From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 901E8C433EF for ; Fri, 3 Jun 2022 17:39:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344553AbiFCRjs (ORCPT ); Fri, 3 Jun 2022 13:39:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54988 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343573AbiFCRjq (ORCPT ); Fri, 3 Jun 2022 13:39:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 71CD15130C; Fri, 3 Jun 2022 10:39:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 11CBFB8241D; Fri, 3 Jun 2022 17:39:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0029BC385B8; Fri, 3 Jun 2022 17:39:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654277982; bh=AV9DVa9fzpZL+XXAkhzFaiq2wJMsBMzKbynklE/2+UY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SD9sJzIU8NR7v8twWqDgsAZ+TxK1vA1BX/46SZ8XQVVcMV+rb1FXbh9ogEPT7Yacn QrKYWKGUjtiGiVP0DaUez2Wxps+RjYk/zM79cGpPzyze0I1tUwWg+VpjBy61yv5vEQ Rs4lBXd8lkUXE/Zh/KiwC8hcuATGOeW4ZGmVM9wc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thomas Bartschies , Steffen Klassert , Sasha Levin Subject: [PATCH 4.9 01/12] net: af_key: check encryption module availability consistency Date: Fri, 3 Jun 2022 19:39:27 +0200 Message-Id: <20220603173812.568108883@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thomas Bartschies [ Upstream commit 015c44d7bff3f44d569716117becd570c179ca32 ] Since the recent introduction supporting the SM3 and SM4 hash algos for IPs= ec, the kernel produces invalid pfkey acquire messages, when these encryption modules are = disabled. This happens because the availability of the algos wasn't checked in all necessa= ry functions. This patch adds these checks. Signed-off-by: Thomas Bartschies Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/key/af_key.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/key/af_key.c b/net/key/af_key.c index 776f94ecbfe6..d5dc614af2f9 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -2935,7 +2935,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t) break; if (!aalg->pfkey_supported) continue; - if (aalg_tmpl_set(t, aalg)) + if (aalg_tmpl_set(t, aalg) && aalg->available) sz +=3D sizeof(struct sadb_comb); } return sz + sizeof(struct sadb_prop); @@ -2953,7 +2953,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t) if (!ealg->pfkey_supported) continue; =20 - if (!(ealg_tmpl_set(t, ealg))) + if (!(ealg_tmpl_set(t, ealg) && ealg->available)) continue; =20 for (k =3D 1; ; k++) { @@ -2964,7 +2964,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t) if (!aalg->pfkey_supported) continue; =20 - if (aalg_tmpl_set(t, aalg)) + if (aalg_tmpl_set(t, aalg) && aalg->available) sz +=3D sizeof(struct sadb_comb); } } --=20 2.35.1 From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07DF5C43334 for ; Fri, 3 Jun 2022 17:40:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344648AbiFCRkP (ORCPT ); Fri, 3 Jun 2022 13:40:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55422 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344588AbiFCRkC (ORCPT ); Fri, 3 Jun 2022 13:40:02 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E576532DA; Fri, 3 Jun 2022 10:40:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A4E86B8241D; Fri, 3 Jun 2022 17:40:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFBFDC3411C; Fri, 3 Jun 2022 17:39:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654277999; bh=hcEIL1pzwL3kUjm/DoQRDd1vOkGaipd/dvLI4ffFRP0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nOJzERBAnwtvXa+4tqXqypbUCiqqWR7XH4n6BwzAqjLZ0vNR85LNh5QgKFEv26JCL Pfn0SzV5aH4zk1JW08qPw2kv3uQQ637hyr0yoaIRQGhzvAcIJ92z18fLuITrAUkAcb 6ZPmCgq9n9VWUMjyejcBEwiQZOn69rDWVDcggiSw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Szymon Balcerak , Piyush Malgujar , Wolfram Sang , Sasha Levin Subject: [PATCH 4.9 02/12] drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers Date: Fri, 3 Jun 2022 19:39:28 +0200 Message-Id: <20220603173812.597594645@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Piyush Malgujar [ Upstream commit 03a35bc856ddc09f2cc1f4701adecfbf3b464cb3 ] Due to i2c->adap.dev.fwnode not being set, ACPI_COMPANION() wasn't properly found for TWSI controllers. Signed-off-by: Szymon Balcerak Signed-off-by: Piyush Malgujar Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/i2c/busses/i2c-thunderx-pcidrv.