2021-04-09 10:11:53

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 00/41] 5.10.29-rc1 review

This is the start of the stable review cycle for the 5.10.29 release.
There are 41 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sun, 11 Apr 2021 09:52:52 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.29-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>
Linux 5.10.29-rc1

Masahiro Yamada <[email protected]>
init/Kconfig: make COMPILE_TEST depend on HAS_IOMEM

Heiko Carstens <[email protected]>
init/Kconfig: make COMPILE_TEST depend on !S390

Piotr Krysiuk <[email protected]>
bpf, x86: Validate computation of branch displacements for x86-32

Piotr Krysiuk <[email protected]>
bpf, x86: Validate computation of branch displacements for x86-64

Stanislav Fomichev <[email protected]>
tools/resolve_btfids: Add /libbpf to .gitignore

Jiri Olsa <[email protected]>
kbuild: Do not clean resolve_btfids if the output does not exist

Jiri Olsa <[email protected]>
kbuild: Add resolve_btfids clean to root clean target

Jiri Olsa <[email protected]>
tools/resolve_btfids: Set srctree variable unconditionally

Jiri Olsa <[email protected]>
tools/resolve_btfids: Check objects before removing

Jiri Olsa <[email protected]>
tools/resolve_btfids: Build libbpf and libsubcmd in separate directories

David S. Miller <[email protected]>
math: Export mul_u64_u64_div_u64

Pavel Begunkov <[email protected]>
io_uring: fix timeout cancel return code

Vincent Whitchurch <[email protected]>
cifs: Silently ignore unknown oplock break handle

Ronnie Sahlberg <[email protected]>
cifs: revalidate mapping when we open files for SMB1 POSIX

Sergei Trofimovich <[email protected]>
ia64: fix format strings for err_inject

Sergei Trofimovich <[email protected]>
ia64: mca: allocate early mca with GFP_ATOMIC

Rong Chen <[email protected]>
selftests/vm: fix out-of-tree build

Martin Wilck <[email protected]>
scsi: target: pscsi: Clean up after failure in pscsi_map_sg()

Yangbo Lu <[email protected]>
ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation

David E. Box <[email protected]>
platform/x86: intel_pmc_core: Ignore GBE LTR on Tiger Lake platforms

Chris Chiu <[email protected]>
block: clear GD_NEED_PART_SCAN later in bdev_disk_changed

Arnd Bergmann <[email protected]>
x86/build: Turn off -fcf-protection for realmode targets

Kalyan Thota <[email protected]>
drm/msm/disp/dpu1: icc path needs to be set before dpu runtime resume

Andre Przywara <[email protected]>
kselftest/arm64: sve: Do not use non-canonical FFR register value

Esteve Varela Colominas <[email protected]>
platform/x86: thinkpad_acpi: Allow the FnLock LED to change state

Alex Elder <[email protected]>
net: ipa: fix init header command validation

Pablo Neira Ayuso <[email protected]>
netfilter: nftables: skip hook overlap logic if flowtable is stale

Ludovic Senecaux <[email protected]>
netfilter: conntrack: Fix gre tunneling over ipv6

Rob Clark <[email protected]>
drm/msm: Ratelimit invalid-fence message

Konrad Dybcio <[email protected]>
drm/msm/adreno: a5xx_power: Don't apply A540 lm_setup to other GPUs

Dmitry Baryshkov <[email protected]>
drm/msm/dsi_pll_7nm: Fix variable usage for pll_lockdet_rate

Karthikeyan Kathirvel <[email protected]>
mac80211: choose first enabled channel for monitor

Daniel Phan <[email protected]>
mac80211: Check crypto_aead_encrypt for errors

Tong Zhang <[email protected]>
mISDN: fix crash in fritzpci

David Gow <[email protected]>
kunit: tool: Fix a python tuple typing error

Pavel Andrianov <[email protected]>
net: pxa168_eth: Fix a potential data race in pxa168_eth_remove

Tariq Toukan <[email protected]>
net/mlx5e: Enforce minimum value check for ICOSQ size

Yonghong Song <[email protected]>
bpf, x86: Use kvmalloc_array instead kmalloc_array in bpf_jit_comp

Alban Bedel <[email protected]>
platform/x86: intel-hid: Support Lenovo ThinkPad X1 Tablet Gen 2

Tony Lindgren <[email protected]>
bus: ti-sysc: Fix warning on unbind if reset is not deasserted

Mans Rullgard <[email protected]>
ARM: dts: am33xx: add aliases for mmc interfaces


