From cf2d02ae1a35b74b9a2da0742e0b34eafd6d17e8 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 15 Jul 2022 15:35:31 +0200 Subject: [PATCH] 4.19-stable patches added patches: alsa-hda-conexant-apply-quirk-for-another-hp-prodesk-600-g3-model.patch alsa-hda-realtek-fix-headset-mic-problem-for-a-hp-machine-with-alc221.patch arm-9213-1-print-message-about-disabled-spectre-workarounds-only-once.patch arm-9214-1-alignment-advance-it-state-after-emulating-thumb-instruction.patch cgroup-use-separate-src-dst-nodes-when-preloading-css_sets-for-migration.patch net-sock-tracing-fix-sock_exceed_buf_limit-not-to-dereference-stale-pointer.patch nilfs2-fix-incorrect-masking-of-permission-flags-for-symlinks.patch tracing-histograms-fix-memory-leak-problem.patch xen-netback-avoid-entering-xenvif_rx_next_skb-with-an-empty-rx-queue.patch --- ...-for-another-hp-prodesk-600-g3-model.patch | 32 +++ ...problem-for-a-hp-machine-with-alc221.patch | 58 +++++ ...sabled-spectre-workarounds-only-once.patch | 33 +++ ...te-after-emulating-thumb-instruction.patch | 117 ++++++++++ ...en-preloading-css_sets-for-migration.patch | 201 ++++++++++++++++++ ...mit-not-to-dereference-stale-pointer.patch | 53 +++++ ...ing-of-permission-flags-for-symlinks.patch | 45 ++++ queue-4.19/series | 9 + ...g-histograms-fix-memory-leak-problem.patch | 80 +++++++ ...f_rx_next_skb-with-an-empty-rx-queue.patch | 60 ++++++ 10 files changed, 688 insertions(+) create mode 100644 queue-4.19/alsa-hda-conexant-apply-quirk-for-another-hp-prodesk-600-g3-model.patch create mode 100644 queue-4.19/alsa-hda-realtek-fix-headset-mic-problem-for-a-hp-machine-with-alc221.patch create mode 100644 queue-4.19/arm-9213-1-print-message-about-disabled-spectre-workarounds-only-once.patch create mode 100644 queue-4.19/arm-9214-1-alignment-advance-it-state-after-emulating-thumb-instruction.patch create mode 100644 queue-4.19/cgroup-use-separate-src-dst-nodes-when-preloading-css_sets-for-migration.patch create mode 100644 queue-4.19/net-sock-tracing-fix-sock_exceed_buf_limit-not-to-dereference-stale-pointer.patch create mode 100644 queue-4.19/nilfs2-fix-incorrect-masking-of-permission-flags-for-symlinks.patch create mode 100644 queue-4.19/tracing-histograms-fix-memory-leak-problem.patch create mode 100644 queue-4.19/xen-netback-avoid-entering-xenvif_rx_next_skb-with-an-empty-rx-queue.patch diff --git a/queue-4.19/alsa-hda-conexant-apply-quirk-for-another-hp-prodesk-600-g3-model.patch b/queue-4.19/alsa-hda-conexant-apply-quirk-for-another-hp-prodesk-600-g3-model.patch new file mode 100644 index 00000000000..7ba8d0ddac9 --- /dev/null +++ b/queue-4.19/alsa-hda-conexant-apply-quirk-for-another-hp-prodesk-600-g3-model.patch @@ -0,0 +1,32 @@ +From d16d69bf5a25d91c6d8f3e29711be12551bf56cd Mon Sep 17 00:00:00 2001 +From: Meng Tang +Date: Mon, 11 Jul 2022 18:17:44 +0800 +Subject: ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model + +From: Meng Tang + +commit d16d69bf5a25d91c6d8f3e29711be12551bf56cd upstream. + +There is another HP ProDesk 600 G3 model with the PCI SSID 103c:82b4 +that requires the quirk HP_MIC_NO_PRESENCE. Add the corresponding +entry to the quirk table. + +Signed-off-by: Meng Tang +Cc: +Link: https://lore.kernel.org/r/20220711101744.25189-1-tangmeng@uniontech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_conexant.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -918,6 +918,7 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x82b4, "HP ProDesk 600 G3", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK), diff --git a/queue-4.19/alsa-hda-realtek-fix-headset-mic-problem-for-a-hp-machine-with-alc221.patch b/queue-4.19/alsa-hda-realtek-fix-headset-mic-problem-for-a-hp-machine-with-alc221.patch new file mode 100644 index 00000000000..d07be6ed7d9 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-fix-headset-mic-problem-for-a-hp-machine-with-alc221.patch @@ -0,0 +1,58 @@ +From 4ba5c853d7945b3855c3dcb293f7f9f019db641e Mon Sep 17 00:00:00 2001 +From: Meng Tang +Date: Wed, 13 Jul 2022 14:33:32 +0800 +Subject: ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 + +From: Meng Tang + +commit 4ba5c853d7945b3855c3dcb293f7f9f019db641e upstream. + +On a HP 288 Pro G2 MT (X9W02AV), the front mic could not be detected. +In order to get it working, the pin configuration needs to be set +correctly, and the ALC221_FIXUP_HP_288PRO_MIC_NO_PRESENCE fixup needs +to be applied. + +Signed-off-by: Meng Tang +Cc: +Link: https://lore.kernel.org/r/20220713063332.30095-1-tangmeng@uniontech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5844,6 +5844,7 @@ enum { + ALC298_FIXUP_LENOVO_SPK_VOLUME, + ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER, + ALC269_FIXUP_ATIV_BOOK_8, ++ ALC221_FIXUP_HP_288PRO_MIC_NO_PRESENCE, + ALC221_FIXUP_HP_MIC_NO_PRESENCE, + ALC256_FIXUP_ASUS_HEADSET_MODE, + ALC256_FIXUP_ASUS_MIC, +@@ -6642,6 +6643,16 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC269_FIXUP_NO_SHUTUP + }, ++ [ALC221_FIXUP_HP_288PRO_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */ ++ { 0x1a, 0x01813030 }, /* use as headphone mic, without its own jack detect */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MODE ++ }, + [ALC221_FIXUP_HP_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -7136,6 +7147,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2b5e, "HP 288 Pro G2 MT", ALC221_FIXUP_HP_288PRO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x802e, "HP Z240 SFF", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x802f, "HP Z240", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), diff --git a/queue-4.19/arm-9213-1-print-message-about-disabled-spectre-workarounds-only-once.patch b/queue-4.19/arm-9213-1-print-message-about-disabled-spectre-workarounds-only-once.patch new file mode 100644 index 00000000000..161cbd147e4 --- /dev/null +++ b/queue-4.19/arm-9213-1-print-message-about-disabled-spectre-workarounds-only-once.patch @@ -0,0 +1,33 @@ +From e4ced82deb5fb17222fb82e092c3f8311955b585 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Tue, 28 Jun 2022 08:55:45 +0100 +Subject: ARM: 9213/1: Print message about disabled Spectre workarounds only once + +From: Dmitry Osipenko + +commit e4ced82deb5fb17222fb82e092c3f8311955b585 upstream. + +Print the message about disabled Spectre workarounds only once. The +message is printed each time CPU goes out from idling state on NVIDIA +Tegra boards, causing storm in KMSG that makes system unusable. + +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Osipenko +Signed-off-by: Russell King (Oracle) +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mm/proc-v7-bugs.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/arm/mm/proc-v7-bugs.c ++++ b/arch/arm/mm/proc-v7-bugs.c +@@ -110,8 +110,7 @@ static unsigned int spectre_v2_install_w + #else + static unsigned int spectre_v2_install_workaround(unsigned int method) + { +- pr_info("CPU%u: Spectre V2: workarounds disabled by configuration\n", +- smp_processor_id()); ++ pr_info_once("Spectre V2: workarounds disabled by configuration\n"); + + return SPECTRE_VULNERABLE; + } diff --git a/queue-4.19/arm-9214-1-alignment-advance-it-state-after-emulating-thumb-instruction.patch b/queue-4.19/arm-9214-1-alignment-advance-it-state-after-emulating-thumb-instruction.patch new file mode 100644 index 00000000000..473df739622 --- /dev/null +++ b/queue-4.19/arm-9214-1-alignment-advance-it-state-after-emulating-thumb-instruction.patch @@ -0,0 +1,117 @@ +From e5c46fde75e43c15a29b40e5fc5641727f97ae47 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Thu, 