July 2021 - Linux-stable-mirror

[PATCH] clk: fix leak on devm_clk_bulk_get_all() unwind

by Brian Norris

clk_bulk_get_all() allocates an array of struct clk_bulk data for us (unlike clk_bulk_get()), so we need to free it. Let's use the clk_bulk_put_all() helper. kmemleak complains, on an RK3399 Gru/Kevin system: unreferenced object 0xffffff80045def00 (size 128): comm "swapper/0", pid 1, jiffies 4294667682 (age 86.394s) hex dump (first 32 bytes): 44 32 60 fe fe ff ff ff 00 00 00 00 00 00 00 00 D2`............. 48 32 60 fe fe ff ff ff 00 00 00 00 00 00 00 00 H2`............. backtrace: [<00000000742860d6>] __kmalloc+0x22c/0x39c [<00000000b0493f2c>] clk_bulk_get_all+0x64/0x188 [<00000000325f5900>] devm_clk_bulk_get_all+0x58/0xa8 [<00000000175b9bc5>] dwc3_probe+0x8ac/0xb5c [<000000009169e2f9>] platform_drv_probe+0x9c/0xbc [<000000005c51e2ee>] really_probe+0x13c/0x378 [<00000000c47b1f24>] driver_probe_device+0x84/0xc0 [<00000000f870fcfb>] __device_attach_driver+0x94/0xb0 [<000000004d1b92ae>] bus_for_each_drv+0x8c/0xd8 [<00000000481d60c3>] __device_attach+0xc4/0x150 [<00000000a163bd36>] device_initial_probe+0x1c/0x28 [<00000000accb6bad>] bus_probe_device+0x3c/0x9c [<000000001a199f89>] device_add+0x218/0x3cc [<000000001bd84952>] of_device_add+0x40/0x50 [<000000009c658c29>] of_platform_device_create_pdata+0xac/0x100 [<0000000021c69ba4>] of_platform_bus_create+0x190/0x224 Fixes: f08c2e2865f6 ("clk: add managed version of clk_bulk_get_all") Cc: Dong Aisheng <aisheng.dong(a)nxp.com> Cc: stable(a)vger.kernel.org Signed-off-by: Brian Norris <briannorris(a)chromium.org> --- Never mind that kmemleak appears broken on 5.14-rc3+... but I caught the leak on an earlier kernel. drivers/clk/clk-devres.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/clk/clk-devres.c b/drivers/clk/clk-devres.c index be160764911b..f9d5b7334341 100644 --- a/drivers/clk/clk-devres.c +++ b/drivers/clk/clk-devres.c @@ -92,13 +92,20 @@ int __must_check devm_clk_bulk_get_optional(struct device *dev, int num_clks, } EXPORT_SYMBOL_GPL(devm_clk_bulk_get_optional); +static void devm_clk_bulk_release_all(struct device *dev, void *res) +{ + struct clk_bulk_devres *devres = res; + + clk_bulk_put_all(devres->num_clks, devres->clks); +} + int __must_check devm_clk_bulk_get_all(struct device *dev, struct clk_bulk_data **clks) { struct clk_bulk_devres *devres; int ret; - devres = devres_alloc(devm_clk_bulk_release, + devres = devres_alloc(devm_clk_bulk_release_all, sizeof(*devres), GFP_KERNEL); if (!devres) return -ENOMEM; -- 2.32.0.554.ge1b32706d8-goog

