This is the start of the stable review cycle for the 4.4.285 release.
There are 23 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 26 Sep 2021 12:43:20 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.285-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman [off-list ref]
Linux 4.4.285-rc1
Marcelo Ricardo Leitner [off-list ref]
sctp: validate from_addr_param return
Guenter Roeck [off-list ref]
drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV
Li Jinlin [off-list ref]
blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
Nanyong Sun [off-list ref]
nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
Nanyong Sun [off-list ref]
nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group
Nanyong Sun [off-list ref]
nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group
Nanyong Sun [off-list ref]
nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group
Nanyong Sun [off-list ref]
nilfs2: fix NULL pointer in nilfs_##name##_attr_release
Nanyong Sun [off-list ref]
nilfs2: fix memory leak in nilfs_sysfs_create_device_group
Jeff Layton [off-list ref]
ceph: lockdep annotations for try_nonblocking_invalidate
Johannes Berg [off-list ref]
dmaengine: ioat: depends on !UML
Guenter Roeck [off-list ref]
parisc: Move pci_dev_is_behind_card_dino to where it is used
Andy Shevchenko [off-list ref]
dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
Andy Shevchenko [off-list ref]
dmaengine: acpi-dma: check for 64-bit MMIO address
Uwe Kleine-König [off-list ref]
pwm: mxs: Don't modify HW state in .probe() after the PWM chip was registered
Pavel Skripkin [off-list ref]
profiling: fix shift-out-of-bounds bugs
Cyrill Gorcunov [off-list ref]
prctl: allow to setup brk for et_dyn executables
Xie Yongji [off-list ref]
9p/trans_virtio: Remove sysfs file on probe failure
Dan Carpenter [off-list ref]
thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
Marcelo Ricardo Leitner [off-list ref]
sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
Marcelo Ricardo Leitner [off-list ref]
sctp: validate chunk size in __rcv_asconf_lookup
Tony Lindgren [off-list ref]
PM / wakeirq: Fix unbalanced IRQ enable for wakeirq
Ilya Leoshkevich [off-list ref]
s390/bpf: Fix optimizing out zero-extensions
-------------
Diffstat:
Makefile | 4 +-
arch/s390/net/bpf_jit_comp.c | 50 ++++++++++++-----------
block/blk-throttle.c | 1 +
drivers/base/power/wakeirq.c | 6 ++-
drivers/dma/Kconfig | 2 +-
drivers/dma/acpi-dma.c | 11 ++++-
drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c | 2 +-
drivers/parisc/dino.c | 18 ++++----
drivers/pwm/pwm-mxs.c | 13 +++---
drivers/thermal/samsung/exynos_tmu.c | 1 +
fs/ceph/caps.c | 2 +
fs/nilfs2/sysfs.c | 26 +++++-------
include/net/sctp/structs.h | 2 +-
kernel/profile.c | 21 +++++-----
kernel/sys.c | 7 ----
net/9p/trans_virtio.c | 4 +-
net/sctp/bind_addr.c | 20 +++++----
net/sctp/input.c | 9 +++-
net/sctp/ipv6.c | 7 +++-
net/sctp/protocol.c | 7 +++-
net/sctp/sm_make_chunk.c | 42 +++++++++++--------
21 files changed, 143 insertions(+), 112 deletions(-)
From: Ilya Leoshkevich <iii@linux.ibm.com>
commit db7bee653859ef7179be933e7d1384644f795f26 upstream.
Currently the JIT completely removes things like `reg32 += 0`,
however, the BPF_ALU semantics requires the target register to be
zero-extended in such cases.
Fix by optimizing out only the arithmetic operation, but not the
subsequent zero-extension.