30 Jun 2022 16:46:54 +0100 +Subject: ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction + +From: Ard Biesheuvel + +commit e5c46fde75e43c15a29b40e5fc5641727f97ae47 upstream. + +After emulating a misaligned load or store issued in Thumb mode, we have +to advance the IT state by hand, or it will get out of sync with the +actual instruction stream, which means we'll end up applying the wrong +condition code to subsequent instructions. This might corrupt the +program state rather catastrophically. + +So borrow the it_advance() helper from the probing code, and use it on +CPSR if the emulated instruction is Thumb. + +Cc: +Reviewed-by: Linus Walleij +Signed-off-by: Ard Biesheuvel +Signed-off-by: Russell King (Oracle) +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/include/asm/ptrace.h | 26 ++++++++++++++++++++++++++ + arch/arm/mm/alignment.c | 3 +++ + arch/arm/probes/decode.h | 26 +------------------------- + 3 files changed, 30 insertions(+), 25 deletions(-) + +--- a/arch/arm/include/asm/ptrace.h ++++ b/arch/arm/include/asm/ptrace.h +@@ -167,5 +167,31 @@ static inline unsigned long user_stack_p + ((current_stack_pointer | (THREAD_SIZE - 1)) - 7) - 1; \ + }) + ++ ++/* ++ * Update ITSTATE after normal execution of an IT block instruction. ++ * ++ * The 8 IT state bits are split into two parts in CPSR: ++ * ITSTATE<1:0> are in CPSR<26:25> ++ * ITSTATE<7:2> are in CPSR<15:10> ++ */ ++static inline unsigned long it_advance(unsigned long cpsr) ++{ ++ if ((cpsr & 0x06000400) == 0) { ++ /* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */ ++ cpsr &= ~PSR_IT_MASK; ++ } else { ++ /* We need to shift left ITSTATE<4:0> */ ++ const unsigned long mask = 0x06001c00; /* Mask ITSTATE<4:0> */ ++ unsigned long it = cpsr & mask; ++ it <<= 1; ++ it |= it >> (27 - 10); /* Carry ITSTATE<2> to correct place */ ++ it &= mask; ++ cpsr &= ~mask; ++ cpsr |= it; ++ } ++ return cpsr; ++} ++ + #endif /* __ASSEMBLY__ */ + #endif +--- a/arch/arm/mm/alignment.c ++++ b/arch/arm/mm/alignment.c +@@ -936,6 +936,9 @@ do_alignment(unsigned long addr, unsigne + if (type == TYPE_LDST) + do_alignment_finish_ldst(addr, instr, regs, offset); + ++ if (thumb_mode(regs)) ++ regs->ARM_cpsr = it_advance(regs->ARM_cpsr); ++ + return 0; + + bad_or_fault: +--- a/arch/arm/probes/decode.h ++++ b/arch/arm/probes/decode.h +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + + void __init arm_probes_decode_init(void); +@@ -43,31 +44,6 @@ void __init find_str_pc_offset(void); + #endif + + +-/* +- * Update ITSTATE after normal execution of an IT block instruction. +- * +- * The 8 IT state bits are split into two parts in CPSR: +- * ITSTATE<1:0> are in CPSR<26:25> +- * ITSTATE<7:2> are in CPSR<15:10> +- */ +-static inline unsigned long it_advance(unsigned long cpsr) +- { +- if ((cpsr & 0x06000400) == 0) { +- /* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */ +- cpsr &= ~PSR_IT_MASK; +- } else { +- /* We need to shift left ITSTATE<4:0> */ +- const unsigned long mask = 0x06001c00; /* Mask ITSTATE<4:0> */ +- unsigned long it = cpsr & mask; +- it <<= 1; +- it |= it >> (27 - 10); /* Carry ITSTATE<2> to correct place */ +- it &= mask; +- cpsr &= ~mask; +- cpsr |= it; +- } +- return cpsr; +-} +- + static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs) + { + long cpsr = regs->ARM_cpsr; diff --git a/queue-4.19/cgroup-use-separate-src-dst-nodes-when-preloading-css_sets-for-migration.patch b/queue-4.19/cgroup-use-separate-src-dst-nodes-when-preloading-css_sets-for-migration.patch new file mode 100644 index 00000000000..bda27f42d74 --- /dev/null +++ b/queue-4.19/cgroup-use-separate-src-dst-nodes-when-preloading-css_sets-for-migration.patch @@ -0,0 +1,201 @@ +From 07fd5b6cdf3cc30bfde8fe0f644771688be04447 