November 2021 - Linux-stable-mirror

FAILED: patch "[PATCH] bpf: Fix toctou on read-only map's constant scalar tracking" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 353050be4c19e102178ccc05988101887c25ae53 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann <daniel(a)iogearbox.net> Date: Tue, 9 Nov 2021 18:48:08 +0000 Subject: [PATCH] bpf: Fix toctou on read-only map's constant scalar tracking Commit a23740ec43ba ("bpf: Track contents of read-only maps as scalars") is checking whether maps are read-only both from BPF program side and user space side, and then, given their content is constant, reading out their data via map->ops->map_direct_value_addr() which is then subsequently used as known scalar value for the register, that is, it is marked as __mark_reg_known() with the read value at verification time. Before a23740ec43ba, the register content was marked as an unknown scalar so the verifier could not make any assumptions about the map content. The current implementation however is prone to a TOCTOU race, meaning, the value read as known scalar for the register is not guaranteed to be exactly the same at a later point when the program is executed, and as such, the prior made assumptions of the verifier with regards to the program will be invalid which can cause issues such as OOB access, etc. While the BPF_F_RDONLY_PROG map flag is always fixed and required to be specified at map creation time, the map->frozen property is initially set to false for the map given the map value needs to be populated, e.g. for global data sections. Once complete, the loader "freezes" the map from user space such that no subsequent updates/deletes are possible anymore. For the rest of the lifetime of the map, this freeze one-time trigger cannot be undone anymore after a successful BPF_MAP_FREEZE cmd return. Meaning, any new BPF_* cmd calls which would update/delete map entries will be rejected with -EPERM since map_get_sys_perms() removes the FMODE_CAN_WRITE permission. This also means that pending update/delete map entries must still complete before this guarantee is given. This corner case is not an issue for loaders since they create and prepare such program private map in successive steps. However, a malicious user is able to trigger this TOCTOU race in two different ways: i) via userfaultfd, and ii) via batched updates. For i) userfaultfd is used to expand the competition interval, so that map_update_elem() can modify the contents of the map after map_freeze() and bpf_prog_load() were executed. This works, because userfaultfd halts the parallel thread which triggered a map_update_elem() at the time where we copy key/value from the user buffer and this already passed the FMODE_CAN_WRITE capability test given at that time the map was not "frozen". Then, the main thread performs the map_freeze() and bpf_prog_load(), and once that had completed successfully, the other thread is woken up to complete the pending map_update_elem() which then changes the map content. For ii) the idea of the batched update is similar, meaning, when there are a large number of updates to be processed, it can increase the competition interval between the two. It is therefore possible in practice to modify the contents of the map after executing map_freeze() and bpf_prog_load(). One way to fix both i) and ii) at the same time is to expand the use of the map's map->writecnt. The latter was introduced in fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY") and further refined in 1f6cb19be2e2 ("bpf: Prevent re-mmap()'ing BPF map as writable for initially r/o mapping") with the rationale to make a writable mmap()'ing of a map mutually exclusive with read-only freezing. The counter indicates writable mmap() mappings and then prevents/fails the freeze operation. Its semantics can be expanded beyond just mmap() by generally indicating ongoing write phases. This would essentially span any parallel regular and batched flavor of update/delete operation and then also have map_freeze() fail with -EBUSY. For the check_mem_access() in the verifier we expand upon the bpf_map_is_rdonly() check ensuring that all last pending writes have completed via bpf_map_write_active() test. Once the map->frozen is set and bpf_map_write_active() indicates a map->writecnt of 0 only then we are really guaranteed to use the map's data as known constants. For map->frozen being set and pending writes in process of still being completed we fall back to marking that register as unknown scalar so we don't end up making assumptions about it. With this, both TOCTOU reproducers from i) and ii) are fixed. Note that the map->writecnt has been converted into a atomic64 in the fix in order to avoid a double freeze_mutex mutex_{un,}lock() pair when updating map->writecnt in the various map update/delete BPF_* cmd flavors. Spanning the freeze_mutex over entire map update/delete operations in syscall side would not be possible due to then causing everything to be serialized. Similarly, something like synchronize_rcu() after setting map->frozen to wait for update/deletes to complete is not possible either since it would also have to span the user copy which can sleep. On the libbpf side, this won't break d66562fba1ce ("libbpf: Add BPF object skeleton support") as the anonymous mmap()-ed "map initialization image" is remapped as a BPF map-backed mmap()-ed memory where for .rodata it's non-writable. Fixes: a23740ec43ba ("bpf: Track contents of read-only maps as scalars") Reported-by: w1tcher.bupt(a)gmail.com Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> diff --git a/include/linux/bpf.h b/include/linux/bpf.h index f715e8863f4d..e7a163a3146b 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -193,7 +193,7 @@ struct bpf_map { atomic64_t usercnt; struct work_struct work; struct mutex freeze_mutex; - u64 writecnt; /* writable mmap cnt; protected by freeze_mutex */ + atomic64_t writecnt; }; static inline bool map_value_has_spin_lock(const struct bpf_map *map) @@ -1419,6 +1419,7 @@ void bpf_map_put(struct bpf_map *map); void *bpf_map_area_alloc(u64 size, int numa_node); void *bpf_map_area_mmapable_alloc(u64 size, int numa_node); void bpf_map_area_free(void *base); +bool bpf_map_write_active(const struct bpf_map *map); void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr); int generic_map_lookup_batch(struct bpf_map *map, const union bpf_attr *attr, diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 50f96ea4452a..1033ee8c0caf 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -132,6 +132,21 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr) return map; } +static void bpf_map_write_active_inc(struct bpf_map *map) +{ + atomic64_inc(&map->writecnt); +} + +static void bpf_map_write_active_dec(struct bpf_map *map) +{ + atomic64_dec(&map->writecnt); +} + +bool bpf_map_write_active(const struct bpf_map *map) +{ + return atomic64_read(&map->writecnt) != 0; +} + static u32 bpf_map_value_size(const struct bpf_map *map) { if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH || @@ -601,11 +616,8 @@ static void bpf_map_mmap_open(struct vm_area_struct *vma) { struct bpf_map *map = vma->vm_file->private_data; - if (vma->vm_flags & VM_MAYWRITE) { - mutex_lock(&map->freeze_mutex); - map->writecnt++; - mutex_unlock(&map->freeze_mutex); - } + if (vma->vm_flags & VM_MAYWRITE) + bpf_map_write_active_inc(map); } /* called for all unmapped memory region (including initial) */ @@ -613,11 +625,8 @@ static void bpf_map_mmap_close(struct vm_area_struct *vma) { struct bpf_map *map = vma->vm_file->private_data; - if (vma->vm_flags & VM_MAYWRITE) { - mutex_lock(&map->freeze_mutex); - map->writecnt--; - mutex_unlock(&map->freeze_mutex); - } + if (vma->vm_flags & VM_MAYWRITE) + bpf_map_write_active_dec(map); } static const struct vm_operations_struct bpf_map_default_vmops = { @@ -668,7 +677,7 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) goto out; if (vma->vm_flags & VM_MAYWRITE) - map->writecnt++; + bpf_map_write_active_inc(map); out: mutex_unlock(&map->freeze_mutex); return err; @@ -1139,6 +1148,7 @@ static int map_update_elem(union bpf_attr *attr, bpfptr_t uattr) map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); + bpf_map_write_active_inc(map); if (!(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) { err = -EPERM; goto err_put; @@ -1174,6 +1184,7 @@ static int map_update_elem(union bpf_attr *attr, bpfptr_t uattr) free_key: kvfree(key); err_put: + bpf_map_write_active_dec(map); fdput(f); return err; } @@ -1196,6 +1207,7 @@ static int map_delete_elem(union bpf_attr *attr) map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); + bpf_map_write_active_inc(map); if (!(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) { err = -EPERM; goto err_put; @@ -1226,6 +1238,7 @@ static int map_delete_elem(union bpf_attr *attr) out: kvfree(key); err_put: + bpf_map_write_active_dec(map); fdput(f); return err; } @@ -1533,6 +1546,7 @@ static int map_lookup_and_delete_elem(union bpf_attr *attr) map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); + bpf_map_write_active_inc(map); if (!(map_get_sys_perms(map, f) & FMODE_CAN_READ) || !(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) { err = -EPERM; @@ -1597,6 +1611,7 @@ static int map_lookup_and_delete_elem(union bpf_attr *attr) free_key: kvfree(key); err_put: + bpf_map_write_active_dec(map); fdput(f); return err; } @@ -1624,8 +1639,7 @@ static int map_freeze(const union bpf_attr *attr) } mutex_lock(&map->freeze_mutex); - - if (map->writecnt) { + if (bpf_map_write_active(map)) { err = -EBUSY; goto err_put; } @@ -4171,6 +4185,9 @@ static int bpf_map_do_batch(const union bpf_attr *attr, union bpf_attr __user *uattr, int cmd) { + bool has_read = cmd == BPF_MAP_LOOKUP_BATCH || + cmd == BPF_MAP_LOOKUP_AND_DELETE_BATCH; + bool has_write = cmd != BPF_MAP_LOOKUP_BATCH; struct bpf_map *map; int err, ufd; struct fd f; @@ -4183,16 +4200,13 @@ static int bpf_map_do_batch(const union bpf_attr *attr, map = __bpf_map_get(f); if (IS_ERR(map)) return PTR_ERR(map); - - if ((cmd == BPF_MAP_LOOKUP_BATCH || - cmd == BPF_MAP_LOOKUP_AND_DELETE_BATCH) && - !(map_get_sys_perms(map, f) & FMODE_CAN_READ)) { + if (has_write) + bpf_map_write_active_inc(map); + if (has_read && !(map_get_sys_perms(map, f) & FMODE_CAN_READ)) { err = -EPERM; goto err_put; } - - if (cmd != BPF_MAP_LOOKUP_BATCH && - !(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) { + if (has_write && !(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) { err = -EPERM; goto err_put; } @@ -4205,8 +4219,9 @@ static int bpf_map_do_batch(const union bpf_attr *attr, BPF_DO_BATCH(map->ops->map_update_batch); else BPF_DO_BATCH(map->ops->map_delete_batch); - err_put: + if (has_write) + bpf_map_write_active_dec(map); fdput(f); return err; } diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 65d2f93b7030..50efda51515b 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -4056,7 +4056,22 @@ static void coerce_reg_to_size(struct bpf_reg_state *reg, int size) static bool bpf_map_is_rdonly(const struct bpf_map *map) { - return (map->map_flags & BPF_F_RDONLY_PROG) && map->frozen; + /* A map is considered read-only if the following condition are true: + * + * 1) BPF program side cannot change any of the map content. The + * BPF_F_RDONLY_PROG flag is throughout the lifetime of a map + * and was set at map creation time. + * 2) The map value(s) have been initialized from user space by a + * loader and then "frozen", such that no new map update/delete + * operations from syscall side are possible for the rest of + * the map's lifetime from that point onwards. + * 3) Any parallel/pending map update/delete operations from syscall + * side have been completed. Only after that point, it's safe to + * assume that map value(s) are immutable. + */ + return (map->map_flags & BPF_F_RDONLY_PROG) && + READ_ONCE(map->frozen) && + !bpf_map_write_active(map); } static int bpf_map_direct_read(struct bpf_map *map, int off, int size, u64 *val)

