This is the start of the stable review cycle for the 5.17.7 release.
There are 140 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 12 May 2022 13:07:16 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.17.7-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.17.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.17.7-rc1
Marek Behún <kabel(a)kernel.org>
PCI: aardvark: Update comment about link going down after link-up
Marek Behún <kabel(a)kernel.org>
PCI: aardvark: Drop __maybe_unused from advk_pcie_disable_phy()
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Don't mask irq when mapping
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Remove irq_mask_ack() callback for INTx interrupts
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Use separate INTA interrupt for emulated root bridge
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Fix support for PME requester on emulated bridge
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Add support for PME interrupts
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Optimize writing PCI_EXP_RTCTL_PMEIE and PCI_EXP_RTSTA_PME on emulated bridge
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Add support for ERR interrupt on emulated bridge
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Enable MSI-X support
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Fix setting MSI address
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Add support for masking MSI interrupts
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Refactor unmasking summary MSI interrupt
Marek Behún <kabel(a)kernel.org>
PCI: aardvark: Use dev_fwnode() instead of of_node_to_fwnode(dev->of_node)
Marek Behún <kabel(a)kernel.org>
PCI: aardvark: Make msi_domain_info structure a static driver structure
Marek Behún <kabel(a)kernel.org>
PCI: aardvark: Make MSI irq_chip structures static driver structures
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Check return value of generic_handle_domain_irq() when processing INTx IRQ
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Rewrite IRQ code to chained IRQ handler
Pali Rohár <pali(a)kernel.org>
PCI: aardvark: Replace custom PCIE_CORE_INT_* macros with PCI_INTERRUPT_*
Ricky WU <ricky_wu(a)realtek.com>
mmc: rtsx: add 74 Clocks in power on flow
Sidhartha Kumar <sidhartha.kumar(a)oracle.com>
selftest/vm: verify remap destination address in mremap_test
Sidhartha Kumar <sidhartha.kumar(a)oracle.com>
selftest/vm: verify mmap addr in mremap_test
Wanpeng Li <wanpengli(a)tencent.com>
KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: Do not change ICR on write to APIC_SELF_IPI
Wanpeng Li <wanpengli(a)tencent.com>
x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
Thomas Huth <thuth(a)redhat.com>
KVM: selftests: Silence compiler warning in the kvm_page_table_test
Paolo Bonzini <pbonzini(a)redhat.com>
kvm: selftests: do not use bitfields larger than 32-bits for PTEs
Sean Christopherson <seanjc(a)google.com>
KVM: VMX: Exit to userspace if vCPU has injected exception and invalid state
Peter Gonda <pgonda(a)google.com>
KVM: SEV: Mark nested locking of vcpu->lock
Hector Martin <marcan(a)marcan.st>
iommu/dart: Add missing module owner to ops structure
Javier Martinez Canillas <javierm(a)redhat.com>
fbdev: Make fb_release() return -ENODEV if fbdev was unregistered
Sandipan Das <sandipan.das(a)amd.com>
kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
net: rds: acquire refcount on TCP sockets
Baruch Siach <baruch(a)tkos.co.il>
gpio: mvebu: drop pwm base assignment
Helge Deller <deller(a)gmx.de>
parisc: Mark cr16 clock unstable on all SMP machines
Filipe Manana <fdmanana(a)suse.com>
btrfs: always log symlinks in full mode
Sergey Shtylyov <s.shtylyov(a)omp.ru>
smsc911x: allow using IRQ0
Vladimir Oltean <vladimir.oltean(a)nxp.com>
selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer
Michael Chan <michael.chan(a)broadcom.com>
bnxt_en: Fix unnecessary dropping of RX packets
Somnath Kotur <somnath.kotur(a)broadcom.com>
bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
Hector Martin <marcan(a)marcan.st>
dt-bindings: pci: apple,pcie: Drop max-link-speed from example
Ido Schimmel <idosch(a)nvidia.com>
selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational
David Howells <dhowells(a)redhat.com>
rxrpc: Enable IPv6 checksums on transport socket
Eric Dumazet <edumazet(a)google.com>
mld: respect RCU rules in ip6_mc_source() and ip6_mc_msfilter()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