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Mon, 13 Jun 2022 12:19:50 -1000 +Subject: cgroup: Use separate src/dst nodes when preloading css_sets for migration + +From: Tejun Heo + +commit 07fd5b6cdf3cc30bfde8fe0f644771688be04447 upstream. + +Each cset (css_set) is pinned by its tasks. When we're moving tasks around +across csets for a migration, we need to hold the source and destination +csets to ensure that they don't go away while we're moving tasks about. This +is done by linking cset->mg_preload_node on either the +mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the +same cset->mg_preload_node for both the src and dst lists was deemed okay as +a cset can't be both the source and destination at the same time. + +Unfortunately, this overloading becomes problematic when multiple tasks are +involved in a migration and some of them are identity noop migrations while +others are actually moving across cgroups. For example, this can happen with +the following sequence on cgroup1: + + #1> mkdir -p /sys/fs/cgroup/misc/a/b + #2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs + #3> RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS & + #4> PID=$! + #5> echo $PID > /sys/fs/cgroup/misc/a/b/tasks + #6> echo $PID > /sys/fs/cgroup/misc/a/cgroup.procs + +the process including the group leader back into a. In this final migration, +non-leader threads would be doing identity migration while the group leader +is doing an actual one. + +After #3, let's say the whole process was in cset A, and that after #4, the +leader moves to cset B. Then, during #6, the following happens: + + 1. cgroup_migrate_add_src() is called on B for the leader. + + 2. cgroup_migrate_add_src() is called on A for the other threads. + + 3. cgroup_migrate_prepare_dst() is called. It scans the src list. + + 4. It notices that B wants to migrate to A, so it tries to A to the dst + list but realizes that its ->mg_preload_node is already busy. + + 5. and then it notices A wants to migrate to A as it's an identity + migration, it culls it by list_del_init()'ing its ->mg_preload_node and + putting references accordingly. + + 6. The rest of migration takes place with B on the src list but nothing on + the dst list. + +This means that A isn't held while migration is in progress. If all tasks +leave A before the migration finishes and the incoming task pins it, the +cset will be destroyed leading to use-after-free. + +This is caused by overloading cset->mg_preload_node for both src and dst +preload lists. We wanted to exclude the cset from the src list but ended up +inadvertently excluding it from the dst list too. + +This patch fixes the issue by separating out cset->mg_preload_node into +->mg_src_preload_node and ->mg_dst_preload_node, so that the src and dst +preloadings don't interfere with each other. + +Signed-off-by: Tejun Heo +Reported-by: Mukesh Ojha +Reported-by: shisiyuan +Link: http://lkml.kernel.org/r/1654187688-27411-1-git-send-email-shisiyuan@xiaomi.com +Link: https://www.spinics.net/lists/cgroups/msg33313.html +Fixes: f817de98513d ("cgroup: prepare migration path for unified hierarchy") +Cc: stable@vger.kernel.org # v3.16+ +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/cgroup-defs.h | 3 ++- + kernel/cgroup/cgroup.c | 37 +++++++++++++++++++++++-------------- + 2 files changed, 25 insertions(+), 15 deletions(-) + +--- a/include/linux/cgroup-defs.h ++++ b/include/linux/cgroup-defs.h +@@ -241,7 +241,8 @@ struct css_set { + * List of csets participating in the on-going migration either as + * source or destination. Protected by cgroup_mutex. + */ +- struct list_head mg_preload_node; ++ struct list_head mg_src_preload_node; ++ struct list_head mg_dst_preload_node; + struct list_head