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/i2c/busses/i2c-thunderx-pcidrv.c b/drivers/i2c/busses/= i2c-thunderx-pcidrv.c index bba5b429f69c..3298483bb9b4 100644 --- a/drivers/i2c/busses/i2c-thunderx-pcidrv.c +++ b/drivers/i2c/busses/i2c-thunderx-pcidrv.c @@ -208,6 +208,7 @@ static int thunder_i2c_probe_pci(struct pci_dev *pdev, i2c->adap.bus_recovery_info =3D &octeon_i2c_recovery_info; i2c->adap.dev.parent =3D dev; i2c->adap.dev.of_node =3D pdev->dev.of_node; + i2c->adap.dev.fwnode =3D dev->fwnode; snprintf(i2c->adap.name, sizeof(i2c->adap.name), "Cavium ThunderX i2c adapter at %s", dev_name(dev)); i2c_set_adapdata(&i2c->adap, i2c); --=20 2.35.1 From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C61BFC43334 for ; Fri, 3 Jun 2022 17:40:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344567AbiFCRkR (ORCPT ); Fri, 3 Jun 2022 13:40:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55674 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344591AbiFCRkL (ORCPT ); Fri, 3 Jun 2022 13:40:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2F4AD53702; Fri, 3 Jun 2022 10:40:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C6307B8242F; Fri, 3 Jun 2022 17:40:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1AE8BC385A9; Fri, 3 Jun 2022 17:40:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654278002; bh=EWXpTEksvB8S2ffedv2N/dJ3pt3UBJG3z47wb74wmtU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M0IfW2+sLRnX21nM4l4wzn2X9nQFq5zCmzOeiyjOCI9vhP286YgzQfqrTQtnpZuxF 55xymc2Nsau9Qy4+GLy8kVIvdcFWdxlJFRbHEcVKeqkRrnR51E25vM45h0LWdv890R xiSq/WPAo6a1g2j0OAm/HN0+RyV9WDiLlU+48UXQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stephen Brennan , David Howells , Andrew Morton , keyrings@vger.kernel.org, Jarkko Sakkinen , Linus Torvalds Subject: [PATCH 4.9 03/12] assoc_array: Fix BUG_ON during garbage collect Date: Fri, 3 Jun 2022 19:39:29 +0200 Message-Id: <20220603173812.625090643@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stephen Brennan commit d1dc87763f406d4e67caf16dbe438a5647692395 upstream. A rare BUG_ON triggered in assoc_array_gc: [3430308.818153] kernel BUG at lib/assoc_array.c:1609! Which corresponded to the statement currently at line 1593 upstream: BUG_ON(assoc_array_ptr_is_meta(p)); Using the data from the core dump, I was able to generate a userspace reproducer[1] and determine the cause of the bug. [1]: https://github.com/brenns10/kernel_stuff/tree/master/assoc_array_gc After running the iterator on the entire branch, an internal tree node looked like the following: NODE (nr_leaves_on_branch: 3) SLOT [0] NODE (2 leaves) SLOT [1] NODE (1 leaf) SLOT [2..f] NODE (empty) In the userspace reproducer, the pr_devel output when compressing this node was: -- compress node 0x5607cc089380 -- free=3D0, leaves=3D0 [0] retain node 2/1 [nx 0] [1] fold node 1/1 [nx 0] [2] fold node 0/1 [nx 2] [3] fold node 0/2 [nx 2] [4] fold node 0/3 [nx 2] [5] fold node 0/4 [nx 2] [6] fold node 0/5 [nx 2] [7] fold node 0/6 [nx 2] [8] fold node 0/7 [nx 2] [9] fold node 0/8 [nx 2] [10] fold node 0/9 [nx 2] [11] fold node 0/10 [nx 2] [12] fold node 0/11 [nx 2] [13] fold node 0/12 [nx 2] [14] fold node 0/13 [nx 2] [15] fold node 0/14 [nx 2] after: 3 At slot 0, an internal node with 2 leaves could not be folded into the node, because there was only one available slot (slot 0). Thus, the internal node was retained. At slot 1, the node had one leaf, and was able to be folded in successfully. The remaining nodes had no leaves, and so were removed. By the end of the compression stage, there were 14 free slots, and only 3 leaf nodes. The tree was ascended and then its parent node was compressed. When this node was seen, it could not be folded, due to the internal node it contained. The invariant for compression in this function is: whenever nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT, the node should contain all leaf nodes. The compression step currently cannot guarantee this, given the corner case shown above. To fix this issue, retry compression whenever we have retained a node, and yet nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT. This second compression will then allow the node in slot 1 to be folded in, satisfying the invariant. Below is the output of the reproducer once the fix is applied: -- compress node 0x560e9c562380 -- free=3D0, leaves=3D0 [0] retain node 2/1 [nx 0] [1] fold node 1/1 [nx 0] [2] fold node 0/1 [nx 2] [3] fold node 0/2 [nx 2] [4] fold node 0/3 [nx 2] [5] fold node 0/4 [nx 2] [6] fold node 0/5 [nx 2] [7] fold node 0/6 [nx 2] [8] fold node 0/7 [nx 2] [9] fold node 0/8 [nx 2] [10] fold node 0/9 [nx 2] [11] fold node 0/10 [nx 2] [12] fold node 0/11 [nx 2] [13] fold node 0/12 [nx 2] [14] fold node 0/13 [nx 2] [15] fold node 0/14 [nx 2] internal nodes remain despite enough space, retrying -- compress node 0x560e9c562380 -- free=3D14, leaves=3D1 [0] fold node 