-------------

Diffstat:

Makefile | 17 ++++++--
arch/arm/boot/dts/am33xx.dtsi | 3 ++
arch/ia64/kernel/err_inject.c | 22 +++++-----
arch/ia64/kernel/mca.c | 2 +-
arch/x86/Makefile | 2 +-
arch/x86/net/bpf_jit_comp.c | 15 +++++--
arch/x86/net/bpf_jit_comp32.c | 11 ++++-
drivers/bus/ti-sysc.c | 4 +-
drivers/gpu/drm/msm/adreno/a5xx_power.c | 2 +-
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 12 +++---
drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c | 2 +-
drivers/gpu/drm/msm/msm_fence.c | 2 +-
drivers/isdn/hardware/mISDN/mISDNipac.c | 2 +-
drivers/net/ethernet/marvell/pxa168_eth.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 ++-
drivers/net/ipa/ipa_cmd.c | 50 +++++++++++++++--------
drivers/platform/x86/intel-hid.c | 7 ++++
drivers/platform/x86/intel_pmc_core.c | 50 ++++++++++++++++-------
drivers/platform/x86/thinkpad_acpi.c | 8 +++-
drivers/ptp/ptp_qoriq.c | 13 +++---
drivers/target/target_core_pscsi.c | 8 ++++
fs/block_dev.c | 4 +-
fs/cifs/file.c | 1 +
fs/cifs/smb2misc.c | 4 +-
fs/io_uring.c | 8 ++--
init/Kconfig | 3 +-
lib/math/div64.c | 1 +
net/mac80211/aead_api.c | 5 ++-
net/mac80211/aes_gmac.c | 5 ++-
net/mac80211/main.c | 13 +++++-
net/netfilter/nf_conntrack_proto_gre.c | 3 --
net/netfilter/nf_tables_api.c | 3 ++
tools/bpf/resolve_btfids/.gitignore | 3 +-
tools/bpf/resolve_btfids/Makefile | 44 ++++++++++----------
tools/testing/kunit/kunit_config.py | 2 +-
tools/testing/selftests/arm64/fp/sve-test.S | 22 +++++++---
tools/testing/selftests/vm/Makefile | 4 +-
37 files changed, 242 insertions(+), 122 deletions(-)



2021-04-09 10:11:55

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 28/41] cifs: revalidate mapping when we open files for SMB1 POSIX

From: Ronnie Sahlberg <[email protected]>

[ Upstream commit cee8f4f6fcabfdf229542926128e9874d19016d5 ]

RHBZ: 1933527

Under SMB1 + POSIX, if an inode is reused on a server after we have read and
cached a part of a file, when we then open the new file with the
re-cycled inode there is a chance that we may serve the old data out of cache
to the application.
This only happens for SMB1 (deprecated) and when posix are used.
The simplest solution to avoid this race is to force a revalidate
on smb1-posix open.

Signed-off-by: Ronnie Sahlberg <[email protected]>
Reviewed-by: Paulo Alcantara (SUSE) <[email protected]>
Signed-off-by: Steve French <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
fs/cifs/file.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index be46fab4c96d..da057570bb93 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -164,6 +164,7 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
goto posix_open_ret;
}
} else {
+ cifs_revalidate_mapping(*pinode);
cifs_fattr_to_inode(*pinode, &fattr);
}

--
2.30.2



2021-04-09 10:12:01

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 32/41] tools/resolve_btfids: Build libbpf and libsubcmd in separate directories

From: Jiri Olsa <[email protected]>

[ Upstream commit fc6b48f692f89cc48bfb7fd1aa65454dfe9b2d77 ]

Setting up separate build directories for libbpf and libpsubcmd,
so it's separated from other objects and we don't get them mixed
in the future.

It also simplifies cleaning, which is now simple rm -rf.

Also there's no need for FEATURE-DUMP.libbpf and bpf_helper_defs.h
files in .gitignore anymore.

