From 567833bc3eb5e01a198eefd5b1e9543f07bb2697 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 27 Jun 2013 12:19:13 -0700 Subject: [PATCH] 3.0-stable patches added patches: bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch dlci-validate-the-net-device-in-dlci_del.patch hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch --- ...sh-in-l2cap_build_cmd-with-small-mtu.patch | 90 +++++++++++++++++++ ...ock-before-calling-__dev_get_by_name.patch | 60 +++++++++++++ ...-validate-the-net-device-in-dlci_del.patch | 67 ++++++++++++++ ...ble_mask-in-reserve-release-_bp_slot.patch | 55 ++++++++++++ queue-3.0/series | 4 + 5 files changed, 276 insertions(+) create mode 100644 queue-3.0/bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch create mode 100644 queue-3.0/dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch create mode 100644 queue-3.0/dlci-validate-the-net-device-in-dlci_del.patch create mode 100644 queue-3.0/hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch create mode 100644 queue-3.0/series diff --git a/queue-3.0/bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch b/queue-3.0/bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch new file mode 100644 index 00000000000..3aa5a867774 --- /dev/null +++ b/queue-3.0/bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch @@ -0,0 +1,90 @@ +From 300b962e5244a1ea010df7e88595faa0085b461d Mon Sep 17 00:00:00 2001 +From: Anderson Lizardo +Date: Sun, 2 Jun 2013 16:30:40 -0400 +Subject: Bluetooth: Fix crash in l2cap_build_cmd() with small MTU + +From: Anderson Lizardo + +commit 300b962e5244a1ea010df7e88595faa0085b461d upstream. + +If a too small MTU value is set with ioctl(HCISETACLMTU) or by a bogus +controller, memory corruption happens due to a memcpy() call with +negative length. + +Fix this crash on either incoming or outgoing connections with a MTU +smaller than L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE: + +[ 46.885433] BUG: unable to handle kernel paging request at f56ad000 +[ 46.888037] IP: [] memcpy+0x1d/0x40 +[ 46.888037] *pdpt = 0000000000ac3001 *pde = 00000000373f8067 *pte = 80000000356ad060 +[ 46.888037] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC +[ 46.888037] Modules linked in: hci_vhci bluetooth virtio_balloon i2c_piix4 uhci_hcd usbcore usb_common +[ 46.888037] CPU: 0 PID: 1044 Comm: kworker/u3:0 Not tainted 3.10.0-rc1+ #12 +[ 46.888037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 +[ 46.888037] Workqueue: hci0 hci_rx_work [bluetooth] +[ 46.888037] task: f59b15b0 ti: f55c4000 task.ti: f55c4000 +[ 46.888037] EIP: 0060:[] EFLAGS: 00010212 CPU: 0 +[ 46.888037] EIP is at memcpy+0x1d/0x40 +[ 46.888037] EAX: f56ac1c0 EBX: fffffff8 ECX: 3ffffc6e EDX: f55c5cf2 +[ 46.888037] ESI: f55c6b32 EDI: f56ad000 EBP: f55c5c68 ESP: f55c5c5c +[ 46.888037] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 +[ 46.888037] CR0: 8005003b CR2: f56ad000 CR3: 3557d000 CR4: 000006f0 +[ 46.888037] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 +[ 46.888037] DR6: ffff0ff0 DR7: 00000400 +[ 46.888037] Stack: +[ 46.888037] fffffff8 00000010 00000003 f55c5cac f8c6a54c ffffffff f8c69eb2 00000000 +[ 46.888037] f4783cdc f57f0070 f759c590 1001c580 00000003 0200000a 00000000 f5a88560 +[ 46.888037] f5ba2600 f5a88560 00000041 00000000 f55c5d90 f8c6f4c7 00000008 f55c5cf2 +[ 46.888037] Call Trace: +[ 46.888037] [] l2cap_send_cmd+0x1cc/0x230 [bluetooth] +[ 46.888037] [] ? l2cap_global_chan_by_psm+0x152/0x1a0 [bluetooth] +[ 46.888037] [] l2cap_connect+0x3f7/0x540 [bluetooth] +[ 46.888037] [] ? trace_hardirqs_off+0xb/0x10 +[ 46.888037] [] ? mark_held_locks+0x68/0x110 +[ 46.888037] [] ? mutex_lock_nested+0x280/0x360 +[ 46.888037] [] ? __mutex_unlock_slowpath+0xa9/0x150 +[ 