* [PATCH RT 1/5] signal: Prevent double-free of user struct
2020-08-21 19:46 [PATCH RT 0/5] Linux v4.19.135-rt61-rc1 zanussi
@ 2020-08-21 19:47 ` zanussi
2020-08-21 19:47 ` [PATCH RT 2/5] Bluetooth: Acquire sk_lock.slock without disabling interrupts zanussi
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: zanussi @ 2020-08-21 19:47 UTC (permalink / raw)
To: LKML, linux-rt-users, Steven Rostedt, Thomas Gleixner,
Carsten Emde, John Kacur, Sebastian Andrzej Siewior,
Daniel Wagner, Clark Williams, Pavel Machek, Tom Zanussi
Cc: Matt Fleming
From: Matt Fleming <matt@codeblueprint.co.uk>
v4.19.135-rt61-rc1 stable review patch.
If anyone has any objections, please let me know.
-----------
[ Upsteam commit 9567db2ebe566a93485e1a27d8759969d0002d7a ]
The way user struct reference counting works changed significantly with,
fda31c50292a ("signal: avoid double atomic counter increments for user accounting")
Now user structs are only freed once the last pending signal is
dequeued. Make sigqueue_free_current() follow this new convention to
avoid freeing the user struct multiple times and triggering this
warning:
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 6794 at lib/refcount.c:288 refcount_dec_not_one+0x45/0x50
Call Trace:
refcount_dec_and_lock_irqsave+0x16/0x60
free_uid+0x31/0xa0
__dequeue_signal+0x17c/0x190
dequeue_signal+0x5a/0x1b0
do_sigtimedwait+0x208/0x250
__x64_sys_rt_sigtimedwait+0x6f/0xd0
do_syscall_64+0x72/0x200
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Reported-by: Daniel Wagner <wagi@monom.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
---
kernel/signal.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/signal.c b/kernel/signal.c
index 45748993f777..05c9b5a6b3ae 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -488,8 +488,8 @@ static void sigqueue_free_current(struct sigqueue *q)
up = q->user;
if (rt_prio(current->normal_prio) && !put_task_cache(current, q)) {
- atomic_dec(&up->sigpending);
- free_uid(up);
+ if (atomic_dec_and_test(&up->sigpending))
+ free_uid(up);
} else
__sigqueue_free(q);
}
--
2.17.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH RT 2/5] Bluetooth: Acquire sk_lock.slock without disabling interrupts
2020-08-21 19:46 [PATCH RT 0/5] Linux v4.19.135-rt61-rc1 zanussi
2020-08-21 19:47 ` [PATCH RT 1/5] signal: Prevent double-free of user struct zanussi
@ 2020-08-21 19:47 ` zanussi
2020-08-21 19:47 ` [PATCH RT 3/5] net: phy: fixed_phy: Remove unused seqcount zanussi
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: zanussi @ 2020-08-21 19:47 UTC (permalink / raw)
To: LKML, linux-rt-users, Steven Rostedt, Thomas Gleixner,
Carsten Emde, John Kacur, Sebastian Andrzej Siewior,
Daniel Wagner, Clark Williams, Pavel Machek, Tom Zanussi
Cc: Marcel Holtmann
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
v4.19.135-rt61-rc1 stable review patch.
If anyone has any objections, please let me know.
-----------
[ Upstream commit e6da0edc24eecef2f6964d92fa9044e1821deace ]
There was a lockdep which led to commit
fad003b6c8e3d ("Bluetooth: Fix inconsistent lock state with RFCOMM")
Lockdep noticed that `sk->sk_lock.slock' was acquired without disabling
the softirq while the lock was also used in softirq context.
Unfortunately the solution back then was to disable interrupts before
acquiring the lock which however made lockdep happy.
It would have been enough to simply disable the softirq. Disabling
interrupts before acquiring a spinlock_t is not allowed on PREEMPT_RT
because these locks are converted to 'sleeping' spinlocks.
Use spin_lock_bh() in order to acquire the `sk_lock.slock'.