Reported-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/net/bpf_jit_comp.c | 50 ++++++++++++++++++++++---------------------
1 file changed, 26 insertions(+), 24 deletions(-)
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit f94cf9f4c54a72ccbd2078bb0cedd3691a71c431 ]
Currently the match DMA controller is done only for lower 32 bits of
address which might be not true on 64-bit platform. Check upper portion
as well.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Vinod Koul <redacted>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/acpi-dma.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
@@ -72,7 +73,9 @@ static int acpi_dma_parse_resource_group(const struct acpi_csrt_group *grp,si=(conststructacpi_csrt_shared_info*)&grp[1];/* Match device by MMIO and IRQ */-if(si->mmio_base_low!=mem||si->gsi_interrupt!=irq)+if(si->mmio_base_low!=lower_32_bits(mem)||+si->mmio_base_high!=upper_32_bits(mem)||+si->gsi_interrupt!=irq)return0;dev_dbg(&adev->dev,"matches with %.4s%04X (rev %u)\n",
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 67db87dc8284070adb15b3c02c1c31d5cf51c5d6 ]
Currently the CRST parsing relies on the fact that on most of x86 devices
the IRQ mapping is 1:1 with Linux vIRQ. However, it may be not true for
some. Fix this by converting GSI to Linux vIRQ before checking it.
Fixes: ee8209fd026b ("dma: acpi-dma: parse CSRT to extract additional resources")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210730202715.24375-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/acpi-dma.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
@@ -72,10 +72,14 @@ static int acpi_dma_parse_resource_group(const struct acpi_csrt_group *grp,si=(conststructacpi_csrt_shared_info*)&grp[1];-/* Match device by MMIO and IRQ */+/* Match device by MMIO */if(si->mmio_base_low!=lower_32_bits(mem)||-si->mmio_base_high!=upper_32_bits(mem)||-si->gsi_interrupt!=irq)+si->mmio_base_high!=upper_32_bits(mem))+return0;++/* Match device by Linux vIRQ */+ret=acpi_register_gsi(NULL,si->gsi_interrupt,si->interrupt_mode,si->interrupt_polarity);+if(ret!=irq)return0;dev_dbg(&adev->dev,"matches with %.4s%04X (rev %u)\n",
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit 907872baa9f1538eed02ec737b8e89eba6c6e4b9 ]
parisc build test images fail to compile with the following error.
drivers/parisc/dino.c:160:12: error:
'pci_dev_is_behind_card_dino' defined but not used
Move the function just ahead of its only caller to avoid the error.
Fixes: 5fa1659105fa ("parisc: Disable HP HSC-PCI Cards to prevent kernel crash")
Cc: Helge Deller <deller@gmx.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/parisc/dino.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
From: Johannes Berg <redacted>
[ Upstream commit bbac7a92a46f0876e588722ebe552ddfe6fd790f ]
Now that UML has PCI support, this driver must depend also on
!UML since it pokes at X86_64 architecture internals that don't
exist on ARCH=um.
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Johannes Berg <redacted>
Acked-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/20210809112409.a3a0974874d2.I2ffe3d11ed37f735da2f39884a74c953b258b995@changeid
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Nanyong Sun <redacted>
[ Upstream commit 5f5dec07aca7067216ed4c1342e464e7307a9197 ]
Patch series "nilfs2: fix incorrect usage of kobject".
This patchset from Nanyong Sun fixes memory leak issues and a NULL
pointer dereference issue caused by incorrect usage of kboject in nilfs2
sysfs implementation.
This patch (of 6):
Reported by syzkaller:
BUG: memory leak
unreferenced object 0xffff888100ca8988 (size 8):
comm "syz-executor.1", pid 1930, jiffies 4294745569 (age 18.052s)
hex dump (first 8 bytes):
6c 6f 6f 70 31 00 ff ff loop1...
backtrace:
kstrdup+0x36/0x70 mm/util.c:60
kstrdup_const+0x35/0x60 mm/util.c:83
kvasprintf_const+0xf1/0x180 lib/kasprintf.c:48
kobject_set_name_vargs+0x56/0x150 lib/kobject.c:289
kobject_add_varg lib/kobject.c:384 [inline]
kobject_init_and_add+0xc9/0x150 lib/kobject.c:473
nilfs_sysfs_create_device_group+0x150/0x7d0 fs/nilfs2/sysfs.c:986
init_nilfs+0xa21/0xea0 fs/nilfs2/the_nilfs.c:637
nilfs_fill_super fs/nilfs2/super.c:1046 [inline]
nilfs_mount+0x7b4/0xe80 fs/nilfs2/super.c:1316
legacy_get_tree+0x105/0x210 fs/fs_context.c:592
vfs_get_tree+0x8e/0x2d0 fs/super.c:1498
do_new_mount fs/namespace.c:2905 [inline]
path_mount+0xf9b/0x1990 fs/namespace.c:3235
do_mount+0xea/0x100 fs/namespace.c:3248
__do_sys_mount fs/namespace.c:3456 [inline]
__se_sys_mount fs/namespace.c:3433 [inline]
__x64_sys_mount+0x14b/0x1f0 fs/namespace.c:3433
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
If kobject_init_and_add return with error, then the cleanup of kobject
is needed because memory may be allocated in kobject_init_and_add
without freeing.
