2020-08-20 10:40:23

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 000/149] 4.4.233-rc1 review

This is the start of the stable review cycle for the 4.4.233 release.
There are 149 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>
Linux 4.4.233-rc1

WANG Cong <[email protected]>
ipv6: check skb->protocol before lookup for nexthop

Denis Efremov <[email protected]>
drm/radeon: fix fb_div check in ni_init_smc_spll_table()

Geert Uytterhoeven <[email protected]>
sh: landisk: Add missing initialization of sh_io_port_base

Dinghao Liu <[email protected]>
ALSA: echoaudio: Fix potential Oops in snd_echo_resume()

Andy Shevchenko <[email protected]>
mfd: dln2: Run event handler loop under spinlock

Colin Ian King <[email protected]>
fs/ufs: avoid potential u32 multiplication overflow

Jeffrey Mitchell <[email protected]>
nfs: Fix getxattr kernel panic and memory overflow

Dan Carpenter <[email protected]>
drm/vmwgfx: Fix two list_for_each loop exit tests

Colin Ian King <[email protected]>
Input: sentelic - fix error return when fsp_reg_write fails

Xu Wang <[email protected]>
clk: clk-atlas6: fix return value check in atlas6_clk_init()

Wolfram Sang <[email protected]>
i2c: rcar: slave: only send STOP event when we have been addressed

Liu Yi L <[email protected]>
iommu/vt-d: Enforce PASID devTLB field mask

Colin Ian King <[email protected]>
iommu/omap: Check for failure of a call to omap_iommu_dump_ctx

Johan Hovold <[email protected]>
USB: serial: ftdi_sio: fix break and sysrq handling

Johan Hovold <[email protected]>
USB: serial: ftdi_sio: clean up receive processing

Johan Hovold <[email protected]>
USB: serial: ftdi_sio: make process-packet buffer unsigned

Anton Blanchard <[email protected]>
pseries: Fix 64 bit logical memory block panic

Muchun Song <[email protected]>
kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler

Junxiao Bi <[email protected]>
ocfs2: change slot number type s16 to u16

Mikulas Patocka <[email protected]>
ext2: fix missing percpu_counter_inc

Huacai Chen <[email protected]>
MIPS: CPU#0 is not hotpluggable

Johannes Berg <[email protected]>
mac80211: fix misplaced while instead of if

Coly Li <[email protected]>
bcache: allocate meta data pages as compound pages

ChangSyun Peng <[email protected]>
md/raid5: Fix Force reconstruct-write io stuck in degraded raid5

Jonathan McDowell <[email protected]>
net: stmmac: dwmac1000: provide multicast filter fallback

Jonathan McDowell <[email protected]>
net: ethernet: stmmac: Disable hardware multicast filter

Michael Ellerman <[email protected]>
powerpc: Fix circular dependency between percpu.h and mmu.h

Filipe Manana <[email protected]>
btrfs: fix memory leaks after failure to lookup checksums during inode logging

Josef Bacik <[email protected]>
btrfs: only search for left_info if there is no right_info in try_merge_free_space

Rafael J. Wysocki <[email protected]>
PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()

Roger Pau Monne <[email protected]>
xen/balloon: make the balloon wait interruptible

Roger Pau Monne <[email protected]>
xen/balloon: fix accounting in alloc_xenballooned_pages error path

Nathan Huckleberry <[email protected]>
ARM: 8992/1: Fix unwind_frame for clang-built kernels

Sven Schnelle <[email protected]>
parisc: mask out enable and reserved bits from sba imask

Zheng Bin <[email protected]>
9p: Fix memory leak in v9fs_mount

Hector Martin <[email protected]>
ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109

Eric Biggers <[email protected]>
fs/minix: reject too-large maximum file size

Eric Biggers <[email protected]>
fs/minix: don't allow getting deleted inodes

Eric Biggers <[email protected]>
fs/minix: check return value of sb_getblk()

Tom Rix <[email protected]>
crypto: qat - fix double free in qat_uclo_create_batch_init_list

Hector Martin <[email protected]>
ALSA: usb-audio: add quirk for Pioneer DDJ-RB

Hector Martin <[email protected]>
ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109

Mirko Dietrich <[email protected]>
ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support

Miaohe Lin <[email protected]>
net: Set fput_needed iff FDPUT_FPUT is set

Qingyu Li <[email protected]>
net/nfc/rawsock.c: add CAP_NET_RAW check.

Xie He <[email protected]>
drivers/net/wan/lapbether: Added needed_headroom and a skb->len check

Drew Fustini <[email protected]>
pinctrl-single: fix pcs_parse_pinconf() return value

Wang Hai <[email protected]>
dlm: Fix kobject memleak

Christophe JAILLET <[email protected]>
net: spider_net: Fix the size used in a 'dma_free_coherent()' call

Wang Hai <[email protected]>
wl1251: fix always return 0 error

Julian Wiedmann <[email protected]>
s390/qeth: don't process empty bridge port events

Tom Rix <[email protected]>
power: supply: check if calc_soc succeeded in pm860x_init_battery

Dan Carpenter <[email protected]>
Smack: prevent underflow in smk_set_cipso()

Dan Carpenter <[email protected]>
Smack: fix another vsscanf out of bounds

Finn Thain <[email protected]>
scsi: mesh: Fix panic after host or bus reset

Marek Szyprowski <[email protected]>
usb: dwc2: Fix error path in gadget registration

Xiongfeng Wang <[email protected]>
PCI/ASPM: Add missing newline in sysfs 'policy'

Milton Miller <[email protected]>
powerpc/vdso: Fix vdso cpu truncation

Dan Carpenter <[email protected]>
mwifiex: Prevent memory corruption handling keys

Laurent Pinchart <[email protected]>
drm: panel: simple: Fix bpc for LG LB070WV8 panel

Chuhong Yuan <[email protected]>
media: exynos4-is: Add missed check for pinctrl_lookup_state()

Dan Carpenter <[email protected]>
media: firewire: Using uninitialized values in node_probe()

Christophe JAILLET <[email protected]>
scsi: eesox: Fix different dev_id between request_irq() and free_irq()

Christophe JAILLET <[email protected]>
scsi: powertec: Fix different dev_id between request_irq() and free_irq()

Colin Ian King <[email protected]>
drm/radeon: fix array out-of-bounds read and write issues

Wang Hai <[email protected]>
cxl: Fix kobject memleak

Christophe JAILLET <[email protected]>
scsi: cumana_2: Fix different dev_id between request_irq() and free_irq()

Chuhong Yuan <[email protected]>
media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities()

Arnd Bergmann <[email protected]>
leds: lm355x: avoid enum conversion warning

Tomasz Duszynski <[email protected]>
iio: improve IIO_CONCENTRATION channel type description

Dejin Zheng <[email protected]>
console: newport_con: fix an issue about leak related system resources

Dejin Zheng <[email protected]>
video: fbdev: sm712fb: fix an issue about iounmap for a wrong address

Qiushi Wu <[email protected]>
agp/intel: Fix a memory leak on module initialisation failure

Erik Kaneda <[email protected]>
ACPICA: Do not increment operation_region reference counts for field units

Coly Li <[email protected]>
bcache: fix super block seq numbers comparision in register_cache_set()

Jim Cromie <[email protected]>
dyndbg: fix a BUG_ON in ddebug_describe_flags

Sasi Kumar <[email protected]>
bdc: Fix bug causing crash after multiple disconnects

Evgeny Novikov <[email protected]>
usb: gadget: net2280: fix memory leak on probe error handling paths

Bolarinwa Olayemi Saheed <[email protected]>
iwlegacy: Check the return value of pcie_capability_read_*()

Prasanna Kerekoppa <[email protected]>
brcmfmac: To fix Bss Info flag definition Bug

Paul E. McKenney <[email protected]>
mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls

Michael Tretter <[email protected]>
drm/debugfs: fix plain echo to connector "force" attribute

Aditya Pakki <[email protected]>
drm/nouveau: fix multiple instances of reference count leaks

Evgeny Novikov <[email protected]>
video: fbdev: neofb: fix memory leak in neo_scan_monitor()

Aditya Pakki <[email protected]>
drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync

Paul E. McKenney <[email protected]>
fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls

Lihong Kou <[email protected]>
Bluetooth: add a mutex lock to avoid UAF in do_enale_set

Tomi Valkeinen <[email protected]>
drm/tilcdc: fix leak & null ref in panel_connector_get_modes

Yu Kuai <[email protected]>
ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh()

yu kuai <[email protected]>
ARM: at91: pm: add missing put_device() call in at91_pm_sram_init()

Finn Thain <[email protected]>
m68k: mac: Fix IOP status/control register writes

Finn Thain <[email protected]>
m68k: mac: Don't send IOP message until channel is idle

Qiushi Wu <[email protected]>
EDAC: Fix reference count leaks

Uwe Kleine-König <[email protected]>
gpio: fix oops resulting from calling of_get_named_gpio(NULL, ...)

