aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2022-02-05Merge tag 'phy-fixes-5.17' of ↵Greg Kroah-Hartman11-34/+80
git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy into char-misc-next Vinod writes: phy: fixes for 5.17 Fixes for bunch of drivers: - clk params for dphy - arg fix for mtk-tphy - refcount leak fix for stm32 - bus width fix for zynqmp - sentinel fix ti - PHY_BRCM_USB Kconfig fix - clk fix for usb phy * tag 'phy-fixes-5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: dphy: Correct clk_pre parameter phy: phy-mtk-tphy: Fix duplicated argument in phy-mtk-tphy phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable() phy: xilinx: zynqmp: Fix bus width setting for SGMII phy: cadence: Sierra: fix error handling bugs in probe() phy: ti: Fix missing sentinel for clk_div_table phy: broadcom: Kconfig: Fix PHY_BRCM_USB config option phy: usb: Leave some clocks running during suspend
2022-02-05Merge tag 'kvmarm-fixes-5.17-2' of ↵Paolo Bonzini10509-213689/+452370
git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 5.17, take #2 - A couple of fixes when handling an exception while a SError has been delivered - Workaround for Cortex-A510's single-step[ erratum
2022-02-05crypto: api - Move cryptomgr soft dependency into algapiHerbert Xu2-1/+1
The soft dependency on cryptomgr is only needed in algapi because if algapi isn't present then no algorithms can be loaded. This also fixes the case where api is built-in but algapi is built as a module as the soft dependency would otherwise get lost. Fixes: 8ab23d547f65 ("crypto: api - Add softdep on cryptomgr") Reported-by: Jan Beulich <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Tested-by: Jan Beulich <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
2022-02-04tcp: take care of mixed splice()/sendmsg(MSG_ZEROCOPY) caseEric Dumazet1-14/+19
syzbot found that mixing sendpage() and sendmsg(MSG_ZEROCOPY) calls over the same TCP socket would again trigger the infamous warning in inet_sock_destruct() WARN_ON(sk_forward_alloc_get(sk)); While Talal took into account a mix of regular copied data and MSG_ZEROCOPY one in the same skb, the sendpage() path has been forgotten. We want the charging to happen for sendpage(), because pages could be coming from a pipe. What is missing is the downgrading of pure zerocopy status to make sure sk_forward_alloc will stay synced. Add tcp_downgrade_zcopy_pure() helper so that we can use it from the two callers. Fixes: 9b65b17db723 ("net: avoid double accounting for pure zerocopy skbs") Signed-off-by: Eric Dumazet <[email protected]> Reported-by: syzbot <[email protected]> Cc: Talal Ahmad <[email protected]> Cc: Arjun Roy <[email protected]> Cc: Willem de Bruijn <[email protected]> Acked-by: Soheil Hassas Yeganeh <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2022-02-04Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds11-64/+95
Pull rdma fixes from Jason Gunthorpe: "Some medium sized bugs in the various drivers. A couple are more recent regressions: - Fix two panics in hfi1 and two allocation problems - Send the IGMP to the correct address in cma - Squash a syzkaller bug related to races reading the multicast list - Memory leak in siw and cm - Fix a corner case spec compliance for HFI/QIB - Correct the implementation of fences in siw - Error unwind bug in mlx4" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/mlx4: Don't continue event handler after memory allocation failure RDMA/siw: Fix broken RDMA Read Fence/Resume logic. IB/rdmavt: Validate remote_addr during loopback atomic tests IB/cm: Release previously acquired reference counter in the cm_id_priv RDMA/siw: Fix refcounting leak in siw_create_qp() RDMA/ucma: Protect mc during concurrent multicast leaves RDMA/cma: Use correct address when leaving multicast group IB/hfi1: Fix tstats alloc and dealloc IB/hfi1: Fix AIP early init panic IB/hfi1: Fix alloc failure with larger txqueuelen IB/hfi1: Fix panic with larger ipoib send_queue_size
2022-02-04Merge tag 'scsi-fixes' of ↵Linus Torvalds6-67/+77
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Seven fixes, six of which are fairly obvious driver fixes. The one core change to the device budget depth is to try to ensure that if the default depth is large (which can produce quite a sizeable bitmap allocation per device), we give back the memory we don't need if there's a queue size reduction in slave_configure (which happens to a lot of devices)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: hisi_sas: Fix setting of hisi_sas_slot.is_internal scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task scsi: pm8001: Fix use-after-free for aborted TMF sas_task scsi: pm8001: Fix warning for undescribed param in process_one_iomb() scsi: core: Reallocate device's budget map on queue depth change scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe scsi: pm80xx: Fix double completion for SATA devices
2022-02-04Merge tag 'pci-v5.17-fixes-3' of ↵Linus Torvalds2-56/+60
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull pci fixes from Bjorn Helgaas: - Restructure j721e_pcie_probe() so we don't dereference a NULL pointer (Bjorn Helgaas) - Add a kirin_pcie_data struct to identify different Kirin variants to fix probe failure for controllers with an internal PHY (Bjorn Helgaas) * tag 'pci-v5.17-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: kirin: Add dev struct for of_device_get_match_data() PCI: j721e: Initialize pcie->cdns_pcie before using it