3 years, 4 months

2
1
0 0

[PATCH 5.10 00/24] 5.10.55-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.55 release. There are 24 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 31 Jul 2021 13:51:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.55-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.55-rc1 Vasily Averin <vvs(a)virtuozzo.com> ipv6: ip6_finish_output2: set sk into newly allocated nskb Sudeep Holla <sudeep.holla(a)arm.com> ARM: dts: versatile: Fix up interrupt controller node names Christoph Hellwig <hch(a)lst.de> iomap: remove the length variable in iomap_seek_hole Christoph Hellwig <hch(a)lst.de> iomap: remove the length variable in iomap_seek_data Hyunchul Lee <hyc.lee(a)gmail.com> cifs: fix the out of range assignment to bit fields in parse_server_interfaces Cristian Marussi <cristian.marussi(a)arm.com> firmware: arm_scmi: Fix range check for the maximum number of pending messages Sudeep Holla <sudeep.holla(a)arm.com> firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> hfs: add lock nesting notation to hfs_find_init Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> hfs: fix high memory mapping in hfs_bnode_read Desmond Cheong Zhi Xi <desmondcheongzx(a)gmail.com> hfs: add missing clean-up in hfs_fill_super Zheyu Ma <zheyuma97(a)gmail.com> drm/ttm: add a check against null pointer dereference Vasily Averin <vvs(a)virtuozzo.com> ipv6: allocate enough headroom in ip6_finish_output2() Paul E. McKenney <paulmck(a)kernel.org> rcu-tasks: Don't delete holdouts within trc_wait_for_one_reader() Paul E. McKenney <paulmck(a)kernel.org> rcu-tasks: Don't delete holdouts within trc_inspect_reader() Xin Long <lucien.xin(a)gmail.com> sctp: move 198 addresses from unusable to private scope Eric Dumazet <edumazet(a)google.com> net: annotate data race around sk_ll_usec Yang Yingliang <yangyingliang(a)huawei.com> net/802/garp: fix memleak in garp_request_join() Yang Yingliang <yangyingliang(a)huawei.com> net/802/mrp: fix memleak in mrp_request_join() Paul Gortmaker <paul.gortmaker(a)windriver.com> cgroup1: fix leaked context root causing sporadic NULL deref in LTP Yang Yingliang <yangyingliang(a)huawei.com> workqueue: fix UAF in pwq_unbound_release_workfn() Miklos Szeredi <mszeredi(a)redhat.com> af_unix: fix garbage collect vs MSG_PEEK Maxim Levitsky <mlevitsk(a)redhat.com> KVM: x86: determine if an exception has an error code only when injecting it. Pavel Begunkov <asml.silence(a)gmail.com> io_uring: fix link timeout refs Yonghong Song <yhs(a)fb.com> tools: Allow proper CC/CXX/... override with LLVM=1 in Makefile.include ------------- Diffstat: Makefile | 4 +-- arch/arm/boot/dts/versatile-ab.dts | 5 ++-- arch/arm/boot/dts/versatile-pb.dts | 2 +- arch/x86/kvm/x86.c | 13 ++++++--- drivers/firmware/arm_scmi/driver.c | 12 ++++---- drivers/gpu/drm/ttm/ttm_range_manager.c | 3 ++ fs/cifs/smb2ops.c | 4 +-- fs/hfs/bfind.c | 14 ++++++++- fs/hfs/bnode.c | 25 ++++++++++++---- fs/hfs/btree.h | 7 +++++ fs/hfs/super.c | 10 +++---- fs/internal.h | 1 - fs/io_uring.c | 1 - fs/iomap/seek.c | 25 ++++++---------- include/linux/fs_context.h | 1 + include/net/busy_poll.h | 2 +- include/net/sctp/constants.h | 4 +-- kernel/cgroup/cgroup-v1.c | 4 +-- kernel/rcu/tasks.h | 6 ++-- kernel/workqueue.c | 20 ++++++++----- net/802/garp.c | 14 +++++++++ net/802/mrp.c | 14 +++++++++ net/core/sock.c | 2 +- net/ipv6/ip6_output.c | 28 ++++++++++++++++++ net/sctp/protocol.c | 3 +- net/unix/af_unix.c | 51 +++++++++++++++++++++++++++++++-- tools/scripts/Makefile.include | 12 ++++++-- 27 files changed, 217 insertions(+), 70 deletions(-)

3 years, 4 months

9
34
0 0

stable-rc/queue/4.9 baseline: 96 runs, 5 regressions (v4.9.277-15-gaf15cee3a62d)