Dexuan Cui <[email protected]>
udp: drop corrupt packets earlier to avoid data corruption

Nick Desaulniers <[email protected]>
tracepoint: Mark __tracepoint_string's __used

Eric Biggers <[email protected]>
Smack: fix use-after-free in smk_write_relabel_self()

Ido Schimmel <[email protected]>
vxlan: Ensure FDB dump is performed under RCU

Rustam Kovhaev <[email protected]>
usb: hso: check for return value in hso_serial_common_create()

Johan Hovold <[email protected]>
net: lan78xx: replace bogus endpoint lookup

Hangbin Liu <[email protected]>
Revert "vxlan: fix tos value before xmit"

Cong Wang <[email protected]>
ipv6: fix memory leaks on IPV6_ADDRFORM path

Ido Schimmel <[email protected]>
ipv4: Silence suspicious RCU usage warning

Jann Horn <[email protected]>
binder: Prevent context manager from incrementing ref 0

Philippe Duplessis-Guindon <[email protected]>
tools lib traceevent: Fix memory leak in process_dynamic_array_len

Xin Xiong <[email protected]>
atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent

Francesco Ruggeri <[email protected]>
igb: reinit_locked() should be called with rtnl_lock

Julian Squires <[email protected]>
cfg80211: check vendor command doit pointer before use

Ben Skeggs <[email protected]>
drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason

Christoph Hellwig <[email protected]>
net/9p: validate fds in p9_fd_open

Greg Kroah-Hartman <[email protected]>
mtd: properly check all write ioctls for permissions

Yunhai Zhang <[email protected]>
vgacon: Fix for missing check in scrollback handling

Peilin Ye <[email protected]>
Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()

Peilin Ye <[email protected]>
Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()

Peilin Ye <[email protected]>
Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()

Takashi Iwai <[email protected]>
ALSA: seq: oss: Serialize ioctls

Erik Ekman <[email protected]>
USB: serial: qcserial: add EM7305 QDL product ID

Jiang Ying <[email protected]>
ext4: fix direct I/O read error

Linus Torvalds <[email protected]>
random32: move the pseudo-random 32-bit definitions to prandom.h

Linus Torvalds <[email protected]>
random32: remove net_rand_state from the latent entropy gcc plugin

Willy Tarreau <[email protected]>
random: fix circular include dependency on arm64 after addition of percpu.h

Grygorii Strashko <[email protected]>
ARM: percpu.h: fix build error

Willy Tarreau <[email protected]>
random32: update the net random state on interrupt and activity

Thomas Gleixner <[email protected]>
x86/i8259: Use printk_deferred() to prevent deadlock

Andrea Righi <[email protected]>
xen-netfront: fix potential deadlock in xennet_remove()

Raviteja Narayanam <[email protected]>
Revert "i2c: cadence: Fix the hold bit setting"

Yoshihiro Shimoda <[email protected]>
net: ethernet: ravb: exit if re-initialization fails in tx timeout

Navid Emamdoost <[email protected]>
nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame

Remi Pommarel <[email protected]>
mac80211: mesh: Free ie data when leaving mesh

Ido Schimmel <[email protected]>
mlxsw: core: Increase scope of RCU read-side critical section

Johan Hovold <[email protected]>
net: lan78xx: fix transfer-buffer memory leak

Johan Hovold <[email protected]>
net: lan78xx: add missing endpoint sanity check

Michael Karcher <[email protected]>
sh: Fix validation of system call number

YueHaibing <[email protected]>
net/x25: Fix null-ptr-deref in x25_disconnect

Xiyu Yang <[email protected]>
net/x25: Fix x25_neigh refcnt leak when x25 disconnect

Peilin Ye <[email protected]>
rds: Prevent kernel-infoleak in rds_notify_queue_get()

Tetsuo Handa <[email protected]>
fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.

Will Deacon <[email protected]>
ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints

Sheng Yong <[email protected]>
f2fs: check if file namelen exceeds max value

Jaegeuk Kim <[email protected]>
f2fs: check memory boundary by insane namelen

Steve Cohen <[email protected]>
drm: hold gem reference until object is no longer accessed

Peilin Ye <[email protected]>
drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()

Robert Hancock <[email protected]>
PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge

Andreas Gruenbacher <[email protected]>
nfs: Move call to security_inode_listsecurity into nfs_listxattr

Navid Emamdoost <[email protected]>
ath9k: release allocated buffer if timed out

Navid Emamdoost <[email protected]>
ath9k_htc: release allocated buffer if timed out

Navid Emamdoost <[email protected]>
media: rc: prevent memory leak in cx23888_ir_probe

Wei Yongjun <[email protected]>
net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe()

Eric Sandeen <[email protected]>
xfs: don't call xfs_da_shrink_inode with NULL bp


-------------

Diffstat:

