting-patches: Fix crossref to 'The canonical patch format'
NFS: Memory allocation failures are not server fatal errors
NFSD: Fix possible sleep during nfsd4_release_lockowner()
bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
Linux 5.4.197
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1b3af44df22d11027b65b96eaac53fe2c3b5db92
commit 45969b4152c1752089351cd6836a42a566d49bcf upstream.
The data length of skb frags + frag_list may be greater than 0xffff, and
skb_header_pointer can not handle negative offset. So, here INT_MAX is used
to check the validity of offset. Add the same change to the related function
skb_store_bytes.
Fixes: 05c74e5e53 ("bpf: add bpf_skb_load_bytes helper")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Song Liu <songliubraving@fb.com>
Link: https://lore.kernel.org/bpf/20220416105801.88708-2-liujian56@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b upstream.
nfsd4_release_lockowner() holds clp->cl_lock when it calls
check_for_locks(). However, check_for_locks() calls nfsd_file_get()
/ nfsd_file_put() to access the backing inode's flc_posix list, and
nfsd_file_put() can sleep if the inode was recently removed.
Let's instead rely on the stateowner's reference count to gate
whether the release is permitted. This should be a reliable
indication of locks-in-use since file lock operations and
->lm_get_owner take appropriate references, which are released
appropriately when file locks are removed.
Reported-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 452284407c18d8a522c3039339b1860afa0025a8 upstream.
We need to filter out ENOMEM in nfs_error_is_fatal_on_server(), because
running out of memory on our client is not a server error.
Reported-by: Olga Kornievskaia <aglo@umich.edu>
Fixes: 2dc23afffb ("NFS: ENOMEM should also be a fatal error.")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6d5aa418b3bd42cdccc36e94ee199af423ef7c84 upstream.
The reference to `explicit_in_reply_to` is pointless as when the
reference was added in the form of "#15" [1], Section 15) was "The
canonical patch format".
The reference of "#15" had not been properly updated in a couple of
reorganizations during the plain-text SubmittingPatches era.
Fix it by using `the_canonical_patch_format`.
[1]: 2ae19acaa5 ("Documentation: Add "how to write a good patch summary" to SubmittingPatches")
Signed-off-by: Akira Yokosawa <akiyks@gmail.com>
Fixes: 5903019b2a ("Documentation/SubmittingPatches: convert it to ReST markup")
Fixes: 9b2c76777a ("Documentation/SubmittingPatches: enrich the Sphinx output")
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: stable@vger.kernel.org # v4.9+
Link: https://lore.kernel.org/r/64e105a5-50be-23f2-6cae-903a2ea98e18@gmail.com
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d0dc1a7100f19121f6e7450f9cdda11926aa3838 upstream.
Currently it returns zero when CRQ response timed out, it should return
an error code instead.
Fixes: d8d74ea3c002 ("tpm: ibmvtpm: Wait for buffer to be set before proceeding")
Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e57b2523bd37e6434f4e64c7a685e3715ad21e9a upstream.
Under certain conditions uninitialized memory will be accessed.
As described by TCG Trusted Platform Module Library Specification,
rev. 1.59 (Part 3: Commands), if a TPM2_GetCapability is received,
requesting a capability, the TPM in field upgrade mode may return a
zero length list.
Check the property count in tpm2_get_tpm_pt().
Fixes: 2ab3241161 ("tpm: migrate tpm2_get_tpm_pt() to use struct tpm_buf")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Mahnke-Hartmann <stefan.mahnke-hartmann@infineon.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1d07cef7fd7599450b3d03e1915efc2a96e1f03f upstream.
The Google Whiskers touchpad does not work properly with the default
multitouch configuration. Instead, use the same configuration as Google
Rose.
Signed-off-by: Marek Maslanka <mm@semihalf.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 57668f0a4cc4083a120cc8c517ca0055c4543b59 upstream.
Raid456 module had allowed to achieve failed state. It was fixed by
fb73b357fb ("raid5: block failing device if raid will be failed").
This fix introduces a bug, now if raid5 fails during IO, it may result
with a hung task without completion. Faulty flag on the device is
necessary to process all requests and is checked many times, mainly in
analyze_stripe().