by kernelci.org bot

stable-rc/queue/4.9 baseline: 96 runs, 5 regressions (v4.9.277-15-gaf15cee3a62d) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ beaglebone-black | arm | lab-cip | gcc-8 | omap2plus_defconfig | 1 qemu_arm-versatilepb | arm | lab-baylibre | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-cip | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-collabora | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-linaro-lkft | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.9/kernel/v4.9.277-… Test: baseline Tree: stable-rc Branch: queue/4.9 Describe: v4.9.277-15-gaf15cee3a62d URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: af15cee3a62d04d60b0ddb625bacc12827d32527 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ beaglebone-black | arm | lab-cip | gcc-8 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/plan/id/6104c7e4f6930deaf285f462 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: omap2plus_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.277-15-gaf15cee3a62d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.277-15-gaf15cee3a62d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-6-g8983f3b7… * baseline.login: https://kernelci.org/test/case/id/6104c7e4f6930deaf285f463 new failure (last pass: v4.9.277-14-g60c4faa62630) platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-baylibre | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/6104c481a749772b8a85f470 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.277-15-gaf15cee3a62d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.277-15-gaf15cee3a62d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-6-g8983f3b7… * baseline.login: https://kernelci.org/test/case/id/6104c481a749772b8a85f471 failing since 259 days (last pass: v4.9.243-16-gd8d67e375b0a, first fail: v4.9.243-25-ga01fe8e99a22) platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-cip | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/6104c48fa749772b8a85f487 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.277-15-gaf15cee3a62d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.277-15-gaf15cee3a62d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-6-g8983f3b7… * baseline.login: https://kernelci.org/test/case/id/6104c48fa749772b8a85f488 failing since 259 days (last pass: v4.9.243-16-gd8d67e375b0a, first fail: v4.9.243-25-ga01fe8e99a22) platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-collabora | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/6104d50cacbc5ecdf985f45f Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.277-15-gaf15cee3a62d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.277-15-gaf15cee3a62d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-6-g8983f3b7… * baseline.login: https://kernelci.org/test/case/id/6104d50cacbc5ecdf985f460 failing since 259 days (last pass: v4.9.243-16-gd8d67e375b0a, first fail: v4.9.243-25-ga01fe8e99a22) platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-linaro-lkft | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/6104c4369a2cf0838f85f461 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.277-15-gaf15cee3a62d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.9/v4.9.277-15-gaf15cee3a62d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-6-g8983f3b7… * baseline.login: https://kernelci.org/test/case/id/6104c4369a2cf0838f85f462 failing since 259 days (last pass: v4.9.243-16-gd8d67e375b0a, first fail: v4.9.243-25-ga01fe8e99a22)

3 years, 4 months

1
0
0 0

stable-rc/queue/5.10 baseline: 173 runs, 2 regressions (v5.10.54-2-g41c54732efb5)

by kernelci.org bot

stable-rc/queue/5.10 baseline: 173 runs, 2 regressions (v5.10.54-2-g41c54732efb5) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions -------------------+-------+---------------+----------+-------------------+------------ bcm2837-rpi-3-b-32 | arm | lab-baylibre | gcc-8 | bcm2835_defconfig | 1 hip07-d05 | arm64 | lab-collabora | gcc-8 | defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F5.10/kernel/v5.10.54… Test: baseline Tree: stable-rc Branch: queue/5.10 Describe: v5.10.54-2-g41c54732efb5 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 41c54732efb52c3df0e1ab8058a8954ddfe9ebe6 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions -------------------+-------+---------------+----------+-------------------+------------ bcm2837-rpi-3-b-32 | arm | lab-baylibre | gcc-8 | bcm2835_defconfig | 1 Details: https://kernelci.org/test/plan/id/6104c3577e969f8acb85f46f Results: 0 PASS, 1 FAIL, 0 SKIP Full config: bcm2835_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-5.10/v5.10.54-2-g41c54732efb5… HTML log: https://storage.kernelci.org//stable-rc/queue-5.10/v5.10.54-2-g41c54732efb5… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-6-g8983f3b7… * baseline.login: https://kernelci.org/test/case/id/6104c3577e969f8acb85f470 new failure (last pass: v5.10.54-1-g413d16971b6e) platform | arch | lab | compiler | defconfig | regressions -------------------+-------+---------------+----------+-------------------+------------ hip07-d05 | arm64 | lab-collabora | gcc-8 | defconfig | 1 Details: https://kernelci.org/test/plan/id/6104d8ca11911b572585f45a Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-8 (aarch64-linux-gnu-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-5.10/v5.10.54-2-g41c54732efb5… HTML log: https://storage.kernelci.org//stable-rc/queue-5.10/v5.10.54-2-g41c54732efb5… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-6-g8983f3b7… * baseline.login: https://kernelci.org/test/case/id/6104d8ca11911b572585f45b failing since 29 days (last pass: v5.10.46-100-gce5b41f85637, first fail: v5.10.46-100-g3b96099161c8b)