Documentation/ABI/testing/sysfs-bus-iio | 3 +-
Makefile | 4 +-
arch/arm/include/asm/percpu.h | 2 +
arch/arm/kernel/hw_breakpoint.c | 27 ++++-
arch/arm/kernel/stacktrace.c | 24 +++++
arch/arm/mach-at91/pm.c | 11 +-
arch/arm/mach-socfpga/pm.c | 8 +-
arch/m68k/mac/iop.c | 21 ++--
arch/mips/kernel/topology.c | 2 +-
arch/powerpc/include/asm/percpu.h | 4 +-
arch/powerpc/kernel/vdso.c | 2 +-
arch/powerpc/platforms/pseries/hotplug-memory.c | 2 +-
arch/sh/boards/mach-landisk/setup.c | 3 +
arch/sh/kernel/entry-common.S | 6 +-
arch/x86/kernel/i8259.c | 2 +-
drivers/acpi/acpica/exprep.c | 4 -
drivers/acpi/acpica/utdelete.c | 6 +-
drivers/android/binder.c | 9 ++
drivers/atm/atmtcp.c | 10 +-
drivers/char/agp/intel-gtt.c | 4 +-
drivers/char/random.c | 1 +
drivers/clk/sirf/clk-atlas6.c | 2 +-
drivers/crypto/qat/qat_common/qat_uclo.c | 9 +-
drivers/edac/edac_device_sysfs.c | 1 +
drivers/edac/edac_pci_sysfs.c | 2 +-
drivers/gpio/gpiolib-of.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 +-
drivers/gpu/drm/drm_debugfs.c | 8 +-
drivers/gpu/drm/drm_gem.c | 10 +-
drivers/gpu/drm/nouveau/nouveau_drm.c | 8 +-
drivers/gpu/drm/nouveau/nouveau_fbcon.c | 1 +
drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +-
drivers/gpu/drm/panel/panel-simple.c | 2 +-
drivers/gpu/drm/radeon/ci_dpm.c | 2 +-
drivers/gpu/drm/radeon/ni_dpm.c | 2 +-
drivers/gpu/drm/radeon/radeon_display.c | 4 +-
drivers/gpu/drm/radeon/radeon_drv.c | 4 +-
drivers/gpu/drm/radeon/radeon_kms.c | 4 +-
drivers/gpu/drm/tilcdc/tilcdc_panel.c | 6 +-
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 +-
drivers/i2c/busses/i2c-cadence.c | 9 +-
drivers/i2c/busses/i2c-rcar.c | 7 +-
drivers/input/mouse/sentelic.c | 2 +-
drivers/iommu/omap-iommu-debug.c | 3 +
drivers/leds/leds-lm355x.c | 7 +-
drivers/md/bcache/bset.c | 2 +-
drivers/md/bcache/btree.c | 2 +-
drivers/md/bcache/journal.c | 4 +-
drivers/md/bcache/super.c | 11 +-
drivers/md/raid5.c | 3 +-
drivers/media/firewire/firedtv-fw.c | 2 +
drivers/media/pci/cx23885/cx23888-ir.c | 5 +-
drivers/media/platform/exynos4-is/media-dev.c | 3 +
drivers/media/platform/omap3isp/isppreview.c | 4 +-
drivers/mfd/dln2.c | 4 +
drivers/misc/cxl/sysfs.c | 5 +-
drivers/mtd/mtdchar.c | 56 +++++++++--
drivers/net/ethernet/intel/igb/igb_main.c | 9 ++
drivers/net/ethernet/mellanox/mlxsw/core.c | 6 +-
drivers/net/ethernet/renesas/ravb_main.c | 26 ++++-
.../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 1 +
.../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 3 +
drivers/net/ethernet/toshiba/spider_net.c | 4 +-
drivers/net/phy/mdio-bcm-unimac.c | 2 +
drivers/net/usb/hso.c | 5 +-
drivers/net/usb/lan78xx.c | 112 ++++++---------------
drivers/net/vxlan.c | 8 +-
drivers/net/wan/lapbether.c | 10 +-
drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +
drivers/net/wireless/ath/ath9k/wmi.c | 1 +
.../net/wireless/brcm80211/brcmfmac/fwil_types.h | 2 +-
drivers/net/wireless/iwlegacy/common.c | 4 +-
drivers/net/wireless/mwifiex/sta_cmdresp.c | 22 ++--
drivers/net/wireless/ti/wl1251/event.c | 2 +-
drivers/net/xen-netfront.c | 64 ++++++++----
drivers/nfc/s3fwrn5/core.c | 1 +
drivers/parisc/sba_iommu.c | 2 +-
drivers/pci/hotplug/acpiphp_glue.c | 14 ++-
drivers/pci/pcie/aspm.c | 1 +
drivers/pci/quirks.c | 13 +++
drivers/pinctrl/pinctrl-single.c | 11 +-
drivers/power/88pm860x_battery.c | 6 +-
drivers/s390/net/qeth_l2_main.c | 4 +
drivers/scsi/arm/cumana_2.c | 2 +-
drivers/scsi/arm/eesox.c | 2 +-
drivers/scsi/arm/powertec.c | 2 +-
drivers/scsi/mesh.c | 8 +-
drivers/usb/dwc2/platform.c | 4 +-
drivers/usb/gadget/udc/bdc/bdc_core.c | 4 +
drivers/usb/gadget/udc/bdc/bdc_ep.c | 16 +--
drivers/usb/gadget/udc/net2280.c | 4 +-
drivers/usb/serial/ftdi_sio.c | 57 ++++++-----
drivers/usb/serial/qcserial.c | 1 +
drivers/video/console/bitblit.c | 4 +-
drivers/video/console/fbcon_ccw.c | 4 +-
drivers/video/console/fbcon_cw.c | 4 +-
drivers/video/console/fbcon_ud.c | 4 +-
drivers/video/console/newport_con.c | 12 ++-
drivers/video/console/vgacon.c | 4 +
drivers/video/fbdev/neofb.c | 1 +
drivers/video/fbdev/sm712fb.c | 2 +
drivers/xen/balloon.c | 12 ++-
fs/9p/v9fs.c | 5 +-
fs/btrfs/extent_io.c | 2 +
fs/btrfs/free-space-cache.c | 4 +-
fs/btrfs/tree-log.c | 8 +-
fs/dlm/lockspace.c | 6 +-
fs/ext2/ialloc.c | 3 +-
fs/ext4/inode.c | 7 ++
fs/f2fs/dir.c | 12 ++-
fs/minix/inode.c | 36 ++++++-
fs/minix/itree_common.c | 8 +-
fs/nfs/nfs4proc.c | 55 ++++++----
fs/nfs/nfs4xdr.c | 6 +-
fs/ocfs2/ocfs2.h | 4 +-
fs/ocfs2/suballoc.c | 4 +-
fs/ocfs2/super.c | 4 +-
fs/ufs/super.c | 2 +-
fs/xattr.c | 4 +
fs/xfs/libxfs/xfs_attr_leaf.c | 5 +-
include/linux/intel-iommu.h | 4 +-
include/linux/prandom.h | 78 ++++++++++++++
include/linux/random.h | 63 +-----------
include/linux/tracepoint.h | 2 +-
include/net/addrconf.h | 1 +
kernel/kprobes.c | 7 ++
kernel/time/timer.c | 8 ++
lib/dynamic_debug.c | 23 ++---
lib/random32.c | 2 +-
mm/mmap.c | 1 +
net/9p/trans_fd.c | 24 +++--
net/bluetooth/6lowpan.c | 5 +
net/bluetooth/hci_event.c | 11 +-
net/ipv4/fib_trie.c | 2 +-
net/ipv4/udp.c | 3 +-
net/ipv6/anycast.c | 17 +++-
net/ipv6/ip6_tunnel.c | 32 +++---
net/ipv6/ipv6_sockglue.c | 1 +
net/ipv6/udp.c | 6 +-
net/mac80211/cfg.c | 1 +
net/mac80211/sta_info.c | 2 +-
net/nfc/rawsock.c | 7 +-
net/rds/recv.c | 3 +-
net/socket.c | 2 +-
net/wireless/nl80211.c | 6 +-
net/x25/x25_subr.c | 6 ++
security/smack/smack_lsm.c | 2 -
security/smack/smackfs.c | 19 +++-
sound/core/seq/oss/seq_oss.c | 8 +-
sound/pci/echoaudio/echoaudio.c | 2 -
sound/usb/card.h | 1 +
sound/usb/mixer_quirks.c | 1 +
sound/usb/pcm.c | 6 ++
sound/usb/quirks-table.h | 64 +++++++++++-
sound/usb/quirks.c | 3 +
sound/usb/stream.c | 1 +
tools/lib/traceevent/event-parse.c | 1 +
157 files changed, 973 insertions(+), 476 deletions(-)



2020-08-20 10:40:25

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 027/149] random32: update the net random state on interrupt and activity

From: Willy Tarreau <[email protected]>

commit f227e3ec3b5cad859ad15666874405e8c1bbc1d4 upstream.

This modifies the first 32 bits out of the 128 bits of a random CPU's
net_rand_state on interrupt or CPU activity to complicate remote
observations that could lead to guessing the network RNG's internal
state.

Note that depending on some network devices' interrupt rate moderation
or binding, this re-seeding might happen on every packet or even almost
never.

In addition, with NOHZ some CPUs might not even get timer interrupts,
leaving their local state rarely updated, while they are running
networked processes making use of the random state. For this reason, we
also perform this update in update_process_times() in order to at least
update the state when there is user or system activity, since it's the
only case we care about.

Reported-by: Amit Klein <[email protected]>
Suggested-by: Linus Torvalds <[email protected]>
Cc: Eric Dumazet <[email protected]>
Cc: "Jason A. Donenfeld" <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: <[email protected]>
Signed-off-by: Willy Tarreau <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/char/random.c | 1 +
include/linux/random.h | 3 +++
kernel/time/timer.c | 8 ++++++++
lib/random32.c | 2 +-
4 files changed, 13 insertions(+), 1 deletion(-)

--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -923,6 +923,7 @@ void add_interrupt_randomness(int irq, i

fast_mix(fast_pool);
add_interrupt_bench(cycles);
+ this_cpu_add(net_rand_state.s1, fast_pool->pool[cycles & 3]);

if ((fast_pool->count < 64) &&
!time_after(now, fast_pool->last + HZ))
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -8,6 +8,7 @@

#include <linux/list.h>
#include <linux/once.h>
+#include <linux/percpu.h>

#include <uapi/linux/random.h>

@@ -46,6 +47,8 @@ struct rnd_state {
__u32 s1, s2, s3, s4;
};

+DECLARE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+
u32 prandom_u32_state(struct rnd_state *state);
void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -42,6 +42,7 @@
#include <linux/sched/sysctl.h>
#include <linux/slab.h>
#include <linux/compat.h>
+#include <linux/random.h>

#include <asm/uaccess.h>
#include <asm/unistd.h>
@@ -1431,6 +1432,13 @@ void update_process_times(int user_tick)
#endif
scheduler_tick();
run_posix_cpu_timers(p);
+
+ /* The current CPU might make use of net randoms without receiving IRQs
+ * to renew them often enough. Let's update the net_rand_state from a
+ * non-constant value that's not affine to the number of calls to make
+ * sure it's updated when there's some activity (we don't care in idle).
+ */
+ this_cpu_add(net_rand_state.s1, rol32(jiffies, 24) + user_tick);
}

/*
--- a/lib/random32.c
+++ b/lib/random32.c
@@ -47,7 +47,7 @@ static inline void prandom_state_selftes
}
#endif

-static DEFINE_PER_CPU(struct rnd_state, net_rand_state);
+DEFINE_PER_CPU(struct rnd_state, net_rand_state);

/**
* prandom_u32_state - seeded pseudo-random number generator.


2020-08-20 10:40:46

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 007/149] PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge

From: Robert Hancock <[email protected]>

commit b361663c5a40c8bc758b7f7f2239f7a192180e7c upstream.

