1. 05 4月, 2021 7 次提交
    • G
    • G
      misc: Add Synopsys DesignWare xData IP driver · e8a30eef
      Gustavo Pimentel 提交于
      Add Synopsys DesignWare xData IP driver. This driver enables/disables
      the PCI traffic generator module pertain to the Synopsys DesignWare
      prototype.
      Signed-off-by: NGustavo Pimentel <gustavo.pimentel@synopsys.com>
      Link: https://lore.kernel.org/r/daa1efe23850e77d6807dc3f371728fc0b7548b8.1617016509.git.gustavo.pimentel@synopsys.comSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e8a30eef
    • T
      misc: vmw_vmci: explicitly initialize vmci_datagram payload · b2192cfe
      Tetsuo Handa 提交于
      KMSAN complains that vmci_check_host_caps() left the payload part of
      check_msg uninitialized.
      
        =====================================================
        BUG: KMSAN: uninit-value in kmsan_check_memory+0xd/0x10
        CPU: 1 PID: 1 Comm: swapper/0 Tainted: G    B             5.11.0-rc7+ #4
        Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020
        Call Trace:
         dump_stack+0x21c/0x280
         kmsan_report+0xfb/0x1e0
         kmsan_internal_check_memory+0x202/0x520
         kmsan_check_memory+0xd/0x10
         iowrite8_rep+0x86/0x380
         vmci_guest_probe_device+0xf0b/0x1e70
         pci_device_probe+0xab3/0xe70
         really_probe+0xd16/0x24d0
         driver_probe_device+0x29d/0x3a0
         device_driver_attach+0x25a/0x490
         __driver_attach+0x78c/0x840
         bus_for_each_dev+0x210/0x340
         driver_attach+0x89/0xb0
         bus_add_driver+0x677/0xc40
         driver_register+0x485/0x8e0
         __pci_register_driver+0x1ff/0x350
         vmci_guest_init+0x3e/0x41
         vmci_drv_init+0x1d6/0x43f
         do_one_initcall+0x39c/0x9a0
         do_initcall_level+0x1d7/0x259
         do_initcalls+0x127/0x1cb
         do_basic_setup+0x33/0x36
         kernel_init_freeable+0x29a/0x3ed
         kernel_init+0x1f/0x840
         ret_from_fork+0x1f/0x30
      
        Uninit was created at:
         kmsan_internal_poison_shadow+0x5c/0xf0
         kmsan_slab_alloc+0x8d/0xe0
         kmem_cache_alloc+0x84f/0xe30
         vmci_guest_probe_device+0xd11/0x1e70
         pci_device_probe+0xab3/0xe70
         really_probe+0xd16/0x24d0
         driver_probe_device+0x29d/0x3a0
         device_driver_attach+0x25a/0x490
         __driver_attach+0x78c/0x840
         bus_for_each_dev+0x210/0x340
         driver_attach+0x89/0xb0
         bus_add_driver+0x677/0xc40
         driver_register+0x485/0x8e0
         __pci_register_driver+0x1ff/0x350
         vmci_guest_init+0x3e/0x41
         vmci_drv_init+0x1d6/0x43f
         do_one_initcall+0x39c/0x9a0
         do_initcall_level+0x1d7/0x259
         do_initcalls+0x127/0x1cb
         do_basic_setup+0x33/0x36
         kernel_init_freeable+0x29a/0x3ed
         kernel_init+0x1f/0x840
         ret_from_fork+0x1f/0x30
      
        Bytes 28-31 of 36 are uninitialized
        Memory access of size 36 starts at ffff8881675e5f00
        =====================================================
      
      Fixes: 1f166439 ("VMCI: guest side driver implementation.")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Link: https://lore.kernel.org/r/20210402121742.3917-2-penguin-kernel@I-love.SAKURA.ne.jpSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b2192cfe
    • T
      misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct · 376565b9
      Tetsuo Handa 提交于
      KMSAN complains that the vmci_use_ppn64() == false path in
      vmci_dbell_register_notification_bitmap() left upper 32bits of
      bitmap_set_msg.bitmap_ppn64 member uninitialized.
      