3 years, 4 months

1
0
0 0

Linux 5.13.7

by Greg Kroah-Hartman

I'm announcing the release of the 5.13.7 kernel. All users of the 5.13 kernel series must upgrade. The updated 5.13.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.13.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm/boot/dts/versatile-ab.dts | 5 -- arch/arm/boot/dts/versatile-pb.dts | 2 drivers/firmware/arm_scmi/driver.c | 12 +++-- drivers/gpu/drm/ttm/ttm_range_manager.c | 3 + drivers/nvme/host/pci.c | 66 ++++++++++++++++++++++++++++---- fs/cifs/smb2ops.c | 4 - fs/hfs/bfind.c | 14 ++++++ fs/hfs/bnode.c | 25 +++++++++--- fs/hfs/btree.h | 7 +++ fs/hfs/super.c | 10 ++-- fs/internal.h | 1 fs/iomap/seek.c | 25 ++++-------- include/linux/fs_context.h | 1 include/net/busy_poll.h | 2 include/net/sctp/constants.h | 4 - kernel/cgroup/cgroup-v1.c | 4 - kernel/rcu/tasks.h | 6 -- kernel/workqueue.c | 20 ++++++--- net/802/garp.c | 14 ++++++ net/802/mrp.c | 14 ++++++ net/core/sock.c | 2 net/ipv6/ip6_output.c | 28 +++++++++++++ net/sctp/protocol.c | 3 - net/unix/af_unix.c | 51 +++++++++++++++++++++++- 25 files changed, 255 insertions(+), 70 deletions(-) Casey Chen (1): nvme-pci: fix multiple races in nvme_setup_io_queues Christoph Hellwig (2): iomap: remove the length variable in iomap_seek_data iomap: remove the length variable in iomap_seek_hole Cristian Marussi (1): firmware: arm_scmi: Fix range check for the maximum number of pending messages Desmond Cheong Zhi Xi (3): hfs: add missing clean-up in hfs_fill_super hfs: fix high memory mapping in hfs_bnode_read hfs: add lock nesting notation to hfs_find_init Eric Dumazet (1): net: annotate data race around sk_ll_usec Greg Kroah-Hartman (1): Linux 5.13.7 Hyunchul Lee (1): cifs: fix the out of range assignment to bit fields in parse_server_interfaces Miklos Szeredi (1): af_unix: fix garbage collect vs MSG_PEEK Paul E. McKenney (2): rcu-tasks: Don't delete holdouts within trc_inspect_reader() rcu-tasks: Don't delete holdouts within trc_wait_for_one_reader() Paul Gortmaker (1): cgroup1: fix leaked context root causing sporadic NULL deref in LTP Sudeep Holla (2): firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow ARM: dts: versatile: Fix up interrupt controller node names Vasily Averin (2): ipv6: allocate enough headroom in ip6_finish_output2() ipv6: ip6_finish_output2: set sk into newly allocated nskb Xin Long (1): sctp: move 198 addresses from unusable to private scope Yang Yingliang (3): workqueue: fix UAF in pwq_unbound_release_workfn() net/802/mrp: fix memleak in mrp_request_join() net/802/garp: fix memleak in garp_request_join() Zheyu Ma (1): drm/ttm: add a check against null pointer dereference