2022-02-04riscv/mm: Add XIP_FIXUP for riscv_pfn_basePalmer Dabbelt1-0/+1
This manifests as a crash early in boot on VexRiscv. Signed-off-by: Myrtle Shah <[email protected]> [Palmer: split commit] Fixes: 44c922572952 ("RISC-V: enable XIP") Cc: [email protected] Signed-off-by: Palmer Dabbelt <[email protected]>
2022-02-04riscv/mm: Add XIP_FIXUP for phys_ram_basePalmer Dabbelt1-0/+1
This manifests as a crash early in boot on VexRiscv. Signed-off-by: Myrtle Shah <[email protected]> [Palmer: split commit] Fixes: 6d7f91d914bc ("riscv: Get rid of CONFIG_PHYS_RAM_BASE in kernel physical address conversion") Cc: [email protected] Signed-off-by: Palmer Dabbelt <[email protected]>
2022-02-04PCI: kirin: Add dev struct for of_device_get_match_data()Bjorn Helgaas1-13/+18
Bean reported that a622435fbe1a ("PCI: kirin: Prefer of_device_get_match_data()") broke kirin_pcie_probe() because it assumed match data of 0 was a failure when in fact, it meant the match data was "(void *)PCIE_KIRIN_INTERNAL_PHY". Therefore, probing of "hisilicon,kirin960-pcie" devices failed with -EINVAL and an "OF data missing" message. Add a struct kirin_pcie_data to encode the PHY type. Then the result of of_device_get_match_data() should always be a non-NULL pointer to a struct kirin_pcie_data that contains the PHY type. Fixes: a622435fbe1a ("PCI: kirin: Prefer of_device_get_match_data()") Link: https://lore.kernel.org/r/20220202162659.GA12603@bhelgaas Link: https://lore.kernel.org/r/[email protected] Reported-by: Bean Huo <[email protected]> Signed-off-by: Bjorn Helgaas <[email protected]>
2022-02-04Merge tag 'for-5.17-rc2-tag' of ↵Linus Torvalds8-9/+128
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few fixes and error handling improvements: - fix deadlock between quota disable and qgroup rescan worker - fix use-after-free after failure to create a snapshot - skip warning on unmount after log cleanup failure - don't start transaction for scrub if the fs is mounted read-only - tree checker verifies item sizes" * tag 'for-5.17-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: skip reserved bytes warning on unmount after log cleanup failure btrfs: fix use of uninitialized variable at rm device ioctl btrfs: fix use-after-free after failure to create a snapshot btrfs: tree-checker: check item_size for dev_item btrfs: tree-checker: check item_size for inode_item btrfs: fix deadlock between quota disable and qgroup rescan worker btrfs: don't start transaction for scrub if the fs is mounted read-only
2022-02-04selftests/ir: fix build with ancient kernel headersSean Young1-0/+10
Since commit e2bcbd7769ee ("tools headers UAPI: remove stale lirc.h"), the build of the selftests fails on rhel 8 since its version of /usr/include/linux/lirc.h has no definition of RC_PROTO_RCMM32, etc [1]. [1] https://lkml.org/lkml/2022/1/28/275 Fixes: e2bcbd7769ee ("tools headers UAPI: remove stale lirc.h") Reviewed-by: Shuah Khan <[email protected]> Reported-by: kernel test robot <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Shuah Khan <[email protected]>
2022-02-04Merge tag 'erofs-for-5.17-rc3-fixes' of ↵Linus Torvalds3-61/+67
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "Two fixes related to fsdax cleanup in this cycle and ztailpacking to fix small compressed data inlining. There is also a trivial cleanup to rearrange code for better reading. Summary: - fix fsdax partition offset misbehavior - clean up z_erofs_decompressqueue_work() declaration - fix up EOF lcluster inlining, especially for small compressed data" * tag 'erofs-for-5.17-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix small compressed files inlining erofs: avoid unnecessary z_erofs_decompressqueue_work() declaration erofs: fix fsdax partition offset handling
2022-02-04selftests: fixup build warnings in pidfd / clone3 testsAxel Rasmussen3-8/+5
These are some trivial fixups, which were needed to build the tests with clang and -Werror. The following issues are fixed: - Remove various unused variables. - In child_poll_leader_exit_test, clang isn't smart enough to realize syscall(SYS_exit, 0) won't return, so it complains we never return from a non-void function. Add an extra exit(0) to appease it. - In test_pidfd_poll_leader_exit, ret may be branched on despite being uninitialized, if we have !use_waitpid. Initialize it to zero to get the right behavior in that case. Signed-off-by: Axel Rasmussen <[email protected]> Acked-by: Christian Brauner <[email protected]> Signed-off-by: Shuah Khan <[email protected]>
2022-02-04pidfd: fix test failure due to stack overflow on some archesAxel Rasmussen2-7/+28
When running the pidfd_fdinfo_test on arm64, it fails for me. After some digging, the reason is that the child exits due to SIGBUS, because it overflows the 1024 byte stack we've reserved for it. To fix the issue, increase the stack size to 8192 bytes (this number is somewhat arbitrary, and was arrived at through experimentation -- I kept doubling until the failure no longer occurred). Also, let's make the issue easier to debug. wait_for_pid() returns an ambiguous value: it may return -1 in all of these cases: 1. waitpid() itself returned -1 2. waitpid() returned success, but we found !WIFEXITED(status). 3. The child process exited, but it did so with a -1 exit code. There's no way for the caller to tell the difference. So, at least log which occurred, so the test runner can debug things. While debugging this, I found that we had !WIFEXITED(), because the child exited due to a signal. This seems like a reasonably common case, so also print out whether or not we have WIFSIGNALED(), and the associated WTERMSIG() (if any). This lets us see the SIGBUS I'm fixing clearly when it occurs. Finally, I'm suspicious of allocating the child's stack on our stack. man clone(2) suggests that the correct way to do this is with mmap(), and in particular by setting MAP_STACK. So, switch to doing it that way instead. Signed-off-by: Axel Rasmussen <[email protected]> Acked-by: Christian Brauner <[email protected]> Signed-off-by: Shuah Khan <[email protected]>