        =====================================================
        BUG: KMSAN: uninit-value in kmsan_check_memory+0xd/0x10
        CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.11.0-rc7+ #4
        Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020
        Call Trace:
         dump_stack+0x21c/0x280
         kmsan_report+0xfb/0x1e0
         kmsan_internal_check_memory+0x484/0x520
         kmsan_check_memory+0xd/0x10
         iowrite8_rep+0x86/0x380
         vmci_send_datagram+0x150/0x280
         vmci_dbell_register_notification_bitmap+0x133/0x1e0
         vmci_guest_probe_device+0xcab/0x1e70
         pci_device_probe+0xab3/0xe70
         really_probe+0xd16/0x24d0
         driver_probe_device+0x29d/0x3a0
         device_driver_attach+0x25a/0x490
         __driver_attach+0x78c/0x840
         bus_for_each_dev+0x210/0x340
         driver_attach+0x89/0xb0
         bus_add_driver+0x677/0xc40
         driver_register+0x485/0x8e0
         __pci_register_driver+0x1ff/0x350
         vmci_guest_init+0x3e/0x41
         vmci_drv_init+0x1d6/0x43f
         do_one_initcall+0x39c/0x9a0
         do_initcall_level+0x1d7/0x259
         do_initcalls+0x127/0x1cb
         do_basic_setup+0x33/0x36
         kernel_init_freeable+0x29a/0x3ed
         kernel_init+0x1f/0x840
         ret_from_fork+0x1f/0x30
      
        Local variable ----bitmap_set_msg@vmci_dbell_register_notification_bitmap created at:
         vmci_dbell_register_notification_bitmap+0x50/0x1e0
         vmci_dbell_register_notification_bitmap+0x50/0x1e0
      
        Bytes 28-31 of 32 are uninitialized
        Memory access of size 32 starts at ffff88810098f570
        =====================================================
      
      Fixes: 83e2ec76 ("VMCI: doorbell implementation.")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Link: https://lore.kernel.org/r/20210402121742.3917-1-penguin-kernel@I-love.SAKURA.ne.jpSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      376565b9
    • G
      Merge 5.12-rc6 into char-misc-next · 422d2245
      Greg Kroah-Hartman 提交于
      We need the char/misc fixes in here as well.
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      422d2245
    • L
      Linux 5.12-rc6 · e49d033b
      Linus Torvalds 提交于
      e49d033b
    • Z
      firewire: nosy: Fix a use-after-free bug in nosy_ioctl() · 829933ef
      Zheyu Ma 提交于
      For each device, the nosy driver allocates a pcilynx structure.
      A use-after-free might happen in the following scenario:
      
       1. Open nosy device for the first time and call ioctl with command
          NOSY_IOC_START, then a new client A will be malloced and added to
          doubly linked list.
       2. Open nosy device for the second time and call ioctl with command
          NOSY_IOC_START, then a new client B will be malloced and added to
          doubly linked list.
       3. Call ioctl with command NOSY_IOC_START for client A, then client A
          will be readded to the doubly linked list. Now the doubly linked
          list is messed up.
       4. Close the first nosy device and nosy_release will be called. In
          nosy_release, client A will be unlinked and freed.
       5. Close the second nosy device, and client A will be referenced,
          resulting in UAF.
      
      The root cause of this bug is that the element in the doubly linked list
      is reentered into the list.
      
      Fix this bug by adding a check before inserting a client.  If a client
      is already in the linked list, don't insert it.
      