2/15 [nx 0] after: 3 Changes =3D=3D=3D=3D=3D=3D=3D DH: - Use false instead of 0. - Reorder the inserted lines in a couple of places to put retained before next_slot. ver #2) - Fix typo in pr_devel, correct comparison to "<=3D" Fixes: 3cb989501c26 ("Add a generic associative array implementation.") Cc: Signed-off-by: Stephen Brennan Signed-off-by: David Howells cc: Andrew Morton cc: keyrings@vger.kernel.org Link: https://lore.kernel.org/r/20220511225517.407935-1-stephen.s.brennan@o= racle.com/ # v1 Link: https://lore.kernel.org/r/20220512215045.489140-1-stephen.s.brennan@o= racle.com/ # v2 Reviewed-by: Jarkko Sakkinen Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- lib/assoc_array.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/lib/assoc_array.c +++ b/lib/assoc_array.c @@ -1478,6 +1478,7 @@ int assoc_array_gc(struct assoc_array *a struct assoc_array_ptr *cursor, *ptr; struct assoc_array_ptr *new_root, *new_parent, **new_ptr_pp; unsigned long nr_leaves_on_tree; + bool retained; int keylen, slot, nr_free, next_slot, i; =20 pr_devel("-->%s()\n", __func__); @@ -1554,6 +1555,7 @@ continue_node: goto descend; } =20 +retry_compress: pr_devel("-- compress node %p --\n", new_n); =20 /* Count up the number of empty slots in this node and work out the @@ -1571,6 +1573,7 @@ continue_node: pr_devel("free=3D%d, leaves=3D%lu\n", nr_free, new_n->nr_leaves_on_branch= ); =20 /* See what we can fold in */ + retained =3D false; next_slot =3D 0; for (slot =3D 0; slot < ASSOC_ARRAY_FAN_OUT; slot++) { struct assoc_array_shortcut *s; @@ -1620,9 +1623,14 @@ continue_node: pr_devel("[%d] retain node %lu/%d [nx %d]\n", slot, child->nr_leaves_on_branch, nr_free + 1, next_slot); + retained =3D true; } } =20 + if (retained && new_n->nr_leaves_on_branch <=3D ASSOC_ARRAY_FAN_OUT) { + pr_devel("internal nodes remain despite enough space, retrying\n"); + goto retry_compress; + } pr_devel("after: %lu\n", new_n->nr_leaves_on_branch); =20 nr_leaves_on_tree =3D new_n->nr_leaves_on_branch; From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7587CC433EF for ; Fri, 3 Jun 2022 17:40:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344641AbiFCRk2 (ORCPT ); Fri, 3 Jun 2022 13:40:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55494 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344618AbiFCRkM (ORCPT ); Fri, 3 Jun 2022 13:40:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E746B532D9; Fri, 3 Jun 2022 10:40:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7FDB561B07; Fri, 3 Jun 2022 17:40:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F9ECC385A9; Fri, 3 Jun 2022 17:40:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654278005; bh=RM5gSl+cMl2QZdDJzI/fwtxpfOOvE12Z8j70+WDKe5E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jp35v6q2TY/vASUNX0DC919Ua3HQd2Gz4MiSQLxCpr+aKmj4ypfAnVmK0TfQRHjO5 eU3yCNeKjrpb0FBe8xY2Q238/upuXoVtd+Bo8wwe0nskBwybxLAxfiqngw91pEbHD1 kVP5E8FJ35IQr+IT3HtIRYTxGLU6Iv3PhisMAJkM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Gustavo A. R. Silva" Subject: [PATCH 4.9 04/12] drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() Date: Fri, 3 Jun 2022 19:39:30 +0200 Message-Id: <20220603173812.655702135@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Gustavo A. R. Silva commit 336feb502a715909a8136eb6a62a83d7268a353b upstream. Fix the following -Wstringop-overflow warnings when building with GCC-11: drivers/gpu/drm/i915/intel_pm.c:3106:9: warning: =E2=80=98intel_read_wm_lat= ency=E2=80=99 accessing 16 bytes in a region of size 10 [-Wstringop-overflo= w=3D] 3106 | intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/i915/intel_pm.c:3106:9: note: referencing argument 2 of typ= e =E2=80=98u16 *=E2=80=99 {aka =E2=80=98short unsigned int *=E2=80=99} drivers/gpu/drm/i915/intel_pm.c:2861:13: note: in a call to function =E2=80= =98intel_read_wm_latency=E2=80=99 2861 | static void intel_read_wm_latency(struct drm_i915_private *dev_priv, | ^~~~~~~~~~~~~~~~~~~~~ by removing the over-specified array size from the argument declarations. It seems that this code is actually safe because the size of the array depends on the hardware generation, and the function checks for that. Notice that wm can be an array of 5 elements: drivers/gpu/drm/i915/intel_pm.c:3109: intel_read_wm_latency(dev_priv, dev= _priv->wm.pri_latency); or an array of 8 elements: drivers/gpu/drm/i915/intel_pm.c:3131: intel_read_wm_latency(dev_priv, dev= _priv->wm.skl_latency); and the compiler legitimately complains about that. This helps with the ongoing efforts to globally enable -Wstringop-overflow. Link: https://github.com/KSPP/linux/issues/181 Signed-off-by: Gustavo A. R. Silva Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/gpu/drm/i915/intel_pm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/i915/intel_pm.c +++ b/drivers/gpu/drm/i915/intel_pm.c @@ -2083,7 +2083,7 @@ hsw_compute_linetime_wm(const struct int PIPE_WM_LINETIME_TIME(linetime); } =20 -static void intel_read_wm_latency(struct drm_device *dev, uint16_t wm[8]) +static void intel_read_wm_latency(struct drm_device *dev, uint16_t wm[]) { struct drm_i915_private *dev_priv =3D to_i915(dev); =20 From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE0B8C433EF for ; Fri, 3 Jun 2022 17:40:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344617AbiFCRkZ (ORCPT ); Fri, 3 Jun 2022 13:40:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344641AbiFCRkO (ORCPT ); Fri, 3 Jun 2022 13:40:14 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 394D152E73; Fri, 3 Jun 2022 10:40:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 8E572CE247C; Fri, 3 Jun 2022 17:40:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 75348C385A9; Fri, 3 Jun 2022 17:40:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654278008; bh=komNFgnS0FqLDSYmW+a2ifBD02kTTJqYIBqeGiPTkEc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=w07WZQ3HHKLuSE9CBwcHzujbBeIHirwic+tJjie1Yn4QjYAMKq+XLL91GQVv3bwJB x9PC1Pc3hEHeJWLC6078OM53pBVE0gLTjSdLqQaC8YuufrceDXsLCgJwkQOf8HF/Qk EVm1uiuKQ+mxbsj9NBxFL86+O99OMdgq/0Y0LKEM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Haimin Zhang , Chaitanya Kulkarni , Christoph Hellwig , Jens Axboe , Dragos-Marian Panait Subject: [PATCH 4.9 05/12] block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern Date: Fri, 3 Jun 2022 19:39:31 +0200 Message-Id: <20220603173812.684682590@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Haimin Zhang commit cc8f7fe1f5eab010191aa4570f27641876fa1267 upstream. Add __GFP_ZERO flag for alloc_page in function bio_copy_kern to initialize the buffer of a bio. Signed-off-by: Haimin Zhang Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220216084038.15635-1-tcs.kernel@gmail.com Signed-off-by: Jens Axboe [DP: Backported to 4.19: Manually added __GFP_ZERO flag] Signed-off-by: Dragos-Marian Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- block/bio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/block/bio.c +++ b/block/bio.c @@ -1538,7 +1538,7 @@ struct bio *bio_copy_kern(struct request if (bytes > len) bytes =3D len; =20 - page =3D alloc_page(q->bounce_gfp | gfp_mask); + page =3D alloc_page(q->bounce_gfp | __GFP_ZERO | gfp_mask); if (!page) goto cleanup; From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CAA56C433EF for ; Fri, 3 Jun 2022 17:40:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243840AbiFCRkg (ORCPT ); Fri, 3 Jun 2022 13:40:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55702 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344650AbiFCRkR (ORCPT ); Fri, 3 Jun 2022 13:40:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3DBF532F3; Fri, 3 Jun 2022 10:40:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F35ACB8242F; Fri, 3 Jun 2022 17:40:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A757C3411C; Fri, 3 Jun 2022 17:40:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654278011; bh=H+33qVGEmmmRXd4D8HKPoED2WQ8+Wv50Xo0oV+noaXc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0/EVWW4b5dAbUugoe4ydwCC+4fGo9alvvec39ygv7HDT6l1vuPhwGU3CLcDA/7S8u O/pogg7RAB4BhuE0+fM27KWAm9j7DOlb2NaUVoaVHzrYL66yzo8Xyaz8bOFSNpLwnq H084RR5Dbat4C3fE8EJZYSwiNJsbU9PBoVsEXrjg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ariadne Conill , Michael Kerrisk , Matthew Wilcox , Christian Brauner , Rich Felker , Eric Biederman , Alexander Viro , linux-fsdevel@vger.kernel.org, Kees Cook , Andy Lutomirski , Vegard Nossum Subject: [PATCH 4.9 06/12] exec: Force single empty string when argv is empty Date: Fri, 3 Jun 2022 19:39:32 +0200 Message-Id: <20220603173812.713763455@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kees Cook commit dcd46d897adb70d63e025f175a00a89797d31a43 upstream. Quoting[1] Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve(2) be the name of a program, thus prohibiting a scenario where argc < 1. POSIX 2017 also recommends this behaviour, but it is not an explicit requirement[2]: The argument arg0 should point to a filename string that is associated with the process being started by one of the exec functions. ... Interestingly, Michael Kerrisk opened an issue about this in 2008[3], but there was no consensus to support fixing this issue then. Hopefully now that CVE-2021-4034 