2022-02-04Merge tag 'block-5.17-2022-02-04' of git://git.kernel.dk/linux-blockLinus Torvalds7-20/+35
Pull block fixes from Jens Axboe: - NVMe pull request - fix use-after-free in rdma and tcp controller reset (Sagi Grimberg) - fix the state check in nvmf_ctlr_matches_baseopts (Uday Shankar) - MD nowait null pointer fix (Song) - blk-integrity seed advance fix (Martin) - Fix a dio regression in this merge window (Ilya) * tag 'block-5.17-2022-02-04' of git://git.kernel.dk/linux-block: block: bio-integrity: Advance seed correctly for larger interval sizes nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts() md: fix NULL pointer deref with nowait but no mddev->queue block: fix DIO handling regressions in blkdev_read_iter() nvme-rdma: fix possible use-after-free in transport error_recovery work nvme-tcp: fix possible use-after-free in transport error_recovery work nvme: fix a possible use-after-free in controller reset during load
2022-02-04Merge tag 'ata-5.17-rc3' of ↵Linus Torvalds3-0/+25
git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA fixes from Damien Le Moal: - Sergey volunteered to be a reviewer for the Renesas R-Car SATA driver and PATA drivers. Update the MAINTAINERS file accordingly. - Regression fix: add a horkage flag to prevent accessing the log directory log page with SATADOM-ML 3ME SATA devices as they react badly to reading that log page (from Anton). * tag 'ata-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: libata-core: Introduce ATA_HORKAGE_NO_LOG_DIR horkage MAINTAINERS: add myself as Renesas R-Car SATA driver reviewer MAINTAINERS: add myself as PATA drivers reviewer
2022-02-04Merge tag 'iommu-fixes-v5.17-rc2' of ↵Linus Torvalds5-18/+33
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Warning fixes and a fix for a potential use-after-free in IOMMU core code - Another potential memory leak fix for the Intel VT-d driver - Fix for an IO polling loop timeout issue in the AMD IOMMU driver * tag 'iommu-fixes-v5.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() iommu: Fix some W=1 warnings iommu: Fix potential use-after-free during probe
2022-02-04Merge tag 'random-5.17-rc3-for-linus' of ↵Linus Torvalds6-40/+55
git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator fixes from Jason Donenfeld: "For this week, we have: - A fix to make more frequent use of hwgenerator randomness, from Dominik. - More cleanups to the boot initialization sequence, from Dominik. - A fix for an old shortcoming with the ZAP ioctl, from me. - A workaround for a still unfixed Clang CFI/FullLTO compiler bug, from me. On one hand, it's a bummer to commit workarounds for experimental compiler features that have bugs. But on the other, I think this actually improves the code somewhat, independent of the bug. So a win-win" * tag 'random-5.17-rc3-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: random: only call crng_finalize_init() for primary_crng random: access primary_pool directly rather than through pointer random: wake up /dev/random writers after zap random: continually use hwgenerator randomness lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI
2022-02-04Merge tag 'acpi-5.17-rc3' of ↵Linus Torvalds1-0/+1
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix compilation in the case when ACPI is selected and CRC32, depended on by ACPI after recent changes, is not (Randy Dunlap)" * tag 'acpi-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: require CRC32 to build
2022-02-04Merge tag 'sound-5.17-rc3' of ↵Linus Torvalds29-105/+263
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. The major changes are ASoC core fixes, addressing the DPCM locking issue after the recent code changes and the potentially invalid register accesses via control API. Also, HD-audio got a core fix for Oops at dynamic unbinding. The rest are device-specific small fixes, including the usual stuff like HD-audio and USB-audio quirks" * tag 'sound-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (31 commits) ALSA: hda: Skip codec shutdown in case the codec is not registered ALSA: usb-audio: Correct quirk for VF0770 ALSA: Replace acpi_bus_get_device() Input: wm97xx: Simplify resource management ALSA: hda/realtek: Add quirk for ASUS GU603 ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks ALSA: hda: realtek: Fix race at concurrent COEF updates ASoC: ops: Check for negative values before reading them ASoC: rt5682: Fix deadlock on resume ASoC: hdmi-codec: Fix OOB memory accesses ASoC: soc-pcm: Move debugfs removal out of spinlock ASoC: soc-pcm: Fix DPCM lockdep warning due to nested stream locks ASoC: fsl: Add missing error handling in pcm030_fabric_probe ALSA: hda: Fix signedness of sscanf() arguments ALSA: usb-audio: initialize variables that could ignore errors ALSA: hda: Fix UAF of leds class devs at unbinding ASoC: qdsp6: q6apm-dai: only stop graphs that are started ASoC: codecs: wcd938x: fix return value of mixer put function ...