SUNRPC: Don't leak sockets in xs_local_connect()
Qiao Ma <mqaio(a)linux.alibaba.com>
hinic: fix bug of wq out of bound access
Kuogee Hsieh <quic_khsieh(a)quicinc.com>
drm/msm/dp: remove fail safe mode related code
Marc Kleine-Budde <mkl(a)pengutronix.de>
selftests/net: so_txtime: usage(): fix documentation of default clock
Marc Kleine-Budde <mkl(a)pengutronix.de>
selftests/net: so_txtime: fix parsing of start time stamp on 32 bit systems
Shravya Kumbham <shravya.kumbham(a)xilinx.com>
net: emaclite: Add error handling for of_address_to_resource()
Eric Dumazet <edumazet(a)google.com>
net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
Yang Yingliang <yangyingliang(a)huawei.com>
net: cpsw: add missing of_node_put() in cpsw_probe_dt()
Niels Dossche <dossche.niels(a)gmail.com>
net: mdio: Fix ENOMEM return value in BCM6368 mux bus controller
Yang Yingliang <yangyingliang(a)huawei.com>
net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux()
Yang Yingliang <yangyingliang(a)huawei.com>
net: dsa: mt7530: add missing of_node_put() in mt7530_setup()
Yang Yingliang <yangyingliang(a)huawei.com>
net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFSv4: Don't invalidate inode attributes on delegation return
Mustafa Ismail <mustafa.ismail(a)intel.com>
RDMA/irdma: Fix possible crash due to NULL netdev in notifier
Shiraz Saleem <shiraz.saleem(a)intel.com>
RDMA/irdma: Reduce iWARP QP destroy time
Tatyana Nikolova <tatyana.e.nikolova(a)intel.com>
RDMA/irdma: Flush iWARP QP if modified to ERR from RTR state
Cheng Xu <chengyou(a)linux.alibaba.com>
RDMA/siw: Fix a condition race issue in MPA request processing
Olga Kornievskaia <kolga(a)netapp.com>
SUNRPC release the transport of a relocated task with an assigned transport
Hui Wang <hui.wang(a)canonical.com>
ALSA: hda/realtek: Fix mute led issue on thinkpad with cs35l41 s-codec
Jann Horn <jannh(a)google.com>
selftests/seccomp: Don't call read() on TTY from background pgrp
Ariel Levkovich <lariel(a)nvidia.com>
net/mlx5e: TC, fix decap fallback to uplink when int port not supported
Vlad Buslov <vladbu(a)nvidia.com>
net/mlx5e: Lag, Don't skip fib events on current dst
Vlad Buslov <vladbu(a)nvidia.com>
net/mlx5e: Lag, Fix fib_info pointer assignment
Vlad Buslov <vladbu(a)nvidia.com>
net/mlx5e: Lag, Fix use-after-free in fib event handler
Moshe Shemesh <moshe(a)nvidia.com>
net/mlx5: Fix deadlock in sync reset flow
Moshe Shemesh <moshe(a)nvidia.com>
net/mlx5: Avoid double clear or set of sync reset requested
Mark Bloch <mbloch(a)nvidia.com>
net/mlx5: Fix matching on inner TTC
Mark Zhang <markzhang(a)nvidia.com>
net/mlx5e: Fix the calling of update_buffer_lossy() API
Paul Blakey <paulb(a)nvidia.com>
net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release
Vlad Buslov <vladbu(a)nvidia.com>
net/mlx5e: Don't match double-vlan packets if cvlan is not set
Ariel Levkovich <lariel(a)nvidia.com>
net/mlx5e: Fix wrong source vport matching on tunnel rule
Aya Levin <ayal(a)nvidia.com>
net/mlx5: Fix slab-out-of-bounds while reading resource dump menu
Moshe Tal <moshet(a)nvidia.com>
net/mlx5e: Fix trust state reset in reload
Yang Yingliang <yangyingliang(a)huawei.com>
iommu/dart: check return value after calling platform_get_resource()
Lu Baolu <baolu.lu(a)linux.intel.com>
iommu/vt-d: Drop stop marker messages
Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>
ASoC: soc-ops: fix error handling
Neil Armstrong <narmstrong(a)baylibre.com>
ASoC: meson: axg-card: Fix nonatomic links
Neil Armstrong <narmstrong(a)baylibre.com>
ASoC: meson: axg-tdm-interface: Fix formatters in trigger"
Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com>
ASoC: dmaengine: Restore NULL prepare_slave_config() callback
Adam Wujek <dev_public(a)wujek.eu>
hwmon: (pmbus) disable PEC if not enabled
Armin Wolf <W_Armin(a)gmx.de>
hwmon: (adt7470) Fix warning on module removal
Puyou Lu <puyou.lu(a)gmail.com>
gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set)
Nobuhiro Iwamatsu <nobuhiro1.iwamatsu(a)toshiba.co.jp>
gpio: visconti: Fix fwnode of GPIO IRQ
Duoming Zhou <duoming(a)zju.edu.cn>
NFC: netlink: fix sleep in atomic bug when firmware download timeout
Duoming Zhou <duoming(a)zju.edu.cn>
nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
Duoming Zhou <duoming(a)zju.edu.cn>
nfc: replace improper check device_is_registered() in netlink related functions
Andreas Larsson <andreas(a)gaisler.com>
can: grcan: only use the NAPI poll budget for RX
Andreas Larsson <andreas(a)gaisler.com>
can: grcan: grcan_probe(): fix broken system id check for errata workaround needs