mg_node; + + /* +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -677,7 +677,8 @@ struct css_set init_css_set = { + .task_iters = LIST_HEAD_INIT(init_css_set.task_iters), + .threaded_csets = LIST_HEAD_INIT(init_css_set.threaded_csets), + .cgrp_links = LIST_HEAD_INIT(init_css_set.cgrp_links), +- .mg_preload_node = LIST_HEAD_INIT(init_css_set.mg_preload_node), ++ .mg_src_preload_node = LIST_HEAD_INIT(init_css_set.mg_src_preload_node), ++ .mg_dst_preload_node = LIST_HEAD_INIT(init_css_set.mg_dst_preload_node), + .mg_node = LIST_HEAD_INIT(init_css_set.mg_node), + + /* +@@ -1151,7 +1152,8 @@ static struct css_set *find_css_set(stru + INIT_LIST_HEAD(&cset->threaded_csets); + INIT_HLIST_NODE(&cset->hlist); + INIT_LIST_HEAD(&cset->cgrp_links); +- INIT_LIST_HEAD(&cset->mg_preload_node); ++ INIT_LIST_HEAD(&cset->mg_src_preload_node); ++ INIT_LIST_HEAD(&cset->mg_dst_preload_node); + INIT_LIST_HEAD(&cset->mg_node); + + /* Copy the set of subsystem state objects generated in +@@ -2455,21 +2457,27 @@ int cgroup_migrate_vet_dst(struct cgroup + */ + void cgroup_migrate_finish(struct cgroup_mgctx *mgctx) + { +- LIST_HEAD(preloaded); + struct css_set *cset, *tmp_cset; + + lockdep_assert_held(&cgroup_mutex); + + spin_lock_irq(&css_set_lock); + +- list_splice_tail_init(&mgctx->preloaded_src_csets, &preloaded); +- list_splice_tail_init(&mgctx->preloaded_dst_csets, &preloaded); ++ list_for_each_entry_safe(cset, tmp_cset, &mgctx->preloaded_src_csets, ++ mg_src_preload_node) { ++ cset->mg_src_cgrp = NULL; ++ cset->mg_dst_cgrp = NULL; ++ cset->mg_dst_cset = NULL; ++ list_del_init(&cset->mg_src_preload_node); ++ put_css_set_locked(cset); ++ } + +- list_for_each_entry_safe(cset, tmp_cset, &preloaded, mg_preload_node) { ++ list_for_each_entry_safe(cset, tmp_cset, &mgctx->preloaded_dst_csets, ++ mg_dst_preload_node) { + cset->mg_src_cgrp = NULL; + cset->mg_dst_cgrp = NULL; + cset->mg_dst_cset = NULL; +- list_del_init(&cset->mg_preload_node); ++ list_del_init(&cset->mg_dst_preload_node); + put_css_set_locked(cset); + } + +@@ -2511,7 +2519,7 @@ void cgroup_migrate_add_src(struct css_s + + src_cgrp = cset_cgroup_from_root(src_cset, dst_cgrp->root); + +- if (!list_empty(&src_cset->mg_preload_node)) ++ if (!list_empty(&src_cset->mg_src_preload_node)) + return; + + WARN_ON(src_cset->mg_src_cgrp); +@@ -2522,7 +2530,7 @@ void cgroup_migrate_add_src(struct css_s + src_cset->mg_src_cgrp = src_cgrp; + src_cset->mg_dst_cgrp = dst_cgrp; + get_css_set(src_cset); +- list_add_tail(&src_cset->mg_preload_node, &mgctx->preloaded_src_csets); ++ list_add_tail(&src_cset->mg_src_preload_node, &mgctx->preloaded_src_csets); + } + + /** +@@ -2547,7 +2555,7 @@ int cgroup_migrate_prepare_dst(struct cg + + /* look up the dst cset for each src cset and link it to src */ + list_for_each_entry_safe(src_cset, tmp_cset, &mgctx->preloaded_src_csets, +- mg_preload_node) { ++ mg_src_preload_node) { + struct css_set *dst_cset; + struct cgroup_subsys *ss; + int ssid; +@@ -2566,7 +2574,7 @@ int cgroup_migrate_prepare_dst(struct cg + if (src_cset == dst_cset) { + src_cset->mg_src_cgrp = NULL; + src_cset->mg_dst_cgrp = NULL; +- list_del_init(&src_cset->mg_preload_node); ++ list_del_init(&src_cset->mg_src_preload_node); + put_css_set(src_cset); + put_css_set(dst_cset); + continue; +@@ -2574,8 +2582,8 @@ int cgroup_migrate_prepare_dst(struct cg + + src_cset->mg_dst_cset = dst_cset; + +- if (list_empty(&dst_cset->mg_preload_node)) +- list_add_tail(&dst_cset->mg_preload_node, ++ if (list_empty(&dst_cset->mg_dst_preload_node)) ++ list_add_tail(&dst_cset->mg_dst_preload_node, + &mgctx->preloaded_dst_csets); + else + put_css_set(dst_cset); +@@ -2809,7 +2817,8 @@ static int cgroup_update_dfl_csses(struc + goto out_finish; + + spin_lock_irq(&css_set_lock); +- list_for_each_entry(src_cset, &mgctx.preloaded_src_csets, mg_preload_node) { ++ list_for_each_entry(src_cset, &mgctx.preloaded_src_csets, ++ mg_src_preload_node) { + struct task_struct *task, *ntask; + + /* all tasks in src_csets need to be migrated */ diff --git a/queue-4.19/net-sock-tracing-fix-sock_exceed_buf_limit-not-to-dereference-stale-pointer.patch b/queue-4.19/net-sock-tracing-fix-sock_exceed_buf_limit-not-to-dereference-stale-pointer.patch new file mode 100644 index 00000000000..ae7c4543a65 --- /dev/null +++ b/queue-4.19/net-sock-tracing-fix-sock_exceed_buf_limit-not-to-dereference-stale-pointer.patch @@ -0,0 +1,53 @@ +From 820b8963adaea34a87abbecb906d1f54c0aabfb7 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Wed, 6 Jul 2022 10:50:40 -0400 +Subject: net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer + +From: Steven Rostedt (Google) + +commit 820b8963adaea34a87abbecb906d1f54c0aabfb7 upstream. + +The trace event sock_exceed_buf_limit saves the prot->sysctl_mem pointer +and then dereferences it in the TP_printk() portion. This is unsafe as the +TP_printk() portion is executed at the time the buffer is read. That is, +it can be seconds, minutes, days, months, even years later. If the proto +is freed, then this dereference will can also lead to a kernel crash. + +Instead, save the sysctl_mem array into the ring buffer and have the +TP_printk() reference that instead. This is the proper and safe way to +read pointers in trace events. + +Link: https://lore.kernel.org/all/20220706052130.16368-12-kuniyu@amazon.com/ + +Cc: stable@vger.kernel.org +Fixes: 3847ce32aea9f ("core: add tracepoints for queueing skb to rcvbuf") +Signed-off-by: Steven Rostedt (Google) +Acked-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/trace/events/sock.h | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/include/trace/events/sock.h ++++ b/include/trace/events/sock.h +@@ -97,7 +97,7 @@ TRACE_EVENT(sock_exceed_buf_limit, + + TP_STRUCT__entry( + __array(char, name, 32) +- __field(long *, sysctl_mem) ++ __array(long, sysctl_mem, 3) + __field(long, allocated) + __field(int, sysctl_rmem) + __field(int, rmem_alloc) +@@ -109,7 +109,9 @@ TRACE_EVENT(sock_exceed_buf_limit, + + TP_fast_assign( + strncpy(__entry->name, prot->name, 32); +- __entry->sysctl_mem = prot->sysctl_mem; ++ __entry->sysctl_mem[0] = READ_ONCE(prot->sysctl_mem[0]); ++ __entry->sysctl_mem[1] = READ_ONCE(prot->sysctl_mem[1]); ++ __entry->sysctl_mem[2] = READ_ONCE(prot->sysctl_mem[2]); + __entry->allocated = allocated; + __entry->sysctl_rmem = sk_get_rmem0(sk, prot); + __entry->rmem_alloc = atomic_read(&sk->sk_rmem_alloc); diff --git a/queue-4.19/nilfs2-fix-incorrect-masking-of-permission-flags-for-symlinks.patch b/queue-4.19/nilfs2-fix-incorrect-masking-of-permission-flags-for-symlinks.patch new file mode 100644 index 00000000000..b95a1454c60 --- /dev/null +++ b/queue-4.19/nilfs2-fix-incorrect-masking-of-permission-flags-for-symlinks.patch @@ -0,0 +1,45 @@ +From 5924e6ec1585445f251ea92713eb15beb732622a Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Thu, 23 Jun 2022 17:54:01 +0900 +Subject: nilfs2: fix incorrect masking of permission flags for symlinks + +From: Ryusuke Konishi + +commit 5924e6ec1585445f251ea92713eb15beb732622a upstream. + +The permission flags of newly created symlinks are wrongly dropped on +nilfs2 with the current umask value even though symlinks should have 777 +(rwxrwxrwx) permissions: + + $ umask + 0022 + $ touch file && ln -s file symlink; ls -l file symlink + -rw-r--r--. 