From: Greg Kroah-Hartman Date: Sun, 23 Jan 2022 16:17:06 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.300~123 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b03a70c8077f41d918bf1978de5dc0fbbf8214da;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: crypto-caam-replace-this_cpu_ptr-with-raw_cpu_ptr.patch crypto-omap-aes-fix-broken-pm_runtime_and_get-usage.patch crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch rpmsg-core-clean-up-resources-on-announce_create-failure.patch ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch --- diff --git a/queue-5.4/crypto-caam-replace-this_cpu_ptr-with-raw_cpu_ptr.patch b/queue-5.4/crypto-caam-replace-this_cpu_ptr-with-raw_cpu_ptr.patch new file mode 100644 index 00000000000..18c3f14e3e8 --- /dev/null +++ b/queue-5.4/crypto-caam-replace-this_cpu_ptr-with-raw_cpu_ptr.patch @@ -0,0 +1,57 @@ +From efd21e10fc3bf4c6da122470a5ae89ec4ed8d180 Mon Sep 17 00:00:00 2001 +From: Meng Li +Date: Mon, 1 Nov 2021 11:13:53 +0800 +Subject: crypto: caam - replace this_cpu_ptr with raw_cpu_ptr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Meng Li + +commit efd21e10fc3bf4c6da122470a5ae89ec4ed8d180 upstream. + +When enable the kernel debug config, there is below calltrace detected: +BUG: using smp_processor_id() in preemptible [00000000] code: cryptomgr_test/339 +caller is debug_smp_processor_id+0x20/0x30 +CPU: 9 PID: 339 Comm: cryptomgr_test Not tainted 5.10.63-yocto-standard #1 +Hardware name: NXP Layerscape LX2160ARDB (DT) +Call trace: + dump_backtrace+0x0/0x1a0 + show_stack+0x24/0x30 + dump_stack+0xf0/0x13c + check_preemption_disabled+0x100/0x110 + debug_smp_processor_id+0x20/0x30 + dpaa2_caam_enqueue+0x10c/0x25c + ...... + cryptomgr_test+0x38/0x60 + kthread+0x158/0x164 + ret_from_fork+0x10/0x38 +According to the comment in commit ac5d15b4519f("crypto: caam/qi2 + - use affine DPIOs "), because preemption is no longer disabled +while trying to enqueue an FQID, it might be possible to run the +enqueue on a different CPU(due to migration, when in process context), +however this wouldn't be a functionality issue. But there will be +above calltrace when enable kernel debug config. So, replace this_cpu_ptr +with raw_cpu_ptr to avoid above call trace. + +Fixes: ac5d15b4519f ("crypto: caam/qi2 - use affine DPIOs") +Cc: stable@vger.kernel.org +Signed-off-by: Meng Li +Reviewed-by: Horia Geantă +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/caam/caamalg_qi2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/caam/caamalg_qi2.c ++++ b/drivers/crypto/caam/caamalg_qi2.c +@@ -5421,7 +5421,7 @@ int dpaa2_caam_enqueue(struct device *de + dpaa2_fd_set_len(&fd, dpaa2_fl_get_len(&req->fd_flt[1])); + dpaa2_fd_set_flc(&fd, req->flc_dma); + +- ppriv = this_cpu_ptr(priv->ppriv); ++ ppriv = raw_cpu_ptr(priv->ppriv); + for (i = 0; i < (priv->dpseci_attr.num_tx_queues << 1); i++) { + err = dpaa2_io_service_enqueue_fq(ppriv->dpio, ppriv->req_fqid, + &fd); diff --git a/queue-5.4/crypto-omap-aes-fix-broken-pm_runtime_and_get-usage.patch b/queue-5.4/crypto-omap-aes-fix-broken-pm_runtime_and_get-usage.patch new file mode 100644 index 00000000000..601e0c35471 --- /dev/null +++ b/queue-5.4/crypto-omap-aes-fix-broken-pm_runtime_and_get-usage.patch @@ -0,0 +1,34 @@ +From c2aec59be093bd44627bc4f6bc67e4614a93a7b6 Mon Sep 17 00:00:00 2001 +From: Heiner Kallweit +Date: Fri, 17 Dec 2021 10:03:30 +0100 +Subject: crypto: omap-aes - Fix broken pm_runtime_and_get() usage + +From: Heiner Kallweit + +commit c2aec59be093bd44627bc4f6bc67e4614a93a7b6 