Recently ASPM handling was changed to allow ASPM on PCIe-to-PCI/PCI-X
bridges. Unfortunately the ASMedia ASM1083/1085 PCIe to PCI bridge device
doesn't seem to function properly with ASPM enabled. On an Asus PRIME
H270-PRO motherboard, it causes errors like these:

pcieport 0000:00:1c.0: AER: PCIe Bus Error: severity=Corrected, type=Data Link Layer, (Transmitter ID)
pcieport 0000:00:1c.0: AER: device [8086:a292] error status/mask=00003000/00002000
pcieport 0000:00:1c.0: AER: [12] Timeout
pcieport 0000:00:1c.0: AER: Corrected error received: 0000:00:1c.0
pcieport 0000:00:1c.0: AER: can't find device of ID00e0

In addition to flooding the kernel log, this also causes the machine to
wake up immediately after suspend is initiated.

The device advertises ASPM L0s and L1 support in the Link Capabilities
register, but the ASMedia web page for ASM1083 [1] claims "No PCIe ASPM
support".

Windows 10 (build 2004) enables L0s, but it also logs correctable PCIe
errors.

Add a quirk to disable ASPM for this device.

[1] https://www.asmedia.com.tw/eng/e_show_products.php?cate_index=169&item=114

[bhelgaas: commit log]
Fixes: 66ff14e59e8a ("PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208667
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Robert Hancock <[email protected]>
Signed-off-by: Bjorn Helgaas <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/pci/quirks.c | 13 +++++++++++++
1 file changed, 13 insertions(+)

--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2273,6 +2273,19 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AM
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);

+static void quirk_disable_aspm_l0s_l1(struct pci_dev *dev)
+{
+ dev_info(&dev->dev, "Disabling ASPM L0s/L1\n");
+ pci_disable_link_state(dev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
+}
+
+/*
+ * ASM1083/1085 PCIe-PCI bridge devices cause AER timeout errors on the
+ * upstream PCIe root port when ASPM is enabled. At least L0s mode is affected;
+ * disable both L0s and L1 for now to be safe.
+ */
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x1080, quirk_disable_aspm_l0s_l1);
+
/*
* The APC bridge device in AMD 780 family northbridges has some random
* OEM subsystem ID in its vendor ID register (erratum 18), so instead


2020-08-20 10:40:47

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 029/149] random: fix circular include dependency on arm64 after addition of percpu.h

From: Willy Tarreau <[email protected]>

commit 1c9df907da83812e4f33b59d3d142c864d9da57f upstream.

Daniel Díaz and Kees Cook independently reported that commit
f227e3ec3b5c ("random32: update the net random state on interrupt and
activity") broke arm64 due to a circular dependency on include files
since the addition of percpu.h in random.h.

The correct fix would definitely be to move all the prandom32 stuff out
of random.h but for backporting, a smaller solution is preferred.

This one replaces linux/percpu.h with asm/percpu.h, and this fixes the
problem on x86_64, arm64, arm, and mips. Note that moving percpu.h
around didn't change anything and that removing it entirely broke
differently. When backporting, such options might still be considered
if this patch fails to help.

[ It turns out that an alternate fix seems to be to just remove the
troublesome <asm/pointer_auth.h> remove from the arm64 <asm/smp.h>
that causes the circular dependency.

But we might as well do the whole belt-and-suspenders thing, and
minimize inclusion in <linux/random.h> too. Either will fix the
problem, and both are good changes. - Linus ]

Reported-by: Daniel Díaz <[email protected]>
Reported-by: Kees Cook <[email protected]>
Tested-by: Marc Zyngier <[email protected]>
Fixes: f227e3ec3b5c
Cc: Stephen Rothwell <[email protected]>
Signed-off-by: Willy Tarreau <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
include/linux/random.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -8,7 +8,7 @@

#include <linux/list.h>
#include <linux/once.h>
-#include <linux/percpu.h>
+#include <asm/percpu.h>

#include <uapi/linux/random.h>



2020-08-20 10:41:04

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 026/149] x86/i8259: Use printk_deferred() to prevent deadlock

From: Thomas Gleixner <[email protected]>

commit bdd65589593edd79b6a12ce86b3b7a7c6dae5208 upstream.

0day reported a possible circular locking dependency:

Chain exists of:
&irq_desc_lock_class --> console_owner --> &port_lock_key

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&port_lock_key);
lock(console_owner);
lock(&port_lock_key);
lock(&irq_desc_lock_class);

The reason for this is a printk() in the i8259 interrupt chip driver
which is invoked with the irq descriptor lock held, which reverses the
lock operations vs. printk() from arbitrary contexts.

Switch the printk() to printk_deferred() to avoid that.

Reported-by: kernel test robot <[email protected]>
Signed-off-by: Thomas Gleixner <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Cc: [email protected]
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
arch/x86/kernel/i8259.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/i8259.c
+++ b/arch/x86/kernel/i8259.c
@@ -204,7 +204,7 @@ spurious_8259A_irq:
* lets ACK and report it. [once per IRQ]
*/
if (!(spurious_irq_mask & irqmask)) {
- printk(KERN_DEBUG
+ printk_deferred(KERN_DEBUG
"spurious 8259A interrupt: IRQ%d.\n", irq);
spurious_irq_mask |= irqmask;
}


2020-08-20 10:41:07

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 030/149] random32: remove net_rand_state from the latent entropy gcc plugin

From: Linus Torvalds <[email protected]>

commit 83bdc7275e6206f560d247be856bceba3e1ed8f2 upstream.

It turns out that the plugin right now ends up being really unhappy
about the change from 'static' to 'extern' storage that happened in
commit f227e3ec3b5c ("random32: update the net random state on interrupt
and activity").

This is probably a trivial fix for the latent_entropy plugin, but for
now, just remove net_rand_state from the list of things the plugin
worries about.

Reported-by: Stephen Rothwell <[email protected]>
Cc: Emese Revfy <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Willy Tarreau <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
include/linux/random.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -47,7 +47,7 @@ struct rnd_state {
__u32 s1, s2, s3, s4;
};

-DECLARE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+DECLARE_PER_CPU(struct rnd_state, net_rand_state);

u32 prandom_u32_state(struct rnd_state *state);
void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);


2020-08-20 10:41:27

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 004/149] ath9k_htc: release allocated buffer if timed out

From: Navid Emamdoost <[email protected]>

[ Upstream commit 853acf7caf10b828102d92d05b5c101666a6142b ]

In htc_config_pipe_credits, htc_setup_complete, and htc_connect_service
if time out happens, the allocated buffer needs to be released.
Otherwise there will be memory leak.

Signed-off-by: Navid Emamdoost <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 257b6ee51e54b..1af216aa5adae 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -175,6 +175,7 @@ static int htc_config_pipe_credits(struct htc_target *target)
time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
if (!time_left) {
dev_err(target->dev, "HTC credit config timeout\n");
+ kfree_skb(skb);
return -ETIMEDOUT;
}

@@ -211,6 +212,7 @@ static int htc_setup_complete(struct htc_target *target)
time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
if (!time_left) {
dev_err(target->dev, "HTC start timeout\n");
+ kfree_skb(skb);
return -ETIMEDOUT;
}

@@ -284,6 +286,7 @@ int htc_connect_service(struct htc_target *target,
if (!time_left) {
dev_err(target->dev, "Service connection timeout for: %d\n",
service_connreq->service_id);
+ kfree_skb(skb);
return -ETIMEDOUT;
}

--
2.25.1



2020-08-20 10:41:33

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 024/149] Revert "i2c: cadence: Fix the hold bit setting"

From: Raviteja Narayanam <[email protected]>

[ Upstream commit 0db9254d6b896b587759e2c844c277fb1a6da5b9 ]

This reverts commit d358def706880defa4c9e87381c5bf086a97d5f9.

There are two issues with "i2c: cadence: Fix the hold bit setting" commit.

1. In case of combined message request from user space, when the HOLD
bit is cleared in cdns_i2c_mrecv function, a STOP condition is sent
on the bus even before the last message is started. This is because when
the HOLD bit is cleared, the FIFOS are empty and there is no pending
transfer. The STOP condition should occur only after the last message
is completed.

2. The code added by the commit is redundant. Driver is handling the
setting/clearing of HOLD bit in right way before the commit.

The setting of HOLD bit based on 'bus_hold_flag' is taken care in
cdns_i2c_master_xfer function even before cdns_i2c_msend/cdns_i2c_recv
functions.

The clearing of HOLD bit is taken care at the end of cdns_i2c_msend and
cdns_i2c_recv functions based on bus_hold_flag and byte count.
Since clearing of HOLD bit is done after the slave address is written to
the register (writing to address register triggers the message transfer),
it is ensured that STOP condition occurs at the right time after
completion of the pending transfer (last message).

