December 2021 - Linux-stable-mirror

FAILED: patch "[PATCH] KVM: Disallow user memslot with size that exceeds "unsigned" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 6b285a5587506bae084cf9a3ed5aa491d623b91b Mon Sep 17 00:00:00 2001 From: Sean Christopherson <seanjc(a)google.com> Date: Thu, 4 Nov 2021 00:25:03 +0000 Subject: [PATCH] KVM: Disallow user memslot with size that exceeds "unsigned long" Reject userspace memslots whose size exceeds the storage capacity of an "unsigned long". KVM's uAPI takes the size as u64 to support large slots on 64-bit hosts, but does not account for the size being truncated on 32-bit hosts in various flows. The access_ok() check on the userspace virtual address in particular casts the size to "unsigned long" and will check the wrong number of bytes. KVM doesn't actually support slots whose size doesn't fit in an "unsigned long", e.g. KVM's internal kvm_memory_slot.npages is an "unsigned long", not a "u64", and misc arch specific code follows that behavior. Fixes: fa3d315a4ce2 ("KVM: Validate userspace_addr of memslot when registered") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com> Message-Id: <20211104002531.1176691-3-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 2104fc29cdd2..6c5083f2eb50 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1689,7 +1689,8 @@ int __kvm_set_memory_region(struct kvm *kvm, id = (u16)mem->slot; /* General sanity checks */ - if (mem->memory_size & (PAGE_SIZE - 1)) + if ((mem->memory_size & (PAGE_SIZE - 1)) || + (mem->memory_size != (unsigned long)mem->memory_size)) return -EINVAL; if (mem->guest_phys_addr & (PAGE_SIZE - 1)) return -EINVAL;

3 years

1
0
0 0

FAILED: patch "[PATCH] KVM: Disallow user memslot with size that exceeds "unsigned" failed to apply to 4.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 6b285a5587506bae084cf9a3ed5aa491d623b91b Mon Sep 17 00:00:00 2001 From: Sean Christopherson <seanjc(a)google.com> Date: Thu, 4 Nov 2021 00:25:03 +0000 Subject: [PATCH] KVM: Disallow user memslot with size that exceeds "unsigned long" Reject userspace memslots whose size exceeds the storage capacity of an "unsigned long". KVM's uAPI takes the size as u64 to support large slots on 64-bit hosts, but does not account for the size being truncated on 32-bit hosts in various flows. The access_ok() check on the userspace virtual address in particular casts the size to "unsigned long" and will check the wrong number of bytes. KVM doesn't actually support slots whose size doesn't fit in an "unsigned long", e.g. KVM's internal kvm_memory_slot.npages is an "unsigned long", not a "u64", and misc arch specific code follows that behavior. Fixes: fa3d315a4ce2 ("KVM: Validate userspace_addr of memslot when registered") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com> Message-Id: <20211104002531.1176691-3-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 2104fc29cdd2..6c5083f2eb50 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1689,7 +1689,8 @@ int __kvm_set_memory_region(struct kvm *kvm, id = (u16)mem->slot; /* General sanity checks */ - if (mem->memory_size & (PAGE_SIZE - 1)) + if ((mem->memory_size & (PAGE_SIZE - 1)) || + (mem->memory_size != (unsigned long)mem->memory_size)) return -EINVAL; if (mem->guest_phys_addr & (PAGE_SIZE - 1)) return -EINVAL;

3 years

1
0
0 0

FAILED: patch "[PATCH] KVM: fix avic_set_running for preemptable kernels" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 7cfc5c653b07782e7059527df8dc1e3143a7591e Mon Sep 17 00:00:00 2001 From: Paolo Bonzini <pbonzini(a)redhat.com> Date: Tue, 30 Nov 2021 03:46:07 -0500 Subject: [PATCH] KVM: fix avic_set_running for preemptable kernels avic_set_running() passes the current CPU to avic_vcpu_load(), albeit via vcpu->cpu rather than smp_processor_id(). If the thread is migrated while avic_set_running runs, the call to avic_vcpu_load() can use a stale value for the processor id. Avoid this by blocking preemption over the entire execution of avic_set_running(). Reported-by: Sean Christopherson <seanjc(a)google.com> Fixes: 8221c1370056 ("svm: Manage vcpu load/unload when enable AVIC") Cc: stable(a)vger.kernel.org Reviewed-by: Maxim Levitsky <mlevitsk(a)redhat.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c index affc0ea98d30..9d6066eb7c10 100644 --- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -989,16 +989,18 @@ void avic_vcpu_put(struct kvm_vcpu *vcpu) static void avic_set_running(struct kvm_vcpu *vcpu, bool is_run) { struct vcpu_svm *svm = to_svm(vcpu); + int cpu = get_cpu(); + WARN_ON(cpu != vcpu->cpu); svm->avic_is_running = is_run; - if (!kvm_vcpu_apicv_active(vcpu)) - return; - - if (is_run) - avic_vcpu_load(vcpu, vcpu->cpu); - else - avic_vcpu_put(vcpu); + if (kvm_vcpu_apicv_active(vcpu)) { + if (is_run) + avic_vcpu_load(vcpu, cpu); + else + avic_vcpu_put(vcpu); + } + put_cpu(); } void svm_vcpu_blocking(struct kvm_vcpu *vcpu)

3 years

1
0
0 0

FAILED: patch "[PATCH] KVM: fix avic_set_running for preemptable kernels" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 7cfc5c653b07782e7059527df8dc1e3143a7591e Mon Sep 17 00:00:00 2001 From: Paolo Bonzini <pbonzini(a)redhat.com> Date: Tue, 30 Nov 2021 03:46:07 -0500 Subject: [PATCH] KVM: fix avic_set_running for preemptable kernels avic_set_running() passes the current CPU to avic_vcpu_load(), albeit via vcpu->cpu rather than smp_processor_id(). If the thread is migrated while avic_set_running runs, the call to avic_vcpu_load() can use a stale value for the processor id. Avoid this by blocking preemption over the entire execution of avic_set_running(). Reported-by: Sean Christopherson <seanjc(a)google.com> Fixes: 8221c1370056 ("svm: Manage vcpu load/unload when enable AVIC") Cc: stable(a)vger.kernel.org Reviewed-by: Maxim Levitsky <mlevitsk(a)redhat.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c index affc0ea98d30..9d6066eb7c10 100644 --- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -989,16 +989,18 @@ void avic_vcpu_put(struct kvm_vcpu *vcpu) static void avic_set_running(struct kvm_vcpu *vcpu, bool is_run) { struct vcpu_svm *svm = to_svm(vcpu); + int cpu = get_cpu(); + WARN_ON(cpu != vcpu->cpu); svm->avic_is_running = is_run; - if (!kvm_vcpu_apicv_active(vcpu)) - return; - - if (is_run) - avic_vcpu_load(vcpu, vcpu->cpu); - else - avic_vcpu_put(vcpu); + if (kvm_vcpu_apicv_active(vcpu)) { + if (is_run) + avic_vcpu_load(vcpu, cpu); + else + avic_vcpu_put(vcpu); + } + put_cpu(); } void svm_vcpu_blocking(struct kvm_vcpu *vcpu)

3 years

1
0
0 0

FAILED: patch "[PATCH] KVM: fix avic_set_running for preemptable kernels" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 7cfc5c653b07782e7059527df8dc1e3143a7591e Mon Sep 17 00:00:00 2001 From: Paolo Bonzini <pbonzini(a)redhat.com> Date: Tue, 30 Nov 2021 03:46:07 -0500 Subject: [PATCH] KVM: fix avic_set_running for preemptable kernels avic_set_running() passes the current CPU to avic_vcpu_load(), albeit via vcpu->cpu rather than smp_processor_id(). If the thread is migrated while avic_set_running runs, the call to avic_vcpu_load() can use a stale value for the processor id. Avoid this by blocking preemption over the entire execution of avic_set_running(). Reported-by: Sean Christopherson <seanjc(a)google.com> Fixes: 8221c1370056 ("svm: Manage vcpu load/unload when enable AVIC") Cc: stable(a)vger.kernel.org Reviewed-by: Maxim Levitsky <mlevitsk(a)redhat.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c index affc0ea98d30..9d6066eb7c10 100644 --- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -989,16 +989,18 @@ void avic_vcpu_put(struct kvm_vcpu *vcpu) static void avic_set_running(struct kvm_vcpu *vcpu, bool is_run) { struct vcpu_svm *svm = to_svm(vcpu); + int cpu = get_cpu(); + WARN_ON(cpu != vcpu->cpu); svm->avic_is_running = is_run; - if (!kvm_vcpu_apicv_active(vcpu)) - return; - - if (is_run) - avic_vcpu_load(vcpu, vcpu->cpu); - else - avic_vcpu_put(vcpu); + if (kvm_vcpu_apicv_active(vcpu)) { + if (is_run) + avic_vcpu_load(vcpu, cpu); + else + avic_vcpu_put(vcpu); + } + put_cpu(); } void svm_vcpu_blocking(struct kvm_vcpu *vcpu)