2022-02-04Merge tag 'drm-fixes-2022-02-04' of git://anongit.freedesktop.org/drm/drmLinus Torvalds38-160/+972
Pull drm fixes from Dave Airlie: "Regular fixes for the week. Daniel has agreed to bring back the fbcon hw acceleration under a CONFIG option for the non-drm fbdev users, we don't advise turning this on unless you are in the niche that is old fbdev drivers, Since it's essentially a revert and shouldn't be high impact seemed like a good time to do it now. Otherwise, i915 and amdgpu fixes are most of it, along with some minor fixes elsewhere. fbdev: - readd fbcon acceleration i915: - fix DP monitor via type-c dock - fix for engine busyness and read timeout with GuC - use ALLOW_FAIL for error capture buffer allocs - don't use interruptible lock on error paths - smatch fix to reject zero sized overlays. amdgpu: - mGPU fan boost fix for beige goby - S0ix fixes - Cyan skillfish hang fix - DCN fixes for DCN 3.1 - DCN fixes for DCN 3.01 - Apple retina panel fix - ttm logic inversion fix dma-buf: - heaps: fix potential spectre v1 gadget kmb: - fix potential oob access mxsfb: - fix NULL ptr deref nouveau: - fix potential oob access during BIOS decode" * tag 'drm-fixes-2022-02-04' of git://anongit.freedesktop.org/drm/drm: (24 commits) drm: mxsfb: Fix NULL pointer dereference drm/amdgpu: fix logic inversion in check drm/amd: avoid suspend on dGPUs w/ s2idle support when runtime PM enabled drm/amd/display: Force link_rate as LINK_RATE_RBR2 for 2018 15" Apple Retina panels drm/amd/display: revert "Reset fifo after enable otg" drm/amd/display: watermark latencies is not enough on DCN31 drm/amd/display: Update watermark values for DCN301 drm/amdgpu: fix a potential GPU hang on cyan skillfish drm/amd: Only run s3 or s0ix if system is configured properly drm/amd: add support to check whether the system is set to s3 fbcon: Add option to enable legacy hardware acceleration Revert "fbcon: Disable accelerated scrolling" Revert "fbdev: Garbage collect fbdev scrolling acceleration, part 1 (from TODO list)" drm/i915/pmu: Fix KMD and GuC race on accessing busyness dma-buf: heaps: Fix potential spectre v1 gadget drm/amd: Warn users about potential s0ix problems drm/amd/pm: correct the MGpuFanBoost support for Beige Goby drm/nouveau: fix off by one in BIOS boundary checking drm/i915/adlp: Fix TypeC PHY-ready status readout drm/i915/pmu: Use PM timestamp instead of RING TIMESTAMP for reference ...
2022-02-04riscv: Fix XIP_FIXUP_FLASH_OFFSETMyrtle Shah1-6/+5
There were several problems with the calculation. Not only was an 'and' being computed into t1 but thrown away; but the 'and' itself would cause problems if the granularity of the XIP physical address was less than XIP_OFFSET - in my case I had the kernel image at 2MB in SPI flash. Fixes: f9ace4ede49b ("riscv: remove .text section size limitation for XIP") Cc: [email protected] Signed-off-by: Myrtle Shah <[email protected]> Signed-off-by: Palmer Dabbelt <[email protected]>
2022-02-04Merge branch 'akpm' (patches from Andrew)Linus Torvalds10-56/+88
Merge misc fixes from Andrew Morton: "10 patches. Subsystems affected by this patch series: ipc, MAINTAINERS, and mm (vmscan, debug, pagemap, kmemleak, and selftests)" * emailed patches from Andrew Morton <[email protected]>: kselftest/vm: revert "tools/testing/selftests/vm/userfaultfd.c: use swap() to make code cleaner" MAINTAINERS: update rppt's email mm/kmemleak: avoid scanning potential huge holes ipc/sem: do not sleep with a spin lock held mm/pgtable: define pte_index so that preprocessor could recognize it mm/page_table_check: check entries at pmd levels mm/khugepaged: unify collapse pmd clear, flush and free mm/page_table_check: use unsigned long for page counters and cleanup mm/debug_vm_pgtable: remove pte entry from the page table Revert "mm/page_isolation: unset migratetype directly for non Buddy page"
2022-02-04random: only call crng_finalize_init() for primary_crngDominik Brodowski1-5/+5
crng_finalize_init() returns instantly if it is called for another pool than primary_crng. The test whether crng_finalize_init() is still required can be moved to the relevant caller in crng_reseed(), and crng_need_final_init can be reset to false if crng_finalize_init() is called with workqueues ready. Then, no previous callsite will call crng_finalize_init() unless it is needed, and we can get rid of the superfluous function parameter. Signed-off-by: Dominik Brodowski <[email protected]> Signed-off-by: Jason A. Donenfeld <[email protected]>
2022-02-04random: access primary_pool directly rather than through pointerDominik Brodowski1-7/+7
Both crng_initialize_primary() and crng_init_try_arch_early() are only called for the primary_pool. Accessing it directly instead of through a function parameter simplifies the code. Signed-off-by: Dominik Brodowski <[email protected]> Signed-off-by: Jason A. Donenfeld <[email protected]>
2022-02-04random: wake up /dev/random writers after zapJason A. Donenfeld1-1/+4
When account() is called, and the amount of entropy dips below random_write_wakeup_bits, we wake up the random writers, so that they can write some more in. However, the RNDZAPENTCNT/RNDCLEARPOOL ioctl sets the entropy count to zero -- a potential reduction just like account() -- but does not unblock writers. This commit adds the missing logic to that ioctl to unblock waiting writers. Reviewed-by: Dominik Brodowski <[email protected]> Signed-off-by: Jason A. Donenfeld <[email protected]>
2022-02-04random: continually use hwgenerator randomnessDominik Brodowski1-4/+6
The rngd kernel thread may sleep indefinitely if the entropy count is kept above random_write_wakeup_bits by other entropy sources. To make best use of multiple sources of randomness, mix entropy from hardware RNGs into the pool at least once within CRNG_RESEED_INTERVAL. Cc: Herbert Xu <[email protected]> Cc: Jason A. Donenfeld <[email protected]> Signed-off-by: Dominik Brodowski <[email protected]> Signed-off-by: Jason A. Donenfeld <[email protected]>