46.888037] [] ? trace_hardirqs_on_caller+0xec/0x1b0 +[ 46.888037] [] ? mutex_lock_nested+0x268/0x360 +[ 46.888037] [] ? trace_hardirqs_on+0xb/0x10 +[ 46.888037] [] l2cap_recv_frame+0xb2d/0x1d30 [bluetooth] +[ 46.888037] [] ? mark_held_locks+0x68/0x110 +[ 46.888037] [] ? __mutex_unlock_slowpath+0xa9/0x150 +[ 46.888037] [] ? trace_hardirqs_on_caller+0xec/0x1b0 +[ 46.888037] [] l2cap_recv_acldata+0x2a1/0x320 [bluetooth] +[ 46.888037] [] hci_rx_work+0x518/0x810 [bluetooth] +[ 46.888037] [] ? hci_rx_work+0x132/0x810 [bluetooth] +[ 46.888037] [] process_one_work+0x1a9/0x600 +[ 46.888037] [] ? process_one_work+0x12b/0x600 +[ 46.888037] [] ? worker_thread+0x19e/0x320 +[ 46.888037] [] ? worker_thread+0x19e/0x320 +[ 46.888037] [] worker_thread+0xf7/0x320 +[ 46.888037] [] ? rescuer_thread+0x290/0x290 +[ 46.888037] [] kthread+0xa8/0xb0 +[ 46.888037] [] ret_from_kernel_thread+0x1b/0x28 +[ 46.888037] [] ? flush_kthread_worker+0x120/0x120 +[ 46.888037] Code: c3 90 8d 74 26 00 e8 63 fc ff ff eb e8 90 55 89 e5 83 ec 0c 89 5d f4 89 75 f8 89 7d fc 3e 8d 74 26 00 89 cb 89 c7 c1 e9 02 89 d6 a5 89 d9 83 e1 03 74 02 f3 a4 8b 5d f4 8b 75 f8 8b 7d fc 89 +[ 46.888037] EIP: [] memcpy+0x1d/0x40 SS:ESP 0068:f55c5c5c +[ 46.888037] CR2: 00000000f56ad000 +[ 46.888037] ---[ end trace 0217c1f4d78714a9 ]--- + +Signed-off-by: Anderson Lizardo +Signed-off-by: Gustavo Padovan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/l2cap_core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -1514,6 +1514,9 @@ static struct sk_buff *l2cap_build_cmd(s + BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d", + conn, code, ident, dlen); + ++ if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE) ++ return NULL; ++ + len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen; + count = min_t(unsigned int, conn->mtu, len); + diff --git a/queue-3.0/dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch b/queue-3.0/dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch new file mode 100644 index 00000000000..53973877f1e --- /dev/null +++ b/queue-3.0/dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch @@ -0,0 +1,60 @@ +From 11eb2645cbf38a08ae491bf6c602eea900ec0bb5 Mon Sep 17 00:00:00 2001 +From: Zefan Li +Date: Wed, 26 Jun 2013 15:29:54 +0800 +Subject: dlci: acquire rtnl_lock before calling __dev_get_by_name() + +From: Zefan Li + +commit 11eb2645cbf38a08ae491bf6c602eea900ec0bb5 upstream. + +Otherwise the net device returned can be freed at anytime. + +Signed-off-by: Li Zefan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wan/dlci.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/net/wan/dlci.c ++++ b/drivers/net/wan/dlci.c +@@ -378,20 +378,24 @@ static int dlci_del(struct dlci_add *dlc + struct net_device *master, *slave; + int err; + ++ rtnl_lock(); ++ + /* validate slave device */ + master = __dev_get_by_name(&init_net, dlci->devname); +- if (!master) +- return -ENODEV; ++ if (!master) { ++ err = -ENODEV; ++ goto out; ++ } + + if (netif_running(master)) { +- return -EBUSY; ++ err = -EBUSY; ++ goto out; + } + + dlp = netdev_priv(master); + slave = dlp->slave; + flp = netdev_priv(slave); + +- rtnl_lock(); + err = (*flp->deassoc)(slave, master); + if (!err) { + list_del(&dlp->list); +@@ -400,8 +404,8 @@ static int dlci_del(struct dlci_add *dlc + + dev_put(slave); + } ++out: + rtnl_unlock(); +- + return err; + } + diff --git a/queue-3.0/dlci-validate-the-net-device-in-dlci_del.patch b/queue-3.0/dlci-validate-the-net-device-in-dlci_del.patch new file mode 100644 index 00000000000..1c9d4c7f20f --- /dev/null +++ b/queue-3.0/dlci-validate-the-net-device-in-dlci_del.patch @@ -0,0 +1,67 @@ +From 578a1310f2592ba90c5674bca21c1dbd1adf3f0a Mon Sep 17 00:00:00 2001 +From: Zefan Li +Date: Wed, 26 Jun 2013 15:31:58 +0800 +Subject: dlci: validate the net device in dlci_del() + +From: Zefan Li + +commit 578a1310f2592ba90c5674bca21c1dbd1adf3f0a upstream. + +We triggered an oops while running trinity with 3.4 kernel: + +BUG: unable to handle kernel paging request at 0000000100000d07 +IP: [] dlci_ioctl+0xd8/0x2d4 [dlci] +PGD 640c0d067 PUD 0 +Oops: 0000 [#1] PREEMPT SMP +CPU 3 +... +Pid: 7302, comm: trinity-child3 Not tainted 3.4.24.09+ 40 Huawei Technologies Co., Ltd. Tecal RH2285 /BC11BTSA +RIP: 0010:[] [] dlci_ioctl+0xd8/0x2d4 [dlci] +... +Call Trace: + [] sock_ioctl+0x153/0x280 + [] do_vfs_ioctl+0xa4/0x5e0 + [] ? fget_light+0x3ea/0x490 + [] sys_ioctl+0x4f/0x80 + [] system_call_fastpath+0x16/0x1b +... + +It's because the net device is not a dlci device. + +Reported-by: Li Jinyue +Signed-off-by: Li Zefan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wan/dlci.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/net/wan/dlci.c ++++ b/drivers/net/wan/dlci.c +@@ -377,6 +377,7 @@ static int dlci_del(struct dlci_add *dlc + struct frad_local *flp; + struct net_device *master, *slave; + int err; ++ bool found = false; + + rtnl_lock(); + +@@ -386,6 +387,17 @@ static int dlci_del(struct dlci_add *dlc + err = -ENODEV; + goto out; + } ++ ++ list_for_each_entry(dlp, &dlci_devs, list) { ++ if (dlp->master == master) { ++ found = true; ++ break; ++ } ++ } ++ if (!found) { ++ err = -ENODEV; ++ goto out; ++ } + + if (netif_running(master)) { + err = -EBUSY; diff --git a/queue-3.0/hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch b/queue-3.0/hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch new file mode 100644 index 00000000000..3ebc2e6fd15 --- /dev/null +++ b/queue-3.0/hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch @@ -0,0 +1,55 @@ +From c790b0ad23f427c7522ffed264706238c57c007e Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Thu, 20 Jun 2013 17:50:09 +0200 +Subject: hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot() + +From: Oleg Nesterov + +commit c790b0ad23f427c7522ffed264706238c57c007e upstream. + +fetch_bp_busy_slots() and toggle_bp_slot() use +for_each_online_cpu(), this is obviously wrong wrt cpu_up() or +cpu_down(), we can over/under account the per-cpu numbers. + +For example: + + # echo 0 >> /sys/devices/system/cpu/cpu1/online + # perf record -e mem:0x10 -p 1 & + # echo 1 >> /sys/devices/system/cpu/cpu1/online + # perf record -e mem:0x10,mem:0x10,mem:0x10,mem:0x10 -C1 -a & + # taskset -p 0x2 1 + +triggers the same WARN_ONCE("Can't find any breakpoint slot") in +arch_install_hw_breakpoint(). + +Reported-by: Vince Weaver +Signed-off-by: Oleg Nesterov +Acked-by: Frederic Weisbecker +Link: http://lkml.kernel.org/r/20130620155009.GA6327@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/hw_breakpoint.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/events/hw_breakpoint.c ++++ b/kernel/events/hw_breakpoint.c +@@ -147,7 +147,7 @@ fetch_bp_busy_slots(struct bp_busy_slots + return; + } + +- for_each_online_cpu(cpu) { ++ for_each_possible_cpu(cpu) { + unsigned int nr; + + nr = per_cpu(nr_cpu_bp_pinned[type], cpu); +@@ -233,7 +233,7 @@ toggle_bp_slot(struct perf_event *bp, bo + if (cpu >= 0) { + toggle_bp_task_slot(bp, cpu, enable, type, weight); + } else { +- for_each_online_cpu(cpu) ++ for_each_possible_cpu(cpu) + toggle_bp_task_slot(bp, cpu, enable, type, weight); + } + diff --git a/queue-3.0/series b/queue-3.0/series new file mode 100644 index 00000000000..097f912c2b5 --- /dev/null +++ b/queue-3.0/series @@ -0,0 +1,4 @@ +bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch +hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch +dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch +dlci-validate-the-net-device-in-dlci_del.patch -- 2.47.3