shows practical exploitative use[4] of this bug in a shellcode, we can reconsider. This issue is being tracked in the KSPP issue tracker[5]." While the initial code searches[6][7] turned up what appeared to be mostly corner case tests, trying to that just reject argv =3D=3D NULL (or an immediately terminated pointer list) quickly started tripping[8] existing userspace programs. The next best approach is forcing a single empty string into argv and adjusting argc to match. The number of programs depending on argc =3D=3D 0 seems a smaller set than those calling execve with a NULL argv. Account for the additional stack space in bprm_stack_limits(). Inject an empty string when argc =3D=3D 0 (and set argc =3D 1). Warn about the case so userspace has some notice about the change: process './argc0' launched './argc0' with NULL argv: empty string added Additionally WARN() and reject NULL argv usage for kernel threads. [1] https://lore.kernel.org/lkml/20220127000724.15106-1-ariadne@dereference= d.org/ [2] https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html [3] https://bugzilla.kernel.org/show_bug.cgi?id=3D8408 [4] https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt [5] https://github.com/KSPP/linux/issues/176 [6] https://codesearch.debian.net/search?q=3Dexecve%5C+*%5C%28%5B%5E%2C%5D%= 2B%2C+*NULL&literal=3D0 [7] https://codesearch.debian.net/search?q=3Dexeclp%3F%5Cs*%5C%28%5B%5E%2C%= 5D%2B%2C%5Cs*NULL&literal=3D0 [8] https://lore.kernel.org/lkml/20220131144352.GE16385@xsang-OptiPlex-9020/ Reported-by: Ariadne Conill Reported-by: Michael Kerrisk Cc: Matthew Wilcox Cc: Christian Brauner Cc: Rich Felker Cc: Eric Biederman Cc: Alexander Viro Cc: linux-fsdevel@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Acked-by: Christian Brauner Acked-by: Ariadne Conill Acked-by: Andy Lutomirski Link: https://lore.kernel.org/r/20220201000947.2453721-1-keescook@chromium.= org [vegard: fixed conflicts due to missing 886d7de631da71e30909980fdbf318f7caade262^- and 3950e975431bc914f7e81b8f2a2dbdf2064acb0f^- and 655c16a8ce9c15842547f40ce23fd148aeccc074] Signed-off-by: Vegard Nossum Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- fs/exec.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) This has been tested in both argc =3D=3D 0 and argc >=3D 1 cases, but I wou= ld still appreciate a review given the differences with mainline. If it's considered too risky I'm also fine with dropping it -- just wanted to make sure this didn't fall through the cracks, as it does block a real (albeit old by now) exploit. --- a/fs/exec.c +++ b/fs/exec.c @@ -1758,6 +1758,9 @@ static int do_execveat_common(int fd, st goto out_unmark; =20 bprm->argc =3D count(argv, MAX_ARG_STRINGS); + if (bprm->argc =3D=3D 0) + pr_warn_once("process '%s' launched '%s' with NULL argv: empty string ad= ded\n", + current->comm, bprm->filename); if ((retval =3D bprm->argc) < 0) goto out; =20 @@ -1782,6 +1785,20 @@ static int do_execveat_common(int fd, st if (retval < 0) goto out; =20 + /* + * When argv is empty, add an empty string ("") as argv[0] to + * ensure confused userspace programs that start processing + * from argv[1] won't end up walking envp. See also + * bprm_stack_limits(). + */ + if (bprm->argc =3D=3D 0) { + const char *argv[] =3D { "", NULL }; + retval =3D copy_strings_kernel(1, argv, bprm); + if (retval < 0) + goto out; + bprm->argc =3D 1; + } + retval =3D exec_binprm(bprm); if (retval < 0) goto out; From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 294E3CCA473 for ; Fri, 3 Jun 2022 17:41:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344710AbiFCRk5 (ORCPT ); Fri, 3 Jun 2022 13:40:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56034 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344662AbiFCRkT (ORCPT ); Fri, 3 Jun 2022 13:40:19 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2EBC553702; Fri, 3 Jun 2022 10:40:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 55EE5CE247C; Fri, 3 Jun 2022 17:40:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 309F4C385A9; Fri, 3 Jun 2022 17:40:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654278014; bh=Hk3/f2nNv92H8r0dP39kp+bBvl8z1V6g6xqfAm88exk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hBdsJFp0Jg3aHyjBwvzgYa6uzenDsWxvsslncRRkcReGNm62oGcJMxNFGQMJ/18H3 /VKfTFabyXseaOoNl8p1GABlDYwLi7YcsZzCZLjIW/zPr9vBCjjCf+eMvE+Y1oIhDX iUiHnc9vIGr0OcXf3V1mVr2YaqUeHiS9wgKGafgI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Milan Broz , Mike Snitzer Subject: [PATCH 4.9 07/12] dm crypt: make printing of the key constant-time Date: Fri, 3 Jun 2022 19:39:33 +0200 Message-Id: <20220603173812.742968160@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit 567dd8f34560fa221a6343729474536aa7ede4fd upstream. The device mapper dm-crypt target is using scnprintf("%02x", cc->key[i]) to report the current key to userspace. However, this is not a constant-time operation and it may leak information about the key via timing, via cache access patterns or via the branch predictor. Change dm-crypt's key printing to use "%c" instead of "%02x". Also introduce hex2asc() that carefully avoids any branching or memory accesses when converting a number in the range 0 ... 