Daniel Hellstrom <daniel(a)gaisler.com>
can: grcan: use ofdev->dev when allocating DMA memory
Oliver Hartkopp <socketcan(a)hartkopp.net>
can: isotp: remove re-binding of bound socket
Duoming Zhou <duoming(a)zju.edu.cn>
can: grcan: grcan_close(): fix deadlock
Jan Höppner <hoeppner(a)linux.ibm.com>
s390/dasd: Fix read inconsistency for ESE DASD devices
Jan Höppner <hoeppner(a)linux.ibm.com>
s390/dasd: Fix read for ESE with blksize < 4k
Stefan Haberland <sth(a)linux.ibm.com>
s390/dasd: prevent double format of tracks for ESE devices
Stefan Haberland <sth(a)linux.ibm.com>
s390/dasd: fix data corruption for ESE devices
Mark Brown <broonie(a)kernel.org>
ASoC: meson: Fix event generation for AUI CODEC mux
Mark Brown <broonie(a)kernel.org>
ASoC: meson: Fix event generation for G12A tohdmi mux
Mark Brown <broonie(a)kernel.org>
ASoC: meson: Fix event generation for AUI ACODEC mux
Mark Brown <broonie(a)kernel.org>
ASoC: wm8958: Fix change notifications for DSP controls
ChiYuan Huang <cy_huang(a)richtek.com>
ASoC: rt9120: Correct the reg 0x09 size to one byte
Mark Brown <broonie(a)kernel.org>
ASoC: da7219: Fix change notifications for tone generator frequency
Thomas Pfaff <tpfaff(a)pcs.com>
genirq: Synchronize interrupt thread startup
Filipe Manana <fdmanana(a)suse.com>
btrfs: skip compression property for anything other than files and dirs
Chung-Chiang Cheng <cccheng(a)synology.com>
btrfs: do not allow compression on nodatacow files
Chung-Chiang Cheng <cccheng(a)synology.com>
btrfs: export a helper for compression hard check
Filipe Manana <fdmanana(a)suse.com>
btrfs: do not BUG_ON() on failure to update inode when setting xattr
Qu Wenruo <wqu(a)suse.com>
btrfs: force v2 space cache usage for subpage mount
David Sterba <dsterba(a)suse.com>
btrfs: sysfs: export the balance paused state of exclusive operation
Tan Tee Min <tee.min.tan(a)linux.intel.com>
net: stmmac: disable Split Header (SPH) for Intel platforms
Niels Dossche <dossche.niels(a)gmail.com>
firewire: core: extend card->lock in fw_core_handle_bus_reset
Jakob Koschel <jakobkoschel(a)gmail.com>
firewire: remove check of list iterator against head past the loop body
Chengfeng Ye <cyeaa(a)connect.ust.hk>
firewire: fix potential uaf in outbound_phy_packet_callback()
Kurt Kanzenbach <kurt(a)linutronix.de>
timekeeping: Mark NMI safe time accessors as notrace
Trond Myklebust <trond.myklebust(a)hammerspace.com>
Revert "SUNRPC: attempt AF_LOCAL connect on setup"
Zev Weiss <zev(a)bewilderbeest.net>
hwmon: (pmbus) delta-ahe50dc-fan: work around hardware quirk
Nick Kossifidis <mick(a)ics.forth.gr>
RISC-V: relocate DTB if it's outside memory region
Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com>
drm/amdgpu: do not use passthrough mode in Xen dom0
Harry Wentland <harry.wentland(a)amd.com>
drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT
Nicolin Chen <nicolinc(a)nvidia.com>
iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range()
David Stevens <stevensd(a)chromium.org>
iommu/vt-d: Calculate mask for non-aligned flushes
Kyle Huey <me(a)kylehuey.com>
KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id
Thomas Gleixner <tglx(a)linutronix.de>
x86/fpu: Prevent FPU state corruption
Andrei Lalaev <andrei.lalaev(a)emlid.com>
gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
Brian Norris <briannorris(a)chromium.org>
mmc: core: Set HS clock speed before sending HS CMD13
Samuel Holland <samuel(a)sholland.org>
mmc: sunxi-mmc: Fix DMA descriptors allocated above 32 bits
Shaik Sajida Bhanu <quic_c_sbhanu(a)quicinc.com>
mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
Zihao Wang <wzhd(a)ustc.edu>
ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers
Helge Deller <deller(a)gmx.de>
parisc: Merge model and model name into one line in /proc/cpuinfo
Helge Deller <deller(a)gmx.de>
Revert "parisc: Mark sched_clock unstable only if clocks are not syncronized"
Helge Deller <deller(a)gmx.de>
Revert "parisc: Mark cr16 CPU clocksource unstable on all SMP machines"
Maciej W. Rozycki <macro(a)orcam.me.uk>
MIPS: Fix CP0 counter erratum detection for R4k CPUs
Corey Minyard <cminyard(a)mvista.com>
ipmi:ipmi_ipmb: Fix null-ptr-deref in ipmi_unregister_smi()
Corey Minyard <cminyard(a)mvista.com>
ipmi: When handling send message responses, don't process the message
Thomas Gleixner <tglx(a)linutronix.de>
pci_irq_vector() can't be used in atomic context any longer. This conflicts with the usage of this function in nic_mbx_intr_handler(). age of this function in nic_mbx_intr_handler().