Signed-off-by: Raviteja Narayanam <[email protected]>
Acked-by: Michal Simek <[email protected]>
Signed-off-by: Wolfram Sang <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/i2c/busses/i2c-cadence.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 6d32e6da3110d..84deed6571bdf 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -378,10 +378,8 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)
* Check for the message size against FIFO depth and set the
* 'hold bus' bit if it is greater than FIFO depth.
*/
- if ((id->recv_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
+ if (id->recv_count > CDNS_I2C_FIFO_DEPTH)
ctrl_reg |= CDNS_I2C_CR_HOLD;
- else
- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;

cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);

@@ -438,11 +436,8 @@ static void cdns_i2c_msend(struct cdns_i2c *id)
* Check for the message size against FIFO depth and set the
* 'hold bus' bit if it is greater than FIFO depth.
*/
- if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
+ if (id->send_count > CDNS_I2C_FIFO_DEPTH)
ctrl_reg |= CDNS_I2C_CR_HOLD;
- else
- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
-
cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);

/* Clear the interrupts in interrupt status register. */
--
2.25.1



2020-08-20 10:41:46

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 002/149] net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe()

From: Wei Yongjun <[email protected]>

[ Upstream commit 297a6961ffb8ff4dc66c9fbf53b924bd1dda05d5 ]

platform_get_resource() may fail and return NULL, so we should
better check it's return value to avoid a NULL pointer dereference
a bit later in the code.

This is detected by Coccinelle semantic patch.

@@
expression pdev, res, n, t, e, e1, e2;
@@

res = platform_get_resource(pdev, t, n);
+ if (!res)
+ return -EINVAL;
... when != res == NULL
e = devm_ioremap(e1, res->start, e2);

Signed-off-by: Wei Yongjun <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/phy/mdio-bcm-unimac.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c
index 4bde5e728fe0a..fd8692b477c96 100644
--- a/drivers/net/phy/mdio-bcm-unimac.c
+++ b/drivers/net/phy/mdio-bcm-unimac.c
@@ -177,6 +177,8 @@ static int unimac_mdio_probe(struct platform_device *pdev)
return -ENOMEM;

r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!r)
+ return -EINVAL;

/* Just ioremap, as this MDIO block is usually integrated into an
* Ethernet MAC controller register range
--
2.25.1



2020-08-20 10:43:13

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 025/149] xen-netfront: fix potential deadlock in xennet_remove()

From: Andrea Righi <[email protected]>

[ Upstream commit c2c633106453611be07821f53dff9e93a9d1c3f0 ]

There's a potential race in xennet_remove(); this is what the driver is
doing upon unregistering a network device:

1. state = read bus state
2. if state is not "Closed":
3. request to set state to "Closing"
4. wait for state to be set to "Closing"
5. request to set state to "Closed"
6. wait for state to be set to "Closed"

If the state changes to "Closed" immediately after step 1 we are stuck
forever in step 4, because the state will never go back from "Closed" to
"Closing".

Make sure to check also for state == "Closed" in step 4 to prevent the
deadlock.

Also add a 5 sec timeout any time we wait for the bus state to change,
to avoid getting stuck forever in wait_event().

Signed-off-by: Andrea Righi <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/xen-netfront.c | 64 +++++++++++++++++++++++++++++----------------
1 file changed, 42 insertions(+), 22 deletions(-)

--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -62,6 +62,8 @@ module_param_named(max_queues, xennet_ma
MODULE_PARM_DESC(max_queues,
"Maximum number of queues per virtual interface");

+#define XENNET_TIMEOUT (5 * HZ)
+
static const struct ethtool_ops xennet_ethtool_ops;

struct netfront_cb {
@@ -1349,12 +1351,15 @@ static struct net_device *xennet_create_

netif_carrier_off(netdev);

- xenbus_switch_state(dev, XenbusStateInitialising);
- wait_event(module_wq,
- xenbus_read_driver_state(dev->otherend) !=
- XenbusStateClosed &&
- xenbus_read_driver_state(dev->otherend) !=
- XenbusStateUnknown);
+ do {
+ xenbus_switch_state(dev, XenbusStateInitialising);
+ err = wait_event_timeout(module_wq,
+ xenbus_read_driver_state(dev->otherend) !=
+ XenbusStateClosed &&
+ xenbus_read_driver_state(dev->otherend) !=
+ XenbusStateUnknown, XENNET_TIMEOUT);
+ } while (!err);
+
return netdev;

exit:
@@ -2166,28 +2171,43 @@ static const struct attribute_group xenn
};
#endif /* CONFIG_SYSFS */

-static int xennet_remove(struct xenbus_device *dev)
+static void xennet_bus_close(struct xenbus_device *dev)
{
- struct netfront_info *info = dev_get_drvdata(&dev->dev);
-
- dev_dbg(&dev->dev, "%s\n", dev->nodename);
+ int ret;

- if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
+ if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed)
+ return;
+ do {
xenbus_switch_state(dev, XenbusStateClosing);
- wait_event(module_wq,
- xenbus_read_driver_state(dev->otherend) ==
- XenbusStateClosing ||
- xenbus_read_driver_state(dev->otherend) ==
- XenbusStateUnknown);
+ ret = wait_event_timeout(module_wq,
+ xenbus_read_driver_state(dev->otherend) ==
+ XenbusStateClosing ||
+ xenbus_read_driver_state(dev->otherend) ==
+ XenbusStateClosed ||
+ xenbus_read_driver_state(dev->otherend) ==
+ XenbusStateUnknown,
+ XENNET_TIMEOUT);
+ } while (!ret);

+ if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed)
+ return;
+
+ do {
xenbus_switch_state(dev, XenbusStateClosed);
- wait_event(module_wq,
- xenbus_read_driver_state(dev->otherend) ==
- XenbusStateClosed ||
- xenbus_read_driver_state(dev->otherend) ==
- XenbusStateUnknown);
- }
+ ret = wait_event_timeout(module_wq,
+ xenbus_read_driver_state(dev->otherend) ==
+ XenbusStateClosed ||
+ xenbus_read_driver_state(dev->otherend) ==
+ XenbusStateUnknown,
+ XENNET_TIMEOUT);
+ } while (!ret);
+}
+
+static int xennet_remove(struct xenbus_device *dev)
+{
+ struct netfront_info *info = dev_get_drvdata(&dev->dev);

+ xennet_bus_close(dev);
xennet_disconnect_backend(info);

if (info->netdev->reg_state == NETREG_REGISTERED)


2020-08-20 10:44:06

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.4 013/149] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.

From: Tetsuo Handa <[email protected]>

[ Upstream commit 033724d6864245a11f8e04c066002e6ad22b3fd0 ]

syzbot is reporting general protection fault in bitfill_aligned() [1]
caused by integer underflow in bit_clear_margins(). The cause of this
problem is when and how do_vc_resize() updates vc->vc_{cols,rows}.

If vc_do_resize() fails (e.g. kzalloc() fails) when var.xres or var.yres
is going to shrink, vc->vc_{cols,rows} will not be updated. This allows
bit_clear_margins() to see info->var.xres < (vc->vc_cols * cw) or
info->var.yres < (vc->vc_rows * ch). Unexpectedly large rw or bh will
try to overrun the __iomem region and causes general protection fault.

Also, vc_resize(vc, 0, 0) does not set vc->vc_{cols,rows} = 0 due to

new_cols = (cols ? cols : vc->vc_cols);
new_rows = (lines ? lines : vc->vc_rows);

exception. Since cols and lines are calculated as

cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
cols /= vc->vc_font.width;
rows /= vc->vc_font.height;
vc_resize(vc, cols, rows);

in fbcon_modechanged(), var.xres < vc->vc_font.width makes cols = 0
and var.yres < vc->vc_font.height makes rows = 0. This means that

const int fd = open("/dev/fb0", O_ACCMODE);
struct fb_var_screeninfo var = { };
ioctl(fd, FBIOGET_VSCREENINFO, &var);
var.xres = var.yres = 1;
ioctl(fd, FBIOPUT_VSCREENINFO, &var);

easily reproduces integer underflow bug explained above.

Of course, callers of vc_resize() are not handling vc_do_resize() failure
is bad. But we can't avoid vc_resize(vc, 0, 0) which returns 0. Therefore,
as a band-aid workaround, this patch checks integer underflow in
"struct fbcon_ops"->clear_margins call, assuming that
vc->vc_cols * vc->vc_font.width and vc->vc_rows * vc->vc_font.heigh do not
cause integer overflow.