1 root root 0 Jun 23 16:29 file + lrwxr-xr-x. 1 root root 4 Jun 23 16:29 symlink -> file + +This fixes the bug by inserting a missing check that excludes +symlinks. + +Link: https://lkml.kernel.org/r/1655974441-5612-1-git-send-email-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Reported-by: Tommy Pettersson +Reported-by: Ciprian Craciun +Tested-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/nilfs.h | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/nilfs2/nilfs.h ++++ b/fs/nilfs2/nilfs.h +@@ -198,6 +198,9 @@ static inline int nilfs_acl_chmod(struct + + static inline int nilfs_init_acl(struct inode *inode, struct inode *dir) + { ++ if (S_ISLNK(inode->i_mode)) ++ return 0; ++ + inode->i_mode &= ~current_umask(); + return 0; + } diff --git a/queue-4.19/series b/queue-4.19/series index 18a2b680ea2..bb488826904 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1 +1,10 @@ alsa-hda-add-fixup-for-dell-latitidue-e5430.patch +alsa-hda-conexant-apply-quirk-for-another-hp-prodesk-600-g3-model.patch +alsa-hda-realtek-fix-headset-mic-problem-for-a-hp-machine-with-alc221.patch +xen-netback-avoid-entering-xenvif_rx_next_skb-with-an-empty-rx-queue.patch +tracing-histograms-fix-memory-leak-problem.patch +net-sock-tracing-fix-sock_exceed_buf_limit-not-to-dereference-stale-pointer.patch +arm-9213-1-print-message-about-disabled-spectre-workarounds-only-once.patch +arm-9214-1-alignment-advance-it-state-after-emulating-thumb-instruction.patch +cgroup-use-separate-src-dst-nodes-when-preloading-css_sets-for-migration.patch +nilfs2-fix-incorrect-masking-of-permission-flags-for-symlinks.patch diff --git a/queue-4.19/tracing-histograms-fix-memory-leak-problem.patch b/queue-4.19/tracing-histograms-fix-memory-leak-problem.patch new file mode 100644 index 00000000000..b22e9f6592d --- /dev/null +++ b/queue-4.19/tracing-histograms-fix-memory-leak-problem.patch @@ -0,0 +1,80 @@ +From 7edc3945bdce9c39198a10d6129377a5c53559c2 Mon Sep 17 00:00:00 2001 +From: Zheng Yejian +Date: Mon, 11 Jul 2022 09:47:31 +0800 +Subject: tracing/histograms: Fix memory leak problem + +From: Zheng Yejian + +commit 7edc3945bdce9c39198a10d6129377a5c53559c2 upstream. + +This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. + +As commit 46bbe5c671e0 ("tracing: fix double free") said, the +"double free" problem reported by clang static analyzer is: + > In parse_var_defs() if there is a problem allocating + > var_defs.expr, the earlier var_defs.name is freed. + > This free is duplicated by free_var_defs() which frees + > the rest of the list. + +However, if there is a problem allocating N-th var_defs.expr: + + in parse_var_defs(), the freed 'earlier var_defs.name' is + actually the N-th var_defs.name; + + then in free_var_defs(), the names from 0th to (N-1)-th are freed; + + IF ALLOCATING PROBLEM HAPPENED HERE!!! -+ + \ + | + 0th 1th (N-1)-th N-th V + +-------------+-------------+-----+-------------+----------- +var_defs: | name | expr | name | expr | ... | name | expr | name | /// + +-------------+-------------+-----+-------------+----------- + +These two frees don't act on same name, so there was no "double free" +problem before. Conversely, after that commit, we get a "memory leak" +problem because the above "N-th var_defs.name" is not freed. + +If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th +var_defs.expr allocated, then execute on shell like: + $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \ +/sys/kernel/debug/tracing/events/kmem/kmalloc/trigger + +Then kmemleak reports: + unreferenced object 0xffff8fb100ef3518 (size 8): + comm "bash", pid 196, jiffies 4295681690 (age 28.538s) + hex dump (first 8 bytes): + 76 31 00 00 b1 8f ff ff v1...... + backtrace: + [<0000000038fe4895>] kstrdup+0x2d/0x60 + [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 + [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110 + [<0000000066737a4c>] event_trigger_write+0x75/0xd0 + [<000000007341e40c>] vfs_write+0xbb/0x2a0 + [<0000000087fde4c2>] ksys_write+0x59/0xd0 + [<00000000581e9cdf>] do_syscall_64+0x3a/0x80 + [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Link: https://lkml.kernel.org/r/20220711014731.69520-1-zhengyejian1@huawei.com + +Cc: stable@vger.kernel.org +Fixes: 46bbe5c671e0 ("tracing: fix double free") +Reported-by: Hulk Robot +Suggested-by: Steven Rostedt +Reviewed-by: Tom Zanussi +Signed-off-by: Zheng Yejian +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events_hist.