-------------
Diffstat:
.../devicetree/bindings/pci/apple,pcie.yaml | 3 -
Makefile | 4 +-
arch/mips/include/asm/timex.h | 8 +-
arch/mips/kernel/time.c | 11 +-
arch/parisc/kernel/processor.c | 3 +-
arch/parisc/kernel/setup.c | 2 +
arch/parisc/kernel/time.c | 6 +-
arch/riscv/mm/init.c | 21 +-
arch/x86/kernel/fpu/core.c | 67 ++--
arch/x86/kernel/kvm.c | 13 +
arch/x86/kvm/cpuid.c | 5 +
arch/x86/kvm/lapic.c | 10 +-
arch/x86/kvm/mmu/mmu.c | 2 +
arch/x86/kvm/svm/pmu.c | 28 +-
arch/x86/kvm/svm/sev.c | 42 ++-
arch/x86/kvm/vmx/vmx.c | 2 +-
drivers/char/ipmi/ipmi_msghandler.c | 7 +-
drivers/char/ipmi/ipmi_si_intf.c | 5 +-
drivers/firewire/core-card.c | 3 +
drivers/firewire/core-cdev.c | 4 +-
drivers/firewire/core-topology.c | 9 +-
drivers/firewire/core-transaction.c | 30 +-
drivers/firewire/sbp2.c | 13 +-
drivers/gpio/gpio-mvebu.c | 7 -
drivers/gpio/gpio-pca953x.c | 4 +-
drivers/gpio/gpio-visconti.c | 7 +-
drivers/gpio/gpiolib-of.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 +-
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 2 +-
drivers/gpu/drm/msm/dp/dp_display.c | 6 -
drivers/gpu/drm/msm/dp/dp_panel.c | 11 -
drivers/gpu/drm/msm/dp/dp_panel.h | 1 -
drivers/hwmon/adt7470.c | 4 +-
drivers/hwmon/pmbus/delta-ahe50dc-fan.c | 16 +
drivers/hwmon/pmbus/pmbus_core.c | 3 +
drivers/infiniband/hw/irdma/cm.c | 26 +-
drivers/infiniband/hw/irdma/utils.c | 21 +-
drivers/infiniband/hw/irdma/verbs.c | 4 +-
drivers/infiniband/sw/siw/siw_cm.c | 7 +-
drivers/iommu/apple-dart.c | 10 +-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 9 +-
drivers/iommu/intel/iommu.c | 27 +-
drivers/iommu/intel/svm.c | 4 +
drivers/mmc/core/mmc.c | 23 +-
drivers/mmc/host/rtsx_pci_sdmmc.c | 29 +-
drivers/mmc/host/sdhci-msm.c | 42 +++
drivers/mmc/host/sunxi-mmc.c | 5 +-
drivers/net/can/grcan.c | 46 +--
drivers/net/dsa/mt7530.c | 1 +
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 +-
drivers/net/ethernet/cavium/thunder/nic_main.c | 16 +-
drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c | 7 +-
drivers/net/ethernet/mediatek/mtk_sgmii.c | 1 +
.../ethernet/mellanox/mlx5/core/diag/rsc_dump.c | 31 +-
.../ethernet/mellanox/mlx5/core/en/port_buffer.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 4 +
.../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 3 +-
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 +
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 +
.../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 60 ++--
drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c | 38 ++-
drivers/net/ethernet/mellanox/mlx5/core/lag/mp.h | 7 +-
.../net/ethernet/mellanox/mlx5/core/lag/port_sel.c | 2 +-
.../net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c | 2 +
drivers/net/ethernet/smsc/smsc911x.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 +
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 1 +
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
drivers/net/ethernet/ti/cpsw_new.c | 5 +-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 +-