upstream. + +This fix is basically the same as 3d6b661330a7 ("crypto: stm32 - +Revert broken pm_runtime_resume_and_get changes"), just for the omap +driver. If the return value isn't used, then pm_runtime_get_sync() +has to be used for ensuring that the usage count is balanced. + +Fixes: 1f34cc4a8da3 ("crypto: omap-aes - Fix PM reference leak on omap-aes.c") +Cc: stable@vger.kernel.org +Signed-off-by: Heiner Kallweit +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/omap-aes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/omap-aes.c ++++ b/drivers/crypto/omap-aes.c +@@ -1318,7 +1318,7 @@ static int omap_aes_suspend(struct devic + + static int omap_aes_resume(struct device *dev) + { +- pm_runtime_resume_and_get(dev); ++ pm_runtime_get_sync(dev); + return 0; + } + #endif diff --git a/queue-5.4/crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch b/queue-5.4/crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch new file mode 100644 index 00000000000..a725f7b3220 --- /dev/null +++ b/queue-5.4/crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch @@ -0,0 +1,64 @@ +From 29009604ad4e3ef784fd9b9fef6f23610ddf633d Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Mon, 20 Dec 2021 20:50:22 +0100 +Subject: crypto: stm32/crc32 - Fix kernel BUG triggered in probe() + +From: Marek Vasut + +commit 29009604ad4e3ef784fd9b9fef6f23610ddf633d upstream. + +The include/linux/crypto.h struct crypto_alg field cra_driver_name description +states "Unique name of the transformation provider. " ... " this contains the +name of the chip or provider and the name of the transformation algorithm." + +In case of the stm32-crc driver, field cra_driver_name is identical for all +registered transformation providers and set to the name of the driver itself, +which is incorrect. This patch fixes it by assigning a unique cra_driver_name +to each registered transformation provider. + +The kernel crash is triggered when the driver calls crypto_register_shashes() +which calls crypto_register_shash(), which calls crypto_register_alg(), which +calls __crypto_register_alg(), which returns -EEXIST, which is propagated +back through this call chain. Upon -EEXIST from crypto_register_shash(), the +crypto_register_shashes() starts unregistering the providers back, and calls +crypto_unregister_shash(), which calls crypto_unregister_alg(), and this is +where the BUG() triggers due to incorrect cra_refcnt. + +Fixes: b51dbe90912a ("crypto: stm32 - Support for STM32 CRC32 crypto module") +Signed-off-by: Marek Vasut +Cc: # 4.12+ +Cc: Alexandre Torgue +Cc: Fabien Dessenne +Cc: Herbert Xu +Cc: Lionel Debieve +Cc: Nicolas Toromanoff +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-crypto@vger.kernel.org +Acked-by: Nicolas Toromanoff +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/stm32/stm32-crc32.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/stm32/stm32-crc32.c ++++ b/drivers/crypto/stm32/stm32-crc32.c +@@ -230,7 +230,7 @@ static struct shash_alg algs[] = { + .digestsize = CHKSUM_DIGEST_SIZE, + .base = { + .cra_name = "crc32", +- .cra_driver_name = DRIVER_NAME, ++ .cra_driver_name = "stm32-crc32-crc32", + .cra_priority = 200, + .cra_flags = CRYPTO_ALG_OPTIONAL_KEY, + .cra_blocksize = CHKSUM_BLOCK_SIZE, +@@ -252,7 +252,7 @@ static struct shash_alg algs[] = { + .digestsize = CHKSUM_DIGEST_SIZE, + .base = { + .cra_name = "crc32c", +- .cra_driver_name = DRIVER_NAME, ++ .cra_driver_name = "stm32-crc32-crc32c", + .cra_priority = 200, + .cra_flags = CRYPTO_ALG_OPTIONAL_KEY, + .cra_blocksize = CHKSUM_BLOCK_SIZE, diff --git a/queue-5.4/rpmsg-core-clean-up-resources-on-announce_create-failure.patch b/queue-5.4/rpmsg-core-clean-up-resources-on-announce_create-failure.patch new file mode 100644 index 00000000000..cbf30c63e1c --- /dev/null +++ b/queue-5.4/rpmsg-core-clean-up-resources-on-announce_create-failure.patch @@ -0,0 +1,57 @@ +From 8066c615cb69b7da8a94f59379847b037b3a5e46 Mon Sep 17 00:00:00 2001 +From: Arnaud Pouliquen +Date: Mon, 6 Dec 2021 20:07:58 +0100 +Subject: rpmsg: core: Clean up resources on announce_create failure. + +From: Arnaud Pouliquen + +commit 8066c615cb69b7da8a94f59379847b037b3a5e46 upstream. + +During the rpmsg_dev_probe, if rpdev->ops->announce_create returns an +error, the rpmsg device and default endpoint should be freed before +exiting the function. + +Fixes: 5e619b48677c ("rpmsg: Split rpmsg core and virtio backend") +Suggested-by: Bjorn Andersson +Signed-off-by: Arnaud Pouliquen +Reviewed-by: Bjorn Andersson +Cc: stable +Link: https://lore.kernel.org/r/20211206190758.10004-1-arnaud.pouliquen@foss.st.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rpmsg/rpmsg_core.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/drivers/rpmsg/rpmsg_core.c ++++ b/drivers/rpmsg/rpmsg_core.c +@@ -473,13 +473,25 @@ static int rpmsg_dev_probe(struct device + err = rpdrv->probe(rpdev); + if (err) { + dev_err(dev, "%s: failed: %d\n", __func__, err); +- if (ept) +- rpmsg_destroy_ept(ept); +- goto out; ++ goto destroy_ept; + } + +- if (ept && rpdev->ops->announce_create) ++ if (ept && rpdev->ops->announce_create) { + err = rpdev->ops->announce_create(rpdev); ++ if (err) { ++ dev_err(dev, "failed to announce creation\n"); ++ goto remove_rpdev; ++ } ++ } ++ ++ return 0; ++ ++remove_rpdev: ++ if (rpdrv->remove) ++ rpdrv->remove(rpdev); ++destroy_ept: ++ if (ept) ++ rpmsg_destroy_ept(ept); + out: + return err; + } diff --git a/queue-5.4/series b/queue-5.4/series index 69e119a23e8..1eda1732de7 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -242,3 +242,8 @@ mips-octeon-fix-build-errors-using-clang.patch scsi-sr-don-t-use-gfp_dma.patch asoc-mediatek-mt8173-fix-device_node-leak.patch power-bq25890-enable-continuous-conversion-for-adc-a.patch +rpmsg-core-clean-up-resources-on-announce_create-failure.patch +crypto-omap-aes-fix-broken-pm_runtime_and_get-usage.patch +crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch +crypto-caam-replace-this_cpu_ptr-with-raw_cpu_ptr.patch +ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch diff --git a/queue-5.4/ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch b/queue-5.4/ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch new file mode 100644 index 00000000000..f64fccb2e6a --- /dev/null +++ b/queue-5.4/ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch @@ -0,0 +1,105 @@ +From 3fea4d9d160186617ff40490ae01f4f4f36b28ff Mon Sep 17 00:00:00 2001 +From: Petr Cvachoucek +Date: Mon, 30 Aug 2021 21:20:37 +0200 +Subject: ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers + +From: Petr Cvachoucek + +commit 3fea4d9d160186617ff40490ae01f4f4f36b28ff upstream. + +it seems freeing the write buffers in the error path of the +ubifs_remount_rw() is wrong. It leads later to a kernel oops like this: + +[10016.431274] UBIFS (ubi0:0): start fixing up free space +[10090.810042] UBIFS (ubi0:0): free space fixup complete +[10090.814623] UBIFS error (ubi0:0 pid 512): ubifs_remount_fs: cannot +spawn "ubifs_bgt0_0", error -4 +[10101.915108] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, +PID 517 +[10105.275498] Unable