Signed-off-by: Jiri Olsa <[email protected]>
Signed-off-by: Andrii Nakryiko <[email protected]>
Acked-by: Song Liu <[email protected]>
Acked-by: Andrii Nakryiko <[email protected]>
Link: https://lore.kernel.org/bpf/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
tools/bpf/resolve_btfids/.gitignore | 2 --
tools/bpf/resolve_btfids/Makefile | 26 +++++++++++---------------
2 files changed, 11 insertions(+), 17 deletions(-)

diff --git a/tools/bpf/resolve_btfids/.gitignore b/tools/bpf/resolve_btfids/.gitignore
index a026df7dc280..25f308c933cc 100644
--- a/tools/bpf/resolve_btfids/.gitignore
+++ b/tools/bpf/resolve_btfids/.gitignore
@@ -1,4 +1,2 @@
-/FEATURE-DUMP.libbpf
-/bpf_helper_defs.h
/fixdep
/resolve_btfids
diff --git a/tools/bpf/resolve_btfids/Makefile b/tools/bpf/resolve_btfids/Makefile
index bf656432ad73..1d46a247ec95 100644
--- a/tools/bpf/resolve_btfids/Makefile
+++ b/tools/bpf/resolve_btfids/Makefile
@@ -28,22 +28,22 @@ OUTPUT ?= $(srctree)/tools/bpf/resolve_btfids/
LIBBPF_SRC := $(srctree)/tools/lib/bpf/
SUBCMD_SRC := $(srctree)/tools/lib/subcmd/

-BPFOBJ := $(OUTPUT)/libbpf.a
-SUBCMDOBJ := $(OUTPUT)/libsubcmd.a
+BPFOBJ := $(OUTPUT)/libbpf/libbpf.a
+SUBCMDOBJ := $(OUTPUT)/libsubcmd/libsubcmd.a

BINARY := $(OUTPUT)/resolve_btfids
BINARY_IN := $(BINARY)-in.o

all: $(BINARY)

-$(OUTPUT):
+$(OUTPUT) $(OUTPUT)/libbpf $(OUTPUT)/libsubcmd:
$(call msg,MKDIR,,$@)
- $(Q)mkdir -p $(OUTPUT)
+ $(Q)mkdir -p $(@)

-$(SUBCMDOBJ): fixdep FORCE
- $(Q)$(MAKE) -C $(SUBCMD_SRC) OUTPUT=$(OUTPUT)
+$(SUBCMDOBJ): fixdep FORCE | $(OUTPUT)/libsubcmd
+ $(Q)$(MAKE) -C $(SUBCMD_SRC) OUTPUT=$(abspath $(dir $@))/ $(abspath $@)

-$(BPFOBJ): $(wildcard $(LIBBPF_SRC)/*.[ch] $(LIBBPF_SRC)/Makefile) | $(OUTPUT)
+$(BPFOBJ): $(wildcard $(LIBBPF_SRC)/*.[ch] $(LIBBPF_SRC)/Makefile) | $(OUTPUT)/libbpf
$(Q)$(MAKE) $(submake_extras) -C $(LIBBPF_SRC) OUTPUT=$(abspath $(dir $@))/ $(abspath $@)

CFLAGS := -g \
@@ -57,23 +57,19 @@ LIBS = -lelf -lz
export srctree OUTPUT CFLAGS Q
include $(srctree)/tools/build/Makefile.include

-$(BINARY_IN): fixdep FORCE
+$(BINARY_IN): fixdep FORCE | $(OUTPUT)
$(Q)$(MAKE) $(build)=resolve_btfids

$(BINARY): $(BPFOBJ) $(SUBCMDOBJ) $(BINARY_IN)
$(call msg,LINK,$@)
$(Q)$(CC) $(BINARY_IN) $(LDFLAGS) -o $@ $(BPFOBJ) $(SUBCMDOBJ) $(LIBS)

-libsubcmd-clean:
- $(Q)$(MAKE) -C $(SUBCMD_SRC) OUTPUT=$(OUTPUT) clean
-
-libbpf-clean:
- $(Q)$(MAKE) -C $(LIBBPF_SRC) OUTPUT=$(OUTPUT) clean
-
-clean: libsubcmd-clean libbpf-clean fixdep-clean
+clean: fixdep-clean
$(call msg,CLEAN,$(BINARY))
$(Q)$(RM) -f $(BINARY); \
$(RM) -rf $(if $(OUTPUT),$(OUTPUT),.)/feature; \
+ $(RM) -rf $(OUTPUT)/libbpf; \
+ $(RM) -rf $(OUTPUT)/libsubcmd; \
find $(if $(OUTPUT),$(OUTPUT),.) -name \*.o -or -name \*.o.cmd -or -name \*.o.d | xargs $(RM)

tags:
--
2.30.2



2021-04-09 10:12:14

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 30/41] io_uring: fix timeout cancel return code

From: Pavel Begunkov <[email protected]>

[ Upstream commit 1ee4160c73b2102a52bc97a4128a89c34821414f ]

When we cancel a timeout we should emit a sensible return code, like
-ECANCELED but not 0, otherwise it may trick users.