      The following KASAN report reveals it:
      
         BUG: KASAN: use-after-free in nosy_release+0x1ea/0x210
         Write of size 8 at addr ffff888102ad7360 by task poc
         CPU: 3 PID: 337 Comm: poc Not tainted 5.12.0-rc5+ #6
         Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
         Call Trace:
           nosy_release+0x1ea/0x210
           __fput+0x1e2/0x840
           task_work_run+0xe8/0x180
           exit_to_user_mode_prepare+0x114/0x120
           syscall_exit_to_user_mode+0x1d/0x40
           entry_SYSCALL_64_after_hwframe+0x44/0xae
      
         Allocated by task 337:
           nosy_open+0x154/0x4d0
           misc_open+0x2ec/0x410
           chrdev_open+0x20d/0x5a0
           do_dentry_open+0x40f/0xe80
           path_openat+0x1cf9/0x37b0
           do_filp_open+0x16d/0x390
           do_sys_openat2+0x11d/0x360
           __x64_sys_open+0xfd/0x1a0
           do_syscall_64+0x33/0x40
           entry_SYSCALL_64_after_hwframe+0x44/0xae
      
         Freed by task 337:
           kfree+0x8f/0x210
           nosy_release+0x158/0x210
           __fput+0x1e2/0x840
           task_work_run+0xe8/0x180
           exit_to_user_mode_prepare+0x114/0x120
           syscall_exit_to_user_mode+0x1d/0x40
           entry_SYSCALL_64_after_hwframe+0x44/0xae
      
         The buggy address belongs to the object at ffff888102ad7300 which belongs to the cache kmalloc-128 of size 128
         The buggy address is located 96 bytes inside of 128-byte region [ffff888102ad7300, ffff888102ad7380)
      
      [ Modified to use 'list_empty()' inside proper lock  - Linus ]
      
      Link: https://lore.kernel.org/lkml/1617433116-5930-1-git-send-email-zheyuma97@gmail.com/Reported-and-tested-by: N马哲宇 (Zheyu Ma) <zheyuma97@gmail.com>
      Signed-off-by: NZheyu Ma <zheyuma97@gmail.com>
      Cc: Greg Kroah-Hartman <greg@kroah.com>
      Cc: Stefan Richter <stefanr@s5r6.in-berlin.de>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      829933ef
  2. 04 4月, 2021 13 次提交
  3. 03 4月, 2021 7 次提交
    • J
      io_uring: fix !CONFIG_BLOCK compilation failure · e82ad485
      Jens Axboe 提交于
      kernel test robot correctly pinpoints a compilation failure if
      CONFIG_BLOCK isn't set:
      
      fs/io_uring.c: In function '__io_complete_rw':
      >> fs/io_uring.c:2509:48: error: implicit declaration of function 'io_rw_should_reissue'; did you mean 'io_rw_reissue'? [-Werror=implicit-function-declaration]
          2509 |  if ((res == -EAGAIN || res == -EOPNOTSUPP) && io_rw_should_reissue(req)) {
               |                                                ^~~~~~~~~~~~~~~~~~~~
               |                                                io_rw_reissue
          cc1: some warnings being treated as errors
      
      Ensure that we have a stub declaration of io_rw_should_reissue() for
      !CONFIG_BLOCK.
      
      Fixes: 230d50d4 ("io_uring: move reissue into regular IO path")
      Reported-by: Nkernel test robot <lkp@intel.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      e82ad485
    • L
      Merge tag 'block-5.12-2021-04-02' of git://git.kernel.dk/linux-block · d93a0d43
      Linus Torvalds 提交于
      Pull block fixes from Jens Axboe:
      
       - Remove comment that never came to fruition in 22 years of development
         (Christoph)
      
       - Remove unused request flag (Christoph)
      
       - Fix for null_blk fake timeout handling (Damien)
      
       - Fix for IOCB_NOWAIT being ignored for O_DIRECT on raw bdevs (Pavel)
      
       - Error propagation fix for multiple split bios (Yufen)
      