15 to an ascii character. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Tested-by: Milan Broz Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/md/dm-crypt.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -1943,6 +1943,11 @@ static int crypt_map(struct dm_target *t return DM_MAPIO_SUBMITTED; } =20 +static char hex2asc(unsigned char c) +{ + return c + '0' + ((unsigned)(9 - c) >> 4 & 0x27); +} + static void crypt_status(struct dm_target *ti, status_type_t type, unsigned status_flags, char *result, unsigned maxlen) { @@ -1958,10 +1963,12 @@ static void crypt_status(struct dm_targe case STATUSTYPE_TABLE: DMEMIT("%s ", cc->cipher_string); =20 - if (cc->key_size > 0) - for (i =3D 0; i < cc->key_size; i++) - DMEMIT("%02x", cc->key[i]); - else + if (cc->key_size > 0) { + for (i =3D 0; i < cc->key_size; i++) { + DMEMIT("%c%c", hex2asc(cc->key[i] >> 4), + hex2asc(cc->key[i] & 0xf)); + } + } else DMEMIT("-"); =20 DMEMIT(" %llu %s %llu", (unsigned long long)cc->iv_offset, From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 534E2CCA473 for ; Fri, 3 Jun 2022 17:40:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344751AbiFCRky (ORCPT ); Fri, 3 Jun 2022 13:40:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236861AbiFCRkV (ORCPT ); Fri, 3 Jun 2022 13:40:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3F3535371B; Fri, 3 Jun 2022 10:40:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BD70AB8242F; Fri, 3 Jun 2022 17:40:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C6FBC385B8; Fri, 3 Jun 2022 17:40:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654278017; bh=Osm3N9ED8aEgFeCh/544mUnrHvCIblxB68cGxirIdOQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mhM8n9Qr8fO30/0iR4FL6qd/By1HcXPTBRgA+dInYG2+OWMJCcZeivnkA/P8cfCKG gCBWQZnPNZyWCWEmJQJ9JdX1o0K32bGwWDVIOtTkfLi4GN6cQfeHiVG0PKW8own5cb d2lix6H2islS1fWnawVRN3hkZsBeRG2s8pwfpyS4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Mike Snitzer Subject: [PATCH 4.9 08/12] dm stats: add cond_resched when looping over entries Date: Fri, 3 Jun 2022 19:39:34 +0200 Message-Id: <20220603173812.772452531@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit bfe2b0146c4d0230b68f5c71a64380ff8d361f8b upstream. dm-stats can be used with a very large number of entries (it is only limited by 1/4 of total system memory), so add rescheduling points to the loops that iterate over the entries. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/md/dm-stats.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/md/dm-stats.c +++ b/drivers/md/dm-stats.c @@ -228,6 +228,7 @@ void dm_stats_cleanup(struct dm_stats *s atomic_read(&shared->in_flight[READ]), atomic_read(&shared->in_flight[WRITE])); } + cond_resched(); } dm_stat_free(&s->rcu_head); } @@ -316,6 +317,7 @@ static int dm_stats_create(struct dm_sta for (ni =3D 0; ni < n_entries; ni++) { atomic_set(&s->stat_shared[ni].in_flight[READ], 0); atomic_set(&s->stat_shared[ni].in_flight[WRITE], 0); + cond_resched(); } =20 if (s->n_histogram_entries) { @@ -328,6 +330,7 @@ static int dm_stats_create(struct dm_sta for (ni =3D 0; ni < n_entries; ni++) { s->stat_shared[ni].tmp.histogram =3D hi; hi +=3D s->n_histogram_entries + 1; + cond_resched(); } } =20 @@ -348,6 +351,7 @@ static int dm_stats_create(struct dm_sta for (ni =3D 0; ni < n_entries; ni++) { p[ni].histogram =3D hi; hi +=3D s->n_histogram_entries + 1; + cond_resched(); } } } @@ -477,6 +481,7 @@ static int dm_stats_list(struct dm_stats } DMEMIT("\n"); } + cond_resched(); } mutex_unlock(&stats->mutex); =20 @@ -753,6 +758,7 @@ static void __dm_stat_clear(struct dm_st local_irq_enable(); } } + cond_resched(); } } =20 @@ -868,6 +874,8 @@ static int dm_stats_print(struct dm_stat =20 if (unlikely(sz + 1 >=3D maxlen)) goto buffer_overflow; + + cond_resched(); } =20 if (clear) From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 577E0CCA47C for ; Fri, 3 Jun 2022 17:40:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236200AbiFCRkl (ORCPT ); Fri, 3 Jun 2022 