Signed-off-by: Pavel Begunkov <[email protected]>
Link: https://lore.kernel.org/r/7b0ad1065e3bd1994722702bd0ba9e7bc9b0683b.1616696997.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
fs/io_uring.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 4ccf99cb8cdc..0de27e75460d 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1489,7 +1489,7 @@ static void io_queue_async_work(struct io_kiocb *req)
io_queue_linked_timeout(link);
}

-static void io_kill_timeout(struct io_kiocb *req)
+static void io_kill_timeout(struct io_kiocb *req, int status)
{
struct io_timeout_data *io = req->async_data;
int ret;
@@ -1499,7 +1499,7 @@ static void io_kill_timeout(struct io_kiocb *req)
atomic_set(&req->ctx->cq_timeouts,
atomic_read(&req->ctx->cq_timeouts) + 1);
list_del_init(&req->timeout.list);
- io_cqring_fill_event(req, 0);
+ io_cqring_fill_event(req, status);
io_put_req_deferred(req, 1);
}
}
@@ -1516,7 +1516,7 @@ static bool io_kill_timeouts(struct io_ring_ctx *ctx, struct task_struct *tsk,
spin_lock_irq(&ctx->completion_lock);
list_for_each_entry_safe(req, tmp, &ctx->timeout_list, timeout.list) {
if (io_match_task(req, tsk, files)) {
- io_kill_timeout(req);
+ io_kill_timeout(req, -ECANCELED);
canceled++;
}
}
@@ -1568,7 +1568,7 @@ static void io_flush_timeouts(struct io_ring_ctx *ctx)
break;

list_del_init(&req->timeout.list);
- io_kill_timeout(req);
+ io_kill_timeout(req, 0);
} while (!list_empty(&ctx->timeout_list));

ctx->cq_last_tm_flush = seq;
--
2.30.2



2021-04-09 10:12:23

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 34/41] tools/resolve_btfids: Set srctree variable unconditionally

From: Jiri Olsa <[email protected]>

[ Upstream commit 7962cb9b640af98ccb577f46c8b894319e6c5c20 ]

We want this clean to be called from tree's root Makefile,
which defines same srctree variable and that will screw
the make setup.

We actually do not use srctree being passed from outside,
so we can solve this by setting current srctree value
directly.

Also changing the way how srctree is initialized as suggested
by Andrri.

Also root Makefile does not define the implicit RM variable,
so adding RM initialization.

Signed-off-by: Jiri Olsa <[email protected]>
Signed-off-by: Andrii Nakryiko <[email protected]>
Acked-by: Andrii Nakryiko <[email protected]>
Link: https://lore.kernel.org/bpf/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
tools/bpf/resolve_btfids/Makefile | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/tools/bpf/resolve_btfids/Makefile b/tools/bpf/resolve_btfids/Makefile
index be09ec4f03ff..bb9fa8de7e62 100644
--- a/tools/bpf/resolve_btfids/Makefile
+++ b/tools/bpf/resolve_btfids/Makefile
@@ -2,11 +2,7 @@
include ../../scripts/Makefile.include
include ../../scripts/Makefile.arch

-ifeq ($(srctree),)
-srctree := $(patsubst %/,%,$(dir $(CURDIR)))
-srctree := $(patsubst %/,%,$(dir $(srctree)))
-srctree := $(patsubst %/,%,$(dir $(srctree)))
-endif
+srctree := $(abspath $(CURDIR)/../../../)

ifeq ($(V),1)
Q =
@@ -22,6 +18,7 @@ AR = $(HOSTAR)
CC = $(HOSTCC)
LD = $(HOSTLD)
ARCH = $(HOSTARCH)
+RM ?= rm

OUTPUT ?= $(srctree)/tools/bpf/resolve_btfids/

--
2.30.2



2021-04-09 10:12:25

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 08/41] mISDN: fix crash in fritzpci

From: Tong Zhang <[email protected]>

[ Upstream commit a9f81244d2e33e6dfcef120fefd30c96b3f7cdb0 ]

setup_fritz() in avmfritz.c might fail with -EIO and in this case the
isac.type and isac.write_reg is not initialized and remains 0(NULL).
A subsequent call to isac_release() will dereference isac->write_reg and
crash.