3 years

1
0
0 0

FAILED: patch "[PATCH] KVM: fix avic_set_running for preemptable kernels" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 7cfc5c653b07782e7059527df8dc1e3143a7591e Mon Sep 17 00:00:00 2001 From: Paolo Bonzini <pbonzini(a)redhat.com> Date: Tue, 30 Nov 2021 03:46:07 -0500 Subject: [PATCH] KVM: fix avic_set_running for preemptable kernels avic_set_running() passes the current CPU to avic_vcpu_load(), albeit via vcpu->cpu rather than smp_processor_id(). If the thread is migrated while avic_set_running runs, the call to avic_vcpu_load() can use a stale value for the processor id. Avoid this by blocking preemption over the entire execution of avic_set_running(). Reported-by: Sean Christopherson <seanjc(a)google.com> Fixes: 8221c1370056 ("svm: Manage vcpu load/unload when enable AVIC") Cc: stable(a)vger.kernel.org Reviewed-by: Maxim Levitsky <mlevitsk(a)redhat.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c index affc0ea98d30..9d6066eb7c10 100644 --- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -989,16 +989,18 @@ void avic_vcpu_put(struct kvm_vcpu *vcpu) static void avic_set_running(struct kvm_vcpu *vcpu, bool is_run) { struct vcpu_svm *svm = to_svm(vcpu); + int cpu = get_cpu(); + WARN_ON(cpu != vcpu->cpu); svm->avic_is_running = is_run; - if (!kvm_vcpu_apicv_active(vcpu)) - return; - - if (is_run) - avic_vcpu_load(vcpu, vcpu->cpu); - else - avic_vcpu_put(vcpu); + if (kvm_vcpu_apicv_active(vcpu)) { + if (is_run) + avic_vcpu_load(vcpu, cpu); + else + avic_vcpu_put(vcpu); + } + put_cpu(); } void svm_vcpu_blocking(struct kvm_vcpu *vcpu)

3 years

1
0
0 0

FAILED: patch "[PATCH] KVM: fix avic_set_running for preemptable kernels" failed to apply to 4.9-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 7cfc5c653b07782e7059527df8dc1e3143a7591e Mon Sep 17 00:00:00 2001 From: Paolo Bonzini <pbonzini(a)redhat.com> Date: Tue, 30 Nov 2021 03:46:07 -0500 Subject: [PATCH] KVM: fix avic_set_running for preemptable kernels avic_set_running() passes the current CPU to avic_vcpu_load(), albeit via vcpu->cpu rather than smp_processor_id(). If the thread is migrated while avic_set_running runs, the call to avic_vcpu_load() can use a stale value for the processor id. Avoid this by blocking preemption over the entire execution of avic_set_running(). Reported-by: Sean Christopherson <seanjc(a)google.com> Fixes: 8221c1370056 ("svm: Manage vcpu load/unload when enable AVIC") Cc: stable(a)vger.kernel.org Reviewed-by: Maxim Levitsky <mlevitsk(a)redhat.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c index affc0ea98d30..9d6066eb7c10 100644 --- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -989,16 +989,18 @@ void avic_vcpu_put(struct kvm_vcpu *vcpu) static void avic_set_running(struct kvm_vcpu *vcpu, bool is_run) { struct vcpu_svm *svm = to_svm(vcpu); + int cpu = get_cpu(); + WARN_ON(cpu != vcpu->cpu); svm->avic_is_running = is_run; - if (!kvm_vcpu_apicv_active(vcpu)) - return; - - if (is_run) - avic_vcpu_load(vcpu, vcpu->cpu); - else - avic_vcpu_put(vcpu); + if (kvm_vcpu_apicv_active(vcpu)) { + if (is_run) + avic_vcpu_load(vcpu, cpu); + else + avic_vcpu_put(vcpu); + } + put_cpu(); } void svm_vcpu_blocking(struct kvm_vcpu *vcpu)