3 years, 4 months

1
1
0 0

Linux 5.10.55

by Greg Kroah-Hartman

I'm announcing the release of the 5.10.55 kernel. All users of the 5.10 kernel series must upgrade. The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 - arch/arm/boot/dts/versatile-ab.dts | 5 +-- arch/arm/boot/dts/versatile-pb.dts | 2 - arch/x86/kvm/x86.c | 13 +++++--- drivers/firmware/arm_scmi/driver.c | 12 ++++--- drivers/gpu/drm/ttm/ttm_range_manager.c | 3 + fs/cifs/smb2ops.c | 4 +- fs/hfs/bfind.c | 14 ++++++++ fs/hfs/bnode.c | 25 ++++++++++++--- fs/hfs/btree.h | 7 ++++ fs/hfs/super.c | 10 +++--- fs/internal.h | 1 fs/io_uring.c | 1 fs/iomap/seek.c | 25 +++++---------- include/linux/fs_context.h | 1 include/net/busy_poll.h | 2 - include/net/sctp/constants.h | 4 -- kernel/cgroup/cgroup-v1.c | 4 -- kernel/rcu/tasks.h | 6 +-- kernel/workqueue.c | 20 ++++++++---- net/802/garp.c | 14 ++++++++ net/802/mrp.c | 14 ++++++++ net/core/sock.c | 2 - net/ipv6/ip6_output.c | 28 +++++++++++++++++ net/sctp/protocol.c | 3 + net/unix/af_unix.c | 51 ++++++++++++++++++++++++++++++-- tools/scripts/Makefile.include | 12 ++++++- 27 files changed, 216 insertions(+), 69 deletions(-) Christoph Hellwig (2): iomap: remove the length variable in iomap_seek_data iomap: remove the length variable in iomap_seek_hole Cristian Marussi (1): firmware: arm_scmi: Fix range check for the maximum number of pending messages Desmond Cheong Zhi Xi (3): hfs: add missing clean-up in hfs_fill_super hfs: fix high memory mapping in hfs_bnode_read hfs: add lock nesting notation to hfs_find_init Eric Dumazet (1): net: annotate data race around sk_ll_usec Greg Kroah-Hartman (1): Linux 5.10.55 Hyunchul Lee (1): cifs: fix the out of range assignment to bit fields in parse_server_interfaces Maxim Levitsky (1): KVM: x86: determine if an exception has an error code only when injecting it. Miklos Szeredi (1): af_unix: fix garbage collect vs MSG_PEEK Paul E. McKenney (2): rcu-tasks: Don't delete holdouts within trc_inspect_reader() rcu-tasks: Don't delete holdouts within trc_wait_for_one_reader() Paul Gortmaker (1): cgroup1: fix leaked context root causing sporadic NULL deref in LTP Pavel Begunkov (1): io_uring: fix link timeout refs Sudeep Holla (2): firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow ARM: dts: versatile: Fix up interrupt controller node names Vasily Averin (2): ipv6: allocate enough headroom in ip6_finish_output2() ipv6: ip6_finish_output2: set sk into newly allocated nskb Xin Long (1): sctp: move 198 addresses from unusable to private scope Yang Yingliang (3): workqueue: fix UAF in pwq_unbound_release_workfn() net/802/mrp: fix memleak in mrp_request_join() net/802/garp: fix memleak in garp_request_join() Yonghong Song (1): tools: Allow proper CC/CXX/... override with LLVM=1 in Makefile.include Zheyu Ma (1): drm/ttm: add a check against null pointer dereference

3 years, 4 months

1
1
0 0

Linux 5.4.137

by Greg Kroah-Hartman

I'm announcing the release of the 5.4.137 kernel. All users of the 5.4 kernel series must upgrade. The updated 5.4.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 - arch/arm/boot/dts/versatile-ab.dts | 5 +-- arch/arm/boot/dts/versatile-pb.dts | 2 - arch/x86/kvm/x86.c | 13 +++++-- drivers/firmware/arm_scmi/driver.c | 12 ++++--- fs/cifs/smb2ops.c | 4 +- fs/hfs/bfind.c | 14 +++++++- fs/hfs/bnode.c | 25 ++++++++++++--- fs/hfs/btree.h | 7 ++++ fs/hfs/super.c | 10 +++--- fs/internal.h | 1 fs/iomap/seek.c | 25 +++++---------- include/linux/fs_context.h | 1 include/net/busy_poll.h | 2 - include/net/sctp/constants.h | 4 -- kernel/cgroup/cgroup-v1.c | 4 -- kernel/workqueue.c | 20 +++++++----- net/802/garp.c | 14 ++++++++ net/802/mrp.c | 14 ++++++++ net/core/sock.c | 2 - net/ipv6/ip6_output.c | 28 +++++++++++++++++ net/sctp/protocol.c | 3 + net/unix/af_unix.c | 51 +++++++++++++++++++++++++++++-- tools/scripts/Makefile.include | 12 ++++++- tools/testing/selftests/vm/userfaultfd.c | 2 - 25 files changed, 212 insertions(+), 65 deletions(-) Christoph Hellwig (2): iomap: remove the length variable in iomap_seek_data iomap: remove the length variable in iomap_seek_hole Cristian Marussi (1): firmware: arm_scmi: Fix range check for the maximum number of pending messages Desmond Cheong Zhi Xi (3): hfs: add missing clean-up in hfs_fill_super hfs: fix high memory mapping in hfs_bnode_read hfs: add lock nesting notation to hfs_find_init Eric Dumazet (1): net: annotate data race around sk_ll_usec Greg Kroah-Hartman (2): selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c Linux 5.4.137 Hyunchul Lee (1): cifs: fix the out of range assignment to bit fields in parse_server_interfaces Maxim Levitsky (1): KVM: x86: determine if an exception has an error code only when injecting it. Miklos Szeredi (1): af_unix: fix garbage collect vs MSG_PEEK Paul Gortmaker (1): cgroup1: fix leaked context root causing sporadic NULL deref in LTP Sudeep Holla (2): firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow ARM: dts: versatile: Fix up interrupt controller node names Vasily Averin (2): ipv6: allocate enough headroom in ip6_finish_output2() ipv6: ip6_finish_output2: set sk into newly allocated nskb Xin Long (1): sctp: move 198 addresses from unusable to private scope Yang Yingliang (3): workqueue: fix UAF in pwq_unbound_release_workfn() net/802/mrp: fix memleak in mrp_request_join() net/802/garp: fix memleak in garp_request_join() Yonghong Song (1): tools: Allow proper CC/CXX/... override with LLVM=1 in Makefile.include