And the place of cleanup_dev_kobject should use kobject_put to free the
memory associated with the kobject. As the section "Kobject removal" of
"Documentation/core-api/kobject.rst" says, kobject_del() just makes the
kobject "invisible", but it is not cleaned up. And no more cleanup will
do after cleanup_dev_kobject, so kobject_put is needed here.
Link: https://lkml.kernel.org/r/1625651306-10829-1-git-send-email-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/1625651306-10829-2-git-send-email-konishi.ryusuke@gmail.com
Reported-by: Hulk Robot <redacted>
Link: https://lkml.kernel.org/r/20210629022556.3985106-2-sunnanyong@huawei.com
Signed-off-by: Nanyong Sun <redacted>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
From: Nanyong Sun <redacted>
[ Upstream commit dbc6e7d44a514f231a64d9d5676e001b660b6448 ]
In nilfs_##name##_attr_release, kobj->parent should not be referenced
because it is a NULL pointer. The release() method of kobject is always
called in kobject_put(kobj), in the implementation of kobject_put(), the
kobj->parent will be assigned as NULL before call the release() method.
So just use kobj to get the subgroups, which is more efficient and can fix
a NULL pointer reference problem.
Link: https://lkml.kernel.org/r/20210629022556.3985106-3-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-3-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <redacted>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
From: Nanyong Sun <redacted>
[ Upstream commit 24f8cb1ed057c840728167dab33b32e44147c86f ]
If kobject_init_and_add return with error, kobject_put() is needed here to
avoid memory leak, because kobject_init_and_add may return error without
freeing the memory associated with the kobject it allocated.
Link: https://lkml.kernel.org/r/20210629022556.3985106-4-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-4-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <redacted>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
From: Nanyong Sun <redacted>
[ Upstream commit a3e181259ddd61fd378390977a1e4e2316853afa ]
The kobject_put() should be used to cleanup the memory associated with the
kobject instead of kobject_del. See the section "Kobject removal" of
"Documentation/core-api/kobject.rst".
Link: https://lkml.kernel.org/r/20210629022556.3985106-5-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-5-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <redacted>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Tony Lindgren <tony@atomide.com>
commit 69728051f5bf15efaf6edfbcfe1b5a49a2437918 upstream.
If a device is runtime PM suspended when we enter suspend and has
a dedicated wake IRQ, we can get the following warning:
WARNING: CPU: 0 PID: 108 at kernel/irq/manage.c:526 enable_irq+0x40/0x94
[ 102.087860] Unbalanced enable for IRQ 147
...
(enable_irq) from [<c06117a8>] (dev_pm_arm_wake_irq+0x4c/0x60)
(dev_pm_arm_wake_irq) from [<c0618360>]
(device_wakeup_arm_wake_irqs+0x58/0x9c)
(device_wakeup_arm_wake_irqs) from [<c0615948>]
(dpm_suspend_noirq+0x10/0x48)
(dpm_suspend_noirq) from [<c01ac7ac>]
(suspend_devices_and_enter+0x30c/0xf14)
(suspend_devices_and_enter) from [<c01adf20>]
(enter_state+0xad4/0xbd8)
(enter_state) from [<c01ad3ec>] (pm_suspend+0x38/0x98)
(pm_suspend) from [<c01ab3e8>] (state_store+0x68/0xc8)
This is because the dedicated wake IRQ for the device may have been
already enabled earlier by dev_pm_enable_wake_irq_check(). Fix the
issue by checking for runtime PM suspended status.
This issue can be easily reproduced by setting serial console log level
to zero, letting the serial console idle, and suspend the system from
an ssh terminal. On resume, dmesg will have the warning above.
The reason why I have not run into this issue earlier has been that I
typically run my PM test cases from on a serial console instead over ssh.