3 years

5
10
0 0

[PATCH 4.19 000/247] 4.19.178-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.178 release. There are 247 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 03 Mar 2021 16:09:49 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.178-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.178-rc1 Takeshi Misawa <jeliantsurux(a)gmail.com> net: qrtr: Fix memory leak in qrtr_tun_open Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Update in-core bitset after committing the metadata Jason A. Donenfeld <Jason(a)zx2c4.com> net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending Leon Romanovsky <leonro(a)nvidia.com> ipv6: silence compilation warning for non-IPV6 builds Eric Dumazet <edumazet(a)google.com> ipv6: icmp6: avoid indirect call for icmpv6_send() Jason A. Donenfeld <Jason(a)zx2c4.com> xfrm: interface: use icmp_ndo_send helper Jason A. Donenfeld <Jason(a)zx2c4.com> sunvnet: use icmp_ndo_send helper Jason A. Donenfeld <Jason(a)zx2c4.com> gtp: use icmp_ndo_send helper Jason A. Donenfeld <Jason(a)zx2c4.com> icmp: introduce helper for nat'd source address in network device context Nikos Tsironis <ntsironis(a)arrikto.com> dm era: only resize metadata in preresume Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Reinitialize bitset cache before digesting a new writeset Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Use correct value size in equality function of writeset tree Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Fix bitset memory leaks Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Verify the data block size hasn't changed Nikos Tsironis <ntsironis(a)arrikto.com> dm era: Recover committed writeset after crash Mikulas Patocka <mpatocka(a)redhat.com> dm: fix deadlock when swapping to encrypted device Bob Peterson <rpeterso(a)redhat.com> gfs2: Don't skip dlm unlock if glock has an lvb Al Viro <viro(a)zeniv.linux.org.uk> sparc32: fix a user-triggerable oops in clear_user() Chao Yu <yuchao0(a)huawei.com> f2fs: fix out-of-repair __setattr_copy() Chen Yu <yu.c.chen(a)intel.com> cpufreq: intel_pstate: Get per-CPU max freq via MSR_HWP_CAPABILITIES if available Muchun Song <songmuchun(a)bytedance.com> printk: fix deadlock when kernel panic Maxim Kiselev <bigunclemax(a)gmail.com> gpio: pcf857x: Fix missing first interrupt Frank Li <Frank.Li(a)nxp.com> mmc: sdhci-esdhc-imx: fix kernel panic when remove module Fangrui Song <maskray(a)google.com> module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols Suzuki K Poulose <suzuki.poulose(a)arm.com> arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55 Dan Williams <dan.j.williams(a)intel.com> libnvdimm/dimm: Avoid race between probe and available_slots_show() Mike Kravetz <mike.kravetz(a)oracle.com> hugetlb: fix copy_huge_page_from_user contig page struct assumption NeilBrown <neilb(a)suse.de> x86: fix seq_file iteration for pat/memtype.c NeilBrown <neilb(a)suse.de> seq_file: document how per-entry resources are managed. Pan Bian <bianpan2016(a)163.com> fs/affs: release old buffer head on error path Pan Bian <bianpan2016(a)163.com> mtd: spi-nor: hisi-sfc: Put child node np on error path Alexander Usyskin <alexander.usyskin(a)intel.com> watchdog: mei_wdt: request stop on unregister He Zhe <zhe.he(a)windriver.com> arm64: uprobe: Return EOPNOTSUPP for AARCH32 instruction probing Jiri Kosina <jkosina(a)suse.cz> floppy: reintroduce O_NDELAY fix Sean Christopherson <seanjc(a)google.com> x86/reboot: Force all cpus to exit VMX root if VMX is supported Pavel Machek <pavel(a)denx.de> media: ipu3-cio2: Fix mbus_code processing in cio2_subdev_set_fmt() Martin Kaiser <martin(a)kaiser.cx> staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table Amey Narkhede <ameynarkhede03(a)gmail.com> staging: gdm724x: Fix DMA from stack Ilya Lipnitskiy <ilya.lipnitskiy(a)gmail.com> staging/mt7621-dma: mtk-hsdma.c->hsdma-mt7621.c Frank Wunderlich <frank-w(a)public-files.de> dts64: mt7622: fix slow sd card access Jiri Bohac <jbohac(a)suse.cz> pstore: Fix typo in compression option name Sabyrzhan Tasbolatov <snovitoll(a)gmail.com> drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue Ricky Wu <ricky_wu(a)realtek.com> misc: rtsx: init of rts522a add OCP power off when no card is present Paul Cercueil <paul(a)crapouillou.net> seccomp: Add missing return in non-void function Corentin Labbe <clabbe(a)baylibre.com> crypto: sun4i-ss - handle BigEndian for cipher Corentin Labbe <clabbe(a)baylibre.com> crypto: sun4i-ss - IV register does not work on A10 and A13 Corentin Labbe <clabbe(a)baylibre.com> crypto: sun4i-ss - checking sg length is not sufficient Ard Biesheuvel <ardb(a)kernel.org> crypto: arm64/sha - add missing module aliases Filipe Manana <fdmanana(a)suse.com> btrfs: fix extent buffer leak on failure to copy root Josef Bacik <josef(a)toxicpanda.com> btrfs: fix reloc root leak with 0 ref reloc roots on recovery Josef Bacik <josef(a)toxicpanda.com> btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: trusted: Fix migratable=1 failing James Bottomley <James.Bottomley(a)HansenPartnership.com> tpm_tis: Clean up locality release James Bottomley <James.Bottomley(a)HansenPartnership.com> tpm_tis: Fix check_locality for correct locality acquisition PeiSen Hou <pshou(a)realtek.com> ALSA: hda/realtek: modify EAPD in the ALC886 Dan Carpenter <dan.carpenter(a)oracle.com> USB: serial: mos7720: fix error code in mos7720_write() Dan Carpenter <dan.carpenter(a)oracle.com> USB: serial: mos7840: fix error code in mos7840_write() Johan Hovold <johan(a)kernel.org> USB: serial: ftdi_sio: fix FTX sub-integer prescaler Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1 Paul Cercueil <paul(a)crapouillou.net> usb: musb: Fix runtime PM race in musb_queue_resume_work Lech Perczak <lech.perczak(a)gmail.com> USB: serial: option: update interface mapping for ZTE P685M Marcos Paulo de Souza <mpdesouza(a)suse.com> Input: i8042 - add ASUS Zenbook Flip to noselftest list Dan Carpenter <dan.carpenter(a)oracle.com> Input: joydev - prevent potential read overflow in ioctl Olivier Crête <olivier.crete(a)ocrete.ca> Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S jeffrey.lin <jeffrey.lin(a)rad-ic.com> Input: raydium_ts_i2c - do not send zero length Jason Gerecke <killertofu(a)gmail.com> HID: wacom: Ignore attempts to overwrite the touch_max value from HID Qinglang Miao <miaoqinglang(a)huawei.com> ACPI: configfs: add missing check after configfs_register_default_group() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: property: Fix fwnode string properties matching Mikulas Patocka <mpatocka(a)redhat.com> blk-settings: align max_sectors on "logical_block_size" boundary Randy Dunlap <rdunlap(a)infradead.org> scsi: bnx2fc: Fix Kconfig warning & CNIC build errors Miaohe Lin <linmiaohe(a)huawei.com> mm/rmap: fix potential pte_unmap on an not mapped pte Maxime Ripard <maxime(a)cerno.tech> i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition Marc Zyngier <maz(a)kernel.org> arm64: Add missing ISB after invalidating TLB in __primary_switch Heiner Kallweit <hkallweit1(a)gmail.com> r8169: fix jumbo packet handling on RTL8168e Miaohe Lin <linmiaohe(a)huawei.com> mm/hugetlb: fix potential double free in hugetlb_register_node() error path Miaohe Lin <linmiaohe(a)huawei.com> mm/memory.c: fix potential pte_unmap_unlock pte error Dan Carpenter <dan.carpenter(a)oracle.com> ocfs2: fix a use after free on error Taehee Yoo <ap420073(a)gmail.com> vxlan: move debug check after netdev unregister Chuhong Yuan <hslester96(a)gmail.com> net/mlx4_core: Add missed mlx4_free_cmd_mailbox() Mateusz Palczewski <mateusz.palczewski(a)intel.com> i40e: Fix add TC filter for IPv6 Jann Horn <jannh(a)google.com> Take mmap lock in cacheflush syscall Sylwester Dziedziuch <sylwesterx.dziedziuch(a)intel.com> i40e: Fix VFs not created Mateusz Palczewski <mateusz.palczewski(a)intel.com> i40e: Fix overwriting flow control settings during driver loading Mateusz Palczewski <mateusz.palczewski(a)intel.com> i40e: Add zero-initialization of AQ command structures Slawomir Laba <slawomirx.laba(a)intel.com> i40e: Fix flow for IPv6 next header (extension header) Bard Liao <yung-chuan.liao(a)linux.intel.com> regmap: sdw: use _no_pm functions in regmap_read/write Theodore Ts'o <tytso(a)mit.edu> ext4: fix potential htree index checksum corruption Konrad Dybcio <konrad.dybcio(a)somainline.org> drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY) Heiner Kallweit <hkallweit1(a)gmail.com> PCI: Align checking of syscall user config accessors Jorgen Hansen <jhansen(a)vmware.com> VMCI: Use set_page_dirty_lock() when unregistering guest memory Simon South <simon(a)simonsouth.net> pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare() Aswath Govindraju <a-govindraju(a)ti.com> misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users Aswath Govindraju <a-govindraju(a)ti.com> misc: eeprom_93xx46: Fix module alias to enable module autoprobe Randy Dunlap <rdunlap(a)infradead.org> sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set Dan Carpenter <dan.carpenter(a)oracle.com> Input: elo - fix an error code in elo_connect() Namhyung Kim <namhyung(a)kernel.org> perf test: Fix unaligned access in sample parsing test Adrian Hunter <adrian.hunter(a)intel.com> perf intel-pt: Fix missing CYC processing in PSB Dan Carpenter <dan.carpenter(a)oracle.com> Input: sur40 - fix an error code in sur40_probe() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> spi: pxa2xx: Fix the controller numbering for Wildcat Point AngeloGioacchino Del Regno <angelogioacchino.delregno(a)somainline.org> clk: qcom: gcc-msm8998: Fix Alpha PLL type for all GPLLs Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/8xx: Fix software emulation interrupt Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/pseries/dlpar: handle ibm, configure-connector delay status Dan Carpenter <dan.carpenter(a)oracle.com> mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq() Alain Volmat <alain.volmat(a)foss.st.com> spi: stm32: properly handle 0 byte transfer Bob Pearson <rpearsonhpe(a)gmail.com> RDMA/rxe: Correct skb on loopback path Bob Pearson <rpearsonhpe(a)gmail.com> RDMA/rxe: Fix coding error in rxe_recv.c Arnaldo Carvalho de Melo <acme(a)redhat.com> perf tools: Fix DSO filtering when not finding a map for a sampled address Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracepoint: Do not fail unregistering a probe due to memory failure Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> amba: Fix resource leak for drivers without .remove Vladimir Murzin <vladimir.murzin(a)arm.com> ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores Takeshi Saito <takeshi.saito.xv(a)renesas.com> mmc: renesas_sdhi_internal_dmac: Fix DMA buffer alignment from 8 to 128-bytes Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/47x: Disable 256k page size Cédric Le Goater <clg(a)kaod.org> KVM: PPC: Make the VMX instruction emulation routines static Shay Drory <shayd(a)nvidia.com> IB/umad: Return EPOLLERR in case of when device disassociated Shay Drory <shayd(a)nvidia.com> IB/umad: Return EIO in case of when device disassociated Geert Uytterhoeven <geert(a)linux-m68k.org> auxdisplay: ht16k33: Fix refresh rate handling Pan Bian <bianpan2016(a)163.com> isofs: release buffer head before return Krzysztof Kozlowski <krzk(a)kernel.org> regulator: s5m8767: Drop regulators OF node reference Pan Bian <bianpan2016(a)163.com> spi: atmel: Put allocated master before return David Howells <dhowells(a)redhat.com> certs: Fix blacklist flag type confusion Pan Bian <bianpan2016(a)163.com> regulator: axp20x: Fix reference cout leak Andre Przywara <andre.przywara(a)arm.com> clk: sunxi-ng: h6: Fix clock divider range on some clocks Yishai Hadas <yishaih(a)nvidia.com> RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation Tom Rix <trix(a)redhat.com> clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined Bartosz Golaszewski <bgolaszewski(a)baylibre.com> rtc: s5m: select REGMAP_I2C Claudiu Beznea <claudiu.beznea(a)microchip.com> power: reset: at91-sama5d2_shdwc: fix wkupdbc mask Nicolas Boichat <drinkcat(a)chromium.org> of/fdt: Make sure no-map does not remove already reserved regions KarimAllah Ahmed <karahmed(a)amazon.de> fdt: Properly handle "no-map" field in the memory region Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> mfd: bd9571mwv: Use devm_mfd_add_devices() Ferry Toth <ftoth(a)exalondelft.nl> dmaengine: hsu: disable spurious interrupt Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> dmaengine: owl-dma: Fix a resource leak in the remove function Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> dmaengine: fsldma: Fix a resource leak in the remove function Randy Dunlap <rdunlap(a)infradead.org> HID: core: detect and skip invalid inputs to snto32() Andre Przywara <andre.przywara(a)arm.com> clk: sunxi-ng: h6: Fix CEC clock Pratyush Yadav <p.yadav(a)ti.com> spi: cadence-quadspi: Abort read if dummy cycles required are too many Jan Kara <jack(a)suse.cz> quota: Fix memory leak when handling corrupted quota file Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL Eric W. Biederman <ebiederm(a)xmission.com> capabilities: Don't allow writing ambiguous v3 file capabilities Tom Rix <trix(a)redhat.com> jffs2: fix use after free in jffs2_sum_write_data() Colin Ian King <colin.king(a)canonical.com> fs/jfs: fix potential integer overflow on shift of a int Lakshmi Ramasubramanian <nramas(a)linux.microsoft.com> ima: Free IMA measurement buffer after kexec syscall Lakshmi Ramasubramanian <nramas(a)linux.microsoft.com> ima: Free IMA measurement buffer on error Daniele Alessandrelli <daniele.alessandrelli(a)intel.com> crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key() Jan Henrik Weinstock <jan.weinstock(a)rwth-aachen.de> hwrng: timeriomem - Fix cooldown period calculation Zhihao Cheng <chengzhihao1(a)huawei.com> btrfs: clarify error returns values in __load_free_space_cache Andrea Parri (Microsoft) <parri.andrea(a)gmail.com> Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() Dan Carpenter <dan.carpenter(a)oracle.com> drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask() Yi Chen <chenyi77(a)huawei.com> f2fs: fix to avoid inconsistent quota data Sebastian Reichel <sre(a)kernel.org> ASoC: cpcap: fix microphone timeslot mask Florian Fainelli <f.fainelli(a)gmail.com> ata: ahci_brcm: Add back regulators management Christophe Leroy <christophe.leroy(a)csgroup.eu> crypto: talitos - Work around SEC6 ERRATA (AES-CTR mode data size error) Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values Tom Rix <trix(a)redhat.com> media: pxa_camera: declare variable when DEBUG is defined Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> media: cx25821: Fix a bug when reallocating some dma memory Luo Meng <luomeng12(a)huawei.com> media: qm1d1c0042: fix error return code in qm1d1c0042_init() Joe Perches <joe(a)perches.com> media: lmedm04: Fix misuse of comma Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Fix 10/12 bpc setup in DCE output bit depth reduction. Jiri Olsa <jolsa(a)kernel.org> crypto: bcm - Rename struct device_private to bcm_device_private Dan Carpenter <dan.carpenter(a)oracle.com> ASoC: cs42l56: fix up error handling in probe Dinghao Liu <dinghao.liu(a)zju.edu.cn> media: tm6000: Fix memleak in tm6000_start_stream Dinghao Liu <dinghao.liu(a)zju.edu.cn> media: media/pci: Fix memleak in empress_init Dinghao Liu <dinghao.liu(a)zju.edu.cn> media: em28xx: Fix use-after-free in em28xx_alloc_urbs Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> media: vsp1: Fix an error handling path in the probe function Dan Carpenter <dan.carpenter(a)oracle.com> media: camss: missing error code in msm_video_register() Jacopo Mondi <jacopo(a)jmondi.org> media: i2c: ov5670: Fix PIXEL_RATE minimum value Nathan Chancellor <natechancellor(a)gmail.com> MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0 Nathan Chancellor <natechancellor(a)gmail.com> MIPS: c-r4k: Fix section mismatch for loongson2_sc_init Chenyang Li <lichenyang(a)loongson.cn> drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if condition Corentin Labbe <clabbe(a)baylibre.com> crypto: sun4i-ss - fix kmap usage Dan Carpenter <dan.carpenter(a)oracle.com> gma500: clean up error handling in init Jialin Zhang <zhangjialin11(a)huawei.com> drm/gma500: Fix error return code in psb_driver_load() Randy Dunlap <rdunlap(a)infradead.org> fbdev: aty: SPARC64 requires FB_ATY_CT Maxime Chevallier <maxime.chevallier(a)bootlin.com> net: mvneta: Remove per-cpu queue mapping for Armada 3700 Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> net: amd-xgbe: Reset link when the link never comes back Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> net: amd-xgbe: Reset the PHY rx data path when mailbox command timeout Lijun Pan <ljp(a)linux.ibm.com> ibmvnic: skip send_request_unmap for timeout reset Lijun Pan <ljp(a)linux.ibm.com> ibmvnic: add memory barrier to protect long term buffer Colin Ian King <colin.king(a)canonical.com> b43: N-PHY: Fix the update of coef for the PHY revision >= 3case Ayush Sawal <ayush.sawal(a)chelsio.com> cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds Eric Dumazet <edumazet(a)google.com> tcp: fix SO_RCVLOWAT related hangs under mem pressure Jesper Dangaard Brouer <brouer(a)redhat.com> bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx Colin Ian King <colin.king(a)canonical.com> mac80211: fix potential overflow when multiplying to u32 integers Juergen Gross <jgross(a)suse.com> xen/netback: fix spurious event detection for common event case Edwin Peer <edwin.peer(a)broadcom.com> bnxt_en: reverse order of TX disable and carrier off Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: Set to CLOSED state even on error Linus Lüssing <ll(a)simonwunderlich.de> ath9k: fix data bus crash when setting nf_override via debugfs Marco Elver <elver(a)google.com> bpf_lru_list: Read double-checked variable once without lock Jae Hyun Yoo <jae.hyun.yoo(a)intel.com> soc: aspeed: snoop: Add clock control logic Arnd Bergmann <arnd(a)arndb.de> ARM: s3c: fix fiq for clang IAS Vincent Knecht <vincent.knecht(a)mailoo.org> arm64: dts: msm8916: Fix reserved and rfsa nodes unit address Rosen Penev <rosenp(a)gmail.com> ARM: dts: armada388-helios4: assign pinctrl to each fan Rosen Penev <rosenp(a)gmail.com> ARM: dts: armada388-helios4: assign pinctrl to LEDs Chen-Yu Tsai <wens(a)csie.org> staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory rules Guenter Roeck <linux(a)roeck-us.net> usb: dwc2: Make "trimming xfer length" a debug message Guenter Roeck <linux(a)roeck-us.net> usb: dwc2: Abort transaction after errors with unknown reason Guenter Roeck <linux(a)roeck-us.net> usb: dwc2: Do not update data length if it is 0 on inbound transfers Tony Lindgren <tony(a)atomide.com> ARM: dts: Configure missing thermal interrupt for 4430 Pan Bian <bianpan2016(a)163.com> memory: ti-aemif: Drop child node when jumping out loop Pan Bian <bianpan2016(a)163.com> Bluetooth: Put HCI device if inquiry procedure interrupts Pan Bian <bianpan2016(a)163.com> Bluetooth: drop HCI device reference before return Jack Pham <jackp(a)codeaurora.org> usb: gadget: u_audio: Free requests only after callback Maximilian Luz <luzmaximilian(a)gmail.com> ACPICA: Fix exception code class checks Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> cpufreq: brcmstb-avs-cpufreq: Free resources in error path Andre Przywara <andre.przywara(a)arm.com> arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz Andre Przywara <andre.przywara(a)arm.com> arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card Andre Przywara <andre.przywara(a)arm.com> arm64: dts: allwinner: A64: properly connect USB PHY to port 0 Andrii Nakryiko <andrii(a)kernel.org> bpf: Avoid warning when re-casting __bpf_call_base into __bpf_call_base_args Krzysztof Kozlowski <krzk(a)kernel.org> arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso Krzysztof Kozlowski <krzk(a)kernel.org> arm64: dts: exynos: correct PMIC interrupt trigger level on TM2 Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3 family Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Spring Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Monk Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: exynos: correct PMIC interrupt trigger level on Artik 5 Christopher William Snowhill <chris(a)kode54.net> Bluetooth: Fix initializing response id after clearing struct Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function Rakesh Pillai <pillair(a)codeaurora.org> ath10k: Fix error handling in case of CE pipe init failure Eric Biggers <ebiggers(a)google.com> random: fix the RNDRESEEDCRNG ioctl Alexander Lobakin <alobakin(a)pm.me> MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode Jan Kara <jack(a)suse.cz> bfq: Avoid false bfq queue merging Ansuel Smith <ansuelsmth(a)gmail.com> PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064 Sumit Garg <sumit.garg(a)linaro.org> kdb: Make memory allocations more robust Nick Desaulniers <ndesaulniers(a)google.com> vmlinux.lds.h: add DWARF v5 sections Peter Zijlstra <peterz(a)infradead.org> locking/static_key: Fix false positive warnings on concurrent dec/inc Peter Zijlstra <peterz(a)infradead.org> jump_label/lockdep: Assert we hold the hotplug lock for _cpuslocked() operations Rong Chen <rong.a.chen(a)intel.com> scripts/recordmcount.pl: support big endian for ARCH sh Shyam Prasad N <sprasad(a)microsoft.com> cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath. Christoph Schemmel <christoph.schemmel(a)gmail.com> NET: usb: qmi_wwan: Adding support for Cinterion MV31 Ming Lei <ming.lei(a)redhat.com> block: don't release queue's sysfs lock during switching elevator Ming Lei <ming.lei(a)redhat.com> block: fix race between switching elevator and removing queues Ming Lei <ming.lei(a)redhat.com> block: split .sysfs_lock into two locks Ming Lei <ming.lei(a)redhat.com> block: add helper for checking if queue is registered Rolf Eike Beer <eb(a)emlix.com> scripts: set proper OpenSSL include dir also for sign-file Rolf Eike Beer <eb(a)emlix.com> scripts: use pkg-config to locate libcrypto Sameer Pujar <spujar(a)nvidia.com> arm64: tegra: Add power-domain for Tegra210 HDA Rustam Kovhaev <rkovhaev(a)gmail.com> ntfs: check for valid standard information attribute Stefan Ursella <stefan.ursella(a)wolfvision.net> usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable Johan Hovold <johan(a)kernel.org> USB: quirks: sort quirk entries Will McVicker <willmcvicker(a)google.com> HID: make arrays usage and value to be the same ------------- Diffstat: Documentation/filesystems/seq_file.txt | 6 + Makefile | 4 +- arch/arm/boot/compressed/head.S | 4 +- arch/arm/boot/dts/armada-388-helios4.dts | 28 +++- arch/arm/boot/dts/exynos3250-artik5.dtsi | 2 +- arch/arm/boot/dts/exynos3250-monk.dts | 2 +- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- arch/arm/boot/dts/exynos5250-spring.dts | 2 +- arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +- arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 2 +- arch/arm/boot/dts/omap443x.dtsi | 2 + arch/arm64/Kconfig | 2 +- .../boot/dts/allwinner/sun50i-a64-pinebook.dts | 5 +- .../boot/dts/allwinner/sun50i-a64-sopine.dtsi | 1 - arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 6 +- .../boot/dts/exynos/exynos5433-tm2-common.dtsi | 2 +- arch/arm64/boot/dts/exynos/exynos7-espresso.dts | 2 +- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 + arch/arm64/boot/dts/nvidia/tegra210.dtsi | 1 + arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +- arch/arm64/crypto/sha1-ce-glue.c | 1 + arch/arm64/crypto/sha2-ce-glue.c | 2 + arch/arm64/crypto/sha3-ce-glue.c | 4 + arch/arm64/crypto/sha512-ce-glue.c | 2 + arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/head.S | 1 + arch/arm64/kernel/probes/uprobes.c | 2 +- arch/mips/kernel/vmlinux.lds.S | 1 + arch/mips/lantiq/irq.c | 2 +- arch/mips/mm/c-r4k.c | 2 +- arch/nios2/kernel/sys_nios2.c | 11 +- arch/powerpc/Kconfig | 2 +- arch/powerpc/kernel/head_8xx.S | 2 +- arch/powerpc/kvm/powerpc.c | 8 +- arch/powerpc/platforms/pseries/dlpar.c | 7 +- arch/sparc/Kconfig | 2 +- arch/sparc/lib/memset.S | 1 + arch/x86/kernel/reboot.c | 29 ++-- arch/x86/mm/pat.c | 3 +- block/bfq-iosched.c | 1 + block/blk-core.c | 1 + block/blk-mq-sysfs.c | 12 +- block/blk-settings.c | 12 ++ block/blk-sysfs.c | 49 ++++--- block/blk-wbt.c | 2 +- block/blk.h | 2 +- block/elevator.c | 30 ++-- certs/blacklist.c | 2 +- crypto/ecdh_helper.c | 3 + drivers/acpi/acpi_configfs.c | 7 +- drivers/acpi/property.c | 44 ++++-- drivers/amba/bus.c | 20 +-- drivers/ata/ahci_brcm.c | 14 +- drivers/auxdisplay/ht16k33.c | 3 +- drivers/base/regmap/regmap-sdw.c | 4 +- drivers/block/floppy.c | 27 ++-- drivers/bluetooth/btqcomsmd.c | 27 ++-- drivers/char/hw_random/timeriomem-rng.c | 2 +- drivers/char/random.c | 2 +- drivers/char/tpm/tpm_tis_core.c | 50 +------ drivers/clk/meson/clk-pll.c | 2 +- drivers/clk/qcom/gcc-msm8998.c | 100 ++++++------- drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 10 +- drivers/clocksource/mxs_timer.c | 5 +- drivers/cpufreq/brcmstb-avs-cpufreq.c | 24 +++- drivers/cpufreq/intel_pstate.c | 5 +- drivers/crypto/bcm/cipher.c | 2 +- drivers/crypto/bcm/cipher.h | 4 +- drivers/crypto/bcm/util.c | 2 +- drivers/crypto/chelsio/chtls/chtls_cm.h | 3 - drivers/crypto/sunxi-ss/sun4i-ss-cipher.c | 159 +++++++++++++-------- drivers/crypto/talitos.c | 28 ++-- drivers/crypto/talitos.h | 1 + drivers/dma/fsldma.c | 6 + drivers/dma/hsu/pci.c | 21 +-- drivers/dma/owl-dma.c | 1 + drivers/gpio/gpio-pcf857x.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 2 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 8 +- drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 +-- drivers/gpu/drm/gma500/psb_drv.c | 2 + drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c | 2 +- drivers/hid/hid-core.c | 9 +- drivers/hid/wacom_wac.c | 7 +- drivers/hv/channel_mgmt.c | 3 +- drivers/i2c/busses/i2c-brcmstb.c | 2 +- drivers/infiniband/core/user_mad.c | 17 ++- drivers/infiniband/hw/mlx5/devx.c | 4 +- drivers/infiniband/sw/rxe/rxe_net.c | 5 + drivers/infiniband/sw/rxe/rxe_recv.c | 11 +- drivers/input/joydev.c | 7 +- drivers/input/joystick/xpad.c | 1 + drivers/input/serio/i8042-x86ia64io.h | 4 + drivers/input/touchscreen/elo.c | 4 +- drivers/input/touchscreen/raydium_i2c_ts.c | 3 +- drivers/input/touchscreen/sur40.c | 1 + drivers/md/dm-core.h | 4 + drivers/md/dm-crypt.c | 1 + drivers/md/dm-era-target.c | 93 +++++++----- drivers/md/dm.c | 60 ++++++++ drivers/media/i2c/ov5670.c | 3 +- drivers/media/pci/cx25821/cx25821-core.c | 4 +- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 2 +- drivers/media/pci/saa7134/saa7134-empress.c | 5 +- drivers/media/platform/pxa_camera.c | 3 + drivers/media/platform/qcom/camss/camss-video.c | 1 + drivers/media/platform/vsp1/vsp1_drv.c | 4 +- drivers/media/tuners/qm1d1c0042.c | 4 +- drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +- drivers/media/usb/em28xx/em28xx-core.c | 6 +- drivers/media/usb/tm6000/tm6000-dvb.c | 4 + drivers/media/usb/uvc/uvc_v4l2.c | 18 +-- drivers/memory/ti-aemif.c | 8 +- drivers/mfd/bd9571mwv.c | 6 +- drivers/mfd/wm831x-auxadc.c | 3 +- drivers/misc/aspeed-lpc-snoop.c | 30 +++- drivers/misc/cardreader/rts5227.c | 5 + drivers/misc/eeprom/eeprom_93xx46.c | 1 + drivers/misc/vmw_vmci/vmci_queue_pair.c | 5 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 4 +- drivers/mmc/host/sdhci-esdhc-imx.c | 3 +- drivers/mmc/host/usdhi6rol0.c | 4 +- drivers/mtd/spi-nor/cadence-quadspi.c | 2 +- drivers/mtd/spi-nor/hisi-sfc.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 14 ++ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 3 +- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 39 ++++- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 3 + drivers/net/ethernet/chelsio/cxgb4/sge.c | 11 +- drivers/net/ethernet/ibm/ibmvnic.c | 16 ++- drivers/net/ethernet/intel/i40e/i40e_main.c | 41 ++---- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 9 +- drivers/net/ethernet/marvell/mvneta.c | 9 +- .../net/ethernet/mellanox/mlx4/resource_tracker.c | 1 + drivers/net/ethernet/realtek/r8169.c | 4 +- drivers/net/ethernet/sun/sunvnet_common.c | 23 +-- drivers/net/gtp.c | 5 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/vxlan.c | 11 +- drivers/net/wireless/ath/ath10k/snoc.c | 5 +- drivers/net/wireless/ath/ath9k/debug.c | 5 +- drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- drivers/net/xen-netback/interface.c | 8 +- drivers/nvdimm/dimm_devs.c | 18 ++- drivers/of/fdt.c | 12 +- drivers/pci/controller/dwc/pcie-qcom.c | 4 +- drivers/pci/syscall.c | 10 +- drivers/power/reset/at91-sama5d2_shdwc.c | 2 +- drivers/pwm/pwm-rockchip.c | 1 - drivers/regulator/axp20x-regulator.c | 7 +- drivers/regulator/s5m8767.c | 8 +- drivers/rtc/Kconfig | 1 + drivers/scsi/bnx2fc/Kconfig | 1 + drivers/spi/spi-atmel.c | 2 +- drivers/spi/spi-pxa2xx-pci.c | 27 ++-- drivers/spi/spi-s3c24xx-fiq.S | 9 +- drivers/spi/spi-stm32.c | 4 + drivers/staging/gdm724x/gdm_usb.c | 10 +- drivers/staging/mt7621-dma/Makefile | 2 +- .../mt7621-dma/{mtk-hsdma.c => hsdma-mt7621.c} | 2 +- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + drivers/staging/rtl8723bs/os_dep/wifi_regd.c | 2 +- drivers/target/iscsi/cxgbit/cxgbit_target.c | 3 +- drivers/usb/core/quirks.c | 9 +- drivers/usb/dwc2/hcd.c | 15 +- drivers/usb/dwc2/hcd_intr.c | 14 +- drivers/usb/dwc3/gadget.c | 19 ++- drivers/usb/gadget/function/u_audio.c | 17 ++- drivers/usb/musb/musb_core.c | 31 ++-- drivers/usb/serial/ftdi_sio.c | 5 +- drivers/usb/serial/mos7720.c | 4 +- drivers/usb/serial/mos7840.c | 4 +- drivers/usb/serial/option.c | 3 +- drivers/video/fbdev/Kconfig | 2 +- drivers/watchdog/mei_wdt.c | 1 + fs/affs/namei.c | 4 +- fs/btrfs/ctree.c | 7 +- fs/btrfs/free-space-cache.c | 6 +- fs/btrfs/relocation.c | 4 +- fs/cifs/connect.c | 1 + fs/ext4/namei.c | 7 +- fs/f2fs/file.c | 7 +- fs/f2fs/inline.c | 4 + fs/gfs2/lock_dlm.c | 8 +- fs/isofs/dir.c | 1 + fs/isofs/namei.c | 1 + fs/jffs2/summary.c | 3 + fs/jfs/jfs_dmap.c | 2 +- fs/ntfs/inode.c | 6 + fs/ocfs2/cluster/heartbeat.c | 8 +- fs/pstore/platform.c | 4 +- fs/quota/quota_v2.c | 11 +- include/acpi/acexcep.h | 10 +- include/asm-generic/vmlinux.lds.h | 7 +- include/linux/blkdev.h | 2 + include/linux/device-mapper.h | 5 + include/linux/filter.h | 2 +- include/linux/icmpv6.h | 44 +++++- include/linux/ipv6.h | 2 +- include/linux/kexec.h | 5 + include/linux/key.h | 1 + include/linux/rmap.h | 3 +- include/net/icmp.h | 10 ++ include/net/tcp.h | 9 +- kernel/bpf/bpf_lru_list.c | 7 +- kernel/debug/kdb/kdb_private.h | 2 +- kernel/jump_label.c | 26 ++-- kernel/kexec_file.c | 5 + kernel/module.c | 21 ++- kernel/printk/printk_safe.c | 16 ++- kernel/seccomp.c | 2 + kernel/tracepoint.c | 80 ++++++++--- mm/hugetlb.c | 4 +- mm/memory.c | 16 ++- net/bluetooth/a2mp.c | 3 +- net/bluetooth/hci_core.c | 6 +- net/core/filter.c | 13 +- net/ipv4/icmp.c | 34 +++++ net/ipv6/icmp.c | 19 +-- net/ipv6/ip6_icmp.c | 46 +++++- net/mac80211/mesh_hwmp.c | 2 +- net/qrtr/tun.c | 12 +- net/xfrm/xfrm_interface.c | 6 +- scripts/Makefile | 9 +- scripts/recordmcount.pl | 6 +- security/commoncap.c | 12 +- security/integrity/ima/ima_kexec.c | 3 + security/integrity/ima/ima_mok.c | 5 +- security/keys/key.c | 2 + security/keys/trusted.c | 2 +- sound/pci/hda/patch_realtek.c | 11 ++ sound/soc/codecs/cpcap.c | 12 +- sound/soc/codecs/cs42l56.c | 3 +- sound/usb/pcm.c | 2 +- tools/perf/tests/sample-parsing.c | 2 +- tools/perf/util/event.c | 2 + .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 + 240 files changed, 1568 insertions(+), 737 deletions(-)

3 years

11
276
0 0

[PATCH] PCI: xgene: Fix IB window setup

by Rob Herring

Commit 6dce5aa59e0b ("PCI: xgene: Use inbound resources for setup") broke PCI support on XGene. The cause is the IB resources are now sorted in address order instead of being in DT dma-ranges order. The result is which inbound registers are used for each region are swapped. I don't know the details about this h/w, but it appears that IB region 0 registers can't handle a size greater than 4GB. In any case, limiting the size for region 0 is enough to get back to the original assignment of dma-ranges to regions. Reported-by: Stéphane Graber <stgraber(a)ubuntu.com> Fixes: 6dce5aa59e0b ("PCI: xgene: Use inbound resources for setup") Link: https://lore.kernel.org/all/CA+enf=v9rY_xnZML01oEgKLmvY1NGBUUhnSJaETmXtDtXf… Cc: stable(a)vger.kernel.org # v5.5+ Signed-off-by: Rob Herring <robh(a)kernel.org> --- drivers/pci/controller/pci-xgene.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/controller/pci-xgene.c b/drivers/pci/controller/pci-xgene.c index 56d0d50338c8..d83dbd977418 100644 --- a/drivers/pci/controller/pci-xgene.c +++ b/drivers/pci/controller/pci-xgene.c @@ -465,7 +465,7 @@ static int xgene_pcie_select_ib_reg(u8 *ib_reg_mask, u64 size) return 1; } - if ((size > SZ_1K) && (size < SZ_1T) && !(*ib_reg_mask & (1 << 0))) { + if ((size > SZ_1K) && (size < SZ_4G) && !(*ib_reg_mask & (1 << 0))) { *ib_reg_mask |= (1 << 0); return 0; } -- 2.32.0

3 years, 1 month

6
12
0 0

[PATCH v2] drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX

by Brian Norris

If the display is not enable()d, then we aren't holding a runtime PM reference here. Thus, it's easy to accidentally cause a hang, if user space is poking around at /dev/drm_dp_aux0 at the "wrong" time. Let's get the panel and PM state right before trying to talk AUX. Fixes: 0d97ad03f422 ("drm/bridge: analogix_dp: Remove duplicated code") Cc: <stable(a)vger.kernel.org> Cc: Tomeu Vizoso <tomeu.vizoso(a)collabora.com> Signed-off-by: Brian Norris <briannorris(a)chromium.org> --- Changes in v2: - Fix spelling in Subject - DRM_DEV_ERROR() -> drm_err() - Propagate errors from un-analogix_dp_prepare_panel() .../drm/bridge/analogix/analogix_dp_core.c | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c index b7d2e4449cfa..6fc46ac93ef8 100644 --- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c @@ -1632,8 +1632,27 @@ static ssize_t analogix_dpaux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg) { struct analogix_dp_device *dp = to_dp(aux); + int ret, ret2; - return analogix_dp_transfer(dp, msg); + ret = analogix_dp_prepare_panel(dp, true, false); + if (ret) { + drm_err(dp->drm_dev, "Failed to prepare panel (%d)\n", ret); + return ret; + } + + pm_runtime_get_sync(dp->dev); + ret = analogix_dp_transfer(dp, msg); + pm_runtime_put(dp->dev); + + ret2 = analogix_dp_prepare_panel(dp, false, false); + if (ret2) { + drm_err(dp->drm_dev, "Failed to unprepare panel (%d)\n", ret2); + /* Prefer the analogix_dp_transfer() error, if it exists. */ + if (!ret) + ret = ret2; + } + + return ret; } struct analogix_dp_device * -- 2.33.0.800.g4c38ced690-goog

3 years, 1 month

3
8
0 0

Re: [PATCH 2/2] arm64: dts: juno: Enable more SMMUs

by Robin Murphy

On 2021-07-30 12:35, Anders Roxell wrote: > From: Robin Murphy <robin.murphy(a)arm.com> > >> Now that PCI inbound window restrictions are handled generically between >> the of_pci resource parsing and the IOMMU layer, and described in the >> Juno DT, we can finally enable the PCIe SMMU without the risk of DMA >> mappings inadvertently allocating unusable addresses. >> >> Similarly, the relevant support for IOMMU mappings for peripheral >> transfers has been hooked up in the pl330 driver for ages, so we can >> happily enable the DMA SMMU without that breaking anything either. >> >> Signed-off-by: Robin Murphy <robin.murphy(a)arm.com> > > When we build a kernel with 64k page size and run the ltp syscalls we > sporadically see a kernel crash while doing a mkfs on a connected SATA > drive. This is happening every third test run on any juno-r2 device in > the lab with the same kernel image (stable-rc 5.13.y, mainline and next) > with gcc-11. Hmm, I guess 64K pages might make a difference in that we'll chew through IOVA space a lot faster with small mappings... I'll have to try to reproduce this locally, since the interesting thing would be knowing what DMA address it was trying to use that went wrong, but IOMMU tracepoints and/or dma-debug are going to generate an crazy amount of data to sift through and try to correlate - having done it before it's not something I'd readily ask someone else to do for me :) On a hunch, though, does it make any difference if you remove the first entry from the PCIe "dma-ranges" (the 0x2c1c0000 one)? Robin. > Here is a snippet of the boot log [1]: > > + mkfs -t ext4 /dev/disk/by-id/ata-SanDisk_SDSSDA120G_165192443611 > mke2fs 1.43.8 (1-Jan-2018) > Discarding device blocks: 4096/29305200 > [ 55.344291] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x6 > frozen > [ 55.351423] ata1.00: irq_stat 0x00020002, failed to transmit command > FIS > [ 55.358205] ata1.00: failed command: DATA SET MANAGEMENT > [ 55.363561] ata1.00: cmd 06/01:01:00:00:00/00:00:00:00:00/a0 tag 12 > dma 512 out > [ 55.363561] res ec/ff:00:00:00:00/00:00:00:00:ec/00 Emask > 0x12 (ATA bus error) > [ 55.378955] ata1.00: status: { Busy } > [ 55.382658] ata1.00: error: { ICRC UNC AMNF IDNF ABRT } > [ 55.387947] ata1: hard resetting link > [ 55.391653] ata1: controller in dubious state, performing PORT_RST > [ 57.588447] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 0) > [ 57.613471] ata1.00: configured for UDMA/100 > [ 57.617866] ata1.00: device reported invalid CHS sector 0 > [ 57.623397] ata1: EH complete > > > When we revert this patch we don't see any issue. > > Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org> > > Cheers, > Anders > [1] > https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.13.y/build/v5.13… >

3 years, 1 month

4
9
0 0

[PATCH v3] mmc: core: Add a card quirk for non-hw busy detection

by Linus Walleij

Some boot partitions on the Samsung 4GB KLM4G1YE4C "4YMD1R" and "M4G1YC" cards appear broken when accessed randomly. CMD6 to switch back to the main partition randomly stalls after CMD18 access to the boot partition 1, and the card never comes back online. The accesses to the boot partitions work several times before this happens, but eventually the card access hangs while initializing the card. Some problematic eMMC cards are found in the Samsung GT-S7710 (Skomer) and SGH-I407 (Kyle) mobile phones. I tried using only single blocks with CMD17 on the boot partitions with the result that it crashed even faster. After a bit of root cause analysis it turns out that these old eMMC cards probably cannot do hardware busy detection (monitoring DAT0) properly. The card survives on older kernels, but this is because recent kernels have added busy detection handling for the SoC used in these phones, exposing the issue. Construct a quirk that makes the MMC cord avoid using the ->card_busy() callback if the card is listed with MMC_QUIRK_BROKEN_HW_BUSY_DETECT and register the known problematic cards. The core changes are pretty straight-forward with a helper inline to check of we can use hardware busy detection. On the MMCI host we have to counter the fact that if the host was able to use busy detect, it would be used unsolicited in the command IRQ callback. Rewrite this so that MMCI will not attempt to use hardware busy detection in the command IRQ until: - A card is attached to the host and - We know that the card can handle this busy detection I have glanced over the ->card_busy() callbacks on some other hosts and they seem to mostly read a register reflecting the value of DAT0 for this which works fine with the quirk in this patch. However if the error appear on other hosts they might need additional fixes. After applying this patch, the main partition can be accessed and mounted without problems on Samsung GT-S7710 and SGH-I407. Fixes: cb0335b778c7 ("mmc: mmci: add busy_complete callback") Cc: stable(a)vger.kernel.org Cc: phone-devel(a)vger.kernel.org Cc: Ludovic Barre <ludovic.barre(a)st.com> Cc: Stephan Gerhold <stephan(a)gerhold.net> Reported-by: newbyte(a)disroot.org Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- ChangeLog v2->v3: - Rebase on v5.14-rc1 - Reword the commit message slightly. ChangeLog v1->v2: - Rewrite to reflect the actual problem of broken busy detection. --- drivers/mmc/core/core.c | 8 ++++---- drivers/mmc/core/core.h | 17 +++++++++++++++++ drivers/mmc/core/mmc_ops.c | 4 ++-- drivers/mmc/core/quirks.h | 21 +++++++++++++++++++++ drivers/mmc/host/mmci.c | 22 ++++++++++++++++++++-- include/linux/mmc/card.h | 1 + 6 files changed, 65 insertions(+), 8 deletions(-) diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c index 95fedcf56e4a..e08dd9ea3d46 100644 --- a/drivers/mmc/core/core.c +++ b/drivers/mmc/core/core.c @@ -232,7 +232,7 @@ static void __mmc_start_request(struct mmc_host *host, struct mmc_request *mrq) * And bypass I/O abort, reset and bus suspend operations. */ if (sdio_is_io_busy(mrq->cmd->opcode, mrq->cmd->arg) && - host->ops->card_busy) { + mmc_hw_busy_detect(host)) { int tries = 500; /* Wait aprox 500ms at maximum */ while (host->ops->card_busy(host) && --tries) @@ -1200,7 +1200,7 @@ int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr) */ if (!host->ops->start_signal_voltage_switch) return -EPERM; - if (!host->ops->card_busy) + if (!mmc_hw_busy_detect(host)) pr_warn("%s: cannot verify signal voltage switch\n", mmc_hostname(host)); @@ -1220,7 +1220,7 @@ int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr) * after the response of cmd11, but wait 1 ms to be sure */ mmc_delay(1); - if (host->ops->card_busy && !host->ops->card_busy(host)) { + if (mmc_hw_busy_detect(host) && !host->ops->card_busy(host)) { err = -EAGAIN; goto power_cycle; } @@ -1241,7 +1241,7 @@ int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr) * Failure to switch is indicated by the card holding * dat[0:3] low */ - if (host->ops->card_busy && host->ops->card_busy(host)) + if (mmc_hw_busy_detect(host) && host->ops->card_busy(host)) err = -EAGAIN; power_cycle: diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h index 0c4de2030b3f..6a5619eed4a6 100644 --- a/drivers/mmc/core/core.h +++ b/drivers/mmc/core/core.h @@ -181,4 +181,21 @@ static inline int mmc_flush_cache(struct mmc_host *host) return 0; } +/** + * mmc_hw_busy_detect() - Can we use hw busy detection? + * @host: the host in question + */ +static inline bool mmc_hw_busy_detect(struct mmc_host *host) +{ + struct mmc_card *card = host->card; + bool has_ops; + bool able = true; + + has_ops = (host->ops->card_busy != NULL); + if (card) + able = !(card->quirks & MMC_QUIRK_BROKEN_HW_BUSY_DETECT); + + return (has_ops && able); +} + #endif diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c index 973756ed4016..546fc799a8e5 100644 --- a/drivers/mmc/core/mmc_ops.c +++ b/drivers/mmc/core/mmc_ops.c @@ -435,7 +435,7 @@ static int mmc_busy_cb(void *cb_data, bool *busy) u32 status = 0; int err; - if (host->ops->card_busy) { + if (mmc_hw_busy_detect(host)) { *busy = host->ops->card_busy(host); return 0; } @@ -597,7 +597,7 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value, * when it's not allowed to poll by using CMD13, then we need to rely on * waiting the stated timeout to be sufficient. */ - if (!send_status && !host->ops->card_busy) { + if (!send_status && !mmc_hw_busy_detect(host)) { mmc_delay(timeout_ms); goto out_tim; } diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h index d68e6e513a4f..8da6526f0eb0 100644 --- a/drivers/mmc/core/quirks.h +++ b/drivers/mmc/core/quirks.h @@ -99,6 +99,27 @@ static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = { MMC_FIXUP("V10016", CID_MANFID_KINGSTON, CID_OEMID_ANY, add_quirk_mmc, MMC_QUIRK_TRIM_BROKEN), + /* + * Some older Samsung eMMCs have broken hardware busy detection. + * Enabling this feature in the host controller can make the card + * accesses lock up completely. + */ + MMC_FIXUP("4YMD1R", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_BROKEN_HW_BUSY_DETECT), + /* Samsung KLMxGxxE4x eMMCs from 2012: 4, 8, 16, 32 and 64 GB */ + MMC_FIXUP("M4G1YC", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_BROKEN_HW_BUSY_DETECT), + MMC_FIXUP("M8G1WA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_BROKEN_HW_BUSY_DETECT), + MMC_FIXUP("MAG2WA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_BROKEN_HW_BUSY_DETECT), + MMC_FIXUP("MBG4WA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_BROKEN_HW_BUSY_DETECT), + MMC_FIXUP("MAG2WA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_BROKEN_HW_BUSY_DETECT), + MMC_FIXUP("MCG8WA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc, + MMC_QUIRK_BROKEN_HW_BUSY_DETECT), + END_FIXUP }; diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c index 984d35055156..3046917b2b67 100644 --- a/drivers/mmc/host/mmci.c +++ b/drivers/mmc/host/mmci.c @@ -347,6 +347,24 @@ static int mmci_card_busy(struct mmc_host *mmc) return busy; } +/* Use this if the MMCI variant AND the card supports it */ +static bool mmci_use_busy_detect(struct mmci_host *host) +{ + struct mmc_card *card = host->mmc->card; + + if (!host->variant->busy_detect) + return false; + + /* We don't allow this until we know that the card can handle it */ + if (!card) + return false; + + if (card->quirks & MMC_QUIRK_BROKEN_HW_BUSY_DETECT) + return false; + + return true; +} + static void mmci_reg_delay(struct mmci_host *host) { /* @@ -1381,7 +1399,7 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd, return; /* Handle busy detection on DAT0 if the variant supports it. */ - if (busy_resp && host->variant->busy_detect) + if (busy_resp && mmci_use_busy_detect(host)) if (!host->ops->busy_complete(host, status, err_msk)) return; @@ -1725,7 +1743,7 @@ static void mmci_set_max_busy_timeout(struct mmc_host *mmc) struct mmci_host *host = mmc_priv(mmc); u32 max_busy_timeout = 0; - if (!host->variant->busy_detect) + if (!mmci_use_busy_detect(host)) return; if (host->variant->busy_timeout && mmc->actual_clock) diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h index 74e6c0624d27..525a39951c6d 100644 --- a/include/linux/mmc/card.h +++ b/include/linux/mmc/card.h @@ -280,6 +280,7 @@ struct mmc_card { /* for byte mode */ #define MMC_QUIRK_NONSTD_SDIO (1<<2) /* non-standard SDIO card attached */ /* (missing CIA registers) */ +#define MMC_QUIRK_BROKEN_HW_BUSY_DETECT (1<<3) /* Disable hardware busy detection on DAT0 */ #define MMC_QUIRK_NONSTD_FUNC_IF (1<<4) /* SDIO card has nonstd function interfaces */ #define MMC_QUIRK_DISABLE_CD (1<<5) /* disconnect CD/DAT[3] resistor */ #define MMC_QUIRK_INAND_CMD38 (1<<6) /* iNAND devices have broken CMD38 */ -- 2.31.1