Allow to set faulty on drive again and set MD_BROKEN if raid is failed.
As a result, this level is allowed to achieve failed state again, but
communication with userspace (via -EBUSY status) will be preserved.
This restores possibility to fail array via #mdadm --set-faulty command
and will be fixed by additional verification on mdadm side.
Reproduction steps:
mdadm -CR imsm -e imsm -n 3 /dev/nvme[0-2]n1
mdadm -CR r5 -e imsm -l5 -n3 /dev/nvme[0-2]n1 --assume-clean
mkfs.xfs /dev/md126 -f
mount /dev/md126 /mnt/root/
fio --filename=/mnt/root/file --size=5GB --direct=1 --rw=randrw
--bs=64k --ioengine=libaio --iodepth=64 --runtime=240 --numjobs=4
--time_based --group_reporting --name=throughput-test-job
--eta-newline=1 &
echo 1 > /sys/block/nvme2n1/device/device/remove
echo 1 > /sys/block/nvme1n1/device/device/remove
[ 1475.787779] Call Trace:
[ 1475.793111] __schedule+0x2a6/0x700
[ 1475.799460] schedule+0x38/0xa0
[ 1475.805454] raid5_get_active_stripe+0x469/0x5f0 [raid456]
[ 1475.813856] ? finish_wait+0x80/0x80
[ 1475.820332] raid5_make_request+0x180/0xb40 [raid456]
[ 1475.828281] ? finish_wait+0x80/0x80
[ 1475.834727] ? finish_wait+0x80/0x80
[ 1475.841127] ? finish_wait+0x80/0x80
[ 1475.847480] md_handle_request+0x119/0x190
[ 1475.854390] md_make_request+0x8a/0x190
[ 1475.861041] generic_make_request+0xcf/0x310
[ 1475.868145] submit_bio+0x3c/0x160
[ 1475.874355] iomap_dio_submit_bio.isra.20+0x51/0x60
[ 1475.882070] iomap_dio_bio_actor+0x175/0x390
[ 1475.889149] iomap_apply+0xff/0x310
[ 1475.895447] ? iomap_dio_bio_actor+0x390/0x390
[ 1475.902736] ? iomap_dio_bio_actor+0x390/0x390
[ 1475.909974] iomap_dio_rw+0x2f2/0x490
[ 1475.916415] ? iomap_dio_bio_actor+0x390/0x390
[ 1475.923680] ? atime_needs_update+0x77/0xe0
[ 1475.930674] ? xfs_file_dio_aio_read+0x6b/0xe0 [xfs]
[ 1475.938455] xfs_file_dio_aio_read+0x6b/0xe0 [xfs]
[ 1475.946084] xfs_file_read_iter+0xba/0xd0 [xfs]
[ 1475.953403] aio_read+0xd5/0x180
[ 1475.959395] ? _cond_resched+0x15/0x30
[ 1475.965907] io_submit_one+0x20b/0x3c0
[ 1475.972398] __x64_sys_io_submit+0xa2/0x180
[ 1475.979335] ? do_io_getevents+0x7c/0xc0
[ 1475.986009] do_syscall_64+0x5b/0x1a0
[ 1475.992419] entry_SYSCALL_64_after_hwframe+0x65/0xca
[ 1476.000255] RIP: 0033:0x7f11fc27978d
[ 1476.006631] Code: Bad RIP value.
[ 1476.073251] INFO: task fio:3877 blocked for more than 120 seconds.
Cc: stable@vger.kernel.org
Fixes: fb73b357fb ("raid5: block failing device if raid will be failed")
Reviewd-by: Xiao Ni <xni@redhat.com>
Signed-off-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 4caae58406f8ceb741603eee460d79bacca9b1b5 upstream.
The device-mapper framework provides a mechanism to mark targets as
immutable (and hence fail table reloads that try to change the target
type). Add the DM_TARGET_IMMUTABLE flag to the dm-verity target's
feature flags to prevent switching the verity target with a different
target type.
Fixes: a4ffc15219 ("dm: add verity target")
Cc: stable@vger.kernel.org
Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit bfe2b0146c4d0230b68f5c71a64380ff8d361f8b upstream.
dm-stats can be used with a very large number of entries (it is only
limited by 1/4 of total system memory), so add rescheduling points to
the loops that iterate over the entries.