2022-02-04lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFIJason A. Donenfeld5-23/+33
blake2s_compress_generic is weakly aliased by blake2s_compress. The current harness for function selection uses a function pointer, which is ordinarily inlined and resolved at compile time. But when Clang's CFI is enabled, CFI still triggers when making an indirect call via a weak symbol. This seems like a bug in Clang's CFI, as though it's bucketing weak symbols and strong symbols differently. It also only seems to trigger when "full LTO" mode is used, rather than "thin LTO". [ 0.000000][ T0] Kernel panic - not syncing: CFI failure (target: blake2s_compress_generic+0x0/0x1444) [ 0.000000][ T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-mainline-06981-g076c855b846e #1 [ 0.000000][ T0] Hardware name: MT6873 (DT) [ 0.000000][ T0] Call trace: [ 0.000000][ T0] dump_backtrace+0xfc/0x1dc [ 0.000000][ T0] dump_stack_lvl+0xa8/0x11c [ 0.000000][ T0] panic+0x194/0x464 [ 0.000000][ T0] __cfi_check_fail+0x54/0x58 [ 0.000000][ T0] __cfi_slowpath_diag+0x354/0x4b0 [ 0.000000][ T0] blake2s_update+0x14c/0x178 [ 0.000000][ T0] _extract_entropy+0xf4/0x29c [ 0.000000][ T0] crng_initialize_primary+0x24/0x94 [ 0.000000][ T0] rand_initialize+0x2c/0x6c [ 0.000000][ T0] start_kernel+0x2f8/0x65c [ 0.000000][ T0] __primary_switched+0xc4/0x7be4 [ 0.000000][ T0] Rebooting in 5 seconds.. Nonetheless, the function pointer method isn't so terrific anyway, so this patch replaces it with a simple boolean, which also gets inlined away. This successfully works around the Clang bug. In general, I'm not too keen on all of the indirection involved here; it clearly does more harm than good. Hopefully the whole thing can get cleaned up down the road when lib/crypto is overhauled more comprehensively. But for now, we go with a simple bandaid. Fixes: 6048fdcc5f26 ("lib/crypto: blake2s: include as built-in") Link: https://github.com/ClangBuiltLinux/linux/issues/1567 Reported-by: Miles Chen <[email protected]> Tested-by: Miles Chen <[email protected]> Tested-by: Nathan Chancellor <[email protected]> Tested-by: John Stultz <[email protected]> Acked-by: Nick Desaulniers <[email protected]> Reviewed-by: Eric Biggers <[email protected]> Signed-off-by: Jason A. Donenfeld <[email protected]>
2022-02-04riscv: eliminate unreliable __builtin_frame_address(1)Changbin Du1-4/+5
I tried different pieces of code which uses __builtin_frame_address(1) (with both gcc version 7.5.0 and 10.3.0) to verify whether it works as expected on riscv64. The result is negative. What the compiler had generated is as below: 31 fp = (unsigned long)__builtin_frame_address(1); 0xffffffff80006024 <+200>: ld s1,0(s0) It takes '0(s0)' as the address of frame 1 (caller), but the actual address should be '-16(s0)'. | ... | <-+ +-----------------+ | | return address | | | previous fp | | | saved registers | | | local variables | | $fp --> | ... | | +-----------------+ | | return address | | | previous fp --------+ | saved registers | $sp --> | local variables | +-----------------+ This leads the kernel can not dump the full stack trace on riscv. [ 7.222126][ T1] Call Trace: [ 7.222804][ T1] [<ffffffff80006058>] dump_backtrace+0x2c/0x3a This problem is not exposed on most riscv builds just because the '0(s0)' occasionally is the address frame 2 (caller's caller), if only ra and fp are stored in frame 1 (caller). | ... | <-+ +-----------------+ | | return address | | $fp --> | previous fp | | +-----------------+ | | return address | | | previous fp --------+ | saved registers | $sp --> | local variables | +-----------------+ This could be a *bug* of gcc that should be fixed. But as noted in gcc manual "Calling this function with a nonzero argument can have unpredictable effects, including crashing the calling program.", let's remove the '__builtin_frame_address(1)' in backtrace code. With this fix now it can show full stack trace: [ 10.444838][ T1] Call Trace: [ 10.446199][ T1] [<ffffffff8000606c>] dump_backtrace+0x2c/0x3a [ 10.447711][ T1] [<ffffffff800060ac>] show_stack+0x32/0x3e [ 10.448710][ T1] [<ffffffff80a005c0>] dump_stack_lvl+0x58/0x7a [ 10.449941][ T1] [<ffffffff80a005f6>] dump_stack+0x14/0x1c [ 10.450929][ T1] [<ffffffff804c04ee>] ubsan_epilogue+0x10/0x5a [ 10.451869][ T1] [<ffffffff804c092e>] __ubsan_handle_load_invalid_value+0x6c/0x78 [ 10.453049][ T1] [<ffffffff8018f834>] __pagevec_release+0x62/0x64 [ 10.455476][ T1] [<ffffffff80190830>] truncate_inode_pages_range+0x132/0x5be [ 10.456798][ T1] [<ffffffff80190ce0>] truncate_inode_pages+0x24/0x30 [ 10.457853][ T1] [<ffffffff8045bb04>] kill_bdev+0x32/0x3c ... Signed-off-by: Changbin Du <[email protected]> Fixes: eac2f3059e02 ("riscv: stacktrace: fix the riscv stacktrace when CONFIG_FRAME_POINTER enabled") Cc: [email protected] Signed-off-by: Palmer Dabbelt <[email protected]>
2022-02-04Merge tag 'ceph-for-5.17-rc3' of git://github.com/ceph/ceph-clientLinus Torvalds6-70/+251
Pull ceph fixes from Ilya Dryomov: "A patch to make it possible to disable zero copy path in the messenger to avoid checksum or authentication tag mismatches and ensuing session resets in case the destination buffer isn't guaranteed to be stable" * tag 'ceph-for-5.17-rc3' of git://github.com/ceph/ceph-client: libceph: optionally use bounce buffer on recv path in crc mode libceph: make recv path in secure mode work the same as send path
2022-02-04Merge tag '9p-for-5.17-rc3' of git://github.com/martinetd/linuxLinus Torvalds1-5/+4