Reported-by: Luis Claudio R. Goncalves <lclaudio@uudg.org>
Reported-by: kbuild test robot <lkp@intel.com> [missing unlock]
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
---
net/bluetooth/rfcomm/sock.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c044ff2f73e6..75bc8102cdd7 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -64,15 +64,13 @@ static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
{
struct sock *sk = d->owner, *parent;
- unsigned long flags;
if (!sk)
return;
BT_DBG("dlc %p state %ld err %d", d, d->state, err);
- local_irq_save(flags);
- bh_lock_sock(sk);
+ spin_lock_bh(&sk->sk_lock.slock);
if (err)
sk->sk_err = err;
@@ -93,8 +91,7 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
sk->sk_state_change(sk);
}
- bh_unlock_sock(sk);
- local_irq_restore(flags);
+ spin_unlock_bh(&sk->sk_lock.slock);
if (parent && sock_flag(sk, SOCK_ZAPPED)) {
/* We have to drop DLC lock here, otherwise
--
2.17.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH RT 3/5] net: phy: fixed_phy: Remove unused seqcount
2020-08-21 19:46 [PATCH RT 0/5] Linux v4.19.135-rt61-rc1 zanussi
2020-08-21 19:47 ` [PATCH RT 1/5] signal: Prevent double-free of user struct zanussi
2020-08-21 19:47 ` [PATCH RT 2/5] Bluetooth: Acquire sk_lock.slock without disabling interrupts zanussi
@ 2020-08-21 19:47 ` zanussi
2020-08-21 19:47 ` [PATCH RT 4/5] net: xfrm: fix compress vs decompress serialization zanussi
2020-08-21 19:47 ` [PATCH RT 5/5] Linux 4.19.135-rt61-rc1 zanussi
4 siblings, 0 replies; 6+ messages in thread
From: zanussi @ 2020-08-21 19:47 UTC (permalink / raw)
To: LKML, linux-rt-users, Steven Rostedt, Thomas Gleixner,
Carsten Emde, John Kacur, Sebastian Andrzej Siewior,
Daniel Wagner, Clark Williams, Pavel Machek, Tom Zanussi
Cc: Ahmed S. Darwish, David S . Miller
From: "Ahmed S. Darwish" <a.darwish@linutronix.de>
v4.19.135-rt61-rc1 stable review patch.
If anyone has any objections, please let me know.
-----------
[ Upstream commit 6554eac9ef2bd1c968886b31cc7266b49258a463 ]
Commit bf7afb29d545 ("phy: improve safety of fixed-phy MII register
reading") protected the fixed PHY status with a sequence counter.
Two years later, commit d2b977939b18 ("net: phy: fixed-phy: remove
fixed_phy_update_state()") removed the sequence counter's write side
critical section -- neutralizing its read side retry loop.
Remove the unused seqcount.
Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from v5.8-rc1 commit 79cbb6bc3332da7162c2581e151659ab8ebaa528)
Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
---
drivers/net/phy/fixed_phy.c | 25 +++++++++----------------
1 file changed, 9 insertions(+), 16 deletions(-)
diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index 59820164502e..953ff54dd5df 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -23,7 +23,6 @@
#include <linux/slab.h>
#include <linux/of.h>
#include <linux/gpio.h>
-#include <linux/seqlock.h>
#include <linux/idr.h>
#include "swphy.h"
@@ -36,7 +35,6 @@ struct fixed_mdio_bus {
struct fixed_phy {
int addr;
struct phy_device *phydev;
- seqcount_t seqcount;
struct fixed_phy_status status;
int (*link_update)(struct net_device *, struct fixed_phy_status *);
struct list_head node;
@@ -62,18 +60,15 @@ static int fixed_mdio_read(struct mii_bus *bus, int phy_addr, int reg_num)
list_for_each_entry(fp, &fmb->phys, node) {
if (fp->addr == phy_addr) {
struct fixed_phy_status state;
- int s;
-
- do {
- s = read_seqcount_begin(&fp->seqcount);
- /* Issue callback if user registered it. */
- if (fp->link_update)
- fp->link_update(fp->phydev->attached_dev,
- &fp->status);
- /* Check the GPIO for change in status */
- fixed_phy_update(fp);
- state = fp->status;
- } while (read_seqcount_retry(&fp->seqcount, s));
+
+ /* Issue callback if user registered it. */
+ if (fp->link_update)
+ fp->link_update(fp->phydev->attached_dev,
+ &fp->status);
+
+ /* Check the GPIO for change in status */
+ fixed_phy_update(fp);
+ state = fp->status;
return swphy_read_reg(reg_num, &state);
}
@@ -131,8 +126,6 @@ int fixed_phy_add(unsigned int irq, int phy_addr,
if (!fp)
return -ENOMEM;
- seqcount_init(&fp->seqcount);
-
if (irq != PHY_POLL)
fmb->mii_bus->irq[phy_addr] = irq;
--
2.17.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH RT 4/5] net: xfrm: fix compress vs decompress serialization
2020-08-21 19:46 [PATCH RT 0/5] Linux v4.19.135-rt61-rc1 zanussi
` (2 preceding siblings ...)