3 years, 4 months

1
1
0 0

Linux 4.19.200

by Greg Kroah-Hartman

I'm announcing the release of the 4.19.200 kernel. All users of the 4.19 kernel series must upgrade. The updated 4.19.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm/boot/dts/versatile-ab.dts | 5 - arch/arm/boot/dts/versatile-pb.dts | 2 arch/x86/kvm/x86.c | 13 +- drivers/firmware/arm_scmi/driver.c | 12 +- drivers/iio/dac/ds4424.c | 6 - fs/cifs/smb2ops.c | 4 fs/hfs/bfind.c | 14 ++ fs/hfs/bnode.c | 25 ++++- fs/hfs/btree.h | 7 + fs/hfs/super.c | 10 +- include/net/af_unix.h | 1 include/net/busy_poll.h | 2 include/net/sctp/constants.h | 4 kernel/workqueue.c | 20 ++-- net/802/garp.c | 14 ++ net/802/mrp.c | 14 ++ net/Makefile | 2 net/core/sock.c | 2 net/sctp/protocol.c | 3 net/unix/Kconfig | 5 + net/unix/Makefile | 2 net/unix/af_unix.c | 102 +++++++++------------ net/unix/garbage.c | 68 -------------- net/unix/scm.c | 148 +++++++++++++++++++++++++++++++ net/unix/scm.h | 10 ++ tools/testing/selftests/vm/userfaultfd.c | 2 27 files changed, 328 insertions(+), 171 deletions(-) Cristian Marussi (1): firmware: arm_scmi: Fix range check for the maximum number of pending messages Desmond Cheong Zhi Xi (3): hfs: add missing clean-up in hfs_fill_super hfs: fix high memory mapping in hfs_bnode_read hfs: add lock nesting notation to hfs_find_init Eric Dumazet (1): net: annotate data race around sk_ll_usec Greg Kroah-Hartman (2): selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c Linux 4.19.200 Hyunchul Lee (1): cifs: fix the out of range assignment to bit fields in parse_server_interfaces Jens Axboe (1): net: split out functions related to registering inflight socket files Maxim Levitsky (1): KVM: x86: determine if an exception has an error code only when injecting it. Miklos Szeredi (1): af_unix: fix garbage collect vs MSG_PEEK Ruslan Babayev (1): iio: dac: ds4422/ds4424 drop of_node check Sudeep Holla (2): firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow ARM: dts: versatile: Fix up interrupt controller node names Xin Long (1): sctp: move 198 addresses from unusable to private scope Yang Yingliang (3): workqueue: fix UAF in pwq_unbound_release_workfn() net/802/mrp: fix memleak in mrp_request_join() net/802/garp: fix memleak in garp_request_join()

3 years, 4 months

1
1
0 0

FAILED: patch "[PATCH] io_uring: fix io_prep_async_link locking" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 44eff40a32e8f5228ae041006352e32638ad2368 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov <asml.silence(a)gmail.com> Date: Mon, 26 Jul 2021 14:14:31 +0100 Subject: [PATCH] io_uring: fix io_prep_async_link locking io_prep_async_link() may be called after arming a linked timeout, automatically making it unsafe to traverse the linked list. Guard with completion_lock if there was a linked timeout. Cc: stable(a)vger.kernel.org # 5.9+ Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/93f7c617e2b4f012a2a175b3dab6bc2f27cebc48.16273044… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/fs/io_uring.c b/fs/io_uring.c index 5a0fd6bcd318..c4d2b320cdd4 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1279,8 +1279,17 @@ static void io_prep_async_link(struct io_kiocb *req) { struct io_kiocb *cur; - io_for_each_link(cur, req) - io_prep_async_work(cur); + if (req->flags & REQ_F_LINK_TIMEOUT) { + struct io_ring_ctx *ctx = req->ctx; + + spin_lock_irq(&ctx->completion_lock); + io_for_each_link(cur, req) + io_prep_async_work(cur); + spin_unlock_irq(&ctx->completion_lock); + } else { + io_for_each_link(cur, req) + io_prep_async_work(cur); + } } static void io_queue_async_work(struct io_kiocb *req)

