From bb21ac5a35f28a6395045215f63208dd13f9d37b Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 24 Jul 2022 16:49:47 +0200 Subject: [PATCH] 5.15-stable patches added patches: kvm-selftests-fix-target-thread-to-be-migrated-in-rseq_test.patch spi-bcm2835-bcm2835_spi_handle_err-fix-null-pointer-deref-for-non-dma-transfers.patch --- ...t-thread-to-be-migrated-in-rseq_test.patch | 92 +++++++++++++++++++ queue-5.15/series | 2 + ...-pointer-deref-for-non-dma-transfers.patch | 49 ++++++++++ 3 files changed, 143 insertions(+) create mode 100644 queue-5.15/kvm-selftests-fix-target-thread-to-be-migrated-in-rseq_test.patch create mode 100644 queue-5.15/spi-bcm2835-bcm2835_spi_handle_err-fix-null-pointer-deref-for-non-dma-transfers.patch diff --git a/queue-5.15/kvm-selftests-fix-target-thread-to-be-migrated-in-rseq_test.patch b/queue-5.15/kvm-selftests-fix-target-thread-to-be-migrated-in-rseq_test.patch new file mode 100644 index 00000000000..e101a5252ab --- /dev/null +++ b/queue-5.15/kvm-selftests-fix-target-thread-to-be-migrated-in-rseq_test.patch @@ -0,0 +1,92 @@ +From e923b0537d28e15c9d31ce8b38f810b325816903 Mon Sep 17 00:00:00 2001 +From: Gavin Shan +Date: Tue, 19 Jul 2022 10:08:30 +0800 +Subject: KVM: selftests: Fix target thread to be migrated in rseq_test + +From: Gavin Shan + +commit e923b0537d28e15c9d31ce8b38f810b325816903 upstream. + +In rseq_test, there are two threads, which are vCPU thread and migration +worker separately. Unfortunately, the test has the wrong PID passed to +sched_setaffinity() in the migration worker. It forces migration on the +migration worker because zeroed PID represents the calling thread, which +is the migration worker itself. It means the vCPU thread is never enforced +to migration and it can migrate at any time, which eventually leads to +failure as the following logs show. + + host# uname -r + 5.19.0-rc6-gavin+ + host# # cat /proc/cpuinfo | grep processor | tail -n 1 + processor : 223 + host# pwd + /home/gavin/sandbox/linux.main/tools/testing/selftests/kvm + host# for i in `seq 1 100`; do \ + echo "--------> $i"; ./rseq_test; done + --------> 1 + --------> 2 + --------> 3 + --------> 4 + --------> 5 + --------> 6 + ==== Test Assertion Failure ==== + rseq_test.c:265: rseq_cpu == cpu + pid=3925 tid=3925 errno=4 - Interrupted system call + 1 0x0000000000401963: main at rseq_test.c:265 (discriminator 2) + 2 0x0000ffffb044affb: ?? ??:0 + 3 0x0000ffffb044b0c7: ?? ??:0 + 4 0x0000000000401a6f: _start at ??:? + rseq CPU = 4, sched CPU = 27 + +Fix the issue by passing correct parameter, TID of the vCPU thread, to +sched_setaffinity() in the migration worker. + +Fixes: 61e52f1630f5 ("KVM: selftests: Add a test for KVM_RUN+rseq to detect task migration bugs") +Suggested-by: Sean Christopherson +Signed-off-by: Gavin Shan +Reviewed-by: Oliver Upton +Message-Id: <20220719020830.3479482-1-gshan@redhat.com> +Reviewed-by: Andrew Jones +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/kvm/rseq_test.