Skip to content
Snippets Groups Projects
  1. May 23, 2021
  2. May 20, 2021
  3. May 19, 2021
    • Arnd Bergmann's avatar
      platform/surface: aggregator: avoid clang -Wconstant-conversion warning · ba6e1d84
      Arnd Bergmann authored
      
      Clang complains about the assignment of SSAM_ANY_IID to
      ssam_device_uid->instance:
      
      drivers/platform/surface/surface_aggregator_registry.c:478:25: error: implicit conversion from 'int' to '__u8' (aka 'unsigned char') changes value from 65535 to 255 [-Werror,-Wconstant-conversion]
              { SSAM_VDEV(HUB, 0x02, SSAM_ANY_IID, 0x00) },
              ~                      ^~~~~~~~~~~~
      include/linux/surface_aggregator/device.h:71:23: note: expanded from macro 'SSAM_ANY_IID'
       #define SSAM_ANY_IID            0xffff
                                      ^~~~~~
      include/linux/surface_aggregator/device.h:126:63: note: expanded from macro 'SSAM_VDEV'
              SSAM_DEVICE(SSAM_DOMAIN_VIRTUAL, SSAM_VIRTUAL_TC_##cat, tid, iid, fun)
                                                                           ^~~
      include/linux/surface_aggregator/device.h:102:41: note: expanded from macro 'SSAM_DEVICE'
              .instance = ((iid) != SSAM_ANY_IID) ? (iid) : 0,                        \
                                                     ^~~
      
      The assignment doesn't actually happen, but clang checks the type limits
      before checking whether this assignment is reached. Replace the ?:
      operator with a __builtin_choose_expr() invocation that avoids the
      warning for the untaken part.
      
      Fixes: eb0e90a8 ("platform/surface: aggregator: Add dedicated bus and device type")
      Cc: platform-driver-x86@vger.kernel.org
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Reviewed-by: default avatarNathan Chancellor <nathan@kernel.org>
      Reviewed-by: default avatarMaximilian Luz <luzmaximilian@gmail.com>
      Link: https://lore.kernel.org/r/20210514200453.1542978-1-arnd@kernel.org
      
      
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      ba6e1d84
  4. May 18, 2021
  5. May 15, 2021
  6. May 14, 2021
  7. May 13, 2021
    • Jim Cromie's avatar
      dyndbg: avoid calling dyndbg_emit_prefix when it has no work · 640d1eaf
      Jim Cromie authored
      
      Wrap function in a static-inline one, which checks flags to avoid
      calling the function unnecessarily.
      
      And hoist its output-buffer initialization to the grand-caller, which
      is already allocating the buffer on the stack, and can trivially
      initialize it too.
      
      Signed-off-by: default avatarJim Cromie <jim.cromie@gmail.com>
      Link: https://lore.kernel.org/r/20210504222235.1033685-2-jim.cromie@gmail.com
      
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      640d1eaf
    • Maciej W. Rozycki's avatar
      vt: Fix character height handling with VT_RESIZEX · 860dafa9
      Maciej W. Rozycki authored
      Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
      which is the number of pixel rows per character (cell) rather than the
      height of the font used.
      
      For framebuffer devices the two values are always the same, because the
      former is inferred from the latter one.  For VGA used as a true text
      mode device these two parameters are independent from each other: the
      number of pixel rows per character is set in the CRT controller, while
      font height is in fact hardwired to 32 pixel rows and fonts of heights
      below that value are handled by padding their data with blanks when
      loaded to hardware for use by the character generator.  One can change
      the setting in the CRT controller and it will update the screen contents
      accordingly regardless of the font loaded.
      
      The `v_clin' parameter is used by the `vgacon' driver to set the height
      of the character cell and then the cursor position within.  Make the
      parameter explicit then, by defining a new `vc_cell_height' struct
      member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
      the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
      except where actual font data is accessed which as noted above is
      independent from the CRTC setting.
      
      This way the framebuffer console driver is free to ignore the `v_clin'
      parameter as irrelevant, as it always should have, avoiding any issues
      attempts to give the parameter a meaning there could have caused, such
      as one that has led to commit 988d0763 ("vt_ioctl: make VT_RESIZEX
      behave like VT_RESIZE"):
      
       "syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
        for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
        larger than actual font height calculated by con_font_set() from
        ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
        minimal amount of memory based on actual font height calculated by
        con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
        data."
      
      The problem first appeared around Linux 2.5.66 which predates our repo
      history, but the origin could be identified with the old MIPS/Linux repo
      also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
      as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
      code in `vt_ioctl' was updated as follows:
      
       		if (clin)
      -			video_font_height = clin;
      +			vc->vc_font.height = clin;
      
      making the parameter apply to framebuffer devices as well, perhaps due
      to the use of "font" in the name of the original `video_font_height'
      variable.  Use "cell" in the new struct member then to avoid ambiguity.
      