Fixes: c84345597558 (PM / wakeirq: Enable dedicated wakeirq for suspend)
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Rafael J. Wysocki <redacted>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/power/wakeirq.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
commit b6ffe7671b24689c09faa5675dd58f93758a97ae upstream.
In one of the fallbacks that SCTP has for identifying an association for an
incoming packet, it looks for AddIp chunk (from ASCONF) and take a peek.
Thing is, at this stage nothing was validating that the chunk actually had
enough content for that, allowing the peek to happen over uninitialized
memory.
Similar check already exists in actual asconf handling in
sctp_verify_asconf().
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/input.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/sctp/input.c+++ b/net/sctp/input.c
@@ -1008,6 +1008,9 @@ static struct sctp_association *__sctp_runionsctp_addr_param*param;unionsctp_addrpaddr;+if(ntohs(ch->length)<sizeof(*asconf)+sizeof(structsctp_paramhdr))+returnNULL;+/* Skip over the ADDIP header and find the Address parameter */param=(unionsctp_addr_param*)(asconf+1);
From: Dan Carpenter <redacted>
commit 02d438f62c05f0d055ceeedf12a2f8796b258c08 upstream.
This error path return success but it should propagate the negative
error code from devm_clk_get().
Fixes: 6c247393cfdd ("thermal: exynos: Add TMU support for Exynos7 SoC")
Signed-off-by: Dan Carpenter <redacted>
Reviewed-by: Krzysztof Kozlowski <redacted>
Signed-off-by: Daniel Lezcano <redacted>
Link: https://lore.kernel.org/r/20210810084413.GA23810@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/samsung/exynos_tmu.c | 1 +
1 file changed, 1 insertion(+)
@@ -1347,6 +1347,7 @@ static int exynos_tmu_probe(struct platfdata->sclk=devm_clk_get(&pdev->dev,"tmu_sclk");if(IS_ERR(data->sclk)){dev_err(&pdev->dev,"Failed to get sclk\n");+ret=PTR_ERR(data->sclk);gotoerr_clk;}else{ret=clk_prepare_enable(data->sclk);
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
commit ef6c8d6ccf0c1dccdda092ebe8782777cd7803c9 upstream.
When SCTP handles an INIT chunk, it calls for example:
sctp_sf_do_5_1B_init
sctp_verify_init
sctp_verify_param
sctp_process_init
sctp_process_param
handling of SCTP_PARAM_SET_PRIMARY
sctp_verify_init() wasn't doing proper size validation and neither the
later handling, allowing it to work over the chunk itself, possibly being
uninitialized memory.
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/sm_make_chunk.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
@@ -2146,9 +2146,16 @@ static sctp_ierror_t sctp_verify_param(sbreak;caseSCTP_PARAM_SET_PRIMARY:-if(net->sctp.addip_enable)-break;-gotofallthrough;+if(!net->sctp.addip_enable)+gotofallthrough;++if(ntohs(param.p->length)<sizeof(structsctp_addip_param)++sizeof(structsctp_paramhdr)){+sctp_process_inv_paramlength(asoc,param.p,+chunk,err_chunk);+retval=SCTP_IERROR_ABORT;+}+break;caseSCTP_PARAM_HOST_NAME_ADDRESS:/* Tell the peer, we won't support this param. */
From: Cyrill Gorcunov <redacted>
commit e1fbbd073137a9d63279f6bf363151a938347640 upstream.
Keno Fischer reported that when a binray loaded via ld-linux-x the
prctl(PR_SET_MM_MAP) doesn't allow to setup brk value because it lays
before mm:end_data.
For example a test program shows
| # ~/t
|
| start_code 401000
| end_code 401a15
| start_stack 7ffce4577dd0
| start_data 403e10
| end_data 40408c
| start_brk b5b000
| sbrk(0) b5b000
and when executed via ld-linux
| # /lib64/ld-linux-x86-64.so.2 ~/t
|
| start_code 7fc25b0a4000
| end_code 7fc25b0c4524
| start_stack 7fffcc6b2400
| start_data 7fc25b0ce4c0
| end_data 7fc25b0cff98
| start_brk 55555710c000
| sbrk(0) 55555710c000
This of course prevent criu from restoring such programs. Looking into
how kernel operates with brk/start_brk inside brk() syscall I don't see
any problem if we allow to setup brk/start_brk without checking for
end_data. Even if someone pass some weird address here on a purpose then
the worst possible result will be an unexpected unmapping of existing vma
(own vma, since prctl works with the callers memory) but test for
RLIMIT_DATA is still valid and a user won't be able to gain more memory in
case of expanding VMAs via new values shipped with prctl call.
Link: https://lkml.kernel.org/r/20210121221207.GB2174@grain
Fixes: bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing direct loader exec")
Signed-off-by: Cyrill Gorcunov <redacted>
Reported-by: Keno Fischer <redacted>
Acked-by: Andrey Vagin <redacted>
Tested-by: Andrey Vagin <redacted>
Cc: Dmitry Safonov <redacted>
Cc: Kirill Tkhai <redacted>
Cc: Eric W. Biederman <redacted>
Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Cc: Alexander Mikhalitsyn <redacted>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sys.c | 7 -------
1 file changed, 7 deletions(-)
--- a/kernel/sys.c+++ b/kernel/sys.c
@@ -1775,13 +1775,6 @@ static int validate_prctl_map(struct prcerror=-EINVAL;/*-*@brkshouldbeafter@end_dataintraditionalmaps.-*/-if(prctl_map->start_brk<=prctl_map->end_data||-prctl_map->brk<=prctl_map->end_data)-gotoout;--/**Neitherweshouldallowtooverridelimitsiftheyset.*/if(check_data_rlimit(rlimit(RLIMIT_DATA),prctl_map->brk,
From: Pavel Skripkin <redacted>
commit 2d186afd04d669fe9c48b994c41a7405a3c9f16d upstream.
Syzbot reported shift-out-of-bounds bug in profile_init().
The problem was in incorrect prof_shift. Since prof_shift value comes from
userspace we need to clamp this value into [0, BITS_PER_LONG -1]
boundaries.
Second possible shiht-out-of-bounds was found by Tetsuo:
sample_step local variable in read_profile() had "unsigned int" type,
but prof_shift allows to make a BITS_PER_LONG shift. So, to prevent
possible shiht-out-of-bounds sample_step type was changed to
"unsigned long".
Also, "unsigned short int" will be sufficient for storing
[0, BITS_PER_LONG] value, that's why there is no need for
"unsigned long" prof_shift.
Link: https://lkml.kernel.org/r/20210813140022.5011-1-paskripkin@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Pavel Skripkin <redacted>
Cc: Thomas Gleixner <redacted>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/profile.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
From: Uwe Kleine-König <redacted>
commit 020162d6f49f2963062229814a56a89c86cbeaa8 upstream.
This fixes a race condition: After pwmchip_add() is called there might
already be a consumer and then modifying the hardware behind the
consumer's back is bad. So reset before calling pwmchip_add().
Note that reseting the hardware isn't the right thing to do if the PWM
is already running as it might e.g. disable (or even enable) a backlight
that is supposed to be on (or off).
Fixes: 4dce82c1e840 ("pwm: add pwm-mxs support")
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Uwe Kleine-König <redacted>
Signed-off-by: Thierry Reding <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pwm/pwm-mxs.c | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
@@ -158,6 +158,11 @@ static int mxs_pwm_probe(struct platformreturnret;}+/* FIXME: Only do this if the PWM isn't already running */+ret=stmp_reset_block(mxs->base);+if(ret)+returndev_err_probe(&pdev->dev,ret,"failed to reset PWM\n");+ret=pwmchip_add(&mxs->chip);if(ret<0){dev_err(&pdev->dev,"failed to add pwm chip %d\n",ret);
@@ -166,15 +171,7 @@ static int mxs_pwm_probe(struct platformplatform_set_drvdata(pdev,mxs);-ret=stmp_reset_block(mxs->base);-if(ret)-gotopwm_remove;-return0;--pwm_remove:-pwmchip_remove(&mxs->chip);-returnret;}staticintmxs_pwm_remove(structplatform_device*pdev)
From: Nanyong Sun <redacted>
[ Upstream commit 17243e1c3072b8417a5ebfc53065d0a87af7ca77 ]
kobject_put() should be used to cleanup the memory associated with the
kobject instead of kobject_del(). See the section "Kobject removal" of
"Documentation/core-api/kobject.rst".