3 years, 4 months

1
0
0 0

FAILED: patch "[PATCH] blk-iocost: fix operation ordering in iocg_wake_fn()" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 5ab189cf3abbc9994bae3be524c5b88589ed56e2 Mon Sep 17 00:00:00 2001 From: Tejun Heo <tj(a)kernel.org> Date: Tue, 27 Jul 2021 14:38:09 -1000 Subject: [PATCH] blk-iocost: fix operation ordering in iocg_wake_fn() iocg_wake_fn() open-codes wait_queue_entry removal and wakeup because it wants the wq_entry to be always removed whether it ended up waking the task or not. finish_wait() tests whether wq_entry needs removal without grabbing the wait_queue lock and expects the waker to use list_del_init_careful() after all waking operations are complete, which iocg_wake_fn() didn't do. The operation order was wrong and the regular list_del_init() was used. The result is that if a waiter wakes up racing the waker, it can free pop the wq_entry off stack before the waker is still looking at it, which can lead to a backtrace like the following. [7312084.588951] general protection fault, probably for non-canonical address 0x586bf4005b2b88: 0000 [#1] SMP ... [7312084.647079] RIP: 0010:queued_spin_lock_slowpath+0x171/0x1b0 ... [7312084.858314] Call Trace: [7312084.863548] _raw_spin_lock_irqsave+0x22/0x30 [7312084.872605] try_to_wake_up+0x4c/0x4f0 [7312084.880444] iocg_wake_fn+0x71/0x80 [7312084.887763] __wake_up_common+0x71/0x140 [7312084.895951] iocg_kick_waitq+0xe8/0x2b0 [7312084.903964] ioc_rqos_throttle+0x275/0x650 [7312084.922423] __rq_qos_throttle+0x20/0x30 [7312084.930608] blk_mq_make_request+0x120/0x650 [7312084.939490] generic_make_request+0xca/0x310 [7312084.957600] submit_bio+0x173/0x200 [7312084.981806] swap_readpage+0x15c/0x240 [7312084.989646] read_swap_cache_async+0x58/0x60 [7312084.998527] swap_cluster_readahead+0x201/0x320 [7312085.023432] swapin_readahead+0x2df/0x450 [7312085.040672] do_swap_page+0x52f/0x820 [7312085.058259] handle_mm_fault+0xa16/0x1420 [7312085.066620] do_page_fault+0x2c6/0x5c0 [7312085.074459] page_fault+0x2f/0x40 Fix it by switching to list_del_init_careful() and putting it at the end. Signed-off-by: Tejun Heo <tj(a)kernel.org> Reported-by: Rik van Riel <riel(a)surriel.com> Fixes: 7caa47151ab2 ("blkcg: implement blk-iocost") Cc: stable(a)vger.kernel.org # v5.4+ Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/block/blk-iocost.c b/block/blk-iocost.c index c2d6bc88d3f1..5fac3757e6e0 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -1440,16 +1440,17 @@ static int iocg_wake_fn(struct wait_queue_entry *wq_entry, unsigned mode, return -1; iocg_commit_bio(ctx->iocg, wait->bio, wait->abs_cost, cost); + wait->committed = true; /* * autoremove_wake_function() removes the wait entry only when it - * actually changed the task state. We want the wait always - * removed. Remove explicitly and use default_wake_function(). + * actually changed the task state. We want the wait always removed. + * Remove explicitly and use default_wake_function(). Note that the + * order of operations is important as finish_wait() tests whether + * @wq_entry is removed without grabbing the lock. */ - list_del_init(&wq_entry->entry); - wait->committed = true; - default_wake_function(wq_entry, mode, flags, key); + list_del_init_careful(&wq_entry->entry); return 0; }

3 years, 4 months

1
0
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror July 2021