3 years

1
0
0 0

[PATCH 5.10 000/290] 5.10.24-rc1 review

by gregkh＠linuxfoundation.org

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> This is the start of the stable review cycle for the 5.10.24 release. There are 290 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 17 Mar 2021 13:55:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.24-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.24-rc1 Christoph Hellwig <hch(a)lst.de> RDMA/umem: Use ib_dma_max_seg_size instead of dma_get_max_seg_size Andrew Scull <ascull(a)google.com> KVM: arm64: Fix nVHE hyp panic host context restore Juergen Gross <jgross(a)suse.com> xen/events: avoid handling the same event on two cpus at the same time Juergen Gross <jgross(a)suse.com> xen/events: don't unmask an event channel when an eoi is pending Mike Rapoport <rppt(a)kernel.org> mm/page_alloc.c: refactor initialization of struct page for holes in memory layout Marc Zyngier <maz(a)kernel.org> KVM: arm64: Ensure I-cache isolation between vcpus of a same VM Suren Baghdasaryan <surenb(a)google.com> mm/madvise: replace ptrace attach requirement for process_madvise Nadav Amit <namit(a)vmware.com> mm/userfaultfd: fix memory corruption due to writeprotect Marc Zyngier <maz(a)kernel.org> KVM: arm64: Fix exclusive limit for IPA size Marc Zyngier <maz(a)kernel.org> KVM: arm64: Reject VM creation when the default IPA size is unsupported Suzuki K Poulose <suzuki.poulose(a)arm.com> KVM: arm64: nvhe: Save the SPE context early Will Deacon <will(a)kernel.org> KVM: arm64: Avoid corrupting vCPU context register in guest exit Jia He <justin.he(a)arm.com> KVM: arm64: Fix range alignment when walking page tables Wanpeng Li <wanpengli(a)tencent.com> KVM: kvmclock: Fix vCPUs > 64 can't be online/hotpluged Sean Christopherson <seanjc(a)google.com> KVM: x86: Ensure deadline timer has truly expired before posting its IRQ Andy Lutomirski <luto(a)kernel.org> x86/entry: Fix entry/exit mismatch on failed fast 32-bit syscalls Joerg Roedel <jroedel(a)suse.de> x86/sev-es: Use __copy_from_user_inatomic() Joerg Roedel <jroedel(a)suse.de> x86/sev-es: Correctly track IRQ states in runtime #VC handler Thomas Gleixner <tglx(a)linutronix.de> x86/entry: Move nmi entry/exit into common code Joerg Roedel <jroedel(a)suse.de> x86/sev-es: Check regs->sp is trusted before adjusting #VC IST stack Joerg Roedel <jroedel(a)suse.de> x86/sev-es: Introduce ip_within_syscall_gap() helper Josh Poimboeuf <jpoimboe(a)redhat.com> x86/unwind/orc: Disable KASAN checking in the ORC unwinder, part 2 Lior Ribak <liorribak(a)gmail.com> binfmt_misc: fix possible deadlock in bm_register_write Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc: Fix missing declaration of [en/dis]able_kernel_vsx() Nicholas Piggin <npiggin(a)gmail.com> powerpc: Fix inverted SET_FULL_REGS bitop Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> powerpc/64s: Fix instruction encoding for lis in ppc_function_entry() Ard Biesheuvel <ardb(a)kernel.org> efi: stub: omit SetVirtualAddressMap() if marked unsupported in RT_PROP table Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> sched/membarrier: fix missing local execution of ipi_sync_rq_state() Arnd Bergmann <arnd(a)arndb.de> linux/compiler-clang.h: define HAVE_BUILTIN_BSWAP* Minchan Kim <minchan(a)kernel.org> zram: fix return value on writeback_store Alexey Dobriyan <adobriyan(a)gmail.com> prctl: fix PR_SET_MM_AUXV kernel stack leak Matthew Wilcox (Oracle) <willy(a)infradead.org> include/linux/sched/mm.h: use rcu_dereference in in_vfork() Arnd Bergmann <arnd(a)arndb.de> stop_machine: mark helpers __always_inline Peter Zijlstra <peterz(a)infradead.org> seqlock,lockdep: Fix seqcount_latch_init() Daniel Axtens <dja(a)axtens.net> powerpc/64s/exception: Clean up a missed SRR specifier Anna-Maria Behnsen <anna-maria(a)linutronix.de> hrtimer: Update softirq_expires_next correctly after __hrtimer_get_next_event() Kan Liang <kan.liang(a)linux.intel.com> perf/x86/intel: Set PERF_ATTACH_SCHED_CB for large PEBS and LBR Kan Liang <kan.liang(a)linux.intel.com> perf/core: Flush PMU internal buffers for per-CPU events Ard Biesheuvel <ardb(a)kernel.org> arm64: mm: use a 48-bit ID map when possible on 52-bit VA builds Daiyue Zhang <zhangdaiyue1(a)huawei.com> configfs: fix a use-after-free in __configfs_open_file James Smart <jsmart2021(a)gmail.com> nvme-fc: fix racing controller reset and create association Jia-Ju Bai <baijiaju1990(a)gmail.com> block: rsxx: fix error return code of rsxx_pci_probe() Ondrej Mosnacek <omosnace(a)redhat.com> NFSv4.2: fix return value of _nfs4_get_security_label() Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Don't gratuitously clear the inode cache when lookup failed Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Don't revalidate the directory permissions on a lookup failure Benjamin Coddington <bcodding(a)redhat.com> SUNRPC: Set memalloc_nofs_save() for sync tasks Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Fix pfn_valid() for ZONE_DEVICE based memory Wei Yongjun <weiyongjun1(a)huawei.com> cpufreq: qcom-hw: Fix return value check in qcom_cpufreq_hw_cpu_init() Shawn Guo <shawn.guo(a)linaro.org> cpufreq: qcom-hw: fix dereferencing freed memory 'data' Sergey Shtylyov <s.shtylyov(a)omprussia.ru> sh_eth: fix TRSCER mask for R7S72100 Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: pcl818: Fix endian problem for AI command data Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: pcl711: Fix endian problem for AI command data Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: me4000: Fix endian problem for AI command data Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: dmm32at: Fix endian problem for AI command data Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: das800: Fix endian problem for AI command data Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: das6402: Fix endian problem for AI command data Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: adv_pci1710: Fix endian problem for AI command data Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: addi_apci_1500: Fix endian problem for command sample Ian Abbott <abbotti(a)mev.co.uk> staging: comedi: addi_apci_1032: Fix endian problem for COS sample Lee Gibson <leegib(a)gmail.com> staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan Lee Gibson <leegib(a)gmail.com> staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd Dan Carpenter <dan.carpenter(a)oracle.com> staging: ks7010: prevent buffer overflow in ks_wlan_set_scan() Dan Carpenter <dan.carpenter(a)oracle.com> staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data() Dan Carpenter <dan.carpenter(a)oracle.com> staging: rtl8712: unterminated string leads to read overflow Dan Carpenter <dan.carpenter(a)oracle.com> staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan() Dan Carpenter <dan.carpenter(a)oracle.com> staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan() Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> misc: fastrpc: restrict user apps from sending kernel RPC messages Shile Zhang <shile.zhang(a)linux.alibaba.com> misc/pvpanic: Export module FDT device table Alexander Shiyan <shc_work(a)mail.ru> Revert "serial: max310x: rework RX interrupt handling" Shuah Khan <skhan(a)linuxfoundation.org> usbip: fix vudc usbip_sockfd_store races leading to gpf Shuah Khan <skhan(a)linuxfoundation.org> usbip: fix vhci_hcd attach_store() races leading to gpf Shuah Khan <skhan(a)linuxfoundation.org> usbip: fix stub_dev usbip_sockfd_store() races leading to gpf Shuah Khan <skhan(a)linuxfoundation.org> usbip: fix vudc to check for stream socket Shuah Khan <skhan(a)linuxfoundation.org> usbip: fix vhci_hcd to check for stream socket Shuah Khan <skhan(a)linuxfoundation.org> usbip: fix stub_dev to check for stream socket Sebastian Reichel <sebastian.reichel(a)collabora.com> USB: serial: cp210x: add some more GE USB IDs Karan Singhal <karan.singhal(a)acuitybrands.com> USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter Niv Sardi <xaiki(a)evilgiggle.com> USB: serial: ch341: add new Product ID Pavel Skripkin <paskripkin(a)gmail.com> USB: serial: io_edgeport: fix memory leak in edge_startup Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: Fix repeated xhci wake after suspend due to uncleared