[1] https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6

Reported-and-tested-by: syzbot <[email protected]>
Signed-off-by: Tetsuo Handa <[email protected]>
Acked-by: Daniel Vetter <[email protected]>
Cc: stable <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/video/console/bitblit.c | 4 ++--
drivers/video/console/fbcon_ccw.c | 4 ++--
drivers/video/console/fbcon_cw.c | 4 ++--
drivers/video/console/fbcon_ud.c | 4 ++--
4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c
index dbfe4eecf12e5..05d1d36a56654 100644
--- a/drivers/video/console/bitblit.c
+++ b/drivers/video/console/bitblit.c
@@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
region.color = 0;
region.rop = ROP_COPY;

- if (rw && !bottom_only) {
+ if ((int) rw > 0 && !bottom_only) {
region.dx = info->var.xoffset + rs;
region.dy = 0;
region.width = rw;
@@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
info->fbops->fb_fillrect(info, &region);
}

- if (bh) {
+ if ((int) bh > 0) {
region.dx = info->var.xoffset;
region.dy = info->var.yoffset + bs;
region.width = rs;
diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c
index 5a3cbf6dff4d9..34da8bba9273a 100644
--- a/drivers/video/console/fbcon_ccw.c
+++ b/drivers/video/console/fbcon_ccw.c
@@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
region.color = 0;
region.rop = ROP_COPY;

- if (rw && !bottom_only) {
+ if ((int) rw > 0 && !bottom_only) {
region.dx = 0;
region.dy = info->var.yoffset;
region.height = rw;
@@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
info->fbops->fb_fillrect(info, &region);
}

- if (bh) {
+ if ((int) bh > 0) {
region.dx = info->var.xoffset + bs;
region.dy = 0;
region.height = info->var.yres_virtual;
diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c
index e7ee44db4e98b..0b552b3fc22ab 100644
--- a/drivers/video/console/fbcon_cw.c
+++ b/drivers/video/console/fbcon_cw.c
@@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
region.color = 0;
region.rop = ROP_COPY;

- if (rw && !bottom_only) {
+ if ((int) rw > 0 && !bottom_only) {
region.dx = 0;
region.dy = info->var.yoffset + rs;
region.height = rw;
@@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
info->fbops->fb_fillrect(info, &region);
}

- if (bh) {
+ if ((int) bh > 0) {
region.dx = info->var.xoffset;
region.dy = info->var.yoffset;
region.height = info->var.yres;
diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c
index 19e3714abfe8f..7f62efe2da526 100644
--- a/drivers/video/console/fbcon_ud.c
+++ b/drivers/video/console/fbcon_ud.c
@@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
region.color = 0;
region.rop = ROP_COPY;

- if (rw && !bottom_only) {
+ if ((int) rw > 0 && !bottom_only) {
region.dy = 0;
region.dx = info->var.xoffset;
region.width = rw;
@@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
info->fbops->fb_fillrect(info, &region);
}

- if (bh) {
+ if ((int) bh > 0) {
region.dy = info->var.yoffset;
region.dx = info->var.xoffset;
region.height = bh;
--
2.25.1



2020-08-20 14:22:36

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On Thu, 20 Aug 2020 at 15:47, Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 4.4.233 release.
> There are 149 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

i386 build failed on stable-rc 4.4 branch

make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=i386 HOSTCC=gcc
CC="sccache gcc" O=build
#
In file included from ../samples/seccomp/bpf-direct.c:19:
/usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
file or directory
5 | #include <asm/types.h>
| ^~~~~~~~~~~~~
compilation terminated.
In file included from /usr/include/linux/filter.h:10,
from ../samples/seccomp/bpf-fancy.c:12:
/usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
file or directory
5 | #include <asm/types.h>
| ^~~~~~~~~~~~~
compilation terminated.
make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-direct.o] Error 1
make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-fancy.o] Error 1
In file included from /usr/include/bits/errno.h:26,
from /usr/include/errno.h:28,
from ../samples/seccomp/dropper.c:17:
/usr/include/linux/errno.h:1:10: fatal error: asm/errno.h: No such
file or directory
1 | #include <asm/errno.h>
| ^~~~~~~~~~~~~
compilation terminated.
make[3]: *** [scripts/Makefile.host:108: samples/seccomp/dropper.o] Error 1
In file included from ../samples/seccomp/bpf-helper.c:16:
../samples/seccomp/bpf-helper.h:17:10: fatal error: asm/bitsperlong.h:
No such file or directory
17 | #include <asm/bitsperlong.h> /* for __BITS_PER_LONG */
| ^~~~~~~~~~~~~~~~~~~


--
Linaro LKFT
https://lkft.linaro.org

2020-08-20 14:28:55

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On Thu, 20 Aug 2020 at 19:49, Naresh Kamboju <[email protected]> wrote:
>
> On Thu, 20 Aug 2020 at 15:47, Greg Kroah-Hartman
> <[email protected]> wrote:
> >
> > This is the start of the stable review cycle for the 4.4.233 release.
> > There are 149 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> i386 build failed on stable-rc 4.4 branch

The defconfig build pass but the config i am using is breaking.
kernel config link,
https://builds.tuxbuild.com/xuCFzjgiR3X6wY9KGKQKwA/kernel.config

>
> make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=i386 HOSTCC=gcc
> CC="sccache gcc" O=build
> #
> In file included from ../samples/seccomp/bpf-direct.c:19:
> /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> file or directory
> 5 | #include <asm/types.h>
> | ^~~~~~~~~~~~~
> compilation terminated.
> In file included from /usr/include/linux/filter.h:10,
> from ../samples/seccomp/bpf-fancy.c:12:
> /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> file or directory
> 5 | #include <asm/types.h>
> | ^~~~~~~~~~~~~
> compilation terminated.
> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-direct.o] Error 1
> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-fancy.o] Error 1
> In file included from /usr/include/bits/errno.h:26,
> from /usr/include/errno.h:28,
> from ../samples/seccomp/dropper.c:17:
> /usr/include/linux/errno.h:1:10: fatal error: asm/errno.h: No such
> file or directory
> 1 | #include <asm/errno.h>
> | ^~~~~~~~~~~~~
> compilation terminated.
> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/dropper.o] Error 1
> In file included from ../samples/seccomp/bpf-helper.c:16:
> ../samples/seccomp/bpf-helper.h:17:10: fatal error: asm/bitsperlong.h:
> No such file or directory
> 17 | #include <asm/bitsperlong.h> /* for __BITS_PER_LONG */
> | ^~~~~~~~~~~~~~~~~~~
>
>
> --
> Linaro LKFT
> https://lkft.linaro.org

2020-08-20 14:38:50

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On 8/20/20 7:19 AM, Naresh Kamboju wrote:
> On Thu, 20 Aug 2020 at 15:47, Greg Kroah-Hartman
> <[email protected]> wrote:
>>
>> This is the start of the stable review cycle for the 4.4.233 release.
>> There are 149 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>>
>> Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
>> Anything received after that time might be too late.
>>
>> The whole patch series can be found in one patch at:
>> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
>> or in the git tree and branch at:
>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
>> and the diffstat can be found below.
>>
>> thanks,
>>
>> greg k-h
>
> i386 build failed on stable-rc 4.4 branch
>

It builds for me.

Build reference: v4.4.232-150-g1c57f0a
gcc version: x86_64-linux-gcc (GCC) 9.2.0

Building i386:defconfig ... passed
Building i386:allyesconfig ... passed
Building i386:allmodconfig ... passed
Building i386:allnoconfig ... passed
Building i386:tinyconfig ... passed
Building i386:tools/perf ... passed

What configuration fails to build for you ?