13:40:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56468 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344623AbiFCRkd (ORCPT ); Fri, 3 Jun 2022 13:40:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 52BD753734; Fri, 3 Jun 2022 10:40:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 01C40B8241D; Fri, 3 Jun 2022 17:40:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43366C385B8; Fri, 3 Jun 2022 17:40:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654278020; bh=Mhd7UTT6zPQOdm7M0jqXy6UQ/4oBn6Jsa5byy3zImKY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MxM2mQiM+xCT0U/RRFAMvObKsV+mMgF+w1nDLMsrCVICsNdXvtu12pVPvxVLGyhBy nxTYIaEZlDTF6Ehw9EjGhmQnXkCQCkmLloN+L+kuKs1sNShgNz/FjZ92yw/blGRP0v 0dYGh/g/IUIFT1NIP0OcHUxtWd0wYc4g4j8OQezQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sarthak Kukreti , Kees Cook , Mike Snitzer Subject: [PATCH 4.9 09/12] dm verity: set DM_TARGET_IMMUTABLE feature flag Date: Fri, 3 Jun 2022 19:39:35 +0200 Message-Id: <20220603173812.801934643@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sarthak Kukreti commit 4caae58406f8ceb741603eee460d79bacca9b1b5 upstream. The device-mapper framework provides a mechanism to mark targets as immutable (and hence fail table reloads that try to change the target type). Add the DM_TARGET_IMMUTABLE flag to the dm-verity target's feature flags to prevent switching the verity target with a different target type. Fixes: a4ffc152198e ("dm: add verity target") Cc: stable@vger.kernel.org Signed-off-by: Sarthak Kukreti Reviewed-by: Kees Cook Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/md/dm-verity-target.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/md/dm-verity-target.c +++ b/drivers/md/dm-verity-target.c @@ -1056,6 +1056,7 @@ bad: =20 static struct target_type verity_target =3D { .name =3D "verity", + .features =3D DM_TARGET_IMMUTABLE, .version =3D {1, 3, 0}, .module =3D THIS_MODULE, .ctr =3D verity_ctr, From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61279C43334 for ; Fri, 3 Jun 2022 17:41:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344764AbiFCRlC (ORCPT ); Fri, 3 Jun 2022 13:41:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55248 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344560AbiFCRjx (ORCPT ); Fri, 3 Jun 2022 13:39:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CA7FC532D2; Fri, 3 Jun 2022 10:39:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8AD2EB8241D; Fri, 3 Jun 2022 17:39:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2D51C385B8; Fri, 3 Jun 2022 17:39:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654277990; bh=BR1Eg9ikP8Kopx7lvdTr9OW2tBskvDe+1UFi5ke+cVc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NOYbDHtZFETTZ66/6/OboZJVxWJt5WwviEl5745kUrRwJhrdzJA0sMBdsD1NKgqpd IrV8kkJTzb6rFaEyuQyqsNk5SEU8PtrGC7yfQa3wG4/p3J2gOcI5+lM7d7droEy5fi vdPUhhyxgRtlMyZEv9ukLsqBUiFXHEeCEo+LzHoE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiu Jianfeng , Stefan Berger , Jarkko Sakkinen Subject: [PATCH 4.9 10/12] tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() Date: Fri, 3 Jun 2022 19:39:36 +0200 Message-Id: <20220603173812.829670788@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiu Jianfeng commit d0dc1a7100f19121f6e7450f9cdda11926aa3838 upstream. Currently it returns zero when CRQ response timed out, it should return an error code instead. Fixes: d8d74ea3c002 ("tpm: ibmvtpm: Wait for buffer to be set before procee= ding") Signed-off-by: Xiu Jianfeng Reviewed-by: Stefan Berger Acked-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/char/tpm/tpm_ibmvtpm.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/char/tpm/tpm_ibmvtpm.c +++ b/drivers/char/tpm/tpm_ibmvtpm.c @@ -653,6 +653,7 @@ static int tpm_ibmvtpm_probe(struct vio_ if (!wait_event_timeout(ibmvtpm->crq_queue.wq, ibmvtpm->rtce_buf !=3D NULL, HZ)) { + rc =3D -ENODEV; dev_err(dev, "CRQ response timed out\n"); goto init_irq_cleanup; } From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E27A5C43334 for ; Fri, 3 Jun 2022 17:40:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344547AbiFCRkB (ORCPT ); Fri, 3 Jun 2022 13:40:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55248 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344605AbiFCRj5 (ORCPT ); Fri, 3 Jun 2022 13:39:57 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D33D352E73; Fri, 3 Jun 2022 10:39:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 428D8CE248B; Fri, 3 Jun 2022 17:39:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18E59C385A9; Fri, 3 Jun 2022 