2020-08-21 19:47 ` [PATCH RT 3/5] net: phy: fixed_phy: Remove unused seqcount zanussi
@ 2020-08-21 19:47 ` zanussi
2020-08-21 19:47 ` [PATCH RT 5/5] Linux 4.19.135-rt61-rc1 zanussi
4 siblings, 0 replies; 6+ messages in thread
From: zanussi @ 2020-08-21 19:47 UTC (permalink / raw)
To: LKML, linux-rt-users, Steven Rostedt, Thomas Gleixner,
Carsten Emde, John Kacur, Sebastian Andrzej Siewior,
Daniel Wagner, Clark Williams, Pavel Machek, Tom Zanussi
Cc: Davidlohr Bueso, Davidlohr Bueso
From: Davidlohr Bueso <dave@stgolabs.net>
v4.19.135-rt61-rc1 stable review patch.
If anyone has any objections, please let me know.
-----------
A crash was seen in xfrm when running ltp's 'tcp4_ipsec06' stresser on v4.x
based RT kernels.
ipcomp_compress() will serialize access to the ipcomp_scratches percpu buffer by
disabling BH and preventing a softirq from coming in and running ipcom_decompress(),
which is never called from process context. This of course won't work on RT and
the buffer can get corrupted; there have been similar issues with in the past with
such assumptions, ie: ebf255ed6c44 (net: add back the missing serialization in
ip_send_unicast_reply()).
Similarly, this patch addresses the issue with locallocks allowing RT to have a
percpu spinlock and do the correct serialization.
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
---
net/xfrm/xfrm_ipcomp.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index a00ec715aa46..a97997385423 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -20,6 +20,7 @@
#include <linux/list.h>
#include <linux/module.h>
#include <linux/mutex.h>
+#include <linux/locallock.h>
#include <linux/percpu.h>
#include <linux/slab.h>
#include <linux/smp.h>
@@ -36,6 +37,7 @@ struct ipcomp_tfms {
static DEFINE_MUTEX(ipcomp_resource_mutex);
static void * __percpu *ipcomp_scratches;
+static DEFINE_LOCAL_IRQ_LOCK(ipcomp_scratches_lock);
static int ipcomp_scratch_users;
static LIST_HEAD(ipcomp_tfms_list);
@@ -45,12 +47,15 @@ static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb)
const int plen = skb->len;
int dlen = IPCOMP_SCRATCH_SIZE;
const u8 *start = skb->data;
- const int cpu = get_cpu();
- u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
- struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
- int err = crypto_comp_decompress(tfm, start, plen, scratch, &dlen);
- int len;
+ u8 *scratch;
+ struct crypto_comp *tfm;
+ int err, len;
+
+ local_lock(ipcomp_scratches_lock);
+ scratch = *this_cpu_ptr(ipcomp_scratches);
+ tfm = *this_cpu_ptr(ipcd->tfms);
+ err = crypto_comp_decompress(tfm, start, plen, scratch, &dlen);
if (err)
goto out;
@@ -103,7 +108,7 @@ static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb)
err = 0;
out:
- put_cpu();
+ local_unlock(ipcomp_scratches_lock);
return err;
}
@@ -146,6 +151,8 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
int err;
local_bh_disable();
+ local_lock(ipcomp_scratches_lock);
+
scratch = *this_cpu_ptr(ipcomp_scratches);
tfm = *this_cpu_ptr(ipcd->tfms);
err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
@@ -158,12 +165,14 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
}
memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen);
+ local_unlock(ipcomp_scratches_lock);
local_bh_enable();
pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr));
return 0;
out:
+ local_unlock(ipcomp_scratches_lock);
local_bh_enable();
return err;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH RT 5/5] Linux 4.19.135-rt61-rc1
2020-08-21 19:46 [PATCH RT 0/5] Linux v4.19.135-rt61-rc1 zanussi
` (3 preceding siblings ...)
2020-08-21 19:47 ` [PATCH RT 4/5] net: xfrm: fix compress vs decompress serialization zanussi
@ 2020-08-21 19:47 ` zanussi
4 siblings, 0 replies; 6+ messages in thread
From: zanussi @ 2020-08-21 19:47 UTC (permalink / raw)
To: LKML, linux-rt-users, Steven Rostedt, Thomas Gleixner,
Carsten Emde, John Kacur, Sebastian Andrzej Siewior,
Daniel Wagner, Clark Williams, Pavel Machek, Tom Zanussi
From: Tom Zanussi <zanussi@kernel.org>
v4.19.135-rt61-rc1 stable review patch.
If anyone has any objections, please let me know.
-----------
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
---
localversion-rt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/localversion-rt b/localversion-rt
index 66fa05e70f29..c04074665349 100644
--- a/localversion-rt
+++ b/localversion-rt
@@ -1 +1 @@
--rt60
+-rt61-rc1
--
2.17.1
^ permalink raw reply related [flat|nested] 6+ messages in thread