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 567dd8f34560fa221a6343729474536aa7ede4fd upstream.
The device mapper dm-crypt target is using scnprintf("%02x", cc->key[i]) to
report the current key to userspace. However, this is not a constant-time
operation and it may leak information about the key via timing, via cache
access patterns or via the branch predictor.
Change dm-crypt's key printing to use "%c" instead of "%02x". Also
introduce hex2asc() that carefully avoids any branching or memory
accesses when converting a number in the range 0 ... 15 to an ascii
character.
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Tested-by: Milan Broz <gmazyland@gmail.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d3f2a14b8906df913cb04a706367b012db94a6e8 upstream.
The "r" variable shadows an earlier "r" that has function scope. It
means that we accidentally return success instead of an error code.
Smatch has a warning for this:
drivers/md/dm-integrity.c:4503 dm_integrity_ctr()
warn: missing error code 'r'
Fixes: 7eada909bf ("dm: add integrity target")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2505a981114dcb715f8977b8433f7540854851d8 upstream.
The asynchronous zspage free worker tries to lock a zspage's entire page
list without defending against page migration. Since pages which haven't
yet been locked can concurrently migrate off the zspage page list while
lock_zspage() churns away, lock_zspage() can suffer from a few different
lethal races.
It can lock a page which no longer belongs to the zspage and unsafely
dereference page_private(), it can unsafely dereference a torn pointer to
the next page (since there's a data race), and it can observe a spurious
NULL pointer to the next page and thus not lock all of the zspage's pages
(since a single page migration will reconstruct the entire page list, and
create_page_chain() unconditionally zeroes out each list pointer in the
process).
Fix the races by using migrate_read_lock() in lock_zspage() to synchronize
with page migration.
Link: https://lkml.kernel.org/r/20220509024703.243847-1-sultan@kerneltoast.com
Fixes: 77ff465799 ("zsmalloc: zs_page_migrate: skip unnecessary loops but not return -EBUSY if zspage is not inuse")
Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Acked-by: Minchan Kim <minchan@kernel.org>
Cc: Nitin Gupta <ngupta@vflare.org>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 56b14ecec97f39118bf85c9ac2438c5a949509ed upstream.
In case the conntrack is clashing, insertion can free skb->_nfct and
set skb->_nfct to the already-confirmed entry.
This wasn't found before because the conntrack entry and the extension
space used to free'd after an rcu grace period, plus the race needs
events enabled to trigger.
Reported-by: <syzbot+793a590957d9c1b96620@syzkaller.appspotmail.com>
Fixes: 71d8c47fc6 ("netfilter: conntrack: introduce clash resolution on insertion race")
Fixes: 2ad9d7747c10 ("netfilter: conntrack: free extension area immediately")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit dcd46d897adb70d63e025f175a00a89797d31a43 upstream.
Quoting[1] Ariadne Conill:
"In several other operating systems, it is a hard requirement that the
second argument to execve(2) be the name of a program, thus prohibiting
a scenario where argc < 1. POSIX 2017 also recommends this behaviour,
but it is not an explicit requirement[2]:
The argument arg0 should point to a filename string that is
associated with the process being started by one of the exec
functions.
...
Interestingly, Michael Kerrisk opened an issue about this in 2008[3],
but there was no consensus to support fixing this issue then.
Hopefully now that CVE-2021-4034 shows practical exploitative use[4]
of this bug in a shellcode, we can reconsider.
This issue is being tracked in the KSPP issue tracker[5]."
While the initial code searches[6][7] turned up what appeared to be
mostly corner case tests, trying to that just reject argv == NULL
(or an immediately terminated pointer list) quickly started tripping[8]
existing userspace programs.
The next best approach is forcing a single empty string into argv and
adjusting argc to match. The number of programs depending on argc == 0
seems a smaller set than those calling execve with a NULL argv.
Account for the additional stack space in bprm_stack_limits(). Inject an
empty string when argc == 0 (and set argc = 1). Warn about the case so
userspace has some notice about the change:
process './argc0' launched './argc0' with NULL argv: empty string added
Additionally WARN() and reject NULL argv usage for kernel threads.