internal wake state Forest Crossman <cyrozap(a)gmail.com> usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: Improve detection of device initiated wake signal. Stanislaw Gruszka <stf_xl(a)wp.pl> usb: xhci: do not perform Soft Retry for some xHCI hosts Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM Pete Zaitcev <zaitcev(a)redhat.com> USB: usblp: fix a hang in poll() if disconnected Matthias Kaehlcke <mka(a)chromium.org> usb: dwc3: qcom: Honor wakeup enabled/disabled state Shawn Guo <shawn.guo(a)linaro.org> usb: dwc3: qcom: add ACPI device id for sc8180x Shawn Guo <shawn.guo(a)linaro.org> usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot Serge Semin <Sergey.Semin(a)baikalelectronics.ru> usb: dwc3: qcom: Add missing DWC3 OF node refcount decrement Ruslan Bilovol <ruslan.bilovol(a)gmail.com> usb: gadget: f_uac1: stop playback on function disable Ruslan Bilovol <ruslan.bilovol(a)gmail.com> usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot Dan Carpenter <dan.carpenter(a)oracle.com> USB: gadget: u_ether: Fix a configfs return code Wei Yongjun <weiyongjun1(a)huawei.com> USB: gadget: udc: s3c2410_udc: fix return value check in s3c2410_udc_probe() Yorick de Wid <ydewid(a)gmail.com> Goodix Fingerprint device is not a modem Paulo Alcantara <pc(a)cjr.nz> cifs: do not send close in compound create+close requests Frank Li <lznuaa(a)gmail.com> mmc: cqhci: Fix random crash when remove mmc module/card Adrian Hunter <adrian.hunter(a)intel.com> mmc: core: Fix partition switch time for eMMC Yann Gautier <yann.gautier(a)foss.st.com> mmc: mmci: Add MMC_CAP_NEED_RSP_BUSY for the stm32 variants Juergen Gross <jgross(a)suse.com> xen/events: reset affinity of 2-level event when tearing it down Heikki Krogerus <heikki.krogerus(a)linux.intel.com> software node: Fix node registration Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: fix hanging IO request during DASD driver unbind Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: fix hanging DASD driver unbind Rob Herring <robh(a)kernel.org> arm64: perf: Fix 64-bit event counter read truncation Catalin Marinas <catalin.marinas(a)arm.com> arm64: mte: Map hotplugged memory as Normal Tagged Andrey Konovalov <andreyknvl(a)google.com> arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL Jan Kara <jack(a)suse.cz> block: Try to handle busy underlying device on discard Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> block: Discard page cache of zone reset target range Eric W. Biederman <ebiederm(a)xmission.com> Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities") Pavel Skripkin <paskripkin(a)gmail.com> ALSA: usb-audio: fix use after free in usb_audio_disconnect Pavel Skripkin <paskripkin(a)gmail.com> ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe Kai-Heng Feng <kai.heng.feng(a)canonical.com> ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend() Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Apply the control quirk to Plantronics headsets Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar Takashi Iwai <tiwai(a)suse.de> ALSA: hda: Avoid spurious unsol event handling during S3/S4 Takashi Iwai <tiwai(a)suse.de> ALSA: hda: Flush pending unsolicited events before suspend Takashi Iwai <tiwai(a)suse.de> ALSA: hda: Drop the BATCH workaround for AMD controllers Simeon Simeonoff <sim.simeonoff(a)gmail.com> ALSA: hda/ca0132: Add Sound BlasterX AE-5 Plus support Takashi Iwai <tiwai(a)suse.de> ALSA: hda/conexant: Add quirk for mute LED control on HP ZBook G5 Takashi Iwai <tiwai(a)suse.de> ALSA: hda/hdmi: Cancel pending works before suspend John Ernberg <john.ernberg(a)actia.se> ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk Ard Biesheuvel <ardb(a)kernel.org> ARM: efistub: replace adrl pseudo-op with adr_l macro invocation Ard Biesheuvel <ardb(a)kernel.org> ARM: assembler: introduce adr_l, ldr_l and str_l macros Jian Cai <jiancai(a)google.com> ARM: 9029/1: Make iwmmxt.S support Clang's integrated assembler Jeremy Linton <jeremy.linton(a)arm.com> mmc: sdhci: Update firmware interface API AngeloGioacchino Del Regno <angelogioacchino.delregno(a)somainline.org> clk: qcom: gpucc-msm8998: Add resets, cxc, fix flags on gpu_gx_gdsc Aleksandr Miloserdov <a.miloserdov(a)yadro.com> scsi: target: core: Prevent underflow for service actions Aleksandr Miloserdov <a.miloserdov(a)yadro.com> scsi: target: core: Add cmd length set before cmd complete Mike Christie <michael.christie(a)oracle.com> scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling Lin Feng <linf(a)wangsu.com> sysctl.c: fix underflow value setting risk in vm_table David Hildenbrand <david(a)redhat.com> drivers/base/memory: don't store phys_device in memory blocks Heiko Carstens <hca(a)linux.ibm.com> s390/smp: __smp_rescan_cpus() - move cpumask away from stack Andrey Konovalov <andreyknvl(a)google.com> kasan: fix memory corruption in kasan_bitops_tags test Keita Suzuki <keitasuzuki.park(a)sslab.ics.keio.ac.jp> i40e: Fix memory leak in i40e_probe Geert Uytterhoeven <geert+renesas(a)glider.be> PCI: Fix pci_register_io_range() memory leak Sasha Levin <sashal(a)kernel.org> kbuild: clamp SUBLEVEL to 255 Theodore Ts'o <tytso(a)mit.edu> ext4: don't try to processed freed blocks until mballoc is initialized Bjorn Helgaas <bhelgaas(a)google.com> PCI/LINK: Remove bandwidth notification Arnd Bergmann <arnd(a)arndb.de> drivers/base: build kunit tests without structleak plugin Krzysztof Wilczyński <kw(a)linux.com> PCI: mediatek: Add missing of_node_put() to fix reference leak Martin Kaiser <martin(a)kaiser.cx> PCI: xgene-msi: Fix race in installing chained irq handler Ronald Tschalär <ronald(a)innovation.ch> Input: applespi - don't wait for responses to commands indefinitely. Khalid Aziz <khalid.aziz(a)oracle.com> sparc64: Use arch_validate_flags() to validate ADI flag Andreas Larsson <andreas(a)gaisler.com> sparc32: Limit memblock allocation to low memory AngeloGioacchino Del Regno <angelogioacchino.delregno(a)somainline.org> clk: qcom: gdsc: Implement NO_RET_PERIPH flag Suravee Suthikulpanit <suravee.suthikulpanit(a)amd.com> iommu/amd: Fix performance counter initialization Michael Ellerman <mpe(a)ellerman.id.au> powerpc/64: Fix stack trace not displaying final frame Filipe Laíns <lains(a)riseup.net> HID: logitech-dj: add support for the new lightspeed connection iteration Athira Rajeev <atrajeev(a)linux.vnet.ibm.com> powerpc/perf: Record counter overflow always if SAMPLE_IP is unset Nicholas Piggin <npiggin(a)gmail.com> powerpc: improve handling of unrecoverable system reset Alain Volmat <alain.volmat(a)foss.st.com> spi: stm32: make spurious and overrun interrupts visible Oliver O'Halloran <oohall(a)gmail.com> powerpc/pci: Add ppc_md.discover_phbs() Lubomir Rintel <lkundrak(a)v3.sk> Platform: OLPC: Fix probe error handling Jeremy Linton <jeremy.linton(a)arm.com> mmc: sdhci-iproc: Add ACPI bindings for the RPi Chaotian Jing <chaotian.jing(a)mediatek.com> mmc: mediatek: fix race condition between msdc_request_timeout and irq Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mmc: mxs-mmc: Fix a resource leak in an error handling path in 'mxs_mmc_probe()' Lu Baolu <baolu.lu(a)linux.intel.com> iommu/vt-d: Clear PRQ overflow only when PRQ is empty Steven J. Magnani <magnani(a)ieee.org> udf: fix silent AED tagLocation corruption Jaegeuk Kim <jaegeuk(a)kernel.org> scsi: ufs: WB is only available on LUN #0 to #7 Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: rcar: optimize cacheline to minimize HW race condition Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: rcar: faster irq code to minimize HW race condition Kalle Valo <kvalo(a)codeaurora.org> ath11k: fix AP mode for QCA6390 Carl Huang <cjhuang(a)codeaurora.org> ath11k: start vdev if a bss peer is already created Ritesh Singh <ritesi(a)codeaurora.org> ath11k: peer delete synchronization with firmware Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: initialize RFS/RSS memories for unused ports too Arnd Bergmann <arnd(a)arndb.de> enetc: Fix unused var build warning for CONFIG_OF DENG Qingfang <dqfext(a)gmail.com> net: dsa: tag_mtk: fix 802.1ad VLAN egress Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: tag_ar9331: let DSA core deal with TX reallocation Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: tag_gswip: let DSA core deal with TX reallocation Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: tag_dsa: let DSA core deal with TX reallocation Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: tag_brcm: let DSA core deal with TX reallocation Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: tag_edsa: let DSA core deal with TX reallocation Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: tag_lan9303: let DSA core deal with TX reallocation Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: tag_mtk: let DSA core deal with TX reallocation Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: tag_ocelot: let DSA core deal with TX reallocation Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: tag_qca: let DSA core deal with TX reallocation Christian Eggers <ceggers(a)arri.de> net: dsa: trailer: don't allocate additional memory for padding/tagging Christian Eggers <ceggers(a)arri.de> net: dsa: tag_ksz: don't allocate additional memory for padding/tagging Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: implement a central TX reallocation procedure Julian Wiedmann <jwi(a)linux.ibm.com> s390/qeth: fix notification for pending buffers during teardown Julian Wiedmann <jwi(a)linux.ibm.com> s390/qeth: improve completion of pending TX buffers Julian Wiedmann <jwi(a)linux.ibm.com> s390/qeth: remove QETH_QDIO_BUF_HANDLED_DELAYED state Julian Wiedmann <jwi(a)linux.ibm.com> s390/qeth: don't replace a fully completed async TX buffer Jian Shen <shenjian15(a)huawei.com> net: hns3: fix error mask definition of flow director Aurelien Aptel <aaptel(a)suse.com> cifs: fix credit accounting for extra channel Hans Verkuil <hverkuil(a)xs4all.nl> media: rc: compile rc-cec.c into rc-core Biju Das <biju.das.jz(a)bp.renesas.com> media: v4l: vsp1: Fix bru null pointer access Biju Das <biju.das.jz(a)bp.renesas.com> media: v4l: vsp1: Fix uif null pointer access Dafna Hirschfeld <dafna.hirschfeld(a)collabora.com> media: rkisp1: params: fix wrong bits settings Maxim Mikityanskiy <maxtram95(a)gmail.com> media: usbtv: Fix deadlock on suspend Sergey Shtylyov <s.shtylyov(a)omprussia.ru> sh_eth: fix TRSCER mask for R7S9210 Colin Ian King <colin.king(a)canonical.com> qxl: Fix uninitialised struct field head.surface_id Wang Qing <wangqing(a)vivo.com> s390/crypto: return -EFAULT if copy_to_user() fails Eric Farman <farman(a)linux.ibm.com> s390/cio: return -EFAULT if copy_to_user() fails Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> drm/i915: Wedge the GPU if command parser setup fails Noralf Trønnes <noralf(a)tronnes.org> drm/shmem-helpers: vunmap: Don't put pages for dma-buf Artem Lapkin <art(a)khadas.com> drm: meson_drv add shutdown function Thomas Zimmermann <tzimmermann(a)suse.de> drm: Use USB controller's DMA mask when importing dmabufs Neil Roberts <nroberts(a)igalia.com> drm/shmem-helper: Don't remove the offset in vm_area_struct pgoff Neil Roberts <nroberts(a)igalia.com> drm/shmem-helper: Check for purged buffers in fault handler Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/display: handle aux backlight in backlight_get_brightness Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/display: don't assert in set backlight function Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/display: simplify backlight setting Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/pm: bug fix for pcie dpm Holger Hoffstätte <holger(a)applied-asynchrony.com> drm/amd/display: Fix nested FPU context in dcn21_validate_bandwidth() Holger Hoffstätte <holger(a)applied-asynchrony.com> drm/amdgpu/display: use GFP_ATOMIC in dcn21_validate_bandwidth_fp() Takashi Iwai <tiwai(a)suse.de> drm/amd/display: Add a backlight module option Daniel Vetter <daniel.vetter(a)ffwll.ch> drm/compat: Clear bounce structures Johan Hovold <johan(a)kernel.org> gpio: fix gpio-device list corruption Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpio: pca953x: Set IRQ type when handle Intel Galileo Gen 2 Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Read "gpio-line-names" from a firmware node Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: acpi: Allow to find GpioInt() resource by name and index Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: acpi: Add ACPI_GPIO_QUIRK_ABSOLUTE_NUMBER quirk Edwin Peer <edwin.peer(a)broadcom.com> bnxt_en: reliably allocate IRQ table on reset to avoid crash Wang Qing <wangqing(a)vivo.com> s390/cio: return -EFAULT if copy_to_user() fails again Jian Shen <shenjian15(a)huawei.com> net: hns3: fix bug when calculating the TCAM table info Jian Shen <shenjian15(a)huawei.com> net: hns3: fix query vlan mask value error for flow director Ravi Bangoria <ravi.bangoria(a)linux.ibm.com> perf report: Fix -F for branch & mem modes Ian Rogers <irogers(a)google.com> perf traceevent: Ensure read cmdlines are null terminated. Danielle Ratson <danieller(a)nvidia.com> mlxsw: spectrum_ethtool: Add an external speed to PTYS register Danielle Ratson <danieller(a)nvidia.com> selftests: forwarding: Fix race condition in mirror installation Arnd Bergmann <arnd(a)arndb.de> net: phy: make mdio_bus_phy_suspend/resume as __maybe_unused Yinjun Zhang <yinjun.zhang(a)corigine.com> ethtool: fix the check logic of at least one channel for RX/TX Joakim Zhang <qiangqing.zhang(a)nxp.com> net: stmmac: fix wrongly set buffer2 valid when sph unsupport Joakim Zhang <qiangqing.zhang(a)nxp.com> net: stmmac: fix watchdog timeout during suspend/resume stress test Joakim Zhang <qiangqing.zhang(a)nxp.com> net: stmmac: stop each tx channel independently Antonio Terceiro <antonio.terceiro(a)linaro.org> perf build: Fix ccache usage in $(CC) when generating arch errno table Kun-Chuan Hsieh <jetswayss(a)gmail.com> tools/resolve_btfids: Fix build error with older host toolchains Antony Antony <antony(a)phenome.org> ixgbe: fail to create xfrm offload of IPsec tunnel mode SA Hayes Wang <hayeswang(a)realtek.com> r8169: fix r8168fp_adjust_ocp_cmd function Julian Wiedmann <jwi(a)linux.ibm.com> s390/qeth: fix memory leak after failed TX Buffer allocation Jia-Ju Bai <baijiaju1990(a)gmail.com> net: qrtr: fix error return code of qrtr_sendmsg() Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: allow hardware timestamping on TX queues with tc-etf enabled Paul Cercueil <paul(a)crapouillou.net> net: davicom: Fix regulator not turned off on driver removal Paul Cercueil <paul(a)crapouillou.net> net: davicom: Fix regulator not turned off on failed probe Xie He <xie.he.0141(a)gmail.com> net: lapbether: Remove netif_start_queue / netif_stop_queue Wong Vee Khee <vee.khee.wong(a)intel.com> stmmac: intel: Fixes clock registration error seen for multiple interfaces Ong Boon Leong <boon.leong.ong(a)intel.com> net: stmmac: Fix VLAN filter delete timeout issue in Intel mGBE SGMII Paul Moore <paul(a)paul-moore.com> cipso,calipso: resolve a number of problems with the DOI refcounts Hillf Danton <hdanton(a)sina.com> netdevsim: init u64 stats for 32bit hardware Daniele Palmas <dnlplm(a)gmail.com> net: usb: qmi_wwan: allow qmimux add/del with master up Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: fix SGMII PCS being forced to SPEED_UNKNOWN instead of SPEED_10 Vladimir Oltean <vladimir.oltean(a)nxp.com> net: mscc: ocelot: properly reject destination IP keys in VCAP IS1 Maximilian Heyne <mheyne(a)amazon.de> net: sched: avoid duplicates in classes dump Ido Schimmel <idosch(a)nvidia.com> nexthop: Do not flush blackhole nexthops when loopback goes down Ong Boon Leong <boon.leong.ong(a)intel.com> net: stmmac: fix incorrect DMA channel intr enable setting of EQoS v4.10 Kevin(Yudong) Yang <yyd(a)google.com> net/mlx4_en: update moderation when config reset Biao Huang <biao.huang(a)mediatek.com> net: ethernet: mtk-star-emac: fix wrong unmap in RX handling Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: keep RX ring consumer index in sync with hardware Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: remove bogus write to SIRXIDR from enetc_setup_rxbdr Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: force the RGMII speed and duplex instead of operating in inband mode Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: don't disable VLAN filtering in IFF_PROMISC mode Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: fix incorrect TPID when receiving 802.1ad tagged packets Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: take the MDIO lock only once per NAPI poll cycle Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: don't overwrite the RSS indirection table when initializing Sergey Shtylyov <s.shtylyov(a)omprussia.ru> sh_eth: fix TRSCER mask for SH771x DENG Qingfang <dqfext(a)gmail.com> net: dsa: tag_rtl4_a: fix egress tags Jakub Kicinski <kuba(a)kernel.org> docs: networking: drop special stable handling Linus Torvalds <torvalds(a)linux-foundation.org> Revert "mm, slub: consider rest of partial list if acquire_slab() fails" Paulo Alcantara <pc(a)cjr.nz> cifs: return proper error code in statfs(2) Christian Brauner <christian.brauner(a)ubuntu.com> mount: fix mounting of detached mounts onto targets that reside on shared mounts Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/603: Fix protection of user pages mapped with PROT_NONE Lorenzo Bianconi <lorenzo(a)kernel.org> mt76: dma: do not report truncated frames to mac80211 Jiri Wiesner <jwiesner(a)suse.com> ibmvnic: always store valid MAC address Michal Suchanek <msuchanek(a)suse.de> ibmvnic: Fix possibly uninitialized old_num_tx_queues variable warning. Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> libbpf: Clear map_info before each bpf_obj_get_info_by_fd Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> samples, bpf: Add missing munmap in xdpsock Yauheni Kaliuta <yauheni.kaliuta(a)redhat.com> selftests/bpf: Mask bpf_csum_diff() return value to 16 bits in test_verifier Hangbin Liu <liuhangbin(a)gmail.com> selftests/bpf: No need to drop the packet when there is no geneve opt Ilya Leoshkevich <iii(a)linux.ibm.com> selftests/bpf: Use the last page in test_snprintf_btf on s390 Guangbin Huang <huangguangbin2(a)huawei.com> net: phy: fix save wrong speed and duplex problem if autoneg is on Jason A. Donenfeld <Jason(a)zx2c4.com> net: always use icmp{,v6}_ndo_send from ndo_start_xmit Vasily Averin <vvs(a)virtuozzo.com> netfilter: x_tables: gpf inside xt_find_revision() Florian Westphal <fw(a)strlen.de> netfilter: nf_nat: undo erroneous tcp edemux lookup Eric Dumazet <edumazet(a)google.com> tcp: add sanity tests to TCP_QUEUE_SEQ Arjun Roy <arjunroy(a)google.com> tcp: Fix sign comparison bug in getsockopt(TCP_ZEROCOPY_RECEIVE) Torin Cooper-Bennun <torin(a)maxiluxsystems.com> can: tcan4x5x: tcan4x5x_init(): fix initialization - clear MRAM before entering Normal Mode Joakim Zhang <qiangqing.zhang(a)nxp.com> can: flexcan: invoke flexcan_chip_freeze() to enter freeze mode Joakim Zhang <qiangqing.zhang(a)nxp.com> can: flexcan: enable RX FIFO after FRZ/HALT valid Joakim Zhang <qiangqing.zhang(a)nxp.com> can: flexcan: assert FRZ bit in flexcan_chip_freeze() Oleksij Rempel <linux(a)rempel-privat.de> can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting skb ownership Matthias Schiffer <mschiffer(a)universe-factory.net> net: l2tp: reduce log level of messages in receive path, add counter instead Balazs Nemeth <bnemeth(a)redhat.com> net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 Balazs Nemeth <bnemeth(a)redhat.com> net: check if protocol extracted by virtio_net_hdr_set_proto is correct Daniel Borkmann <daniel(a)iogearbox.net> net: Fix gro aggregation for udp encaps with zero csum Felix Fietkau <nbd(a)nbd.name> ath9k: fix transmitting to stations in dynamic SMPS mode Maciej W. Rozycki <macro(a)orcam.me.uk> crypto: mips/poly1305 - enable for all MIPS processors Jakub Kicinski <kuba(a)kernel.org> ethernet: alx: fix order of calls on resume Greg Kurz <groug(a)kaod.org> powerpc/pseries: Don't enforce MSI affinity with kdump Athira Rajeev <atrajeev(a)linux.vnet.ibm.com> powerpc/perf: Fix handling of privilege level checks in perf interrupt context Dmitry V. Levin <ldv(a)altlinux.org> uapi: nfnetlink_cthelper.h: fix userspace compilation error ------------- Diffstat: Documentation/ABI/testing/sysfs-devices-memory | 5 +- Documentation/admin-guide/mm/memory-hotplug.rst | 4 +- Documentation/gpu/todo.rst | 21 +++ Documentation/networking/netdev-FAQ.rst | 78 +------- Documentation/process/stable-kernel-rules.rst | 6 - Documentation/process/submitting-patches.rst | 5 - Documentation/virt/kvm/api.rst | 3 + Makefile | 16 +- arch/arm/boot/compressed/head.S | 3 +- arch/arm/include/asm/assembler.h | 84 +++++++++ arch/arm/kernel/iwmmxt.S | 89 ++++----- arch/arm/kernel/iwmmxt.h | 47 +++++ arch/arm64/include/asm/kvm_asm.h | 4 +- arch/arm64/include/asm/kvm_hyp.h | 8 +- arch/arm64/include/asm/memory.h | 5 + arch/arm64/include/asm/mmu_context.h | 5 +- arch/arm64/include/asm/pgtable-prot.h | 1 - arch/arm64/include/asm/pgtable.h | 3 + arch/arm64/kernel/head.S | 2 +- arch/arm64/kernel/perf_event.c | 2 +- arch/arm64/kvm/arm.c | 7 +- arch/arm64/kvm/hyp/entry.S | 2 +- arch/arm64/kvm/hyp/nvhe/debug-sr.c | 12 +- arch/arm64/kvm/hyp/nvhe/host.S | 20 +-- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 4 +- arch/arm64/kvm/hyp/nvhe/switch.c | 14 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 3 +- arch/arm64/kvm/hyp/pgtable.c | 1 + arch/arm64/kvm/hyp/vhe/tlb.c | 3 +- arch/arm64/kvm/mmu.c | 3 +- arch/arm64/kvm/reset.c | 12 +- arch/arm64/mm/init.c | 12 ++ arch/arm64/mm/mmu.c | 5 +- arch/mips/crypto/Makefile | 4 +- arch/powerpc/include/asm/code-patching.h | 2 +- arch/powerpc/include/asm/machdep.h | 3 + arch/powerpc/include/asm/ptrace.h | 7 +- arch/powerpc/include/asm/switch_to.h | 10 ++ arch/powerpc/kernel/asm-offsets.c | 2 +- arch/powerpc/kernel/exceptions-64s.S | 2 +- arch/powerpc/kernel/head_book3s_32.S | 9 +- arch/powerpc/kernel/pci-common.c | 10 ++ arch/powerpc/kernel/process.c | 2 +- arch/powerpc/kernel/traps.c | 5 +- arch/powerpc/perf/core-book3s.c | 23 ++- arch/powerpc/platforms/pseries/msi.c | 25 ++- arch/s390/kernel/smp.c | 2 +- arch/sparc/include/asm/mman.h | 54 +++--- arch/sparc/mm/init_32.c | 3 + arch/x86/entry/common.c | 37 +--- arch/x86/entry/entry_64_compat.S | 2 + arch/x86/events/intel/core.c | 5 +- arch/x86/include/asm/idtentry.h | 3 - arch/x86/include/asm/insn-eval.h | 2 + arch/x86/include/asm/proto.h | 1 + arch/x86/include/asm/ptrace.h | 15 ++ arch/x86/kernel/cpu/mce/core.c | 6 +- arch/x86/kernel/kvmclock.c | 19 +- arch/x86/kernel/nmi.c | 6 +- arch/x86/kernel/sev-es.c | 22 ++- arch/x86/kernel/traps.c | 16 +- arch/x86/kernel/unwind_orc.c | 12 +- arch/x86/kvm/lapic.c | 11 +- arch/x86/lib/insn-eval.c | 66 +++++-- block/blk-zoned.c | 38 +++- crypto/Kconfig | 2 +- drivers/base/memory.c | 25 +-- drivers/base/swnode.c | 3 + drivers/base/test/Makefile | 1 + drivers/block/rsxx/core.c | 1 + drivers/block/zram/zram_drv.c | 11 +- drivers/clk/qcom/gdsc.c | 10 +- drivers/clk/qcom/gdsc.h | 3 +- drivers/clk/qcom/gpucc-msm8998.c | 8 +- drivers/cpufreq/qcom-cpufreq-hw.c | 6 +- drivers/firmware/efi/libstub/efi-stub.c | 16 ++ drivers/gpio/gpio-pca953x.c | 78 +++----- drivers/gpio/gpiolib-acpi.c | 19 +- drivers/gpio/gpiolib.c | 16 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 49 ++--- drivers/gpu/drm/amd/display/dc/core/dc_link.c | 1 - .../gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 6 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 48 +++++ .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 66 +++++++ .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 48 ++--- drivers/gpu/drm/drm_gem_shmem_helper.c | 32 ++-- drivers/gpu/drm/drm_ioc32.c | 11 ++ drivers/gpu/drm/i915/gt/intel_engine_cs.c | 7 +- drivers/gpu/drm/i915/i915_cmd_parser.c | 19 +- drivers/gpu/drm/i915/i915_drv.h | 2 +- drivers/gpu/drm/meson/meson_drv.c | 11 ++ drivers/gpu/drm/qxl/qxl_display.c | 1 + drivers/gpu/drm/tiny/gm12u320.c | 44 ++++- drivers/gpu/drm/udl/udl_drv.c | 17 ++ drivers/gpu/drm/udl/udl_drv.h | 1 + drivers/gpu/drm/udl/udl_main.c | 10 ++ drivers/hid/hid-logitech-dj.c | 7 +- drivers/i2c/busses/i2c-rcar.c | 13 +- drivers/infiniband/core/umem.c | 8 +- drivers/input/keyboard/applespi.c | 21 ++- drivers/iommu/amd/init.c | 45 +++-- drivers/iommu/intel/svm.c | 13 +- drivers/media/platform/vsp1/vsp1_drm.c | 6 +- drivers/media/rc/Makefile | 1 + drivers/media/rc/keymaps/Makefile | 1 - drivers/media/rc/keymaps/rc-cec.c | 28 ++- drivers/media/rc/rc-main.c | 6 + drivers/media/usb/usbtv/usbtv-audio.c | 2 +- drivers/misc/fastrpc.c | 5 + drivers/misc/pvpanic.c | 1 + drivers/mmc/core/bus.c | 11 +- drivers/mmc/core/mmc.c | 15 +- drivers/mmc/host/mmci.c | 10 +- drivers/mmc/host/mtk-sd.c | 18 +- drivers/mmc/host/mxs-mmc.c | 2 +- drivers/mmc/host/sdhci-iproc.c | 18 ++ drivers/mmc/host/sdhci.c | 8 +- drivers/net/Kconfig | 2 +- drivers/net/can/flexcan.c | 24 ++- drivers/net/can/m_can/tcan4x5x.c | 6 +- drivers/net/dsa/sja1105/sja1105_main.c | 2 +- drivers/net/ethernet/atheros/alx/main.c | 7 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 14 +- drivers/net/ethernet/davicom/dm9000.c | 21 ++- drivers/net/ethernet/freescale/enetc/enetc.c | 93 +++++----- drivers/net/ethernet/freescale/enetc/enetc.h | 5 + drivers/net/ethernet/freescale/enetc/enetc_hw.h | 18 +- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 117 +++++++++--- drivers/net/ethernet/freescale/enetc/enetc_vf.c | 7 + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 6 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +- drivers/net/ethernet/ibm/ibmvnic.c | 13 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 + drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 5 + drivers/net/ethernet/intel/ixgbevf/ipsec.c | 5 + drivers/net/ethernet/mediatek/mtk_star_emac.c | 5 +- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 + drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 + drivers/net/ethernet/mellanox/mlxsw/reg.h | 1 + .../net/ethernet/mellanox/mlxsw/spectrum_ethtool.c | 5 + drivers/net/ethernet/mellanox/mlxsw/switchx2.c | 3 +- drivers/net/ethernet/mscc/ocelot_flower.c | 3 +- drivers/net/ethernet/realtek/r8169_main.c | 2 +- drivers/net/ethernet/renesas/sh_eth.c | 7 + drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 5 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 9 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c | 19 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 4 - .../net/ethernet/stmicro/stmmac/dwxgmac2_descs.c | 2 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 19 +- drivers/net/netdevsim/netdev.c | 1 + drivers/net/phy/phy.c | 6 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/usb/qmi_wwan.c | 14 -- drivers/net/wan/lapbether.c | 3 - drivers/net/wireless/ath/ath11k/core.c | 1 + drivers/net/wireless/ath/ath11k/core.h | 1 + drivers/net/wireless/ath/ath11k/mac.c | 25 ++- drivers/net/wireless/ath/ath11k/peer.c | 61 ++++++- drivers/net/wireless/ath/ath11k/peer.h | 4 + drivers/net/wireless/ath/ath11k/wmi.c | 17 +- drivers/net/wireless/ath/ath9k/ath9k.h | 3 +- drivers/net/wireless/ath/ath9k/xmit.c | 6 + drivers/net/wireless/mediatek/mt76/dma.c | 11 +- drivers/nvme/host/fc.c | 2 +- drivers/pci/controller/pci-xgene-msi.c | 10 +- drivers/pci/controller/pcie-mediatek.c | 7 +- drivers/pci/pci.c | 4 + drivers/pci/pcie/Kconfig | 8 - drivers/pci/pcie/Makefile | 1 - drivers/pci/pcie/bw_notification.c | 138 -------------- drivers/pci/pcie/portdrv.h | 6 - drivers/pci/pcie/portdrv_pci.c | 1 - drivers/platform/olpc/olpc-ec.c | 15 +- drivers/s390/block/dasd.c | 6 +- drivers/s390/cio/vfio_ccw_ops.c | 6 +- drivers/s390/crypto/vfio_ap_ops.c | 2 +- drivers/s390/net/qeth_core.h | 5 +- drivers/s390/net/qeth_core_main.c | 200 ++++++++++----------- drivers/scsi/libiscsi.c | 11 +- drivers/scsi/ufs/ufs-sysfs.c | 3 +- drivers/scsi/ufs/ufs.h | 6 +- drivers/scsi/ufs/ufshcd.c | 2 +- drivers/spi/spi-stm32.c | 15 +- drivers/staging/comedi/drivers/addi_apci_1032.c | 4 +- drivers/staging/comedi/drivers/addi_apci_1500.c | 18 +- drivers/staging/comedi/drivers/adv_pci1710.c | 10 +- drivers/staging/comedi/drivers/das6402.c | 2 +- drivers/staging/comedi/drivers/das800.c | 2 +- drivers/staging/comedi/drivers/dmm32at.c | 2 +- drivers/staging/comedi/drivers/me4000.c | 2 +- drivers/staging/comedi/drivers/pcl711.c | 2 +- drivers/staging/comedi/drivers/pcl818.c | 2 +- drivers/staging/ks7010/ks_wlan_net.c | 6 +- drivers/staging/media/rkisp1/rkisp1-params.c | 1 - drivers/staging/rtl8188eu/core/rtw_ap.c | 5 + drivers/staging/rtl8188eu/os_dep/ioctl_linux.c | 6 +- drivers/staging/rtl8192e/rtl8192e/rtl_wx.c | 7 +- drivers/staging/rtl8192u/r8192U_wx.c | 6 +- drivers/staging/rtl8712/rtl871x_cmd.c | 6 +- drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 2 +- drivers/target/target_core_pr.c | 15 +- drivers/target/target_core_transport.c | 15 +- drivers/tty/serial/max310x.c | 29 +-- drivers/usb/class/cdc-acm.c | 5 + drivers/usb/class/usblp.c | 16 +- drivers/usb/core/usb.c | 32 ++++ drivers/usb/dwc3/dwc3-qcom.c | 77 +++++++- drivers/usb/gadget/function/f_uac1.c | 1 + drivers/usb/gadget/function/f_uac2.c | 2 +- drivers/usb/gadget/function/u_ether_configfs.h | 5 +- drivers/usb/gadget/udc/s3c2410_udc.c | 4 +- drivers/usb/host/xhci-pci.c | 13 +- drivers/usb/host/xhci-ring.c | 3 +- drivers/usb/host/xhci.c | 78 ++++---- drivers/usb/host/xhci.h | 1 + drivers/usb/renesas_usbhs/pipe.c | 2 + drivers/usb/serial/ch341.c | 1 + drivers/usb/serial/cp210x.c | 3 + drivers/usb/serial/io_edgeport.c | 26 +-- drivers/usb/usbip/stub_dev.c | 42 ++++- drivers/usb/usbip/vhci_sysfs.c | 39 +++- drivers/usb/usbip/vudc_sysfs.c | 49 ++++- drivers/xen/events/events_2l.c | 22 ++- drivers/xen/events/events_base.c | 140 +++++++++++---- drivers/xen/events/events_fifo.c | 7 - drivers/xen/events/events_internal.h | 14 +- fs/binfmt_misc.c | 29 ++- fs/block_dev.c | 11 +- fs/cifs/cifsfs.c | 2 +- fs/cifs/cifsglob.h | 11 +- fs/cifs/connect.c | 10 +- fs/cifs/sess.c | 1 + fs/cifs/smb2inode.c | 1 + fs/cifs/smb2misc.c | 8 +- fs/cifs/smb2ops.c | 10 +- fs/cifs/smb2proto.h | 3 +- fs/cifs/transport.c | 2 +- fs/configfs/file.c | 6 +- fs/ext4/super.c | 9 +- fs/nfs/dir.c | 40 +++-- fs/nfs/nfs4proc.c | 2 +- fs/pnode.h | 2 +- fs/udf/inode.c | 9 +- include/linux/acpi.h | 10 +- include/linux/can/skb.h | 8 +- include/linux/compiler-clang.h | 6 + include/linux/entry-common.h | 39 +++- include/linux/gpio/consumer.h | 2 + include/linux/memory.h | 3 +- include/linux/perf_event.h | 2 + include/linux/pgtable.h | 4 + include/linux/sched/mm.h | 3 +- include/linux/seqlock.h | 5 +- include/linux/stop_machine.h | 11 +- include/linux/usb.h | 2 + include/linux/virtio_net.h | 7 +- include/media/rc-map.h | 7 + include/target/target_core_backend.h | 1 + include/uapi/linux/l2tp.h | 1 + include/uapi/linux/netfilter/nfnetlink_cthelper.h | 2 +- kernel/entry/common.c | 36 ++++ kernel/events/core.c | 42 ++++- kernel/sched/membarrier.c | 4 +- kernel/sys.c | 2 +- kernel/sysctl.c | 8 +- kernel/time/hrtimer.c | 60 ++++--- lib/logic_pio.c | 3 + lib/test_kasan.c | 10 +- mm/madvise.c | 13 +- mm/memory.c | 8 + mm/memory_hotplug.c | 2 +- mm/page_alloc.c | 158 ++++++++-------- mm/slub.c | 2 +- net/dsa/slave.c | 45 +++++ net/dsa/tag_ar9331.c | 3 - net/dsa/tag_brcm.c | 3 - net/dsa/tag_dsa.c | 5 - net/dsa/tag_edsa.c | 4 - net/dsa/tag_gswip.c | 5 - net/dsa/tag_ksz.c | 73 +------- net/dsa/tag_lan9303.c | 9 - net/dsa/tag_mtk.c | 22 ++- net/dsa/tag_ocelot.c | 7 - net/dsa/tag_qca.c | 3 - net/dsa/tag_rtl4_a.c | 12 +- net/dsa/tag_trailer.c | 31 +--- net/ethtool/channels.c | 26 +-- net/ipv4/cipso_ipv4.c | 11 +- net/ipv4/ip_tunnel.c | 5 +- net/ipv4/ip_vti.c | 6 +- net/ipv4/nexthop.c | 10 +- net/ipv4/tcp.c | 26 ++- net/ipv4/udp_offload.c | 2 +- net/ipv6/calipso.c | 14 +- net/ipv6/ip6_gre.c | 16 +- net/ipv6/ip6_tunnel.c | 10 +- net/ipv6/ip6_vti.c | 6 +- net/ipv6/sit.c | 2 +- net/l2tp/l2tp_core.c | 41 +++-- net/l2tp/l2tp_core.h | 1 + net/l2tp/l2tp_netlink.c | 6 + net/mpls/mpls_gso.c | 3 + net/netfilter/nf_nat_proto.c | 25 ++- net/netfilter/x_tables.c | 6 +- net/netlabel/netlabel_cipso_v4.c | 3 + net/qrtr/qrtr.c | 4 +- net/sched/sch_api.c | 8 +- net/sunrpc/sched.c | 5 +- samples/bpf/xdpsock_user.c | 2 + security/commoncap.c | 12 +- sound/pci/hda/hda_bind.c | 4 + sound/pci/hda/hda_controller.c | 7 - sound/pci/hda/hda_intel.c | 2 + sound/pci/hda/patch_ca0132.c | 1 + sound/pci/hda/patch_conexant.c | 62 +++++-- sound/pci/hda/patch_hdmi.c | 13 ++ sound/usb/card.c | 6 + sound/usb/quirks.c | 11 +- sound/usb/usbaudio.h | 1 + tools/bpf/resolve_btfids/main.c | 5 + tools/lib/bpf/xsk.c | 5 +- tools/perf/Makefile.perf | 2 +- tools/perf/util/sort.c | 4 +- tools/perf/util/trace-event-read.c | 1 + .../selftests/bpf/progs/netif_receive_skb.c | 13 +- .../testing/selftests/bpf/progs/test_tunnel_kern.c | 6 +- .../testing/selftests/bpf/verifier/array_access.c | 3 +- .../net/forwarding/mirror_gre_bridge_1d_vlan.sh | 9 + 333 files changed, 3007 insertions(+), 1742 deletions(-)

3 years

19
320
0 0

FAILED: patch "[PATCH] ipv6: fix memory leak in fib6_rule_suppress" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From cdef485217d30382f3bf6448c54b4401648fe3f1 Mon Sep 17 00:00:00 2001 From: msizanoen1 <msizanoen(a)qtmlabs.xyz> Date: Tue, 23 Nov 2021 13:48:32 +0100 Subject: [PATCH] ipv6: fix memory leak in fib6_rule_suppress The kernel leaks memory when a `fib` rule is present in IPv6 nftables firewall rules and a suppress_prefix rule is present in the IPv6 routing rules (used by certain tools such as wg-quick). In such scenarios, every incoming packet will leak an allocation in `ip6_dst_cache` slab cache. After some hours of `bpftrace`-ing and source code reading, I tracked down the issue to ca7a03c41753 ("ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule"). The problem with that change is that the generic `args->flags` always have `FIB_LOOKUP_NOREF` set[1][2] but the IPv6-specific flag `RT6_LOOKUP_F_DST_NOREF` might not be, leading to `fib6_rule_suppress` not decreasing the refcount when needed. How to reproduce: - Add the following nftables rule to a prerouting chain: meta nfproto ipv6 fib saddr . mark . iif oif missing drop This can be done with: sudo nft create table inet test sudo nft create chain inet test test_chain '{ type filter hook prerouting priority filter + 10; policy accept; }' sudo nft add rule inet test test_chain meta nfproto ipv6 fib saddr . mark . iif oif missing drop - Run: sudo ip -6 rule add table main suppress_prefixlength 0 - Watch `sudo slabtop -o | grep ip6_dst_cache` to see memory usage increase with every incoming ipv6 packet. This patch exposes the protocol-specific flags to the protocol specific `suppress` function, and check the protocol-specific `flags` argument for RT6_LOOKUP_F_DST_NOREF instead of the generic FIB_LOOKUP_NOREF when decreasing the refcount, like this. [1]: https://github.com/torvalds/linux/blob/ca7a03c4175366a92cee0ccc4fec0038c326… [2]: https://github.com/torvalds/linux/blob/ca7a03c4175366a92cee0ccc4fec0038c326… Link: https://bugzilla.kernel.org/show_bug.cgi?id=215105 Fixes: ca7a03c41753 ("ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule") Cc: stable(a)vger.kernel.org Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h index 4b10676c69d1..bd07484ab9dd 100644 --- a/include/net/fib_rules.h +++ b/include/net/fib_rules.h @@ -69,7 +69,7 @@ struct fib_rules_ops { int (*action)(struct fib_rule *, struct flowi *, int, struct fib_lookup_arg *); - bool (*suppress)(struct fib_rule *, + bool (*suppress)(struct fib_rule *, int, struct fib_lookup_arg *); int (*match)(struct fib_rule *, struct flowi *, int); @@ -218,7 +218,9 @@ INDIRECT_CALLABLE_DECLARE(int fib4_rule_action(struct fib_rule *rule, struct fib_lookup_arg *arg)); INDIRECT_CALLABLE_DECLARE(bool fib6_rule_suppress(struct fib_rule *rule, + int flags, struct fib_lookup_arg *arg)); INDIRECT_CALLABLE_DECLARE(bool fib4_rule_suppress(struct fib_rule *rule, + int flags, struct fib_lookup_arg *arg)); #endif diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c index 79df7cd9dbc1..1bb567a3b329 100644 --- a/net/core/fib_rules.c +++ b/net/core/fib_rules.c @@ -323,7 +323,7 @@ int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl, if (!err && ops->suppress && INDIRECT_CALL_MT(ops->suppress, fib6_rule_suppress, fib4_rule_suppress, - rule, arg)) + rule, flags, arg)) continue; if (err != -EAGAIN) { diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c index ce54a30c2ef1..364ad3446b2f 100644 --- a/net/ipv4/fib_rules.c +++ b/net/ipv4/fib_rules.c @@ -141,6 +141,7 @@ INDIRECT_CALLABLE_SCOPE int fib4_rule_action(struct fib_rule *rule, } INDIRECT_CALLABLE_SCOPE bool fib4_rule_suppress(struct fib_rule *rule, + int flags, struct fib_lookup_arg *arg) { struct fib_result *result = (struct fib_result *) arg->result; diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c index 40f3e4f9f33a..dcedfe29d9d9 100644 --- a/net/ipv6/fib6_rules.c +++ b/net/ipv6/fib6_rules.c @@ -267,6 +267,7 @@ INDIRECT_CALLABLE_SCOPE int fib6_rule_action(struct fib_rule *rule, } INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule, + int flags, struct fib_lookup_arg *arg) { struct fib6_result *res = arg->result; @@ -294,8 +295,7 @@ INDIRECT_CALLABLE_SCOPE bool fib6_rule_suppress(struct fib_rule *rule, return false; suppress_route: - if (!(arg->flags & FIB_LOOKUP_NOREF)) - ip6_rt_put(rt); + ip6_rt_put_flags(rt, flags); return true; }

3 years

1
0
0 0

[PATCH v2] x86/sgx: Free backing memory after faulting the enclave page

by Jarkko Sakkinen

There is a limited amount of SGX memory (EPC) on each system. When that memory is used up, SGX has its own swapping mechanism which is similar in concept but totally separate from the core mm/* code. Instead of swapping to disk, SGX swaps from EPC to normal RAM. That normal RAM comes from a shared memory pseudo-file and can itself be swapped by the core mm code. There is a hierarchy like this: EPC <-> shmem <-> disk After data is swapped back in from shmem to EPC, the shmem backing storage needs to be freed. Currently, the backing shmem is not freed. This effectively wastes the shmem while the enclave is running. The memory is recovered when the enclave is destroyed and the backing storage freed. Sort this out by freeing memory with shmem_truncate_range(), as soon as a page is faulted back to the EPC. In addition, free the memory for PCMD pages as soon as all PCMD's in a page have been marked as unused by zeroing its contents. Reported-by: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: stable(a)vger.kernel.org Fixes: 1728ab54b4be ("x86/sgx: Add a page reclaimer") Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> --- v2: * Rewrite commit message as proposed by Dave. * Truncate PCMD pages (Dave). --- arch/x86/kernel/cpu/sgx/encl.c | 48 +++++++++++++++++++++++++++++++--- 1 file changed, 44 insertions(+), 4 deletions(-) diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c index 001808e3901c..ea43c10e5458 100644 --- a/arch/x86/kernel/cpu/sgx/encl.c +++ b/arch/x86/kernel/cpu/sgx/encl.c @@ -12,6 +12,27 @@ #include "encls.h" #include "sgx.h" + +/* + * Get the page number of the page in the backing storage, which stores the PCMD + * of the enclave page in the given page index. PCMD pages are located after + * the backing storage for the visible enclave pages and SECS. + */ +static inline pgoff_t sgx_encl_get_backing_pcmd_nr(struct sgx_encl *encl, pgoff_t index) +{ + return PFN_DOWN(encl->size) + 1 + (index / sizeof(struct sgx_pcmd)); +} + +/* + * Free a page from the backing storage in the given page index. + */ +static inline void sgx_encl_truncate_backing_page(struct sgx_encl *encl, pgoff_t index) +{ + struct inode *inode = file_inode(encl->backing); + + shmem_truncate_range(inode, PFN_PHYS(index), PFN_PHYS(index) + PAGE_SIZE - 1); +} + /* * ELDU: Load an EPC page as unblocked. For more info, see "OS Management of EPC * Pages" in the SDM. @@ -24,7 +45,10 @@ static int __sgx_encl_eldu(struct sgx_encl_page *encl_page, struct sgx_encl *encl = encl_page->encl; struct sgx_pageinfo pginfo; struct sgx_backing b; + bool pcmd_page_empty; pgoff_t page_index; + pgoff_t pcmd_index; + u8 *pcmd_page; int ret; if (secs_page) @@ -38,8 +62,8 @@ static int __sgx_encl_eldu(struct sgx_encl_page *encl_page, pginfo.addr = encl_page->desc & PAGE_MASK; pginfo.contents = (unsigned long)kmap_atomic(b.contents); - pginfo.metadata = (unsigned long)kmap_atomic(b.pcmd) + - b.pcmd_offset; + pcmd_page = kmap_atomic(b.pcmd); + pginfo.metadata = (unsigned long)pcmd_page + b.pcmd_offset; if (secs_page) pginfo.secs = (u64)sgx_get_epc_virt_addr(secs_page); @@ -55,11 +79,27 @@ static int __sgx_encl_eldu(struct sgx_encl_page *encl_page, ret = -EFAULT; } - kunmap_atomic((void *)(unsigned long)(pginfo.metadata - b.pcmd_offset)); + memset(pcmd_page + b.pcmd_offset, 0, sizeof(struct sgx_pcmd)); + + /* + * The area for the PCMD in the page was zeroed above. Check if the + * whole page is now empty meaning that all PCMD's have been zeroed: + */ + pcmd_page_empty = !memchr_inv(pcmd_page, 0, PAGE_SIZE); + + kunmap_atomic(pcmd_page); kunmap_atomic((void *)(unsigned long)pginfo.contents); sgx_encl_put_backing(&b, false); + /* Free the backing memory. */ + sgx_encl_truncate_backing_page(encl, page_index); + + if (pcmd_page_empty) { + pcmd_index = sgx_encl_get_backing_pcmd_nr(encl, page_index); + sgx_encl_truncate_backing_page(encl, pcmd_index); + } + return ret; } @@ -577,7 +617,7 @@ static struct page *sgx_encl_get_backing_page(struct sgx_encl *encl, int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index, struct sgx_backing *backing) { - pgoff_t pcmd_index = PFN_DOWN(encl->size) + 1 + (page_index >> 5); + pgoff_t pcmd_index = sgx_encl_get_backing_pcmd_nr(encl, page_index); struct page *contents; struct page *pcmd; -- 2.32.0

3 years

1
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2021