Link: https://lkml.kernel.org/r/20210629022556.3985106-7-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-7-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <redacted>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Li Jinlin <redacted>
[ Upstream commit 884f0e84f1e3195b801319c8ec3d5774e9bf2710 ]
The pending timer has been set up in blk_throtl_init(). However, the
timer is not deleted in blk_throtl_exit(). This means that the timer
handler may still be running after freeing the timer, which would
result in a use-after-free.
Fix by calling del_timer_sync() to delete the timer in blk_throtl_exit().
Signed-off-by: Li Jinlin <redacted>
Link: https://lore.kernel.org/r/20210907121242.2885564-1-lijinlin3@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-throttle.c | 1 +
1 file changed, 1 insertion(+)
From: Guenter Roeck <linux@roeck-us.net>
commit e8f71f89236ef82d449991bfbc237e3cb6ea584f upstream.
nvkm test builds fail with the following error.
drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c: In function 'nvkm_control_mthd_pstate_info':
drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c:60:35: error: overflow in conversion from 'int' to '__s8' {aka 'signed char'} changes value from '-251' to '5'
The code builds on most architectures, but fails on parisc where ENOSYS
is defined as 251.
Replace the error code with -ENODEV (-19). The actual error code does
not really matter and is not passed to userspace - it just has to be
negative.
Fixes: 7238eca4cf18 ("drm/nouveau: expose pstate selection per-power source in sysfs")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: Ben Skeggs <redacted>
Cc: David Airlie <redacted>
Cc: Daniel Vetter <redacted>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
commit 0c5dc070ff3d6246d22ddd931f23a6266249e3db upstream.
Ilja reported that, simply putting it, nothing was validating that
from_addr_param functions were operating on initialized memory. That is,
the parameter itself was being validated by sctp_walk_params, but it
doesn't check for types and their specific sizes and it could be a 0-length
one, causing from_addr_param to potentially work over the next parameter or
even uninitialized memory.
The fix here is to, in all calls to from_addr_param, check if enough space
is there for the wanted IP address type.
Reported-by: Ilja Van Sprundel <redacted>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/sctp/structs.h | 2 +-
net/sctp/bind_addr.c | 20 +++++++++++---------
net/sctp/input.c | 6 ++++--
net/sctp/ipv6.c | 7 ++++++-
net/sctp/protocol.c | 7 ++++++-
net/sctp/sm_make_chunk.c | 29 ++++++++++++++++-------------
6 files changed, 44 insertions(+), 27 deletions(-)
@@ -284,19 +284,15 @@ int sctp_raw_to_bind_addrs(struct sctp_brawaddr=(unionsctp_addr_param*)raw_addr_list;af=sctp_get_af_specific(param_type2af(param->type));-if(unlikely(!af)){+if(unlikely(!af)||+!af->from_addr_param(&addr,rawaddr,htons(port),0)){retval=-EINVAL;-sctp_bind_addr_clean(bp);-break;+gotoout_err;}-af->from_addr_param(&addr,rawaddr,htons(port),0);retval=sctp_add_bind_addr(bp,&addr,SCTP_ADDR_SRC,gfp);-if(retval){-/* Can't finish building the list, clean up. */-sctp_bind_addr_clean(bp);-break;-}+if(retval)+gotoout_err;len=ntohs(param->length);addrs_len-=len;
@@ -304,6 +300,12 @@ int sctp_raw_to_bind_addrs(struct sctp_b}returnretval;++out_err:+if(retval)+sctp_bind_addr_clean(bp);++returnretval;}/********************************************************************---a/net/sctp/input.c+++b/net/sctp/input.c