to handle kernel NULL pointer dereference at +virtual address 0000000000000030 +[10105.284352] Mem abort info: +[10105.287160] ESR = 0x96000006 +[10105.290252] EC = 0x25: DABT (current EL), IL = 32 bits +[10105.295592] SET = 0, FnV = 0 +[10105.298652] EA = 0, S1PTW = 0 +[10105.301848] Data abort info: +[10105.304723] ISV = 0, ISS = 0x00000006 +[10105.308573] CM = 0, WnR = 0 +[10105.311564] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000f03d1000 +[10105.318034] [0000000000000030] pgd=00000000f6cee003, +pud=00000000f4884003, pmd=0000000000000000 +[10105.326783] Internal error: Oops: 96000006 [#1] PREEMPT SMP +[10105.332355] Modules linked in: ath10k_pci ath10k_core ath mac80211 +libarc4 cfg80211 nvme nvme_core cryptodev(O) +[10105.342468] CPU: 3 PID: 518 Comm: touch Tainted: G O +5.4.3 #1 +[10105.349517] Hardware name: HYPEX CPU (DT) +[10105.353525] pstate: 40000005 (nZcv daif -PAN -UAO) +[10105.358324] pc : atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34 +[10105.364596] lr : mutex_lock+0x1c/0x34 +[10105.368253] sp : ffff000075633aa0 +[10105.371563] x29: ffff000075633aa0 x28: 0000000000000001 +[10105.376874] x27: ffff000076fa80c8 x26: 0000000000000004 +[10105.382185] x25: 0000000000000030 x24: 0000000000000000 +[10105.387495] x23: 0000000000000000 x22: 0000000000000038 +[10105.392807] x21: 000000000000000c x20: ffff000076fa80c8 +[10105.398119] x19: ffff000076fa8000 x18: 0000000000000000 +[10105.403429] x17: 0000000000000000 x16: 0000000000000000 +[10105.408741] x15: 0000000000000000 x14: fefefefefefefeff +[10105.414052] x13: 0000000000000000 x12: 0000000000000fe0 +[10105.419364] x11: 0000000000000fe0 x10: ffff000076709020 +[10105.424675] x9 : 0000000000000000 x8 : 00000000000000a0 +[10105.429986] x7 : ffff000076fa80f4 x6 : 0000000000000030 +[10105.435297] x5 : 0000000000000000 x4 : 0000000000000000 +[10105.440609] x3 : 0000000000000000 x2 : ffff00006f276040 +[10105.445920] x1 : ffff000075633ab8 x0 : 0000000000000030 +[10105.451232] Call trace: +[10105.453676] atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34 +[10105.459600] ubifs_garbage_collect+0xb4/0x334 +[10105.463956] ubifs_budget_space+0x398/0x458 +[10105.468139] ubifs_create+0x50/0x180 +[10105.471712] path_openat+0x6a0/0x9b0 +[10105.475284] do_filp_open+0x34/0x7c +[10105.478771] do_sys_open+0x78/0xe4 +[10105.482170] __arm64_sys_openat+0x1c/0x24 +[10105.486180] el0_svc_handler+0x84/0xc8 +[10105.489928] el0_svc+0x8/0xc +[10105.492808] Code: 52800013 17fffffb d2800003 f9800011 (c85ffc05) +[10105.498903] ---[ end trace 46b721d93267a586 ]--- + +To reproduce the problem: + +1. Filesystem initially mounted read-only, free space fixup flag set. + +2. mount -o remount,rw + +3. it takes some time (free space fixup running) + ... try to terminate running mount by CTRL-C + ... does not respond, only after free space fixup is complete + ... then "ubifs_remount_fs: cannot spawn "ubifs_bgt0_0", error -4" + +4. mount -o remount,rw + ... now finished instantly (fixup already done). + +5. Create file or just unmount the filesystem and we get the oops. + +Cc: +Fixes: b50b9f408502 ("UBIFS: do not free write-buffers when in R/O mode") +Signed-off-by: Petr Cvachoucek +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +--- + fs/ubifs/super.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/fs/ubifs/super.c ++++ b/fs/ubifs/super.c +@@ -1835,7 +1835,6 @@ out: + kthread_stop(c->bgt); + c->bgt = NULL; + } +- free_wbufs(c); + kfree(c->write_reserve_buf); + c->write_reserve_buf = NULL; + vfree(c->ileb_buf);