[1] https://lore.kernel.org/lkml/20220127000724.15106-1-ariadne@dereferenced.org/
[2] https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html
[3] https://bugzilla.kernel.org/show_bug.cgi?id=8408
[4] https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
[5] https://github.com/KSPP/linux/issues/176
[6] https://codesearch.debian.net/search?q=execve%5C+*%5C%28%5B%5E%2C%5D%2B%2C+*NULL&literal=0
[7] https://codesearch.debian.net/search?q=execlp%3F%5Cs*%5C%28%5B%5E%2C%5D%2B%2C%5Cs*NULL&literal=0
[8] https://lore.kernel.org/lkml/20220131144352.GE16385@xsang-OptiPlex-9020/
Reported-by: Ariadne Conill <ariadne@dereferenced.org>
Reported-by: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Rich Felker <dalias@libc.org>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Christian Brauner <brauner@kernel.org>
Acked-by: Ariadne Conill <ariadne@dereferenced.org>
Acked-by: Andy Lutomirski <luto@kernel.org>
Link: https://lore.kernel.org/r/20220201000947.2453721-1-keescook@chromium.org
[vegard: fixed conflicts due to missing
886d7de631da71e30909980fdbf318f7caade262^- and
3950e975431bc914f7e81b8f2a2dbdf2064acb0f^-]
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 336feb502a715909a8136eb6a62a83d7268a353b upstream.
Fix the following -Wstringop-overflow warnings when building with GCC-11:
drivers/gpu/drm/i915/intel_pm.c:3106:9: warning: ‘intel_read_wm_latency’ accessing 16 bytes in a region of size 10 [-Wstringop-overflow=]
3106 | intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/intel_pm.c:3106:9: note: referencing argument 2 of type ‘u16 *’ {aka ‘short unsigned int *’}
drivers/gpu/drm/i915/intel_pm.c:2861:13: note: in a call to function ‘intel_read_wm_latency’
2861 | static void intel_read_wm_latency(struct drm_i915_private *dev_priv,
| ^~~~~~~~~~~~~~~~~~~~~
by removing the over-specified array size from the argument declarations.
It seems that this code is actually safe because the size of the
array depends on the hardware generation, and the function checks
for that.
Notice that wm can be an array of 5 elements:
drivers/gpu/drm/i915/intel_pm.c:3109: intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency);
or an array of 8 elements:
drivers/gpu/drm/i915/intel_pm.c:3131: intel_read_wm_latency(dev_priv, dev_priv->wm.skl_latency);
and the compiler legitimately complains about that.
This helps with the ongoing efforts to globally enable
-Wstringop-overflow.
Link: https://github.com/KSPP/linux/issues/181
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1b7b3ac8ff3317cdcf07a1c413de9bdb68019c2b upstream.
We used to set regulatory info before the registration of
the device and then the regulatory info didn't get set, because
the device isn't registered so there isn't a device to set the
regulatory info for. So set the regulatory info after the device
registration.
Call reg_process_self_managed_hints() once again after the device
registration because it does nothing before it.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210618133832.c96eadcffe80.I86799c2c866b5610b4cf91115c21d8ceb525c5aa@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d1dc87763f406d4e67caf16dbe438a5647692395 upstream.
A rare BUG_ON triggered in assoc_array_gc:
[3430308.818153] kernel BUG at lib/assoc_array.c:1609!
Which corresponded to the statement currently at line 1593 upstream:
BUG_ON(assoc_array_ptr_is_meta(p));
Using the data from the core dump, I was able to generate a userspace
reproducer[1] and determine the cause of the bug.