Thanks,
Guenter

> make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=i386 HOSTCC=gcc
> CC="sccache gcc" O=build
> #
> In file included from ../samples/seccomp/bpf-direct.c:19:
> /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> file or directory
> 5 | #include <asm/types.h>
> | ^~~~~~~~~~~~~
> compilation terminated.
> In file included from /usr/include/linux/filter.h:10,
> from ../samples/seccomp/bpf-fancy.c:12:
> /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> file or directory
> 5 | #include <asm/types.h>
> | ^~~~~~~~~~~~~
> compilation terminated.
> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-direct.o] Error 1
> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-fancy.o] Error 1
> In file included from /usr/include/bits/errno.h:26,
> from /usr/include/errno.h:28,
> from ../samples/seccomp/dropper.c:17:
> /usr/include/linux/errno.h:1:10: fatal error: asm/errno.h: No such
> file or directory
> 1 | #include <asm/errno.h>
> | ^~~~~~~~~~~~~
> compilation terminated.
> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/dropper.o] Error 1
> In file included from ../samples/seccomp/bpf-helper.c:16:
> ../samples/seccomp/bpf-helper.h:17:10: fatal error: asm/bitsperlong.h:
> No such file or directory
> 17 | #include <asm/bitsperlong.h> /* for __BITS_PER_LONG */
> | ^~~~~~~~~~~~~~~~~~~
>
>

2020-08-20 15:07:44

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On 8/20/20 7:25 AM, Naresh Kamboju wrote:
> On Thu, 20 Aug 2020 at 19:49, Naresh Kamboju <[email protected]> wrote:
>>
>> On Thu, 20 Aug 2020 at 15:47, Greg Kroah-Hartman
>> <[email protected]> wrote:
>>>
>>> This is the start of the stable review cycle for the 4.4.233 release.
>>> There are 149 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
>>> Anything received after that time might be too late.
>>>
>>> The whole patch series can be found in one patch at:
>>> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
>>> or in the git tree and branch at:
>>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
>>> and the diffstat can be found below.
>>>
>>> thanks,
>>>
>>> greg k-h
>>
>> i386 build failed on stable-rc 4.4 branch
>
> The defconfig build pass but the config i am using is breaking.
> kernel config link,
> https://builds.tuxbuild.com/xuCFzjgiR3X6wY9KGKQKwA/kernel.config
>

This configuration WFM as well. I tried with

gcc (Ubuntu 6.5.0-2ubuntu1~18.04) 6.5.0 20181026
gcc-7 (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0
gcc-8 (Ubuntu 8.4.0-1ubuntu1~18.04) 8.4.0

I tried with and without O=.

Guenter

>>
>> make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=i386 HOSTCC=gcc
>> CC="sccache gcc" O=build
>> #
>> In file included from ../samples/seccomp/bpf-direct.c:19:
>> /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
>> file or directory>> 5 | #include <asm/types.h>
>> | ^~~~~~~~~~~~~
>> compilation terminated.
>> In file included from /usr/include/linux/filter.h:10,
>> from ../samples/seccomp/bpf-fancy.c:12:
>> /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
>> file or directory
>> 5 | #include <asm/types.h>
>> | ^~~~~~~~~~~~~
>> compilation terminated.
>> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-direct.o] Error 1
>> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-fancy.o] Error 1
>> In file included from /usr/include/bits/errno.h:26,
>> from /usr/include/errno.h:28,
>> from ../samples/seccomp/dropper.c:17:
>> /usr/include/linux/errno.h:1:10: fatal error: asm/errno.h: No such
>> file or directory
>> 1 | #include <asm/errno.h>
>> | ^~~~~~~~~~~~~
>> compilation terminated.
>> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/dropper.o] Error 1
>> In file included from ../samples/seccomp/bpf-helper.c:16:
>> ../samples/seccomp/bpf-helper.h:17:10: fatal error: asm/bitsperlong.h:
>> No such file or directory
>> 17 | #include <asm/bitsperlong.h> /* for __BITS_PER_LONG */
>> | ^~~~~~~~~~~~~~~~~~~
>>
>>
>> --
>> Linaro LKFT
>> https://lkft.linaro.org

2020-08-20 15:10:07

by Greg Kroah-Hartman

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On Thu, Aug 20, 2020 at 07:49:06PM +0530, Naresh Kamboju wrote:
> On Thu, 20 Aug 2020 at 15:47, Greg Kroah-Hartman
> <[email protected]> wrote:
> >
> > This is the start of the stable review cycle for the 4.4.233 release.
> > There are 149 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> i386 build failed on stable-rc 4.4 branch
>
> make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=i386 HOSTCC=gcc
> CC="sccache gcc" O=build
> #
> In file included from ../samples/seccomp/bpf-direct.c:19:
> /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> file or directory
> 5 | #include <asm/types.h>
> | ^~~~~~~~~~~~~
> compilation terminated.
> In file included from /usr/include/linux/filter.h:10,
> from ../samples/seccomp/bpf-fancy.c:12:
> /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> file or directory
> 5 | #include <asm/types.h>
> | ^~~~~~~~~~~~~
> compilation terminated.
> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-direct.o] Error 1
> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-fancy.o] Error 1
> In file included from /usr/include/bits/errno.h:26,
> from /usr/include/errno.h:28,
> from ../samples/seccomp/dropper.c:17:
> /usr/include/linux/errno.h:1:10: fatal error: asm/errno.h: No such
> file or directory
> 1 | #include <asm/errno.h>
> | ^~~~~~~~~~~~~
> compilation terminated.
> make[3]: *** [scripts/Makefile.host:108: samples/seccomp/dropper.o] Error 1
> In file included from ../samples/seccomp/bpf-helper.c:16:
> ../samples/seccomp/bpf-helper.h:17:10: fatal error: asm/bitsperlong.h:
> No such file or directory
> 17 | #include <asm/bitsperlong.h> /* for __BITS_PER_LONG */
> | ^~~~~~~~~~~~~~~~~~~

Any pointers to the commit that caused this? I'll place odds on one of
the random.h changes :(

greg k-h

2020-08-20 17:58:34

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On Thu, 20 Aug 2020 at 22:09, Naresh Kamboju <[email protected]> wrote:
>
> On Thu, 20 Aug 2020 at 20:38, Greg Kroah-Hartman
> <[email protected]> wrote:
> >
> > On Thu, Aug 20, 2020 at 07:49:06PM +0530, Naresh Kamboju wrote:
> > > On Thu, 20 Aug 2020 at 15:47, Greg Kroah-Hartman
> > > <[email protected]> wrote:
> > > >
> > > > This is the start of the stable review cycle for the 4.4.233 release.
> > > > There are 149 patches in this series, all will be posted as a response
> > > > to this one. If anyone has any issues with these being applied, please
> > > > let me know.
> > > >
> > > > Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
> > > > Anything received after that time might be too late.
> > > >
> > > > The whole patch series can be found in one patch at:
> > > > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
> > > > or in the git tree and branch at:
> > > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> > > > and the diffstat can be found below.
> > > >
> > > > thanks,
> > > >
> > > > greg k-h
> > >
> > > i386 build failed on stable-rc 4.4 branch
> > >
> > > make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=i386 HOSTCC=gcc
> > > CC="sccache gcc" O=build
> > > #
> > > In file included from ../samples/seccomp/bpf-direct.c:19:
> > > /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> > > file or directory
> > > 5 | #include <asm/types.h>
> > > | ^~~~~~~~~~~~~
> > > compilation terminated.
> > > In file included from /usr/include/linux/filter.h:10,
> > > from ../samples/seccomp/bpf-fancy.c:12:
> > > /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> > > file or directory
> > > 5 | #include <asm/types.h>
> > > | ^~~~~~~~~~~~~
> > > compilation terminated.
> > > make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-direct.o] Error 1
> > > make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-fancy.o] Error 1
> > > In file included from /usr/include/bits/errno.h:26,
> > > from /usr/include/errno.h:28,
> > > from ../samples/seccomp/dropper.c:17:
> > > /usr/include/linux/errno.h:1:10: fatal error: asm/errno.h: No such
> > > file or directory
> > > 1 | #include <asm/errno.h>
> > > | ^~~~~~~~~~~~~
> > > compilation terminated.
> > > make[3]: *** [scripts/Makefile.host:108: samples/seccomp/dropper.o] Error 1
> > > In file included from ../samples/seccomp/bpf-helper.c:16:
> > > ../samples/seccomp/bpf-helper.h:17:10: fatal error: asm/bitsperlong.h:
> > > No such file or directory
> > > 17 | #include <asm/bitsperlong.h> /* for __BITS_PER_LONG */
> > > | ^~~~~~~~~~~~~~~~~~~
> >
> > Any pointers to the commit that caused this? I'll place odds on one of
> > the random.h changes :(
> >
>
> This config is causing a build break with gcc-9 on stable-rc 4.4 on i386.
> CONFIG_SAMPLES=y

The reported problem is not related to this stable rc review cycle.

Recently we have started running LTP tracing testing and added
config fragments from selftests/ftrace/config file. From that file

CONFIG_SAMPLES=y
has been enabled and the build broken only on i386 stable rc 4.4.

Sorry for the noise.