      * tag 'block-5.12-2021-04-02' of git://git.kernel.dk/linux-block:
        block: remove the unused RQF_ALLOCED flag
        block: update a few comments in uapi/linux/blkpg.h
        block: don't ignore REQ_NOWAIT for direct IO
        null_blk: fix command timeout completion handling
        block: only update parent bi_status when bio fail
      d93a0d43
    • L
      Merge tag 'io_uring-5.12-2021-04-02' of git://git.kernel.dk/linux-block · 1faccb63
      Linus Torvalds 提交于
      Pull io_uring fixes from Jens Axboe:
       "Nothing really major in here, and finally nothing really related to
        signals. A few minor fixups related to the threading changes, and some
        general fixes, that's it.
      
        There's the pending gdb-get-confused-about-arch, but that's more of a
        cosmetic issue, nothing that hinder use of it. And given that other
        archs will likely be affected by that oddity too, better to postpone
        any changes there until 5.13 imho"
      
      * tag 'io_uring-5.12-2021-04-02' of git://git.kernel.dk/linux-block:
        io_uring: move reissue into regular IO path
        io_uring: fix EIOCBQUEUED iter revert
        io_uring/io-wq: protect against sprintf overflow
        io_uring: don't mark S_ISBLK async work as unbounded
        io_uring: drop sqd lock before handling signals for SQPOLL
        io_uring: handle setup-failed ctx in kill_timeouts
        io_uring: always go for cancellation spin on exec
      1faccb63
    • L
      Merge tag 'acpi-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 0a84c2e4
      Linus Torvalds 提交于
      Pull ACPI fixes from Rafael Wysocki:
       "These fix an ACPI tables management issue, an issue related to the
        ACPI enumeration of devices and CPU wakeup in the ACPI processor
        driver.
      
        Specifics:
      
         - Ensure that the memory occupied by ACPI tables on x86 will always
           be reserved to prevent it from being allocated for other purposes
           which was possible in some cases (Rafael Wysocki).
      
         - Fix the ACPI device enumeration code to prevent it from attempting
           to evaluate the _STA control method for devices with unmet
           dependencies which is likely to fail (Hans de Goede).
      
         - Fix the handling of CPU0 wakeup in the ACPI processor driver to
           prevent CPU0 online failures from occurring (Vitaly Kuznetsov)"
      
      * tag 'acpi-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: processor: Fix CPU0 wakeup in acpi_idle_play_dead()
        ACPI: scan: Fix _STA getting called on devices with unmet dependencies
        ACPI: tables: x86: Reserve memory occupied by ACPI tables
      0a84c2e4
    • L
      Merge tag 'pm-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 9314a0e9
      Linus Torvalds 提交于
      Pull power management fixes from Rafael Wysocki:
       "These fix a race condition and an ordering issue related to using
        device links in the runtime PM framework and two kerneldoc comments in
        cpufreq.
      
        Specifics:
      
         - Fix race condition related to the handling of supplier devices
           during consumer device probe and fix the order of decrementation of
           two related reference counters in the runtime PM core code handling
           supplier devices (Adrian Hunter).
      
         - Fix kerneldoc comments in cpufreq that have not been updated along
           with the functions documented by them (Geert Uytterhoeven)"
      
      * tag 'pm-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PM: runtime: Fix race getting/putting suppliers at probe
        PM: runtime: Fix ordering in pm_runtime_get_suppliers()
        cpufreq: Fix scaling_{available,boost}_frequencies_show() comments
      9314a0e9
    • C
      block: remove the unused RQF_ALLOCED flag · f06c6096
      Christoph Hellwig 提交于
      Signed-off-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      f06c6096
    • C
      block: update a few comments in uapi/linux/blkpg.h · b9c6cdc3
      Christoph Hellwig 提交于
      The big top of the file comment talk about grand plans that never
      happened, so remove them to not confuse the readers.  Also mark the
      devname and volname fields as ignored as they were never used by the
      kernel.
      Signed-off-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      b9c6cdc3
  4. 02 4月, 2021 13 次提交