Pull 9p fix from Dominique Martinet: "Fix 'cannot walk open fid' rule The 9p 'walk' operation requires fid arguments to not originate from an open or create call and we've missed that for a while as the servers regularly running tests with don't enforce the check and no active reviewer knew about the rule. Both reporters confirmed reverting this patch fixes things for them and looking at it further wasn't actually required... Will take more time for follow up and enforcing the rule more thoroughly later" * tag '9p-for-5.17-rc3' of git://github.com/martinetd/linux: Revert "fs/9p: search open fids first"
2022-02-04rtla/trace: Error message fixupDaniel Bristot de Oliveira1-4/+4
Use capital and change "tracer %s" to "%s tracer". No functional change. Link: https://lkml.kernel.org/r/361697d27431afefa64c67c323564205385c418d.1643990447.git.bristot@kernel.org Fixes: b1696371d865 ("rtla: Helper functions for rtla") Cc: Daniel Bristot de Oliveira <[email protected]> Cc: [email protected] Cc: [email protected] Signed-off-by: Daniel Bristot de Oliveira <[email protected]> Signed-off-by: Steven Rostedt (Google) <[email protected]>
2022-02-04rtla/utils: Fix session duration parsingDaniel Bristot de Oliveira1-2/+2
Use gmtime to format the duration time. This avoids problems when the system uses local time different of Pisa's Local Time. Link: https://lkml.kernel.org/r/a2f0a37bc006c2561bb8ecd871cd70532b4a9f2d.1643990447.git.bristot@kernel.org Fixes: b1696371d865 ("rtla: Helper functions for rtla") Cc: Daniel Bristot de Oliveira <[email protected]> Cc: [email protected] Cc: [email protected] Signed-off-by: Daniel Bristot de Oliveira <[email protected]> Signed-off-by: Steven Rostedt (Google) <[email protected]>
2022-02-04rtla: Follow kernel versionDaniel Bristot de Oliveira1-1/+3
To avoid having commits with new version, it is just easier to follow kernel version. Link: https://lkml.kernel.org/r/9c2df0d1de65cea96c7d731fe64781a2bb90c5b3.1643990447.git.bristot@kernel.org Cc: Daniel Bristot de Oliveira <[email protected]> Cc: [email protected] Cc: [email protected] Signed-off-by: Daniel Bristot de Oliveira <[email protected]> Signed-off-by: Steven Rostedt (Google) <[email protected]>
2022-02-04Merge tag '5.17-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds9-199/+346
Pull cifs fixes from Steve French: "SMB3 client fixes including: - multiple fscache related fixes, reenabling ability to read/write to cached files for cifs.ko (that was temporarily disabled for cifs.ko a few weeks ago due to the recent fscache changes) - also includes a new fscache helper function ("query_occupancy") used by above - fix for multiuser mounts and NTLMSSP auth (workstation name) for stable - fix locking ordering problem in multichannel code - trivial malformed comment fix" * tag '5.17-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix workstation_name for multiuser mounts Invalidate fscache cookie only when inode attributes are changed. cifs: Fix the readahead conversion to manage the batch when reading from cache cifs: Implement cache I/O by accessing the cache directly netfs, cachefiles: Add a method to query presence of data in the cache cifs: Transition from ->readpages() to ->readahead() cifs: unlock chan_lock before calling cifs_put_tcp_session Fix a warning about a malformed kernel doc comment in cifs
2022-02-04kselftest/vm: revert "tools/testing/selftests/vm/userfaultfd.c: use swap() ↵Shuah Khan1-2/+7
to make code cleaner" With this change, userfaultfd fails to build with undefined reference swap() error: userfaultfd.c: In function `userfaultfd_stress': userfaultfd.c:1530:17: warning: implicit declaration of function `swap'; did you mean `swab'? [-Wimplicit-function-declaration] 1530 | swap(area_src, area_dst); | ^~~~ | swab /usr/bin/ld: /tmp/ccDGOAdV.o: in function `userfaultfd_stress': userfaultfd.c:(.text+0x549e): undefined reference to `swap' /usr/bin/ld: userfaultfd.c:(.text+0x54bc): undefined reference to `swap' collect2: error: ld returned 1 exit status Revert the commit to fix the problem. Link: https://lkml.kernel.org/r/[email protected] Fixes: 2c769ed7137a ("tools/testing/selftests/vm/userfaultfd.c: use swap() to make code cleaner") Signed-off-by: Shuah Khan <[email protected]> Cc: Shuah Khan <[email protected]> Cc: Minghao Chi <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2022-02-04MAINTAINERS: update rppt's emailMike Rapoport1-1/+1
Use my @kernel.org address Link: https://lkml.kernel.org/r/[email protected] Signed-off-by: Mike Rapoport <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2022-02-04mm/kmemleak: avoid scanning potential huge holesLang Yu1-6/+7
When using devm_request_free_mem_region() and devm_memremap_pages() to add ZONE_DEVICE memory, if requested free mem region's end pfn were huge(e.g., 0x400000000), the node_end_pfn() will be also huge (see move_pfn_range_to_zone()). Thus it creates a huge hole between node_start_pfn() and node_end_pfn(). We found on some AMD APUs, amdkfd requested such a free mem region and created a huge hole. In such a case, following code snippet was just doing busy test_bit() looping on the huge hole. for (pfn = start_pfn; pfn < end_pfn; pfn++) { struct page *page = pfn_to_online_page(pfn); if (!page) continue; ... } So we got a soft lockup: watchdog: BUG: soft lockup - CPU#6 stuck for 26s! [bash:1221] CPU: 6 PID: 1221 Comm: bash Not tainted 5.15.0-custom #1 RIP: 0010:pfn_to_online_page+0x5/0xd0 Call Trace: ? kmemleak_scan+0x16a/0x440 kmemleak_write+0x306/0x3a0 ? common_file_perm+0x72/0x170 full_proxy_write+0x5c/0x90 vfs_write+0xb9/0x260 ksys_write+0x67/0xe0 __x64_sys_write+0x1a/0x20 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae I did some tests with the patch. (1) amdgpu module unloaded before the patch: real 0m0.976s user 0m0.000s sys 0m0.968s after the patch: real 0m0.981s user 0m0.000s sys 0m0.973s (2) amdgpu module loaded before the patch: real 0m35.365s user 0m0.000s sys 0m35.354s after the patch: real 0m1.049s user 0m0.000s sys 0m1.042s Link: https://lkml.kernel.org/r/[email protected] Signed-off-by: Lang Yu <[email protected]> Acked-by: David Hildenbrand <[email protected]> Acked-by: Catalin Marinas <[email protected]> Cc: Oscar Salvador <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2022-02-04ipc/sem: do not sleep with a spin lock heldMinghao Chi1-2/+2