17:39:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654277993; bh=K2UcJs8lyn/XvERkGKZD//vrM/SfylPMMZ3TvOo2daQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lC9pkglABQcGKetw4IVDhK6WTYPovLSbKHPqKVCw0NiSM6LDGKp0PMLSrVoTHBaTa l1VmFhdflYsFz0nl+S5pZzOP47sMWWHkvO68Am1rk2DHsGqKRyb1c44/HK0trbLiZe 4WgpPHE3rY6WvD0klRxN/ZdJUyk3llom/5WcNEa0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dai Ngo , Chuck Lever Subject: [PATCH 4.9 11/12] NFSD: Fix possible sleep during nfsd4_release_lockowner() Date: Fri, 3 Jun 2022 19:39:37 +0200 Message-Id: <20220603173812.858812832@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chuck Lever commit ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b upstream. nfsd4_release_lockowner() holds clp->cl_lock when it calls check_for_locks(). However, check_for_locks() calls nfsd_file_get() / nfsd_file_put() to access the backing inode's flc_posix list, and nfsd_file_put() can sleep if the inode was recently removed. Let's instead rely on the stateowner's reference count to gate whether the release is permitted. This should be a reliable indication of locks-in-use since file lock operations and ->lm_get_owner take appropriate references, which are released appropriately when file locks are removed. Reported-by: Dai Ngo Signed-off-by: Chuck Lever Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- fs/nfsd/nfs4state.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -6342,16 +6342,12 @@ nfsd4_release_lockowner(struct svc_rqst if (sop->so_is_open_owner || !same_owner_str(sop, owner)) continue; =20 - /* see if there are still any locks associated with it */ - lo =3D lockowner(sop); - list_for_each_entry(stp, &sop->so_stateids, st_perstateowner) { - if (check_for_locks(stp->st_stid.sc_file, lo)) { - status =3D nfserr_locks_held; - spin_unlock(&clp->cl_lock); - return status; - } + if (atomic_read(&sop->so_count) !=3D 1) { + spin_unlock(&clp->cl_lock); + return nfserr_locks_held; } =20 + lo =3D lockowner(sop); nfs4_get_stateowner(sop); break; } From nobody Sat May 2 09:01:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B22CEC433EF for ; Fri, 3 Jun 2022 17:40:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245744AbiFCRkG (ORCPT ); Fri, 3 Jun 2022 13:40:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55312 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344555AbiFCRj6 (ORCPT ); Fri, 3 Jun 2022 13:39:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6CBFF532D2; Fri, 3 Jun 2022 10:39:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 13AD561AFE; Fri, 3 Jun 2022 17:39:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01135C385A9; Fri, 3 Jun 2022 17:39:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654277996; bh=91WP0WsekVQqxGMEqgheIRA1Sj3Gwf5SBCJ8OU/bmX8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v3CYmvT116cWtWsebWEyU4AKGPz7HE5DztZvyyLCIK2GBfGbb/23B002jtdBX6JqE 08jY1tzQsNfersR6a6tOi9kcHuD2bA+7KisKPA0/qL9zwVo88UKG+HbpSRK/Z5Hbwr rUaQn6Du6T+jhC5ZCuR/R+ejEZdPkCBNR6UmhrTs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liu Jian , Daniel Borkmann , Song Liu Subject: [PATCH 4.9 12/12] bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes Date: Fri, 3 Jun 2022 19:39:38 +0200 Message-Id: <20220603173812.887419971@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220603173812.524184588@linuxfoundation.org> References: <20220603173812.524184588@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liu Jian commit 45969b4152c1752089351cd6836a42a566d49bcf upstream. The data length of skb frags + frag_list may be greater than 0xffff, and skb_header_pointer can not handle negative offset. So, here INT_MAX is used to check the validity of offset. Add the same change to the related function skb_store_bytes. Fixes: 05c74e5e53f6 ("bpf: add bpf_skb_load_bytes helper") Signed-off-by: Liu Jian Signed-off-by: Daniel Borkmann Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20220416105801.88708-2-liujian56@huawei.c= om Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/core/filter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/core/filter.c +++ b/net/core/filter.c @@ -1388,7 +1388,7 @@ BPF_CALL_5(bpf_skb_store_bytes, struct s =20 if (unlikely(flags & ~(BPF_F_RECOMPUTE_CSUM | BPF_F_INVALIDATE_HASH))) return -EINVAL; - if (unlikely(offset > 0xffff)) + if (unlikely(offset > INT_MAX)) return -EFAULT; if (unlikely(bpf_try_make_writable(skb, offset + len))) return -EFAULT; @@ -1423,7 +1423,7 @@ BPF_CALL_4(bpf_skb_load_bytes, const str { void *ptr; =20 - if (unlikely(offset > 0xffff)) + if (unlikely(offset > INT_MAX)) goto err_clear; =20 ptr =3D skb_header_pointer(skb, offset, len, to);