[ 1.737444] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 1.737809] #PF: supervisor instruction fetch in kernel mode
[ 1.738106] #PF: error_code(0x0010) - not-present page
[ 1.738378] PGD 0 P4D 0
[ 1.738515] Oops: 0010 [#1] SMP NOPTI
[ 1.738711] CPU: 0 PID: 180 Comm: systemd-udevd Not tainted 5.12.0-rc2+ #78
[ 1.739077] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-p
rebuilt.qemu.org 04/01/2014
[ 1.739664] RIP: 0010:0x0
[ 1.739807] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
[ 1.740200] RSP: 0018:ffffc9000027ba10 EFLAGS: 00010202
[ 1.740478] RAX: 0000000000000000 RBX: ffff888102f41840 RCX: 0000000000000027
[ 1.740853] RDX: 00000000000000ff RSI: 0000000000000020 RDI: ffff888102f41800
[ 1.741226] RBP: ffffc9000027ba20 R08: ffff88817bc18440 R09: ffffc9000027b808
[ 1.741600] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888102f41840
[ 1.741976] R13: 00000000fffffffb R14: ffff888102f41800 R15: ffff8881008b0000
[ 1.742351] FS: 00007fda3a38a8c0(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000
[ 1.742774] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1.743076] CR2: ffffffffffffffd6 CR3: 00000001021ec000 CR4: 00000000000006f0
[ 1.743452] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1.743828] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1.744206] Call Trace:
[ 1.744339] isac_release+0xcc/0xe0 [mISDNipac]
[ 1.744582] fritzpci_probe.cold+0x282/0x739 [avmfritz]
[ 1.744861] local_pci_probe+0x48/0x80
[ 1.745063] pci_device_probe+0x10f/0x1c0
[ 1.745278] really_probe+0xfb/0x420
[ 1.745471] driver_probe_device+0xe9/0x160
[ 1.745693] device_driver_attach+0x5d/0x70
[ 1.745917] __driver_attach+0x8f/0x150
[ 1.746123] ? device_driver_attach+0x70/0x70
[ 1.746354] bus_for_each_dev+0x7e/0xc0
[ 1.746560] driver_attach+0x1e/0x20
[ 1.746751] bus_add_driver+0x152/0x1f0
[ 1.746957] driver_register+0x74/0xd0
[ 1.747157] ? 0xffffffffc00d8000
[ 1.747334] __pci_register_driver+0x54/0x60
[ 1.747562] AVM_init+0x36/0x1000 [avmfritz]
[ 1.747791] do_one_initcall+0x48/0x1d0
[ 1.747997] ? __cond_resched+0x19/0x30
[ 1.748206] ? kmem_cache_alloc_trace+0x390/0x440
[ 1.748458] ? do_init_module+0x28/0x250
[ 1.748669] do_init_module+0x62/0x250
[ 1.748870] load_module+0x23ee/0x26a0
[ 1.749073] __do_sys_finit_module+0xc2/0x120
[ 1.749307] ? __do_sys_finit_module+0xc2/0x120
[ 1.749549] __x64_sys_finit_module+0x1a/0x20
[ 1.749782] do_syscall_64+0x38/0x90

Signed-off-by: Tong Zhang <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/isdn/hardware/mISDN/mISDNipac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
index ec475087fbf9..39f841b42488 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -694,7 +694,7 @@ isac_release(struct isac_hw *isac)
{
if (isac->type & IPAC_TYPE_ISACX)
WriteISAC(isac, ISACX_MASK, 0xff);
- else
+ else if (isac->type != 0)
WriteISAC(isac, ISAC_MASK, 0xff);
if (isac->dch.timer.function != NULL) {
del_timer(&isac->dch.timer);
--
2.30.2



2021-04-09 10:12:27

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 06/41] net: pxa168_eth: Fix a potential data race in pxa168_eth_remove

From: Pavel Andrianov <[email protected]>

[ Upstream commit 0571a753cb07982cc82f4a5115e0b321da89e1f3 ]

pxa168_eth_remove() firstly calls unregister_netdev(),
then cancels a timeout work. unregister_netdev() shuts down a device
interface and removes it from the kernel tables. If the timeout occurs
in parallel, the timeout work (pxa168_eth_tx_timeout_task) performs stop
and open of the device. It may lead to an inconsistent state and memory
leaks.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Pavel Andrianov <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/marvell/pxa168_eth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
index d1e4d42e497d..3712e1786091 100644
--- a/drivers/net/ethernet/marvell/pxa168_eth.c
+++ b/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1544,8 +1544,8 @@ static int pxa168_eth_remove(struct platform_device *pdev)
clk_disable_unprepare(pep->clk);
mdiobus_unregister(pep->smi_bus);
mdiobus_free(pep->smi_bus);
- unregister_netdev(dev);
cancel_work_sync(&pep->tx_timeout_task);
+ unregister_netdev(dev);
free_netdev(dev);
return 0;
}
--
2.30.2



2021-04-09 10:17:11

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 33/41] tools/resolve_btfids: Check objects before removing

From: Jiri Olsa <[email protected]>

[ Upstream commit f23130979c2f15ea29a431cd9e1ea7916337bbd4 ]

We want this clean to be called from tree's root clean
and that one is silent if there's nothing to clean.