      References:
      
      [1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
      [2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3
      
      
      
      Signed-off-by: default avatarMaciej W. Rozycki <macro@orcam.me.uk>
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Cc: stable@vger.kernel.org # v2.6.12+
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      860dafa9
  8. May 12, 2021
  9. May 11, 2021
    • Omar Sandoval's avatar
      kyber: fix out of bounds access when preempted · efed9a33
      Omar Sandoval authored
      
      __blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and
      passes the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx
      for the current CPU again and uses that to get the corresponding Kyber
      context in the passed hctx. However, the thread may be preempted between
      the two calls to blk_mq_get_ctx(), and the ctx returned the second time
      may no longer correspond to the passed hctx. This "works" accidentally
      most of the time, but it can cause us to read garbage if the second ctx
      came from an hctx with more ctx's than the first one (i.e., if
      ctx->index_hw[hctx->type] > hctx->nr_ctx).
      
      This manifested as this UBSAN array index out of bounds error reported
      by Jakub:
      
      UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9
      index 13106 is out of range for type 'long unsigned int [128]'
      Call Trace:
       dump_stack+0xa4/0xe5
       ubsan_epilogue+0x5/0x40
       __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34
       queued_spin_lock_slowpath+0x476/0x480
       do_raw_spin_lock+0x1c2/0x1d0
       kyber_bio_merge+0x112/0x180
       blk_mq_submit_bio+0x1f5/0x1100
       submit_bio_noacct+0x7b0/0x870
       submit_bio+0xc2/0x3a0
       btrfs_map_bio+0x4f0/0x9d0
       btrfs_submit_data_bio+0x24e/0x310
       submit_one_bio+0x7f/0xb0
       submit_extent_page+0xc4/0x440
       __extent_writepage_io+0x2b8/0x5e0
       __extent_writepage+0x28d/0x6e0
       extent_write_cache_pages+0x4d7/0x7a0
       extent_writepages+0xa2/0x110
       do_writepages+0x8f/0x180
       __writeback_single_inode+0x99/0x7f0
       writeback_sb_inodes+0x34e/0x790
       __writeback_inodes_wb+0x9e/0x120
       wb_writeback+0x4d2/0x660
       wb_workfn+0x64d/0xa10
       process_one_work+0x53a/0xa80
       worker_thread+0x69/0x5b0
       kthread+0x20b/0x240
       ret_from_fork+0x1f/0x30
      
      Only Kyber uses the hctx, so fix it by passing the request_queue to
      ->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can
      map the queues itself to avoid the mismatch.
      
      Fixes: a6088845 ("block: kyber: make kyber more friendly with merging")
      Reported-by: default avatarJakub Kicinski <kuba@kernel.org>
      Signed-off-by: default avatarOmar Sandoval <osandov@fb.com>
      Link: https://lore.kernel.org/r/c7598605401a48d5cfeadebb678abd10af22b83f.1620691329.git.osandov@fb.com
      
      
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      efed9a33
    • Nick Desaulniers's avatar
      stack: Replace "o" output with "r" input constraint · 2515dd6c
      Nick Desaulniers authored
      "o" isn't a common asm() constraint to use; it triggers an assertion in
      assert-enabled builds of LLVM that it's not recognized when targeting
      aarch64 (though it appears to fall back to "m"). It's fixed in LLVM 13 now,
      but there isn't really a good reason to use "o" in particular here. To
      avoid causing build issues for those using assert-enabled builds of earlier
      LLVM versions, the constraint needs changing.
      
      Instead, if the point is to retain the __builtin_alloca(), make ptr appear
      to "escape" via being an input to an empty inline asm block. This is
      preferable anyways, since otherwise this looks like a dead store.
      
      While the use of "r" was considered in
      
        https://lore.kernel.org/lkml/202104011447.2E7F543@keescook/
      
      
      
      it was only tested as an output (which looks like a dead store, and wasn't
      sufficient).
      
      Use "r" as an input constraint instead, which behaves correctly across
      compilers and architectures.
      
      Fixes: 39218ff4 ("stack: Optionally randomize kernel stack offset each syscall")
      Signed-off-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Tested-by: default avatarKees Cook <keescook@chromium.org>
      Tested-by: default avatarNathan Chancellor <nathan@kernel.org>
      Reviewed-by: default avatarNathan Chancellor <nathan@kernel.org>
      Link: https://reviews.llvm.org/D100412
      Link: https://bugs.llvm.org/show_bug.cgi?id=49956
      Link: https://lore.kernel.org/r/20210419231741.4084415-1-keescook@chromium.org
      2515dd6c
  10. May 10, 2021
  11. May 09, 2021
  12. May 08, 2021
  13. May 07, 2021
Loading