4.9-stable patches

added patches:
	can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch
	mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch

diff --git a/queue-4.9/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch b/queue-4.9/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch
new file mode 100644 (file)
index 0000000..93ec918
--- /dev/null
+++ b/queue-4.9/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch
@@ -0,0 +1,46 @@
+From foo@baz Tue Jul 19 01:39:08 PM CEST 2022
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Thu, 17 Mar 2022 08:57:35 +0100
+Subject: can: m_can: m_can_tx_handler(): fix use after free of skb
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 2e8e79c416aae1de224c0f1860f2e3350fa171f8 upstream.
+
+can_put_echo_skb() will clone skb then free the skb. Move the
+can_put_echo_skb() for the m_can version 3.0.x directly before the
+start of the xmit in hardware, similar to the 3.1.x branch.
+
+Fixes: 80646733f11c ("can: m_can: update to support CAN FD features")
+Link: https://lore.kernel.org/all/20220317081305.739554-1-mkl@pengutronix.de
+Cc: stable@vger.kernel.org
+Reported-by: Hangyu Hua <hbh25y@gmail.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+[sudip: adjust context]
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/m_can/m_can.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1068,8 +1068,6 @@ static netdev_tx_t m_can_start_xmit(stru
+               m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(i / 4),
+                                *(u32 *)(cf->data + i));
+ 
+-      can_put_echo_skb(skb, dev, 0);
+-
+       if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+               cccr = m_can_read(priv, M_CAN_CCCR);
+               cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT);
+@@ -1086,6 +1084,9 @@ static netdev_tx_t m_can_start_xmit(stru
+ 
+       /* enable first TX buffer to start transfer  */
+       m_can_write(priv, M_CAN_TXBTIE, 0x1);
++
++      can_put_echo_skb(skb, dev, 0);
++
+       m_can_write(priv, M_CAN_TXBAR, 0x1);
+ 
+       return NETDEV_TX_OK;

diff --git a/queue-4.9/mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch b/queue-4.9/mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch
new file mode 100644 (file)
index 0000000..a00aef8
--- /dev/null
+++ b/queue-4.9/mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch
@@ -0,0 +1,64 @@
+From foo@baz Tue Jul 19 01:37:46 PM CEST 2022
+From: Rik van Riel <riel@surriel.com>
+Date: Tue, 22 Mar 2022 14:44:09 -0700
+Subject: mm: invalidate hwpoison page cache page in fault path
+
+From: Rik van Riel <riel@surriel.com>
+
+commit e53ac7374e64dede04d745ff0e70ff5048378d1f upstream.
+
+Sometimes the page offlining code can leave behind a hwpoisoned clean
+page cache page.  This can lead to programs being killed over and over
+and over again as they fault in the hwpoisoned page, get killed, and
+then get re-spawned by whatever wanted to run them.
+
+This is particularly embarrassing when the page was offlined due to
+having too many corrected memory errors.  Now we are killing tasks due
+to them trying to access memory that probably isn't even corrupted.
+
+This problem can be avoided by invalidating the page from the page fault
+handler, which already has a branch for dealing with these kinds of
+pages.  With this patch we simply pretend the page fault was successful
+if the page was invalidated, return to userspace, incur another page
+fault, read in the file from disk (to a new memory page), and then
+everything works again.
+
+Link: https://lkml.kernel.org/r/20220212213740.423efcea@imladris.surriel.com
+Signed-off-by: Rik van Riel <riel@surriel.com>
+Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
+Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+[sudip: use int instead of vm_fault_t and adjust context]
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/memory.c |    9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2891,10 +2891,15 @@ static int __do_fault(struct fault_env *
+       }
+ 
+       if (unlikely(PageHWPoison(vmf.page))) {
+-              if (ret & VM_FAULT_LOCKED)
++              int poisonret = VM_FAULT_HWPOISON;
++              if (ret & VM_FAULT_LOCKED) {
++                      /* Retry if a clean page was removed from the cache. */
++                      if (invalidate_inode_page(vmf.page))
++                              poisonret = 0;
+                       unlock_page(vmf.page);
++              }
+               put_page(vmf.page);
+-              return VM_FAULT_HWPOISON;
++              return poisonret;
+       }
+ 
+       if (unlikely(!(ret & VM_FAULT_LOCKED)))

diff --git a/queue-4.9/series b/queue-4.9/series
index ee4f54d03bfd06b81adb0119c52850c6dee6857b..b9720bbe6de42045187060f50e69063aa44463aa 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -24,3 +24,5 @@ usb-serial-ftdi_sio-add-belimo-device-ids.patch
 usb-dwc3-gadget-fix-event-pending-check.patch
 tty-serial-samsung_tty-set-dma-burst_size-to-1.patch
 serial-8250-fix-return-error-code-in-serial8250_request_std_resource.patch
+mm-invalidate-hwpoison-page-cache-page-in-fault-path.patch
+can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch