{"push_id":3457379814,"size":3,"distinct_size":0,"ref":"refs/heads/fixes","head":"6f845ebec2706841d15831fab3ffffcfd9e676fa","before":"8c2ffd9174779014c3fe1f96d9dc3641d9175f00","commits":[{"sha":"d9470757398a700d9450a43508000bcfd010c7a4","author":{"name":"Michael Ellerman","email":"864f124608374e06e4da1fa5d2e47ed839b95411@ellerman.id.au"},"message":"powerpc/64: Fix memcmp reading past the end of src/dest\n\nChandan reported that fstests' generic/026 test hit a crash:\n\n  BUG: Unable to handle kernel data access at 0xc00000062ac40000\n  Faulting instruction address: 0xc000000000092240\n  Oops: Kernel access of bad area, sig: 11 [#1]\n  LE SMP NR_CPUS=2048 DEBUG_PAGEALLOC NUMA pSeries\n  CPU: 0 PID: 27828 Comm: chacl Not tainted 5.0.0-rc2-next-20190115-00001-g6de6dba64dda #1\n  NIP:  c000000000092240 LR: c00000000066a55c CTR: 0000000000000000\n  REGS: c00000062c0c3430 TRAP: 0300   Not tainted  (5.0.0-rc2-next-20190115-00001-g6de6dba64dda)\n  MSR:  8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE>  CR: 44000842  XER: 20000000\n  CFAR: 00007fff7f3108ac DAR: c00000062ac40000 DSISR: 40000000 IRQMASK: 0\n  GPR00: 0000000000000000 c00000062c0c36c0 c0000000017f4c00 c00000000121a660\n  GPR04: c00000062ac3fff9 0000000000000004 0000000000000020 00000000275b19c4\n  GPR08: 000000000000000c 46494c4500000000 5347495f41434c5f c0000000026073a0\n  GPR12: 0000000000000000 c0000000027a0000 0000000000000000 0000000000000000\n  GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000\n  GPR20: c00000062ea70020 c00000062c0c38d0 0000000000000002 0000000000000002\n  GPR24: c00000062ac3ffe8 00000000275b19c4 0000000000000001 c00000062ac30000\n  GPR28: c00000062c0c38d0 c00000062ac30050 c00000062ac30058 0000000000000000\n  NIP memcmp+0x120/0x690\n  LR  xfs_attr3_leaf_lookup_int+0x53c/0x5b0\n  Call Trace:\n    xfs_attr3_leaf_lookup_int+0x78/0x5b0 (unreliable)\n    xfs_da3_node_lookup_int+0x32c/0x5a0\n    xfs_attr_node_addname+0x170/0x6b0\n    xfs_attr_set+0x2ac/0x340\n    __xfs_set_acl+0xf0/0x230\n    xfs_set_acl+0xd0/0x160\n    set_posix_acl+0xc0/0x130\n    posix_acl_xattr_set+0x68/0x110\n    __vfs_setxattr+0xa4/0x110\n    __vfs_setxattr_noperm+0xac/0x240\n    vfs_setxattr+0x128/0x130\n    setxattr+0x248/0x600\n    path_setxattr+0x108/0x120\n    sys_setxattr+0x28/0x40\n    system_call+0x5c/0x70\n  Instruction dump:\n  7d201c28 7d402428 7c295040 38630008 38840008 408201f0 4200ffe8 2c050000\n  4182ff6c 20c50008 54c61838 7d201c28 <7d402428> 7d293436 7d4a3436 7c295040\n\nThe instruction dump decodes as:\n  subfic  r6,r5,8\n  rlwinm  r6,r6,3,0,28\n  ldbrx   r9,0,r3\n  ldbrx   r10,0,r4      <-\n\nWhich shows us doing an 8 byte load from c00000062ac3fff9, which\ncrosses the page boundary at c00000062ac40000 and faults.\n\nIt's not OK for memcmp to read past the end of the source or\ndestination buffers if that would cross a page boundary, because we\ndon't know that the next page is mapped.\n\nAs pointed out by Segher, we can read past the end of the source or\ndestination as long as we don't cross a 4K boundary, because that's\nour minimum page size on all platforms.\n\nThe bug is in the code at the .Lcmp_rest_lt8bytes label. When we get\nthere we know that s1 is 8-byte aligned and we have at least 1 byte to\nread, so a single 8-byte load won't read past the end of s1 and cross\na page boundary.\n\nBut we have to be more careful with s2. So check if it's within 8\nbytes of a 4K boundary and if so go to the byte-by-byte loop.\n\nFixes: 2d9ee327adce (\"powerpc/64: Align bytes before fall back to .Lshort in powerpc64 memcmp()\")\nCc: stable@vger.kernel.org # v4.19+\nReported-by: Chandan Rajendra <chandan@linux.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nReviewed-by: Segher Boessenkool <segher@kernel.crashing.org>\nTested-by: Chandan Rajendra <chandan@linux.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>","distinct":false,"url":"https://api.github.com/repos/linuxppc/linux/commits/d9470757398a700d9450a43508000bcfd010c7a4"},{"sha":"ce9afe08e71e3f7d64f337a6e932e50849230fc2","author":{"name":"Gautham R. Shenoy","email":"c13571dbffa0eb89c7f8eebdce482897b0f5a685@linux.vnet.ibm.com"},"message":"powerpc/pseries/energy: Use OF accessor functions to read ibm,drc-indexes\n\nIn cpu_to_drc_index() in the case when FW_FEATURE_DRC_INFO is absent,\nwe currently use of_read_property() to obtain the pointer to the array\ncorresponding to the property \"ibm,drc-indexes\". The elements of this\narray are of type __be32, but are accessed without any conversion to\nthe OS-endianness, which is buggy on a Little Endian OS.\n\nFix this by using of_property_read_u32_index() accessor function to\nsafely read the elements of the array.\n\nFixes: e83636ac3334 (\"pseries/drc-info: Search DRC properties for CPU indexes\")\nCc: stable@vger.kernel.org # v4.16+\nReported-by: Pavithra R. Prakash <pavrampu@in.ibm.com>\nSigned-off-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>\nReviewed-by: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>\n[mpe: Make the WARN_ON a WARN_ON_ONCE so it's not retriggerable]\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>","distinct":false,"url":"https://api.github.com/repos/linuxppc/linux/commits/ce9afe08e71e3f7d64f337a6e932e50849230fc2"},{"sha":"6f845ebec2706841d15831fab3ffffcfd9e676fa","author":{"name":"Mahesh Salgaonkar","email":"6a890e1065a1d4e8df9dcf1d9a2c9c740bbcf8aa@linux.vnet.ibm.com"},"message":"powerpc/pseries/mce: Fix misleading print for TLB mutlihit\n\nOn pseries, TLB multihit are reported as D-Cache Multihit. This is because\nthe wrongly populated mc_err_types[] array. Per PAPR, TLB error type is 0x04\nand mc_err_types[4] points to \"D-Cache\" instead of \"TLB\" string. Fixup the\nmc_err_types[] array.\n\nMachine check error type per PAPR:\n  0x00 = Uncorrectable Memory Error (UE)\n  0x01 = SLB error\n  0x02 = ERAT Error\n  0x04 = TLB error\n  0x05 = D-Cache error\n  0x07 = I-Cache error\n\nFixes: 8f0b80561f21 (\"powerpc/pseries: Display machine check error details.\")\nCc: stable@vger.kernel.org # v4.20+\nReported-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>\nSigned-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>","distinct":false,"url":"https://api.github.com/repos/linuxppc/linux/commits/6f845ebec2706841d15831fab3ffffcfd9e676fa"}]}
{"actor":{"display_login":"mpe"}}