Adding check for all object to clean and display CLEAN
messages only if there are objects to remove.

Signed-off-by: Jiri Olsa <[email protected]>
Signed-off-by: Andrii Nakryiko <[email protected]>
Acked-by: Andrii Nakryiko <[email protected]>
Link: https://lore.kernel.org/bpf/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
tools/bpf/resolve_btfids/Makefile | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/tools/bpf/resolve_btfids/Makefile b/tools/bpf/resolve_btfids/Makefile
index 1d46a247ec95..be09ec4f03ff 100644
--- a/tools/bpf/resolve_btfids/Makefile
+++ b/tools/bpf/resolve_btfids/Makefile
@@ -64,13 +64,20 @@ $(BINARY): $(BPFOBJ) $(SUBCMDOBJ) $(BINARY_IN)
$(call msg,LINK,$@)
$(Q)$(CC) $(BINARY_IN) $(LDFLAGS) -o $@ $(BPFOBJ) $(SUBCMDOBJ) $(LIBS)

+clean_objects := $(wildcard $(OUTPUT)/*.o \
+ $(OUTPUT)/.*.o.cmd \
+ $(OUTPUT)/.*.o.d \
+ $(OUTPUT)/libbpf \
+ $(OUTPUT)/libsubcmd \
+ $(OUTPUT)/resolve_btfids)
+
+ifneq ($(clean_objects),)
clean: fixdep-clean
$(call msg,CLEAN,$(BINARY))
- $(Q)$(RM) -f $(BINARY); \
- $(RM) -rf $(if $(OUTPUT),$(OUTPUT),.)/feature; \
- $(RM) -rf $(OUTPUT)/libbpf; \
- $(RM) -rf $(OUTPUT)/libsubcmd; \
- find $(if $(OUTPUT),$(OUTPUT),.) -name \*.o -or -name \*.o.cmd -or -name \*.o.d | xargs $(RM)
+ $(Q)$(RM) -rf $(clean_objects)
+else
+clean:
+endif

tags:
$(call msg,GEN,,tags)
--
2.30.2



2021-04-09 10:18:53

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 39/41] bpf, x86: Validate computation of branch displacements for x86-32

From: Piotr Krysiuk <[email protected]>

commit 26f55a59dc65ff77cd1c4b37991e26497fc68049 upstream.

The branch displacement logic in the BPF JIT compilers for x86 assumes
that, for any generated branch instruction, the distance cannot
increase between optimization passes.

But this assumption can be violated due to how the distances are
computed. Specifically, whenever a backward branch is processed in
do_jit(), the distance is computed by subtracting the positions in the
machine code from different optimization passes. This is because part
of addrs[] is already updated for the current optimization pass, before
the branch instruction is visited.

And so the optimizer can expand blocks of machine code in some cases.

This can confuse the optimizer logic, where it assumes that a fixed
point has been reached for all machine code blocks once the total
program size stops changing. And then the JIT compiler can output
abnormal machine code containing incorrect branch displacements.

To mitigate this issue, we assert that a fixed point is reached while
populating the output image. This rejects any problematic programs.
The issue affects both x86-32 and x86-64. We mitigate separately to
ease backporting.

Signed-off-by: Piotr Krysiuk <[email protected]>
Reviewed-by: Daniel Borkmann <[email protected]>
Signed-off-by: Daniel Borkmann <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/x86/net/bpf_jit_comp32.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)

--- a/arch/x86/net/bpf_jit_comp32.c
+++ b/arch/x86/net/bpf_jit_comp32.c
@@ -2278,7 +2278,16 @@ notyet:
}

if (image) {
- if (unlikely(proglen + ilen > oldproglen)) {
+ /*
+ * When populating the image, assert that:
+ *
+ * i) We do not write beyond the allocated space, and
+ * ii) addrs[i] did not change from the prior run, in order
+ * to validate assumptions made for computing branch
+ * displacements.
+ */
+ if (unlikely(proglen + ilen > oldproglen ||
+ proglen + ilen != addrs[i])) {
pr_err("bpf_jit: fatal error\n");
return -EFAULT;
}


2021-04-09 10:35:43

by Pavel Machek

[permalink] [raw]
Subject: Re: [PATCH 5.10 06/41] net: pxa168_eth: Fix a potential data race in pxa168_eth_remove

Hi!