We can't call kvfree() with a spin lock held, so defer it. Link: https://lkml.kernel.org/r/[email protected] Fixes: fc37a3b8b438 ("[PATCH] ipc sem: use kvmalloc for sem_undo allocation") Reported-by: Zeal Robot <[email protected]> Signed-off-by: Minghao Chi <[email protected]> Reviewed-by: Shakeel Butt <[email protected]> Reviewed-by: Manfred Spraul <[email protected]> Cc: Arnd Bergmann <[email protected]> Cc: Yang Guang <[email protected]> Cc: Davidlohr Bueso <[email protected]> Cc: Randy Dunlap <[email protected]> Cc: Bhaskar Chowdhury <[email protected]> Cc: Vasily Averin <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2022-02-04mm/pgtable: define pte_index so that preprocessor could recognize itMike Rapoport1-0/+1
Since commit 974b9b2c68f3 ("mm: consolidate pte_index() and pte_offset_*() definitions") pte_index is a static inline and there is no define for it that can be recognized by the preprocessor. As a result, vm_insert_pages() uses slower loop over vm_insert_page() instead of insert_pages() that amortizes the cost of spinlock operations when inserting multiple pages. Link: https://lkml.kernel.org/r/[email protected] Fixes: 974b9b2c68f3 ("mm: consolidate pte_index() and pte_offset_*() definitions") Signed-off-by: Mike Rapoport <[email protected]> Reported-by: Christian Dietrich <[email protected]> Reviewed-by: Khalid Aziz <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2022-02-04mm/page_table_check: check entries at pmd levelsPasha Tatashin3-0/+42
syzbot detected a case where the page table counters were not properly updated. syzkaller login: ------------[ cut here ]------------ kernel BUG at mm/page_table_check.c:162! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3099 Comm: pasha Not tainted 5.16.0+ #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIO4 RIP: 0010:__page_table_check_zero+0x159/0x1a0 Call Trace: free_pcp_prepare+0x3be/0xaa0 free_unref_page+0x1c/0x650 free_compound_page+0xec/0x130 free_transhuge_page+0x1be/0x260 __put_compound_page+0x90/0xd0 release_pages+0x54c/0x1060 __pagevec_release+0x7c/0x110 shmem_undo_range+0x85e/0x1250 ... The repro involved having a huge page that is split due to uprobe event temporarily replacing one of the pages in the huge page. Later the huge page was combined again, but the counters were off, as the PTE level was not properly updated. Make sure that when PMD is cleared and prior to freeing the level the PTEs are updated. Link: https://lkml.kernel.org/r/[email protected] Fixes: df4e817b7108 ("mm: page table check") Signed-off-by: Pasha Tatashin <[email protected]> Acked-by: David Rientjes <[email protected]> Cc: Aneesh Kumar K.V <[email protected]> Cc: Anshuman Khandual <[email protected]> Cc: Dave Hansen <[email protected]> Cc: Greg Thelen <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Hugh Dickins <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Jiri Slaby <[email protected]> Cc: Mike Rapoport <[email protected]> Cc: Muchun Song <[email protected]> Cc: Paul Turner <[email protected]> Cc: Wei Xu <[email protected]> Cc: Will Deacon <[email protected]> Cc: Zi Yan <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2022-02-04mm/khugepaged: unify collapse pmd clear, flush and freePasha Tatashin1-16/+18
Unify the code that flushes, clears pmd entry, and frees the PTE table level into a new function collapse_and_free_pmd(). This cleanup is useful as in the next patch we will add another call to this function to iterate through PTE prior to freeing the level for page table check. Link: https://lkml.kernel.org/r/[email protected] Signed-off-by: Pasha Tatashin <[email protected]> Acked-by: David Rientjes <[email protected]> Cc: Aneesh Kumar K.V <[email protected]> Cc: Anshuman Khandual <[email protected]> Cc: Dave Hansen <[email protected]> Cc: Greg Thelen <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Hugh Dickins <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Jiri Slaby <[email protected]> Cc: Mike Rapoport <[email protected]> Cc: Muchun Song <[email protected]> Cc: Paul Turner <[email protected]> Cc: Wei Xu <[email protected]> Cc: Will Deacon <[email protected]> Cc: Zi Yan <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2022-02-04mm/page_table_check: use unsigned long for page counters and cleanupPasha Tatashin1-28/+7
For consistency, use "unsigned long" for all page counters. Also, reduce code duplication by calling __page_table_check_*_clear() from __page_table_check_*_set() functions. Link: https://lkml.kernel.org/r/[email protected] Signed-off-by: Pasha Tatashin <[email protected]> Reviewed-by: Wei Xu <[email protected]> Acked-by: David Rientjes <[email protected]> Cc: Aneesh Kumar K.V <[email protected]> Cc: Anshuman Khandual <[email protected]> Cc: Dave Hansen <[email protected]> Cc: Greg Thelen <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Hugh Dickins <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Jiri Slaby <[email protected]> Cc: Mike Rapoport <[email protected]> Cc: Muchun Song <[email protected]> Cc: Paul Turner <[email protected]> Cc: Will Deacon <[email protected]> Cc: Zi Yan <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2022-02-04mm/debug_vm_pgtable: remove pte entry from the page tablePasha Tatashin1-0/+2