3 years, 1 month

3
5
0 0

Re: uring regression - lost write request

by Jens Axboe

On 11/24/21 8:28 AM, Jens Axboe wrote: > On 11/23/21 8:27 PM, Daniel Black wrote: >> On Mon, Nov 15, 2021 at 7:55 AM Jens Axboe <axboe(a)kernel.dk> wrote: >>> >>> On 11/14/21 1:33 PM, Daniel Black wrote: >>>> On Fri, Nov 12, 2021 at 10:44 AM Jens Axboe <axboe(a)kernel.dk> wrote: >>>>> >>>>> Alright, give this one a go if you can. Against -git, but will apply to >>>>> 5.15 as well. >>>> >>>> >>>> Works. Thank you very much. >>>> >>>> https://jira.mariadb.org/browse/MDEV-26674?page=com.atlassian.jira.plugin.s… >>>> >>>> Tested-by: Marko Mäkelä <marko.makela(a)mariadb.com> >>> >>> The patch is already upstream (and in the 5.15 stable queue), and I >>> provided 5.14 patches too. >> >> Jens, >> >> I'm getting the same reproducer on 5.14.20 >> (https://bugzilla.redhat.com/show_bug.cgi?id=2018882#c3) though the >> backport change logs indicate 5.14.19 has the patch. >> >> Anything missing? > > We might also need another patch that isn't in stable, I'm attaching > it here. Any chance you can run 5.14.20/21 with this applied? If not, > I'll do some sanity checking here and push it to -stable. Looks good to me - Greg, would you mind queueing this up for 5.14-stable? -- Jens Axboe

3 years, 1 month

4
9
0 0

[PATCH] io_uring: prevent io_put_identity() from freeing a static identity

by Tadeusz Struk

Note: this applies to 5.10 stable only. It doesn't trigger on anything above 5.10 as the code there has been substantially reworked. This also doesn't apply to any stable kernel below 5.10 afaict. Syzbot found a bug: KASAN: invalid-free in io_dismantle_req https://syzkaller.appspot.com/bug?id=123d9a852fc88ba573ffcb2dbcf4f9576c3b05… The test submits bunch of io_uring writes and exits, which then triggers uring_task_cancel() and io_put_identity(), which in some corner cases, tries to free a static identity. This causes a panic as shown in the trace below: BUG: KASAN: double-free or invalid-free in kfree+0xd5/0x310 CPU: 0 PID: 4618 Comm: repro Not tainted 5.10.76-05281-g4944ec82ebb9-dirty #17 Call Trace: dump_stack_lvl+0x1b2/0x21b print_address_description+0x8d/0x3b0 kasan_report_invalid_free+0x58/0x130 ____kasan_slab_free+0x14b/0x170 __kasan_slab_free+0x11/0x20 slab_free_freelist_hook+0xcc/0x1a0 kfree+0xd5/0x310 io_dismantle_req+0x9b0/0xd90 io_do_iopoll+0x13a4/0x23e0 io_iopoll_try_reap_events+0x116/0x290 io_uring_cancel_task_requests+0x197d/0x1ee0 io_uring_flush+0x170/0x6d0 filp_close+0xb0/0x150 put_files_struct+0x1d4/0x350 exit_files+0x80/0xa0 do_exit+0x6d9/0x2390 do_group_exit+0x16a/0x2d0 get_signal+0x133e/0x1f80 arch_do_signal+0x7b/0x610 exit_to_user_mode_prepare+0xaa/0xe0 syscall_exit_to_user_mode+0x24/0x40 do_syscall_64+0x3d/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 4611: ____kasan_kmalloc+0xcd/0x100 __kasan_kmalloc+0x9/0x10 kmem_cache_alloc_trace+0x208/0x390 io_uring_alloc_task_context+0x57/0x550 io_uring_add_task_file+0x1f7/0x290 io_uring_create+0x2195/0x3490 __x64_sys_io_uring_setup+0x1bf/0x280 do_syscall_64+0x31/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff88810732b500 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 88 bytes inside of 192-byte region [ffff88810732b500, ffff88810732b5c0) Kernel panic - not syncing: panic_on_warn set ... This issue bisected to this commit: commit 186725a80c4e ("io_uring: fix skipping disabling sqo on exec") Simple reverting the offending commit doesn't work as it hits some other, related issues like: /* sqo_dead check is for when this happens after cancellation */ WARN_ON_ONCE(ctx->sqo_task == current && !ctx->sqo_dead && !xa_load(&tctx->xa, (unsigned long)file)); ------------[ cut here ]------------ WARNING: CPU: 1 PID: 5622 at fs/io_uring.c:8960 io_uring_flush+0x5bc/0x6d0 Modules linked in: CPU: 1 PID: 5622 Comm: repro Not tainted 5.10.76-05281-g4944ec82ebb9-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-6.fc35 04/01/2014 RIP: 0010:io_uring_flush+0x5bc/0x6d0 Call Trace: filp_close+0xb0/0x150 put_files_struct+0x1d4/0x350 reset_files_struct+0x88/0xa0 bprm_execve+0x7f2/0x9f0 do_execveat_common+0x46f/0x5d0 __x64_sys_execve+0x92/0xb0 do_syscall_64+0x31/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Changing __io_uring_task_cancel() to call io_disable_sqo_submit() directly, as the comment suggests, only if __io_uring_files_cancel() is not executed seems to fix the issue. Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Alexander Viro <viro(a)zeniv.linux.org.uk> Cc: <io-uring(a)vger.kernel.org> Cc: <linux-fsdevel(a)vger.kernel.org> Cc: <linux-kernel(a)vger.kernel.org> Cc: <stable(a)vger.kernel.org> Reported-by: syzbot+6055980d041c8ac23307(a)syzkaller.appspotmail.com Signed-off-by: Tadeusz Struk <tadeusz.struk(a)linaro.org> --- fs/io_uring.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 0736487165da..fcf9ffe9b209 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -8882,20 +8882,18 @@ void __io_uring_task_cancel(void) struct io_uring_task *tctx = current->io_uring; DEFINE_WAIT(wait); s64 inflight; + int canceled = 0; /* make sure overflow events are dropped */ atomic_inc(&tctx->in_idle); - /* trigger io_disable_sqo_submit() */ - if (tctx->sqpoll) - __io_uring_files_cancel(NULL); - do { /* read completions before cancelations */ inflight = tctx_inflight(tctx); if (!inflight) break; __io_uring_files_cancel(NULL); + canceled = 1; prepare_to_wait(&tctx->wait, &wait, TASK_UNINTERRUPTIBLE); @@ -8909,6 +8907,21 @@ void __io_uring_task_cancel(void) finish_wait(&tctx->wait, &wait); } while (1); + /* + * trigger io_disable_sqo_submit() + * if not already done by __io_uring_files_cancel() + */ + if (tctx->sqpoll && !canceled) { + struct file *file; + unsigned long index; + + xa_for_each(&tctx->xa, index, file) { + struct io_ring_ctx *ctx = file->private_data; + + io_disable_sqo_submit(ctx); + } + } + atomic_dec(&tctx->in_idle); io_uring_remove_task_files(tctx); -- 2.33.1

3 years, 1 month

1
3
0 0

ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback

by Georgi Valkov

ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback https://github.com/openwrt/openwrt/pull/4084 From dd109ded2b526636fff438d33433ab64ffd21583 Mon Sep 17 00:00:00 2001 From: Georgi Valkov <gvalkov(a)abv.bg> Date: Fri, 16 Apr 2021 20:44:36 +0300 Subject: [PATCH] ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback When rx_buf is allocated we need to account for IPHETH_IP_ALIGN, which reduces the usable size by 2 bytes. Otherwise we have 1512 bytes usable instead of 1514, and if we receive more than 1512 bytes, ipheth_rcvbulk_callback is called with status -EOVERFLOW, after which the driver malfunctiones and all communication stops. Fixes: ipheth 2-1:4.2: ipheth_rcvbulk_callback: urb status: -75 Signed-off-by: Georgi Valkov <gvalkov(a)abv.bg> --- drivers/net/usb/ipheth.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index 207e59e74935..06d9f19ca142 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -121,7 +121,7 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone) if (tx_buf == NULL) goto free_rx_urb; - rx_buf = usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE, + rx_buf = usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, GFP_KERNEL, &rx_urb->transfer_dma); if (rx_buf == NULL) goto free_tx_buf; @@ -146,7 +146,7 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone) static void ipheth_free_urbs(struct ipheth_device *iphone) { - usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf, + usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, iphone->rx_buf, iphone->rx_urb->transfer_dma); usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf, iphone->tx_urb->transfer_dma); @@ -317,7 +317,7 @@ static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags) usb_fill_bulk_urb(dev->rx_urb, udev, usb_rcvbulkpipe(udev, dev->bulk_in), - dev->rx_buf, IPHETH_BUF_SIZE, + dev->rx_buf, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, ipheth_rcvbulk_callback, dev); dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; -- 2.31.1

