From: Greg Kroah-Hartman Date: Mon, 9 Mar 2020 20:18:44 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.4.216~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6be33601e1e07e44ce2ecb4b7fd8ad37f7caf042;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: dm-cache-fix-a-crash-due-to-incorrect-work-item-cancelling.patch dmaengine-tegra-apb-fix-use-after-free.patch dmaengine-tegra-apb-prevent-race-conditions-of-tasklet-vs-free-list.patch --- diff --git a/queue-4.14/dm-cache-fix-a-crash-due-to-incorrect-work-item-cancelling.patch b/queue-4.14/dm-cache-fix-a-crash-due-to-incorrect-work-item-cancelling.patch new file mode 100644 index 00000000000..7cf9a65255e --- /dev/null +++ b/queue-4.14/dm-cache-fix-a-crash-due-to-incorrect-work-item-cancelling.patch @@ -0,0 +1,51 @@ +From 7cdf6a0aae1cccf5167f3f04ecddcf648b78e289 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Wed, 19 Feb 2020 10:25:45 -0500 +Subject: dm cache: fix a crash due to incorrect work item cancelling + +From: Mikulas Patocka + +commit 7cdf6a0aae1cccf5167f3f04ecddcf648b78e289 upstream. + +The crash can be reproduced by running the lvm2 testsuite test +lvconvert-thin-external-cache.sh for several minutes, e.g.: + while :; do make check T=shell/lvconvert-thin-external-cache.sh; done + +The crash happens in this call chain: +do_waker -> policy_tick -> smq_tick -> end_hotspot_period -> clear_bitset +-> memset -> __memset -- which accesses an invalid pointer in the vmalloc +area. + +The work entry on the workqueue is executed even after the bitmap was +freed. The problem is that cancel_delayed_work doesn't wait for the +running work item to finish, so the work item can continue running and +re-submitting itself even after cache_postsuspend. In order to make sure +that the work item won't be running, we must use cancel_delayed_work_sync. + +Also, change flush_workqueue to drain_workqueue, so that if some work item +submits itself or another work item, we are properly waiting for both of +them. + +Fixes: c6b4fcbad044 ("dm: add cache target") +Cc: stable@vger.kernel.org # v3.9 +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-cache-target.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -2971,8 +2971,8 @@ static void cache_postsuspend(struct dm_ + prevent_background_work(cache); + BUG_ON(atomic_read(&cache->nr_io_migrations)); + +- cancel_delayed_work(&cache->waker); +- flush_workqueue(cache->wq); ++ cancel_delayed_work_sync(&cache->waker); ++ drain_workqueue(cache->wq); + WARN_ON(cache->tracker.in_flight); + + /* diff --git a/queue-4.14/dmaengine-tegra-apb-fix-use-after-free.patch b/queue-4.14/dmaengine-tegra-apb-fix-use-after-free.patch new file mode 100644 index 00000000000..675ae6bed46 --- /dev/null +++ b/queue-4.14/dmaengine-tegra-apb-fix-use-after-free.patch @@ -0,0 +1,62 @@ +From 94788af4ed039476ff3527b0e6a12c1dc42cb022 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Sun, 9 Feb 2020 19:33:38 +0300 +Subject: dmaengine: tegra-apb: Fix use-after-free + +From: Dmitry Osipenko + +commit 94788af4ed039476ff3527b0e6a12c1dc42cb022 upstream. + +I was doing some experiments with I2C and noticed that Tegra APB DMA +driver crashes sometime after I2C DMA transfer termination. The crash +happens because tegra_dma_terminate_all() bails out immediately if pending +list is empty, and thus, it doesn't release the half-completed descriptors +which are getting re-used before ISR tasklet kicks-in. + + tegra-i2c 7000c400.i2c: DMA transfer timeout + elants_i2c 0-0010: elants_i2c_irq: failed to read data: -110 + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 142 at lib/list_debug.c:45 __list_del_entry_valid+0x45/0xac + list_del corruption, ddbaac44->next is LIST_POISON1 (00000100) + Modules linked in: + CPU: 