[1]: https://github.com/brenns10/kernel_stuff/tree/master/assoc_array_gc
After running the iterator on the entire branch, an internal tree node
looked like the following:
NODE (nr_leaves_on_branch: 3)
SLOT [0] NODE (2 leaves)
SLOT [1] NODE (1 leaf)
SLOT [2..f] NODE (empty)
In the userspace reproducer, the pr_devel output when compressing this
node was:
-- compress node 0x5607cc089380 --
free=0, leaves=0
[0] retain node 2/1 [nx 0]
[1] fold node 1/1 [nx 0]
[2] fold node 0/1 [nx 2]
[3] fold node 0/2 [nx 2]
[4] fold node 0/3 [nx 2]
[5] fold node 0/4 [nx 2]
[6] fold node 0/5 [nx 2]
[7] fold node 0/6 [nx 2]
[8] fold node 0/7 [nx 2]
[9] fold node 0/8 [nx 2]
[10] fold node 0/9 [nx 2]
[11] fold node 0/10 [nx 2]
[12] fold node 0/11 [nx 2]
[13] fold node 0/12 [nx 2]
[14] fold node 0/13 [nx 2]
[15] fold node 0/14 [nx 2]
after: 3
At slot 0, an internal node with 2 leaves could not be folded into the
node, because there was only one available slot (slot 0). Thus, the
internal node was retained. At slot 1, the node had one leaf, and was
able to be folded in successfully. The remaining nodes had no leaves,
and so were removed. By the end of the compression stage, there were 14
free slots, and only 3 leaf nodes. The tree was ascended and then its
parent node was compressed. When this node was seen, it could not be
folded, due to the internal node it contained.
The invariant for compression in this function is: whenever
nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT, the node should contain all
leaf nodes. The compression step currently cannot guarantee this, given
the corner case shown above.
To fix this issue, retry compression whenever we have retained a node,
and yet nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT. This second
compression will then allow the node in slot 1 to be folded in,
satisfying the invariant. Below is the output of the reproducer once the
fix is applied:
-- compress node 0x560e9c562380 --
free=0, leaves=0
[0] retain node 2/1 [nx 0]
[1] fold node 1/1 [nx 0]
[2] fold node 0/1 [nx 2]
[3] fold node 0/2 [nx 2]
[4] fold node 0/3 [nx 2]
[5] fold node 0/4 [nx 2]
[6] fold node 0/5 [nx 2]
[7] fold node 0/6 [nx 2]
[8] fold node 0/7 [nx 2]
[9] fold node 0/8 [nx 2]
[10] fold node 0/9 [nx 2]
[11] fold node 0/10 [nx 2]
[12] fold node 0/11 [nx 2]
[13] fold node 0/12 [nx 2]
[14] fold node 0/13 [nx 2]
[15] fold node 0/14 [nx 2]
internal nodes remain despite enough space, retrying
-- compress node 0x560e9c562380 --
free=14, leaves=1
[0] fold node 2/15 [nx 0]
after: 3
Changes
=======
DH:
- Use false instead of 0.
- Reorder the inserted lines in a couple of places to put retained before
next_slot.
ver #2)
- Fix typo in pr_devel, correct comparison to "<="
Fixes: 3cb989501c ("Add a generic associative array implementation.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Stephen Brennan <stephen.s.brennan@oracle.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Andrew Morton <akpm@linux-foundation.org>
cc: keyrings@vger.kernel.org
Link: https://lore.kernel.org/r/20220511225517.407935-1-stephen.s.brennan@oracle.com/ # v1
Link: https://lore.kernel.org/r/20220512215045.489140-1-stephen.s.brennan@oracle.com/ # v2
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 03a35bc856ddc09f2cc1f4701adecfbf3b464cb3 ]
Due to i2c->adap.dev.fwnode not being set, ACPI_COMPANION() wasn't properly
found for TWSI controllers.
Signed-off-by: Szymon Balcerak <sbalcerak@marvell.com>
Signed-off-by: Piyush Malgujar <pmalgujar@marvell.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 17a0f3acdc6ec8b89ad40f6e22165a4beee25663 ]
Before sending a MSI the hardware writes information pertinent to the
interrupt cause to a memory location pointed by SMTICL register. This
memory holds three double words where the least significant bit tells
whether the interrupt cause of master/target/error is valid. The driver
does not use this but we need to set it up because otherwise it will
perform DMA write to the default address (0) and this will cause an
IOMMU fault such as below:
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Write] Request device [00:12.0] PASID ffffffff fault addr 0
[fault reason 05] PTE Write access is not set
To prevent this from happening, provide a proper DMA buffer for this
that then gets mapped by the IOMMU accordingly.
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