3 years, 1 month

4
13
0 0

[PATCH 5.10 000/167] 5.10.54-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.54 release. There are 167 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 28 Jul 2021 15:38:12 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.54-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.54-rc1 Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: add xhci_get_virt_ep() helper Íñigo Huguet <ihuguet(a)redhat.com> sfc: ensure correct number of XDP queues Colin Xu <colin.xu(a)intel.com> drm/i915/gvt: Clear d3_entered on elsp cmd submission. David Jeffery <djeffery(a)redhat.com> usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI Riccardo Mancini <rickyman7(a)gmail.com> perf inject: Close inject.output on exit Robert Richter <rrichter(a)amd.com> Documentation: Fix intiramfs script name Paul Blakey <paulb(a)nvidia.com> skbuff: Release nfct refcount on napi stolen or re-used skbs Mahesh Bandewar <maheshb(a)google.com> bonding: fix build issue Evan Quan <evan.quan(a)amd.com> PCI: Mark AMD Navi14 GPU ATS as broken Marek Behún <kabel(a)kernel.org> net: dsa: mv88e6xxx: enable SerDes PCS register dump via ethtool -d on Topaz Marek Behún <kabel(a)kernel.org> net: dsa: mv88e6xxx: enable SerDes RX stats for Topaz Likun Gao <Likun.Gao(a)amd.com> drm/amdgpu: update golden setting for sienna_cichlid Charles Baylis <cb-kernel(a)fishzet.co.uk> drm: Return -ENOTTY for non-drm ioctls Jason Ekstrand <jason(a)jlekstrand.net> Revert "drm/i915: Propagate errors on awaiting already signaled fences" Adrian Hunter <adrian.hunter(a)intel.com> driver core: Prevent warning when removing a device link from unregistered consumer Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nds32: fix up stack guard gap Jérôme Glisse <jglisse(a)redhat.com> misc: eeprom: at24: Always append device id even if label property is set. Ilya Dryomov <idryomov(a)gmail.com> rbd: always kick acquire on "acquired" and "released" notifications Ilya Dryomov <idryomov(a)gmail.com> rbd: don't hold lock_rwsem while running_list is being drained Mike Kravetz <mike.kravetz(a)oracle.com> hugetlbfs: fix mount mode command line processing Mike Rapoport <rppt(a)kernel.org> memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions Peter Collingbourne <pcc(a)google.com> userfaultfd: do not untag user pointers Pavel Begunkov <asml.silence(a)gmail.com> io_uring: remove double poll entry on arm failure Pavel Begunkov <asml.silence(a)gmail.com> io_uring: explicitly count entries for poll reqs Peter Collingbourne <pcc(a)google.com> selftest: use mmap instead of posix_memalign to allocate memory Frederic Weisbecker <frederic(a)kernel.org> posix-cpu-timers: Fix rearm racing against process tick Bhaumik Bhatt <bbhatt(a)codeaurora.org> bus: mhi: core: Validate channel ID when processing command completions Markus Boehme <markubo(a)amazon.com> ixgbe: Fix packet corruption due to missing DMA sync Gustavo A. R. Silva <gustavoars(a)kernel.org> media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() Anand Jain <anand.jain(a)oracle.com> btrfs: check for missing device in btrfs_trim_fs Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing: Synthetic event field_pos is an index not a boolean Haoran Luo <www(a)aegistudio.net> tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracing/histogram: Rename "cpu" to "common_cpu" Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracepoints: Update static_call before tp_funcs when adding a tracepoint Marc Zyngier <maz(a)kernel.org> firmware/efi: Tell memblock about EFI iomem reservations Amelie Delaunay <amelie.delaunay(a)foss.st.com> usb: typec: stusb160x: register role switch before interrupt registration Minas Harutyunyan <Minas.Harutyunyan(a)synopsys.com> usb: dwc2: gadget: Fix sending zero length packet in DDMA mode. Minas Harutyunyan <Minas.Harutyunyan(a)synopsys.com> usb: dwc2: gadget: Fix GOUTNAK flow for Slave mode. Zhang Qilong <zhangqilong3(a)huawei.com> usb: gadget: Fix Unbalanced pm_runtime_enable in tegra_xudc_probe John Keeping <john(a)metanate.com> USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick Ian Ray <ian.ray(a)ge.com> USB: serial: cp210x: fix comments for GE CS1000 Marco De Marco <marco.demarco(a)posteo.net> USB: serial: option: add support for u-blox LARA-R6 family Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop() Mark Tomlinson <mark.tomlinson(a)alliedtelesis.co.nz> usb: max-3421: Prevent corruption of freed memory Julian Sikorski <belegdol(a)gmail.com> USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS Mathias Nyman <mathias.nyman(a)linux.intel.com> usb: hub: Fix link power management max exit latency (MEL) calculations Mathias Nyman <mathias.nyman(a)linux.intel.com> usb: hub: Disable USB 3 device initiated lpm if exit latency is too high Nicholas Piggin <npiggin(a)gmail.com> KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state Nicholas Piggin <npiggin(a)gmail.com> KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: Fix lost USB 2 remote wake Greg Thelen <gthelen(a)google.com> usb: xhci: avoid renesas_usb_fw.mem when it's unusable Moritz Fischer <mdf(a)kernel.org> Revert "usb: renesas-xhci: Fix handling of unknown ROM state" Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: Fix mmap capability check Alan Young <consult.awy(a)gmail.com> ALSA: pcm: Call substream ack() method upon compat mmap commit Takashi Iwai <tiwai(a)suse.de> ALSA: hdmi: Expose all pins on MSI MS-7C94 board Hui Wang <hui.wang(a)canonical.com> ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine Takashi Iwai <tiwai(a)suse.de> ALSA: sb: Fix potential ABBA deadlock in CSP driver Alexander Tsoy <alexander(a)tsoy.me> ALSA: usb-audio: Add registration quirk for JBL Quantum headsets Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Add missing proc text entry for BESPOKEN type Alexander Egorenkov <egorenar(a)linux.ibm.com> s390/boot: fix use of expolines in the DMA code Vasily Gorbik <gor(a)linux.ibm.com> s390/ftrace: fix ftrace_update_ftrace_func implementation Stephen Boyd <swboyd(a)chromium.org> mmc: core: Don't allocate IDA for OF aliases Marcelo Henrique Cerri <marcelo.cerri(a)canonical.com> proc: Avoid mixing integer types in mem_rw() Ronnie Sahlberg <lsahlber(a)redhat.com> cifs: fix fallocate when trying to allocate a hole. Ronnie Sahlberg <lsahlber(a)redhat.com> cifs: only write 64kb at a time when fallocating a small region of a file Maxime Ripard <maxime(a)cerno.tech> drm/panel: raspberrypi-touchscreen: Prevent double-free Yajun Deng <yajun.deng(a)linux.dev> net: sched: cls_api: Fix the the wrong parameter Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: make VID 4095 a bridge VLAN too Wei Wang <weiwan(a)google.com> tcp: disable TFO blackhole logic by default Xin Long <lucien.xin(a)gmail.com> sctp: update active_key for asoc when old key is being replaced Christoph Hellwig <hch(a)lst.de> nvme: set the PRACT bit when using Write Zeroes with T10 PI Sayanta Pattanayak <sayanta.pattanayak(a)arm.com> r8169: Avoid duplicate sysfs entry creation error David Howells <dhowells(a)redhat.com> afs: Fix tracepoint string placement with built-in AFS Vincent Palatin <vpalatin(a)chromium.org> Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem" Zhihao Cheng <chengzhihao1(a)huawei.com> nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING Luis Henriques <lhenriques(a)suse.de> ceph: don't WARN if we're still opening a session to an MDS Paolo Abeni <pabeni(a)redhat.com> ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions Peilin Ye <peilin.ye(a)bytedance.com> net/sched: act_skbmod: Skip non-Ethernet packets Alexandru Tachici <alexandru.tachici(a)analog.com> spi: spi-bcm2835: Fix deadlock Jian Shen <shenjian15(a)huawei.com> net: hns3: fix rx VLAN offload state inconsistent issue Chengwen Feng <fengchengwen(a)huawei.com> net: hns3: fix possible mismatches resp of mailbox Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID Eric Dumazet <edumazet(a)google.com> net/tcp_fastopen: fix data races around tfo_active_disable_stamp Randy Dunlap <rdunlap(a)infradead.org> net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition Somnath Kotur <somnath.kotur(a)broadcom.com> bnxt_en: Check abort error state in bnxt_half_open_nic() Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Validate vlan protocol ID on RX packets Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task() Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe() Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> bnxt_en: don't disable an already disabled PCI device Robert Richter <rrichter(a)amd.com> ACPI: Kconfig: Fix table override from built-in initrd Marek Vasut <marex(a)denx.de> spi: cadence: Correct initialisation of runtime PM again Dmitry Bogdanov <d.bogdanov(a)yadro.com> scsi: target: Fix protect handling in WRITE SAME(32) Mike Christie <michael.christie(a)oracle.com> scsi: iscsi: Fix iface sysfs attr detection Nguyen Dinh Phi <phind.uet(a)gmail.com> netrom: Decrease sock refcount when sock timers expire Xin Long <lucien.xin(a)gmail.com> sctp: trim optlen when it's a huge value in sctp_setsockopt Pavel Skripkin <paskripkin(a)gmail.com> net: sched: fix memory leak in tcindex_partial_destroy_work Nicholas Piggin <npiggin(a)gmail.com> KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak Nicholas Piggin <npiggin(a)gmail.com> KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash Yajun Deng <yajun.deng(a)linux.dev> net: decnet: Fix sleeping inside in af_decnet Michal Suchanek <msuchanek(a)suse.de> efi/tpm: Differentiate missing and invalid final event log table. Roman Skakun <Roman_Skakun(a)epam.com> dma-mapping: handle vmalloc addresses in dma_common_{mmap,get_sgtable} Dongliang Mu <mudongliangabcd(a)gmail.com> usb: hso: fix error handling code of hso_create_net_device Ziyang Xuan <william.xuanziyang(a)huawei.com> net: fix uninit-value in caif_seqpkt_sendmsg Tobias Klauser <tklauser(a)distanz.ch> bpftool: Check malloc return value in mount_bpffs_for_pin Jakub Sitnicki <jakub(a)cloudflare.com> bpf, sockmap, udp: sk_prot needs inuse_idx set for proc stats John Fastabend <john.fastabend(a)gmail.com> bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats John Fastabend <john.fastabend(a)gmail.com> bpf, sockmap: Fix potential memory leak on unlikely error case Colin Ian King <colin.king(a)canonical.com> s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1] Colin Ian King <colin.king(a)canonical.com> liquidio: Fix unintentional sign extension issue on left shift of u16 Nicolas Saenz Julienne <nsaenzju(a)redhat.com> timers: Fix get_next_timer_interrupt() with no timers pending Xuan Zhuo <xuanzhuo(a)linux.alibaba.com> xdp, net: Fix use-after-free in bpf_xdp_link_release Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix tail_call_reachable rejection for interpreter when jit failed Xuan Zhuo <xuanzhuo(a)linux.alibaba.com> bpf, test: fix NULL pointer dereference on invalid expected_attach_type Maxim Schwalm <maxim.schwalm(a)gmail.com> ASoC: rt5631: Fix regcache sync errors on resume Peter Hess <peter.hess(a)ph-home.de> spi: mediatek: fix fifo rx mode Axel Lin <axel.lin(a)ingics.com> regulator: hi6421: Fix getting wrong drvdata Axel Lin <axel.lin(a)ingics.com> regulator: hi6421: Use correct variable type for regmap api val argument Alain Volmat <alain.volmat(a)foss.st.com> spi: stm32: fixes pm_runtime calls in probe/remove Clark Wang <xiaoning.wang(a)nxp.com> spi: imx: add a check for speed_hz before calculating the clock Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: wm_adsp: Correct wm_coeff_tlv_get handling Yang Jihong <yangjihong1(a)huawei.com> perf sched: Fix record failure when CONFIG_SCHEDSTATS is not set Riccardo Mancini <rickyman7(a)gmail.com> perf data: Close all files in close_dir() Riccardo Mancini <rickyman7(a)gmail.com> perf probe-file: Delete namelist in del_events() on the error path Riccardo Mancini <rickyman7(a)gmail.com> perf lzma: Close lzma stream on exit Riccardo Mancini <rickyman7(a)gmail.com> perf script: Fix memory 'threads' and 'cpus' leaks on exit Riccardo Mancini <rickyman7(a)gmail.com> perf report: Free generated help strings for sort option Riccardo Mancini <rickyman7(a)gmail.com> perf env: Fix memory leak of cpu_pmu_caps Riccardo Mancini <rickyman7(a)gmail.com> perf test maps__merge_in: Fix memory leak of maps Riccardo Mancini <rickyman7(a)gmail.com> perf dso: Fix memory leak in dso__new_map() Riccardo Mancini <rickyman7(a)gmail.com> perf test event_update: Fix memory leak of evlist Riccardo Mancini <rickyman7(a)gmail.com> perf test session_topology: Delete session->evlist Riccardo Mancini <rickyman7(a)gmail.com> perf env: Fix sibling_dies memory leak Riccardo Mancini <rickyman7(a)gmail.com> perf probe: Fix dso->nsinfo refcounting Riccardo Mancini <rickyman7(a)gmail.com> perf map: Fix dso->nsinfo refcounting Riccardo Mancini <rickyman7(a)gmail.com> perf inject: Fix dso->nsinfo refcounting Like Xu <like.xu.linux(a)gmail.com> KVM: x86/pmu: Clear anythread deprecated bit when 0xa leaf is unsupported on the SVM Casey Chen <cachen(a)purestorage.com> nvme-pci: do not call nvme_dev_remove_admin from nvme_remove Jianguo Wu <wujianguo(a)chinatelecom.cn> mptcp: fix warning in __skb_flow_dissect() when do syn cookie for subflow join Antoine Tenart <atenart(a)kernel.org> net: do not reuse skbuff allocated from skbuff_fclone_cache in the skb cache Shahjada Abul Husain <shahjada(a)chelsio.com> cxgb4: fix IRQ free race during driver unload Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> pwm: sprd: Ensure configuring period and duty_cycle isn't wrongly skipped Hangbin Liu <liuhangbin(a)gmail.com> selftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect Hangbin Liu <liuhangbin(a)gmail.com> selftests: icmp_redirect: remove from checking for IPv6 route get YueHaibing <yuehaibing(a)huawei.com> stmmac: platform: Fix signedness bug in stmmac_probe_config_dt() Nicolas Dichtel <nicolas.dichtel(a)6wind.com> ipv6: fix 'disable_policy' for fwd packets Taehee Yoo <ap420073(a)gmail.com> bonding: fix incorrect return value of bond_ipsec_offload_ok() Taehee Yoo <ap420073(a)gmail.com> bonding: fix suspicious RCU usage in bond_ipsec_offload_ok() Taehee Yoo <ap420073(a)gmail.com> bonding: Add struct bond_ipesc to manage SA Taehee Yoo <ap420073(a)gmail.com> bonding: disallow setting nested bonding + ipsec offload Taehee Yoo <ap420073(a)gmail.com> bonding: fix suspicious RCU usage in bond_ipsec_del_sa() Taehee Yoo <ap420073(a)gmail.com> ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops Taehee Yoo <ap420073(a)gmail.com> bonding: fix null dereference in bond_ipsec_add_sa() Taehee Yoo <ap420073(a)gmail.com> bonding: fix suspicious RCU usage in bond_ipsec_add_sa() Björn Töpel <bjorn.topel(a)intel.com> net: Introduce preferred busy-polling Aleksandr Nogikh <nogikh(a)google.com> net: add kcov handle to skb extensions Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> gve: Fix an error handling path in 'gve_probe()' Jedrzej Jagielski <jedrzej.jagielski(a)intel.com> igb: Fix position of assignment to *ring Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> igb: Check if num of q_vectors is smaller than max before array access Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> iavf: Fix an error handling path in 'iavf_probe()' Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> e1000e: Fix an error handling path in 'e1000_probe()' Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> fm10k: Fix an error handling path in 'fm10k_probe()' Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> igb: Fix an error handling path in 'igb_probe()' Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> igc: Fix an error handling path in 'igc_probe()' Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> ixgbe: Fix an error handling path in 'ixgbe_probe()' Tom Rix <trix(a)redhat.com> igc: change default return of igc_read_phy_reg() Vinicius Costa Gomes <vinicius.gomes(a)intel.com> igb: Fix use-after-free error during reset Vinicius Costa Gomes <vinicius.gomes(a)intel.com> igc: Fix use-after-free error during reset ------------- Diffstat: Documentation/arm64/tagged-address-abi.rst | 26 ++- .../early-userspace/early_userspace_support.rst | 8 +- .../filesystems/ramfs-rootfs-initramfs.rst | 2 +- Documentation/networking/ip-sysctl.rst | 2 +- Documentation/trace/histogram.rst | 2 +- Makefile | 4 +- arch/alpha/include/uapi/asm/socket.h | 2 + arch/mips/include/uapi/asm/socket.h | 2 + arch/nds32/mm/mmap.c | 2 +- arch/parisc/include/uapi/asm/socket.h | 2 + arch/powerpc/kvm/book3s_hv.c | 2 + arch/powerpc/kvm/book3s_hv_nested.c | 20 +++ arch/powerpc/kvm/book3s_rtas.c | 25 ++- arch/powerpc/kvm/powerpc.c | 4 +- arch/s390/boot/text_dma.S | 19 +-- arch/s390/include/asm/ftrace.h | 1 + arch/s390/kernel/ftrace.c | 2 + arch/s390/kernel/mcount.S | 4 +- arch/s390/net/bpf_jit_comp.c | 2 +- arch/sparc/include/uapi/asm/socket.h | 2 + arch/x86/kvm/cpuid.c | 3 +- drivers/acpi/Kconfig | 2 +- drivers/base/core.c | 6 +- drivers/block/rbd.c | 32 ++-- drivers/bus/mhi/core/main.c | 17 +- drivers/firmware/efi/efi.c | 13 +- drivers/firmware/efi/tpm.c | 8 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 1 + drivers/gpu/drm/drm_ioctl.c | 3 + drivers/gpu/drm/i915/gvt/handlers.c | 15 ++ drivers/gpu/drm/i915/i915_request.c | 8 +- .../gpu/drm/panel/panel-raspberrypi-touchscreen.c | 1 - drivers/media/pci/ngene/ngene-core.c | 2 +- drivers/media/pci/ngene/ngene.h | 14 +- drivers/misc/eeprom/at24.c | 17 +- drivers/mmc/core/host.c | 20 +-- drivers/net/bonding/bond_main.c | 183 +++++++++++++++++---- drivers/net/dsa/mv88e6xxx/chip.c | 10 ++ drivers/net/dsa/mv88e6xxx/serdes.c | 6 +- drivers/net/dsa/sja1105/sja1105_main.c | 6 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 34 +++- drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 9 +- .../ethernet/cavium/liquidio/cn23xx_pf_device.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 18 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c | 3 + drivers/net/ethernet/google/gve/gve_main.c | 5 +- drivers/net/ethernet/hisilicon/hip04_eth.c | 6 +- drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h | 6 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 1 + .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 10 ++ drivers/net/ethernet/intel/e1000e/netdev.c | 1 + drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 1 + drivers/net/ethernet/intel/iavf/iavf_main.c | 1 + drivers/net/ethernet/intel/igb/igb_main.c | 15 +- drivers/net/ethernet/intel/igc/igc.h | 2 +- drivers/net/ethernet/intel/igc/igc_main.c | 3 + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 4 +- drivers/net/ethernet/intel/ixgbevf/ipsec.c | 20 ++- drivers/net/ethernet/realtek/r8169_main.c | 3 +- drivers/net/ethernet/sfc/efx_channels.c | 13 +- .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 8 +- drivers/net/usb/hso.c | 33 ++-- drivers/nvme/host/core.c | 5 +- drivers/nvme/host/pci.c | 5 +- drivers/pci/quirks.c | 4 +- drivers/pwm/pwm-sprd.c | 11 +- drivers/regulator/hi6421-regulator.c | 30 ++-- drivers/scsi/scsi_transport_iscsi.c | 90 ++++------ drivers/spi/spi-bcm2835.c | 12 +- drivers/spi/spi-cadence.c | 14 +- drivers/spi/spi-imx.c | 37 +++-- drivers/spi/spi-mt65xx.c | 16 +- drivers/spi/spi-stm32.c | 9 +- drivers/target/target_core_sbc.c | 35 ++-- drivers/usb/core/hub.c | 120 ++++++++++---- drivers/usb/core/quirks.c | 4 - drivers/usb/dwc2/gadget.c | 31 +++- drivers/usb/gadget/udc/tegra-xudc.c | 1 + drivers/usb/host/ehci-hcd.c | 18 +- drivers/usb/host/max3421-hcd.c | 44 ++--- drivers/usb/host/xhci-hub.c | 3 +- drivers/usb/host/xhci-pci-renesas.c | 16 +- drivers/usb/host/xhci-pci.c | 7 + drivers/usb/host/xhci-ring.c | 58 +++++-- drivers/usb/host/xhci.h | 3 +- drivers/usb/renesas_usbhs/fifo.c | 7 + drivers/usb/serial/cp210x.c | 5 +- drivers/usb/serial/option.c | 3 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/stusb160x.c | 11 +- fs/afs/cmservice.c | 25 +-- fs/btrfs/extent-tree.c | 3 + fs/ceph/mds_client.c | 2 +- fs/cifs/smb2ops.c | 49 ++++-- fs/eventpoll.c | 2 +- fs/hugetlbfs/inode.c | 2 +- fs/io_uring.c | 18 +- fs/proc/base.c | 2 +- fs/userfaultfd.c | 24 ++- include/drm/drm_ioctl.h | 1 + include/linux/memblock.h | 4 +- include/linux/netdevice.h | 35 ++-- include/linux/skbuff.h | 33 ++++ include/net/bonding.h | 9 +- include/net/busy_poll.h | 5 +- include/net/sock.h | 4 + include/trace/events/afs.h | 67 +++++++- include/uapi/asm-generic/socket.h | 2 + kernel/bpf/verifier.c | 2 + kernel/dma/ops_helpers.c | 12 +- kernel/time/posix-cpu-timers.c | 10 +- kernel/time/timer.c | 8 +- kernel/trace/ring_buffer.c | 28 +++- kernel/trace/trace.c | 4 + kernel/trace/trace_events_hist.c | 22 ++- kernel/trace/trace_synth.h | 2 +- kernel/tracepoint.c | 2 +- lib/Kconfig.debug | 1 + mm/memblock.c | 3 +- net/bpf/test_run.c | 3 + net/caif/caif_socket.c | 3 +- net/core/dev.c | 107 +++++++++--- net/core/skbuff.c | 12 ++ net/core/skmsg.c | 16 +- net/core/sock.c | 9 + net/decnet/af_decnet.c | 27 ++- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_fastopen.c | 28 +++- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/udp_bpf.c | 2 +- net/ipv6/ip6_output.c | 4 +- net/ipv6/route.c | 2 +- net/mptcp/syncookies.c | 16 +- net/netrom/nr_timer.c | 20 ++- net/sched/act_skbmod.c | 12 +- net/sched/cls_api.c | 2 +- net/sched/cls_tcindex.c | 5 +- net/sctp/auth.c | 2 + net/sctp/socket.c | 4 + sound/core/pcm_native.c | 25 ++- sound/hda/intel-dsp-config.c | 4 + sound/isa/sb/sb16_csp.c | 4 + sound/pci/hda/patch_hdmi.c | 1 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/rt5631.c | 2 + sound/soc/codecs/wm_adsp.c | 2 +- sound/usb/mixer.c | 10 +- sound/usb/quirks.c | 3 + tools/bpf/bpftool/common.c | 5 + tools/perf/builtin-inject.c | 13 +- tools/perf/builtin-report.c | 33 ++-- tools/perf/builtin-sched.c | 33 +++- tools/perf/builtin-script.c | 7 + tools/perf/tests/event_update.c | 2 +- tools/perf/tests/maps.c | 2 + tools/perf/tests/topology.c | 1 + tools/perf/util/data.c | 2 +- tools/perf/util/dso.c | 4 +- tools/perf/util/env.c | 2 + tools/perf/util/lzma.c | 8 +- tools/perf/util/map.c | 2 + tools/perf/util/probe-event.c | 4 +- tools/perf/util/probe-file.c | 4 +- tools/perf/util/sort.c | 2 +- tools/perf/util/sort.h | 2 +- tools/testing/selftests/net/icmp_redirect.sh | 5 +- tools/testing/selftests/vm/userfaultfd.c | 6 +- 167 files changed, 1515 insertions(+), 637 deletions(-)

3 years, 1 month

7
182
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror November 2021