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/kvm/rseq_test.c b/tools/testing/selftests/kvm/rseq_test.c +index 4158da0da2bb..2237d1aac801 100644 +--- a/tools/testing/selftests/kvm/rseq_test.c ++++ b/tools/testing/selftests/kvm/rseq_test.c +@@ -82,8 +82,9 @@ static int next_cpu(int cpu) + return cpu; + } + +-static void *migration_worker(void *ign) ++static void *migration_worker(void *__rseq_tid) + { ++ pid_t rseq_tid = (pid_t)(unsigned long)__rseq_tid; + cpu_set_t allowed_mask; + int r, i, cpu; + +@@ -106,7 +107,7 @@ static void *migration_worker(void *ign) + * stable, i.e. while changing affinity is in-progress. + */ + smp_wmb(); +- r = sched_setaffinity(0, sizeof(allowed_mask), &allowed_mask); ++ r = sched_setaffinity(rseq_tid, sizeof(allowed_mask), &allowed_mask); + TEST_ASSERT(!r, "sched_setaffinity failed, errno = %d (%s)", + errno, strerror(errno)); + smp_wmb(); +@@ -231,7 +232,8 @@ int main(int argc, char *argv[]) + vm = vm_create_default(VCPU_ID, 0, guest_code); + ucall_init(vm, NULL); + +- pthread_create(&migration_thread, NULL, migration_worker, 0); ++ pthread_create(&migration_thread, NULL, migration_worker, ++ (void *)(unsigned long)gettid()); + + for (i = 0; !done; i++) { + vcpu_run(vm, VCPU_ID); +-- +2.37.1 + diff --git a/queue-5.15/series b/queue-5.15/series index 9f4f77f0d80..2b883469404 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -129,3 +129,5 @@ tcp-fix-a-data-race-around-sysctl_tcp_rfc1337.patch tcp-fix-a-data-race-around-sysctl_tcp_abort_on_overf.patch tcp-fix-data-races-around-sysctl_tcp_max_reordering.patch gpio-gpio-xilinx-fix-integer-overflow.patch +kvm-selftests-fix-target-thread-to-be-migrated-in-rseq_test.patch +spi-bcm2835-bcm2835_spi_handle_err-fix-null-pointer-deref-for-non-dma-transfers.patch diff --git a/queue-5.15/spi-bcm2835-bcm2835_spi_handle_err-fix-null-pointer-deref-for-non-dma-transfers.patch b/queue-5.15/spi-bcm2835-bcm2835_spi_handle_err-fix-null-pointer-deref-for-non-dma-transfers.patch new file mode 100644 index 00000000000..3a6f820f921 --- /dev/null +++ b/queue-5.15/spi-bcm2835-bcm2835_spi_handle_err-fix-null-pointer-deref-for-non-dma-transfers.patch @@ -0,0 +1,49 @@ +From 4ceaa684459d414992acbefb4e4c31f2dfc50641 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Tue, 19 Jul 2022 09:22:35 +0200 +Subject: spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers + +From: Marc Kleine-Budde + +commit 4ceaa684459d414992acbefb4e4c31f2dfc50641 upstream. + +In case a IRQ based transfer times out the bcm2835_spi_handle_err() +function is called. Since commit 1513ceee70f2 ("spi: bcm2835: Drop +dma_pending flag") the TX and RX DMA transfers are unconditionally +canceled, leading to NULL pointer derefs if ctlr->dma_tx or +ctlr->dma_rx are not set. + +Fix the NULL pointer deref by checking that ctlr->dma_tx and +ctlr->dma_rx are valid pointers before accessing them. + +Fixes: 1513ceee70f2 ("spi: bcm2835: Drop dma_pending flag") +Cc: Lukas Wunner +Signed-off-by: Marc Kleine-Budde +Link: https://lore.kernel.org/r/20220719072234.2782764-1-mkl@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-bcm2835.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-bcm2835.c ++++ b/drivers/spi/spi-bcm2835.c +@@ -1138,10 +1138,14 @@ static void bcm2835_spi_handle_err(struc + struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr); + + /* if an error occurred and we have an active dma, then terminate */ +- dmaengine_terminate_sync(ctlr->dma_tx); +- bs->tx_dma_active = false; +- dmaengine_terminate_sync(ctlr->dma_rx); +- bs->rx_dma_active = false; ++ if (ctlr->dma_tx) { ++ dmaengine_terminate_sync(ctlr->dma_tx); ++ bs->tx_dma_active = false; ++ } ++ if (ctlr->dma_rx) { ++ dmaengine_terminate_sync(ctlr->dma_rx); ++ bs->rx_dma_active = false; ++ } + bcm2835_spi_undo_prologue(bs); + + /* and reset */ -- 2.47.3