@@ -488,15 +488,20 @@ static void sctp_v6_to_sk_daddr(union sc}/* Initialize a sctp_addr from an address parameter. */-staticvoidsctp_v6_from_addr_param(unionsctp_addr*addr,+staticboolsctp_v6_from_addr_param(unionsctp_addr*addr,unionsctp_addr_param*param,__be16port,intiif){+if(ntohs(param->v6.param_hdr.length)<sizeof(structsctp_ipv6addr_param))+returnfalse;+addr->v6.sin6_family=AF_INET6;addr->v6.sin6_port=port;addr->v6.sin6_flowinfo=0;/* BUG */addr->v6.sin6_addr=param->v6.addr;addr->v6.sin6_scope_id=iif;++returntrue;}/* Initialize an address parameter from a sctp_addr and return the length---a/net/sctp/protocol.c+++b/net/sctp/protocol.c
@@ -272,14 +272,19 @@ static void sctp_v4_to_sk_daddr(union sc}/* Initialize a sctp_addr from an address parameter. */-staticvoidsctp_v4_from_addr_param(unionsctp_addr*addr,+staticboolsctp_v4_from_addr_param(unionsctp_addr*addr,unionsctp_addr_param*param,__be16port,intiif){+if(ntohs(param->v4.param_hdr.length)<sizeof(structsctp_ipv4addr_param))+returnfalse;+addr->v4.sin_family=AF_INET;addr->v4.sin_port=port;addr->v4.sin_addr.s_addr=param->v4.addr.s_addr;memset(addr->v4.sin_zero,0,sizeof(addr->v4.sin_zero));++returntrue;}/* Initialize an address parameter from a sctp_addr and return the length---a/net/sctp/sm_make_chunk.c+++b/net/sctp/sm_make_chunk.c
@@ -2333,11 +2333,13 @@ int sctp_process_init(struct sctp_associ/* Process the initialization parameters. */sctp_walk_params(param,peer_init,init_hdr.params){-if(!src_match&&(param.p->type==SCTP_PARAM_IPV4_ADDRESS||-param.p->type==SCTP_PARAM_IPV6_ADDRESS)){+if(!src_match&&+(param.p->type==SCTP_PARAM_IPV4_ADDRESS||+param.p->type==SCTP_PARAM_IPV6_ADDRESS)){af=sctp_get_af_specific(param_type2af(param.p->type));-af->from_addr_param(&addr,param.addr,-chunk->sctp_hdr->source,0);+if(!af->from_addr_param(&addr,param.addr,+chunk->sctp_hdr->source,0))+continue;if(sctp_cmp_addr_exact(sctp_source(chunk),&addr))src_match=1;}
@@ -2531,7 +2533,8 @@ static int sctp_process_param(struct sctbreak;do_addr_param:af=sctp_get_af_specific(param_type2af(param.p->type));-af->from_addr_param(&addr,param.addr,htons(asoc->peer.port),0);+if(!af->from_addr_param(&addr,param.addr,htons(asoc->peer.port),0))+break;scope=sctp_scope(peer_addr);if(sctp_in_scope(net,&addr,scope))if(!sctp_assoc_add_peer(asoc,&addr,gfp,SCTP_UNCONFIRMED))
@@ -2624,15 +2627,13 @@ do_addr_param:addr_param=param.v+sizeof(sctp_addip_param_t);af=sctp_get_af_specific(param_type2af(addr_param->p.type));-if(af==NULL)+if(!af)break;-af->from_addr_param(&addr,addr_param,-htons(asoc->peer.port),0);+if(!af->from_addr_param(&addr,addr_param,+htons(asoc->peer.port),0))+break;-/* if the address is invalid, we can't process it.-*XXX:seespecforwhattodo.-*/if(!af->addr_valid(&addr,NULL,NULL))break;
@@ -3042,7 +3043,8 @@ static __be16 sctp_process_asconf_param(if(unlikely(!af))returnSCTP_ERROR_DNS_FAILED;-af->from_addr_param(&addr,addr_param,htons(asoc->peer.port),0);+if(!af->from_addr_param(&addr,addr_param,htons(asoc->peer.port),0))+returnSCTP_ERROR_DNS_FAILED;/* ADDIP 4.2.1 This parameter MUST NOT contain a broadcast*ormulticastaddress.
@@ -3308,7 +3310,8 @@ static void sctp_asconf_param_success(st/* We have checked the packet before, so we do not check again. */af=sctp_get_af_specific(param_type2af(addr_param->p.type));-af->from_addr_param(&addr,addr_param,htons(bp->port),0);+if(!af->from_addr_param(&addr,addr_param,htons(bp->port),0))+return;switch(asconf_param->param_hdr.type){caseSCTP_PARAM_ADD_IP:
From: Nanyong Sun <redacted>
[ Upstream commit b2fe39c248f3fa4bbb2a20759b4fdd83504190f7 ]
If kobject_init_and_add returns with error, kobject_put() is needed here
to avoid memory leak, because kobject_init_and_add may return error
without freeing the memory associated with the kobject it allocated.