> [ Upstream commit 0571a753cb07982cc82f4a5115e0b321da89e1f3 ]
>
> pxa168_eth_remove() firstly calls unregister_netdev(),
> then cancels a timeout work. unregister_netdev() shuts down a device
> interface and removes it from the kernel tables. If the timeout occurs
> in parallel, the timeout work (pxa168_eth_tx_timeout_task) performs stop
> and open of the device. It may lead to an inconsistent state and memory
> leaks.

AFAICT the timeout work does a lot of processing, including
pxa168_eth_open(), pxa168_init_phy() and phy_connect_direct(). We
probably don't want that to run with clock being disabled and DMA
being unmapped.

We certainly don't want phy_disconnect() being undone by
phy_connect_direct() running in the workqueue.

IOW this patch is not enough to fix the bugs, and at least fix below
is needed to get something reasonable.

Signed-off-by: Pavel Machek (CIP) <[email protected]>

Best regards,
Pavel

> +++ b/drivers/net/ethernet/marvell/pxa168_eth.c
> @@ -1544,8 +1544,8 @@ static int pxa168_eth_remove(struct platform_device *pdev)
> clk_disable_unprepare(pep->clk);
> mdiobus_unregister(pep->smi_bus);
> mdiobus_free(pep->smi_bus);
> - unregister_netdev(dev);
> cancel_work_sync(&pep->tx_timeout_task);
> + unregister_netdev(dev);
> free_netdev(dev);
> return 0;
> }

diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
index d1e4d42e497d..432be22a51be 100644
--- a/drivers/net/ethernet/marvell/pxa168_eth.c
+++ b/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1532,7 +1532,8 @@ static int pxa168_eth_remove(struct platform_device *pdev)
{
struct net_device *dev = platform_get_drvdata(pdev);
struct pxa168_eth_private *pep = netdev_priv(dev);
-
+
+ cancel_work_sync(&pep->tx_timeout_task);
if (pep->htpr) {
dma_free_coherent(pep->dev->dev.parent, HASH_ADDR_TABLE_SIZE,
pep->htpr, pep->htpr_dma);
@@ -1545,7 +1546,6 @@ static int pxa168_eth_remove(struct platform_device *pdev)
mdiobus_unregister(pep->smi_bus);
mdiobus_free(pep->smi_bus);
unregister_netdev(dev);
- cancel_work_sync(&pep->tx_timeout_task);
free_netdev(dev);
return 0;
}

--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany


Attachments:
(No filename) (2.32 kB)
signature.asc (188.00 B)
Digital signature
Download all attachments

2021-04-09 15:11:20

by Andrei Rabusov

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/41] 5.10.29-rc1 review

On Fri, Apr 09, 2021 at 11:53:22AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.29 release.
> There are 41 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 11 Apr 2021 09:52:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.29-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

For my i686 with gcc 10.2 no regressions were found
Selftest result [ok/not ok]: [1436/80]

Tested-by: A. Rabusov <[email protected]>

2021-04-09 18:11:41

by Florian Fainelli

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/41] 5.10.29-rc1 review



On 4/9/2021 2:53 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.29 release.
> There are 41 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 11 Apr 2021 09:52:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.29-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

On ARCH_BRCMSTB, using 32-bit and 64-bit kernels:

Tested-by: Florian Fainelli <[email protected]>
--
Florian

2021-04-09 19:53:21

by Sudip Mukherjee

[permalink] [raw]
Subject: Re: [PATCH 5.10 39/41] bpf, x86: Validate computation of branch displacements for x86-32

Hi Greg,

On Fri, Apr 09, 2021 at 11:54:01AM +0200, Greg Kroah-Hartman wrote:
> From: Piotr Krysiuk <[email protected]>
>
> commit 26f55a59dc65ff77cd1c4b37991e26497fc68049 upstream.

I am not finding this in Linus's tree and even not seeing this change in
master branch also. Am I missing something?