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -4266,6 +4266,8 @@ static int parse_var_defs(struct hist_tr + + s = kstrdup(field_str, GFP_KERNEL); + if (!s) { ++ kfree(hist_data->attrs->var_defs.name[n_vars]); ++ hist_data->attrs->var_defs.name[n_vars] = NULL; + ret = -ENOMEM; + goto free; + } diff --git a/queue-4.19/xen-netback-avoid-entering-xenvif_rx_next_skb-with-an-empty-rx-queue.patch b/queue-4.19/xen-netback-avoid-entering-xenvif_rx_next_skb-with-an-empty-rx-queue.patch new file mode 100644 index 00000000000..995d47a20f6 --- /dev/null +++ b/queue-4.19/xen-netback-avoid-entering-xenvif_rx_next_skb-with-an-empty-rx-queue.patch @@ -0,0 +1,60 @@ +From 94e8100678889ab428e68acadf042de723f094b9 Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Wed, 13 Jul 2022 15:53:22 +0200 +Subject: xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue + +From: Juergen Gross + +commit 94e8100678889ab428e68acadf042de723f094b9 upstream. + +xenvif_rx_next_skb() is expecting the rx queue not being empty, but +in case the loop in xenvif_rx_action() is doing multiple iterations, +the availability of another skb in the rx queue is not being checked. + +This can lead to crashes: + +[40072.537261] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 +[40072.537407] IP: xenvif_rx_skb+0x23/0x590 [xen_netback] +[40072.537534] PGD 0 P4D 0 +[40072.537644] Oops: 0000 [#1] SMP NOPTI +[40072.537749] CPU: 0 PID: 12505 Comm: v1-c40247-q2-gu Not tainted 4.12.14-122.121-default #1 SLE12-SP5 +[40072.537867] Hardware name: HP ProLiant DL580 Gen9/ProLiant DL580 Gen9, BIOS U17 11/23/2021 +[40072.537999] task: ffff880433b38100 task.stack: ffffc90043d40000 +[40072.538112] RIP: e030:xenvif_rx_skb+0x23/0x590 [xen_netback] +[40072.538217] RSP: e02b:ffffc90043d43de0 EFLAGS: 00010246 +[40072.538319] RAX: 0000000000000000 RBX: ffffc90043cd7cd0 RCX: 00000000000000f7 +[40072.538430] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffc90043d43df8 +[40072.538531] RBP: 000000000000003f R08: 000077ff80000000 R09: 0000000000000008 +[40072.538644] R10: 0000000000007ff0 R11: 00000000000008f6 R12: ffffc90043ce2708 +[40072.538745] R13: 0000000000000000 R14: ffffc90043d43ed0 R15: ffff88043ea748c0 +[40072.538861] FS: 0000000000000000(0000) GS:ffff880484600000(0000) knlGS:0000000000000000 +[40072.538988] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 +[40072.539088] CR2: 0000000000000080 CR3: 0000000407ac8000 CR4: 0000000000040660 +[40072.539211] Call Trace: +[40072.539319] xenvif_rx_action+0x71/0x90 [xen_netback] +[40072.539429] xenvif_kthread_guest_rx+0x14a/0x29c [xen_netback] + +Fix that by stopping the loop in case the rx queue becomes empty. + +Cc: stable@vger.kernel.org +Fixes: 98f6d57ced73 ("xen-netback: process guest rx packets in batches") +Signed-off-by: Juergen Gross +Reviewed-by: Jan Beulich +Reviewed-by: Paul Durrant +Link: https://lore.kernel.org/r/20220713135322.19616-1-jgross@suse.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netback/rx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/xen-netback/rx.c ++++ b/drivers/net/xen-netback/rx.c +@@ -482,6 +482,7 @@ void xenvif_rx_action(struct xenvif_queu + queue->rx_copy.completed = &completed_skbs; + + while (xenvif_rx_ring_slots_available(queue) && ++ !skb_queue_empty(&queue->rx_queue) && + work_done < RX_BATCH_SIZE) { + xenvif_rx_skb(queue); + work_done++; -- 2.47.3