Patch series "page table check fixes and cleanups", v5. This patch (of 4): The pte entry that is used in pte_advanced_tests() is never removed from the page table at the end of the test. The issue is detected by page_table_check, to repro compile kernel with the following configs: CONFIG_DEBUG_VM_PGTABLE=y CONFIG_PAGE_TABLE_CHECK=y CONFIG_PAGE_TABLE_CHECK_ENFORCED=y During the boot the following BUG is printed: debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers ------------[ cut here ]------------ kernel BUG at mm/page_table_check.c:162! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.16.0-11413-g2c271fe77d52 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 ... The entry should be properly removed from the page table before the page is released to the free list. Link: https://lkml.kernel.org/r/[email protected] Link: https://lkml.kernel.org/r/[email protected] Fixes: a5c3b9ffb0f4 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") Signed-off-by: Pasha Tatashin <[email protected]> Reviewed-by: Zi Yan <[email protected]> Tested-by: Zi Yan <[email protected]> Acked-by: David Rientjes <[email protected]> Reviewed-by: Anshuman Khandual <[email protected]> Cc: Paul Turner <[email protected]> Cc: Wei Xu <[email protected]> Cc: Greg Thelen <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Will Deacon <[email protected]> Cc: Mike Rapoport <[email protected]> Cc: Dave Hansen <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Aneesh Kumar K.V <[email protected]> Cc: Jiri Slaby <[email protected]> Cc: Muchun Song <[email protected]> Cc: Hugh Dickins <[email protected]> Cc: <[email protected]> [5.9+] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2022-02-04Revert "mm/page_isolation: unset migratetype directly for non Buddy page"Chen Wandun1-1/+1
This reverts commit 721fb891ad0b3956d5c168b2931e3e5e4fb7ca40. Commit 721fb891ad0b ("mm/page_isolation: unset migratetype directly for non Buddy page") will result memory that should in buddy disappear by mistake. move_freepages_block moves all pages in pageblock instead of pages indicated by input parameter, so if input pages is not in buddy but other pages in pageblock is in buddy, it will result in page out of control. Link: https://lkml.kernel.org/r/[email protected] Fixes: 721fb891ad0b ("mm/page_isolation: unset migratetype directly for non Buddy page") Signed-off-by: Chen Wandun <[email protected]> Reported-by: "kernelci.org bot" <[email protected]> Acked-by: David Hildenbrand <[email protected]> Tested-by: Dong Aisheng <[email protected]> Tested-by: Francesco Dolcini <[email protected]> Acked-by: Vlastimil Babka <[email protected]> Tested-by: Guenter Roeck <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2022-02-04Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nfJakub Kicinski7-27/+61
Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Don't refresh timeout for SCTP flows in CLOSED state. 2) Don't allow access to transport header if fragment offset is set on. 3) Reinitialize internal conntrack state for retransmitted TCP syn-ack packet. 4) Update MAINTAINER file to add the Netfilter group tree. Moving forward, Florian Westphal has access to this tree so he can also send pull requests. 5) Set on IPS_HELPER for entries created via ctnetlink, otherwise NAT might zap it. All patches from Florian Westphal. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: ctnetlink: disable helper autoassign MAINTAINERS: netfilter: update git links netfilter: conntrack: re-init state for retransmitted syn-ack netfilter: conntrack: move synack init code to helper netfilter: nft_payload: don't allow th access for fragments netfilter: conntrack: don't refresh sctp entries in closed state ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2022-02-04eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAXJonas Malaco1-0/+3
Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size") revealed that ee1004_eeprom_read() did not properly limit how many bytes to read at once. In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the length to read as an u8. If count == 256 after taking into account the offset and page boundary, the cast to u8 overflows. And this is common when user space tries to read the entire EEPROM at once. To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows. Fixes: effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size") Cc: [email protected] Reviewed-by: Heiner Kallweit <[email protected]> Signed-off-by: Jonas Malaco <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2022-02-04vt_ioctl: add array_index_nospec to VT_ACTIVATEJakob Koschel1-0/+1
in vt_setactivate an almost identical code path has been patched with array_index_nospec. In the VT_ACTIVATE path the user input is from a system call argument instead of a usercopy. For consistency both code paths should have the same mitigations applied. Kasper Acknowledgements: Jakob Koschel, Brian Johannesmeyer, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida from the VUSec group at VU Amsterdam. Co-developed-by: Brian Johannesmeyer <[email protected]> Signed-off-by: Brian Johannesmeyer <[email protected]> Signed-off-by: Jakob Koschel <[email protected]> Link: https://lore.kernel.org/r/[email protected] Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2022-02-04vt_ioctl: fix array_index_nospec in vt_setactivateJakob Koschel1-1/+1
array_index_nospec ensures that an out-of-bounds value is set to zero on the transient path. Decreasing the value by one afterwards causes a transient integer underflow. vsa.console should be decreased first and then sanitized with array_index_nospec. Kasper Acknowledgements: Jakob Koschel, Brian Johannesmeyer, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida from the VUSec group at VU Amsterdam. Co-developed-by: Brian Johannesmeyer <[email protected]> Signed-off-by: Brian Johannesmeyer <[email protected]> Signed-off-by: Jakob Koschel <[email protected]> Link: https://lore.kernel.org/r/[email protected] Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.