Link: https://lkml.kernel.org/r/20210629022556.3985106-6-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-6-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <redacted>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
From: Daniel Díaz <hidden> Date: 2021-09-24 13:50:42
Hello!
On 9/24/21 7:43 AM, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 4.4.285 release.
There are 23 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 26 Sep 2021 12:43:20 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.285-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
Regressions detected.
While building mxs_defconfig for arm, the following error was encountered:
/builds/linux/arch/arm/mach-mxs/mach-mxs.c:285:26: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
285 | static const struct gpio const tx28_gpios[] __initconst = {
| ^~~~~
/builds/linux/drivers/pwm/pwm-mxs.c: In function 'mxs_pwm_probe':
/builds/linux/drivers/pwm/pwm-mxs.c:164:24: error: implicit declaration of function 'dev_err_probe'; did you mean 'device_reprobe'? [-Werror=implicit-function-declaration]
164 | return dev_err_probe(&pdev->dev, ret, "failed to reset PWM\n");
| ^~~~~~~~~~~~~
| device_reprobe
cc1: some warnings being treated as errors
make[3]: *** [/builds/linux/scripts/Makefile.build:280: drivers/pwm/pwm-mxs.o] Error 1
This is also seen in other branches (from 4.4 to 5.4). To reproduce this build locally:
tuxmake \
--target-arch=arm \
--kconfig=mxs_defconfig \
--toolchain=gcc-11 \
--runtime=podman \
config default kernel xipkernel modules dtbs dtbs-legacy debugkernel headers
Greetings!
Daniel Díaz
daniel.diaz@linaro.org
From: Jon Hunter <jonathanh@nvidia.com> Date: 2021-09-24 17:50:13
On Fri, 24 Sep 2021 14:43:41 +0200, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 4.4.285 release.
There are 23 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 26 Sep 2021 12:43:20 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.285-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.4:
6 builds: 6 pass, 0 fail
12 boots: 12 pass, 0 fail
30 tests: 30 pass, 0 fail
Linux version: 4.4.285-rc1-gf0ff061a858b
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra30-cardhu-a04
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Jon
From: Pavel Machek <hidden> Date: 2021-09-24 21:50:45
Hi!
This is the start of the stable review cycle for the 4.4.285 release.
There are 23 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.4.y
Tested-by: Pavel Machek (CIP) <redacted>
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
This is the start of the stable review cycle for the 4.4.285 release.
There are 23 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 26 Sep 2021 12:43:20 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.285-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
On Fri, Sep 24, 2021 at 08:50:21AM -0500, Daniel Díaz wrote:
Hello!
On 9/24/21 7:43 AM, Greg Kroah-Hartman wrote:
quoted
This is the start of the stable review cycle for the 4.4.285 release.
There are 23 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 26 Sep 2021 12:43:20 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.285-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
Regressions detected.
While building mxs_defconfig for arm, the following error was encountered:
/builds/linux/arch/arm/mach-mxs/mach-mxs.c:285:26: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
285 | static const struct gpio const tx28_gpios[] __initconst = {
| ^~~~~
/builds/linux/drivers/pwm/pwm-mxs.c: In function 'mxs_pwm_probe':
/builds/linux/drivers/pwm/pwm-mxs.c:164:24: error: implicit declaration of function 'dev_err_probe'; did you mean 'device_reprobe'? [-Werror=implicit-function-declaration]
164 | return dev_err_probe(&pdev->dev, ret, "failed to reset PWM\n");
| ^~~~~~~~~~~~~
| device_reprobe
cc1: some warnings being treated as errors
make[3]: *** [/builds/linux/scripts/Makefile.build:280: drivers/pwm/pwm-mxs.o] Error 1
This is also seen in other branches (from 4.4 to 5.4). To reproduce this build locally:
tuxmake \
--target-arch=arm \
--kconfig=mxs_defconfig \
--toolchain=gcc-11 \
--runtime=podman \
config default kernel xipkernel modules dtbs dtbs-legacy debugkernel headers
Now dropped from all 4.4 - 5.4 kernels, thanks! I'll push out a -rc2
soon with all of these fixed up...
greg k-h