- Naresh

2020-08-20 19:58:14

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On Thu, 20 Aug 2020 at 20:38, Greg Kroah-Hartman
<[email protected]> wrote:
>
> On Thu, Aug 20, 2020 at 07:49:06PM +0530, Naresh Kamboju wrote:
> > On Thu, 20 Aug 2020 at 15:47, Greg Kroah-Hartman
> > <[email protected]> wrote:
> > >
> > > This is the start of the stable review cycle for the 4.4.233 release.
> > > There are 149 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
> > > Anything received after that time might be too late.
> > >
> > > The whole patch series can be found in one patch at:
> > > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
> > > or in the git tree and branch at:
> > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> > > and the diffstat can be found below.
> > >
> > > thanks,
> > >
> > > greg k-h
> >
> > i386 build failed on stable-rc 4.4 branch
> >
> > make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=i386 HOSTCC=gcc
> > CC="sccache gcc" O=build
> > #
> > In file included from ../samples/seccomp/bpf-direct.c:19:
> > /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> > file or directory
> > 5 | #include <asm/types.h>
> > | ^~~~~~~~~~~~~
> > compilation terminated.
> > In file included from /usr/include/linux/filter.h:10,
> > from ../samples/seccomp/bpf-fancy.c:12:
> > /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> > file or directory
> > 5 | #include <asm/types.h>
> > | ^~~~~~~~~~~~~
> > compilation terminated.
> > make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-direct.o] Error 1
> > make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-fancy.o] Error 1
> > In file included from /usr/include/bits/errno.h:26,
> > from /usr/include/errno.h:28,
> > from ../samples/seccomp/dropper.c:17:
> > /usr/include/linux/errno.h:1:10: fatal error: asm/errno.h: No such
> > file or directory
> > 1 | #include <asm/errno.h>
> > | ^~~~~~~~~~~~~
> > compilation terminated.
> > make[3]: *** [scripts/Makefile.host:108: samples/seccomp/dropper.o] Error 1
> > In file included from ../samples/seccomp/bpf-helper.c:16:
> > ../samples/seccomp/bpf-helper.h:17:10: fatal error: asm/bitsperlong.h:
> > No such file or directory
> > 17 | #include <asm/bitsperlong.h> /* for __BITS_PER_LONG */
> > | ^~~~~~~~~~~~~~~~~~~
>
> Any pointers to the commit that caused this? I'll place odds on one of
> the random.h changes :(
>

This config is causing a build break with gcc-9 on stable-rc 4.4 on i386.
CONFIG_SAMPLES=y

P.S. Recently we have enabled DYNAMIC debug and more trace configs.

- Naresh

2020-08-20 20:05:18

by Willy Tarreau

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On Thu, Aug 20, 2020 at 05:08:48PM +0200, Greg Kroah-Hartman wrote:
> On Thu, Aug 20, 2020 at 07:49:06PM +0530, Naresh Kamboju wrote:
> > On Thu, 20 Aug 2020 at 15:47, Greg Kroah-Hartman
> > <[email protected]> wrote:
> > >
> > > This is the start of the stable review cycle for the 4.4.233 release.
> > > There are 149 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
> > > Anything received after that time might be too late.
> > >
> > > The whole patch series can be found in one patch at:
> > > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
> > > or in the git tree and branch at:
> > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> > > and the diffstat can be found below.
> > >
> > > thanks,
> > >
> > > greg k-h
> >
> > i386 build failed on stable-rc 4.4 branch
> >
> > make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=i386 HOSTCC=gcc
> > CC="sccache gcc" O=build
> > #
> > In file included from ../samples/seccomp/bpf-direct.c:19:
> > /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> > file or directory
> > 5 | #include <asm/types.h>
> > | ^~~~~~~~~~~~~
> > compilation terminated.
> > In file included from /usr/include/linux/filter.h:10,
> > from ../samples/seccomp/bpf-fancy.c:12:
> > /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> > file or directory
> > 5 | #include <asm/types.h>
> > | ^~~~~~~~~~~~~
> > compilation terminated.
> > make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-direct.o] Error 1
> > make[3]: *** [scripts/Makefile.host:108: samples/seccomp/bpf-fancy.o] Error 1
> > In file included from /usr/include/bits/errno.h:26,
> > from /usr/include/errno.h:28,
> > from ../samples/seccomp/dropper.c:17:
> > /usr/include/linux/errno.h:1:10: fatal error: asm/errno.h: No such
> > file or directory
> > 1 | #include <asm/errno.h>
> > | ^~~~~~~~~~~~~
> > compilation terminated.
> > make[3]: *** [scripts/Makefile.host:108: samples/seccomp/dropper.o] Error 1
> > In file included from ../samples/seccomp/bpf-helper.c:16:
> > ../samples/seccomp/bpf-helper.h:17:10: fatal error: asm/bitsperlong.h:
> > No such file or directory
> > 17 | #include <asm/bitsperlong.h> /* for __BITS_PER_LONG */
> > | ^~~~~~~~~~~~~~~~~~~
>
> Any pointers to the commit that caused this? I'll place odds on one of
> the random.h changes :(

It's very possible, but we never touched these files, so it looks like
there is something else if these ones cannot even be found :

> > /usr/include/linux/types.h:5:10: fatal error: asm/types.h: No such
> > file or directory
> > 5 | #include <asm/types.h>
> > | ^~~~~~~~~~~~~

Also I don't know what this "sccache" wrapper is, maybe it needs to be
cleaned before trying again ?

That's a bit confusing :-/

Willy

2020-08-20 21:50:15

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On Thu, Aug 20, 2020 at 11:21:17AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.233 release.
> There are 149 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
> Anything received after that time might be too late.
>
Oh, and:

Tested-by: Guenter Roeck <[email protected]>

Guenter

2020-08-20 21:50:55

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On Thu, Aug 20, 2020 at 11:21:17AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.233 release.
> There are 149 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 169 pass: 169 fail: 0
Qemu test results:
total: 332 pass: 332 fail: 0

Guenter

2020-08-21 00:04:39

by Shuah Khan

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On 8/20/20 3:21 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.233 release.
> There are 149 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
>

Compiled and booted on my test system. No dmesg regressions.

Tested-by: Shuah Khan <[email protected]>

thanks,
-- Shuah

2020-08-21 09:54:37

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 4.4 000/149] 4.4.233-rc1 review

On Thu, 20 Aug 2020 at 23:26, Naresh Kamboju <[email protected]> wrote:
>
> On Thu, 20 Aug 2020 at 22:09, Naresh Kamboju <[email protected]> wrote:
> >
> > On Thu, 20 Aug 2020 at 20:38, Greg Kroah-Hartman
> > <[email protected]> wrote:
> > >
> > > On Thu, Aug 20, 2020 at 07:49:06PM +0530, Naresh Kamboju wrote:
> > > > On Thu, 20 Aug 2020 at 15:47, Greg Kroah-Hartman
> > > > <[email protected]> wrote:
> > > > >
> > > > > This is the start of the stable review cycle for the 4.4.233 release.
> > > > > There are 149 patches in this series, all will be posted as a response
> > > > > to this one. If anyone has any issues with these being applied, please
> > > > > let me know.
> > > > >
> > > > > Responses should be made by Sat, 22 Aug 2020 09:21:01 +0000.
> > > > > Anything received after that time might be too late.
> > > > >
> > > > > The whole patch series can be found in one patch at:
> > > > > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.233-rc1.gz
> > > > > or in the git tree and branch at:
> > > > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> > > > > and the diffstat can be found below.
> > > > >
> > > > > thanks,
> > > > >
> > > > > greg k-h

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Summary
------------------------------------------------------------------------

kernel: 4.4.233-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.4.y
git commit: 1c57f0a7ac3845a9f81f463bcd28d926afaa86a7
git describe: v4.4.232-150-g1c57f0a7ac38
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.4-oe/build/v4.4.232-150-g1c57f0a7ac38


No regressions (compared to build v4.4.232)

No fixes (compared to build v4.4.232)

Ran 7413 total tests in the following environments and test suites.

Environments
--------------
- i386
- juno-r2 - arm64
- juno-r2-compat
- x15 - arm
- x86_64
- x86-kasan

Test Suites
-----------
* build
* linux-log-parser
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-ipc-tests
* network-basic-tests
* v4l2-compliance
* ltp-syscalls-tests
* install-android-platform-tools-r2600
* kselftest
* kselftest/drivers
* kselftest/filesystems
* kselftest/net
* perf
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-tracing-tests

Summary
------------------------------------------------------------------------

kernel: 4.4.233-rc1
git repo: https://git.linaro.org/lkft/arm64-stable-rc.git
git branch: 4.4.233-rc1-hikey-20200820-795
git commit: 00f7a2d07eefd72ddbc7179ea7b911111d8d7df0
git describe: 4.4.233-rc1-hikey-20200820-795
Test details: https://qa-reports.linaro.org/lkft/linaro-hikey-stable-rc-4.4-oe/build/4.4.233-rc1-hikey-20200820-795


No regressions (compared to build 4.4.233-rc1-hikey-20200819-792)


No fixes (compared to build 4.4.233-rc1-hikey-20200819-792)

Ran 715 total tests in the following environments and test suites.

Environments
--------------
- hi6220-hikey - arm64

Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* kselftest/drivers
* kselftest/filesystems
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-fs-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-sched-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance

--
Linaro LKFT
https://lkft.linaro.org