--
Regards
Sudip

2021-04-09 20:16:42

by Daniel Borkmann

[permalink] [raw]
Subject: Re: [PATCH 5.10 39/41] bpf, x86: Validate computation of branch displacements for x86-32

On 4/9/21 9:51 PM, Sudip Mukherjee wrote:
> On Fri, Apr 09, 2021 at 11:54:01AM +0200, Greg Kroah-Hartman wrote:
>> From: Piotr Krysiuk <[email protected]>
>>
>> commit 26f55a59dc65ff77cd1c4b37991e26497fc68049 upstream.
>
> I am not finding this in Linus's tree and even not seeing this change in
> master branch also. Am I missing something?

Both are in -net tree at this point, thus commit sha won't change anymore. David or
Jakub will likely send their -net PR to Linus today or tomorrow for landing in
mainline. For stable things had to move a bit quicker given the announcement in [0]
yesterday. Timing was a bit unfortunate here as I would have preferred for things to
land in stable the regular way first (aka merge to mainline, cherry-picking to stable,
minor stable release, then announcement).

Thanks,
Daniel

[0] https://www.openwall.com/lists/oss-security/2021/04/08/1

2021-04-09 20:17:15

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/41] 5.10.29-rc1 review

On Fri, Apr 09, 2021 at 11:53:22AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.29 release.
> There are 41 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 11 Apr 2021 09:52:52 +0000.
> Anything received after that time might be too late.
>

Build results:
total: 156 pass: 156 fail: 0
Qemu test results:
total: 454 pass: 454 fail: 0

Tested-by: Guenter Roeck <[email protected]>

Guenter

2021-04-09 20:40:48

by Shuah Khan

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/41] 5.10.29-rc1 review

On 4/9/21 3:53 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.29 release.
> There are 41 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 11 Apr 2021 09:52:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.29-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

Compiled and booted on my test system. No dmesg regressions.

Tested-by: Shuah Khan <[email protected]>

thanks,
-- Shuah

2021-04-09 21:25:36

by Sudip Mukherjee

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/41] 5.10.29-rc1 review

Hi Greg,

On Fri, Apr 09, 2021 at 11:53:22AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.29 release.
> There are 41 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 11 Apr 2021 09:52:52 +0000.
> Anything received after that time might be too late.

Build test:
mips: 63 configs -> no new failure
arm: 105 configs -> no new failure
x86_64: 2 configs -> no failure

Boot test:
x86_64: Booted on my test laptop. No regression.

Tested-by: Sudip Mukherjee <[email protected]>


--
Regards
Sudip

2021-04-10 00:57:30

by Zou Wei

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/41] 5.10.29-rc1 review



On 2021/4/9 17:53, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.29 release.
> There are 41 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 11 Apr 2021 09:52:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.29-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

Tested on arm64 and x86 for 5.10.29-rc1,

Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.29-rc1
Commit: 18f507c37f338c5d30f58839060d3af0d8504162
Compiler: gcc version 7.3.0 (GCC)

arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 4720
passed: 4720
failed: 0
timeout: 0
--------------------------------------------------------------------

x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 4720
passed: 4720
failed: 0
timeout: 0
--------------------------------------------------------------------

Tested-by: Hulk Robot <[email protected]>

2021-04-10 07:26:11

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/41] 5.10.29-rc1 review

On Fri, 9 Apr 2021 at 15:30, Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 5.10.29 release.
> There are 41 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 11 Apr 2021 09:52:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.29-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Tested-by: Linux Kernel Functional Testing <[email protected]>

## Build
* kernel: 5.10.29-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-5.10.y
* git commit: 18f507c37f338c5d30f58839060d3af0d8504162
* git describe: v5.10.28-42-g18f507c37f33
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.28-42-g18f507c37f33

## No regressions (compared to v5.10.28)

## No fixes (compared to v5.10.28)


## Test result summary
total: 76017, pass: 63668, fail: 2017, skip: 10100, xfail: 232,

## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 192 total, 192 passed, 0 failed
* arm64: 26 total, 26 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 24 total, 24 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 45 total, 45 passed, 0 failed
* parisc: 9 total, 9 passed, 0 failed
* powerpc: 27 total, 27 passed, 0 failed
* riscv: 21 total, 21 passed, 0 failed
* s390: 18 total, 18 passed, 0 failed
* sh: 18 total, 18 passed, 0 failed
* sparc: 9 total, 9 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 26 total, 26 passed, 0 failed

## Test suites summary
* fwts
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest-
* kselftest-android
* kselftest-bpf
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-vsyscall-mode-native-
* kselftest-vsyscall-mode-none-
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* perf
* rcutorture
* ssuite
* v4l2-compliance

--
Linaro LKFT
https://lkft.linaro.org