0 PID: 142 Comm: kworker/0:2 Not tainted 5.5.0-rc2-next-20191220-00175-gc3605715758d-dirty #538 + Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) + Workqueue: events_freezable_power_ thermal_zone_device_check + [] (unwind_backtrace) from [] (show_stack+0x11/0x14) + [] (show_stack) from [] (dump_stack+0x85/0x94) + [] (dump_stack) from [] (__warn+0xc1/0xc4) + [] (__warn) from [] (warn_slowpath_fmt+0x61/0x78) + [] (warn_slowpath_fmt) from [] (__list_del_entry_valid+0x45/0xac) + [] (__list_del_entry_valid) from [] (tegra_dma_tasklet+0x5b/0x154) + [] (tegra_dma_tasklet) from [] (tasklet_action_common.constprop.0+0x41/0x7c) + [] (tasklet_action_common.constprop.0) from [] (__do_softirq+0xd3/0x2a8) + [] (__do_softirq) from [] (irq_exit+0x7b/0x98) + [] (irq_exit) from [] (__handle_domain_irq+0x45/0x80) + [] (__handle_domain_irq) from [] (gic_handle_irq+0x45/0x7c) + [] (gic_handle_irq) from [] (__irq_svc+0x65/0x94) + Exception stack(0xde2ebb90 to 0xde2ebbd8) + +Signed-off-by: Dmitry Osipenko +Acked-by: Jon Hunter +Cc: +Link: https://lore.kernel.org/r/20200209163356.6439-2-digetx@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/tegra20-apb-dma.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/dma/tegra20-apb-dma.c ++++ b/drivers/dma/tegra20-apb-dma.c +@@ -755,10 +755,6 @@ static int tegra_dma_terminate_all(struc + bool was_busy; + + spin_lock_irqsave(&tdc->lock, flags); +- if (list_empty(&tdc->pending_sg_req)) { +- spin_unlock_irqrestore(&tdc->lock, flags); +- return 0; +- } + + if (!tdc->busy) + goto skip_dma_stop; diff --git a/queue-4.14/dmaengine-tegra-apb-prevent-race-conditions-of-tasklet-vs-free-list.patch b/queue-4.14/dmaengine-tegra-apb-prevent-race-conditions-of-tasklet-vs-free-list.patch new file mode 100644 index 00000000000..e72a401be9b --- /dev/null +++ b/queue-4.14/dmaengine-tegra-apb-prevent-race-conditions-of-tasklet-vs-free-list.patch @@ -0,0 +1,37 @@ +From c33ee1301c393a241d6424e36eff1071811b1064 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Sun, 9 Feb 2020 19:33:39 +0300 +Subject: dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list + +From: Dmitry Osipenko + +commit c33ee1301c393a241d6424e36eff1071811b1064 upstream. + +The interrupt handler puts a half-completed DMA descriptor on a free list +and then schedules tasklet to process bottom half of the descriptor that +executes client's callback, this creates possibility to pick up the busy +descriptor from the free list. Thus, let's disallow descriptor's re-use +until it is fully processed. + +Signed-off-by: Dmitry Osipenko +Acked-by: Jon Hunter +Cc: +Link: https://lore.kernel.org/r/20200209163356.6439-3-digetx@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/tegra20-apb-dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/tegra20-apb-dma.c ++++ b/drivers/dma/tegra20-apb-dma.c +@@ -288,7 +288,7 @@ static struct tegra_dma_desc *tegra_dma_ + + /* Do not allocate if desc are waiting for ack */ + list_for_each_entry(dma_desc, &tdc->free_dma_desc, node) { +- if (async_tx_test_ack(&dma_desc->txd)) { ++ if (async_tx_test_ack(&dma_desc->txd) && !dma_desc->cb_count) { + list_del(&dma_desc->node); + spin_unlock_irqrestore(&tdc->lock, flags); + dma_desc->txd.flags = 0; diff --git a/queue-4.14/series b/queue-4.14/series index f72164142b3..8d8ecad1abe 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -104,3 +104,6 @@ vt-selection-close-sel_buffer-race.patch vt-selection-push-console-lock-down.patch vt-selection-push-sel_lock-up.patch x86-pkeys-manually-set-x86_feature_ospke-to-preserve-existing-changes.patch +dmaengine-tegra-apb-fix-use-after-free.patch +dmaengine-tegra-apb-prevent-race-conditions-of-tasklet-vs-free-list.patch +dm-cache-fix-a-crash-due-to-incorrect-work-item-cancelling.patch