drivers/net/mdio/mdio-mux-bcm6368.c | 2 +-
drivers/nfc/nfcmrvl/main.c | 2 +-
drivers/pci/controller/pci-aardvark.c | 367 +++++++++++++++------
drivers/s390/block/dasd.c | 18 +-
drivers/s390/block/dasd_eckd.c | 28 +-
drivers/s390/block/dasd_int.h | 14 +
drivers/video/fbdev/core/fbmem.c | 5 +-
fs/btrfs/btrfs_inode.h | 11 +
fs/btrfs/disk-io.c | 11 +
fs/btrfs/inode.c | 15 +-
fs/btrfs/props.c | 59 +++-
fs/btrfs/props.h | 4 +-
fs/btrfs/sysfs.c | 3 +
fs/btrfs/tree-log.c | 14 +-
fs/btrfs/xattr.c | 11 +-
fs/nfs/nfs4proc.c | 12 +-
include/linux/stmmac.h | 1 +
kernel/irq/internals.h | 2 +
kernel/irq/irqdesc.c | 2 +
kernel/irq/manage.c | 39 ++-
kernel/time/timekeeping.c | 4 +-
net/can/isotp.c | 22 +-
net/ipv4/igmp.c | 9 +-
net/ipv6/mcast.c | 8 +-
net/nfc/core.c | 29 +-
net/nfc/netlink.c | 4 +-
net/rds/tcp.c | 8 +
net/rxrpc/local_object.c | 3 +
net/sunrpc/clnt.c | 11 +-
net/sunrpc/xprtsock.c | 14 +-
sound/firewire/fireworks/fireworks_hwdep.c | 1 +
sound/pci/hda/patch_realtek.c | 3 +
sound/soc/codecs/da7219.c | 14 +-
sound/soc/codecs/rt9120.c | 1 -
sound/soc/codecs/wm8958-dsp2.c | 8 +-
sound/soc/meson/aiu-acodec-ctrl.c | 2 +-
sound/soc/meson/aiu-codec-ctrl.c | 2 +-
sound/soc/meson/axg-card.c | 1 -
sound/soc/meson/axg-tdm-interface.c | 26 +-
sound/soc/meson/g12a-tohdmitx.c | 2 +-
sound/soc/soc-generic-dmaengine-pcm.c | 6 +-
sound/soc/soc-ops.c | 2 +-
.../drivers/net/ocelot/tc_flower_chains.sh | 2 +-
.../selftests/kvm/include/x86_64/processor.h | 15 +
tools/testing/selftests/kvm/kvm_page_table_test.c | 2 +-
tools/testing/selftests/kvm/lib/x86_64/processor.c | 192 +++++------
.../net/forwarding/mirror_gre_bridge_1q.sh | 3 +
tools/testing/selftests/net/so_txtime.c | 4 +-
tools/testing/selftests/seccomp/seccomp_bpf.c | 10 +-
tools/testing/selftests/vm/mremap_test.c | 53 +++
121 files changed, 1274 insertions(+), 663 deletions(-)
Currently, a problem faced by arm64 is if a kernel image is signed by a
MOK key, loading it via the kexec_file_load() system call would be
rejected with the error "Lockdown: kexec: kexec of unsigned images is
restricted; see man kernel_lockdown.7".
This happens because image_verify_sig uses only the primary keyring that
contains only kernel built-in keys to verify the kexec image.
This patch allows to verify arm64 kernel image signature using not only
.builtin_trusted_keys but also .platform and .secondary_trusted_keys
keyring.
Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
Cc: stable(a)vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
Cc: stable(a)vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic
Acked-by: Baoquan He <bhe(a)redhat.com>
Cc: kexec(a)lists.infradead.org
Cc: keyrings(a)vger.kernel.org
Cc: linux-security-module(a)vger.kernel.org
Co-developed-by: Michal Suchanek <msuchanek(a)suse.de>
Signed-off-by: Michal Suchanek <msuchanek(a)suse.de>
Acked-by: Will Deacon <will(a)kernel.org>
Signed-off-by: Coiby Xu <coxu(a)redhat.com>
---
arch/arm64/kernel/kexec_image.c | 11 +----------
1 file changed, 1 insertion(+), 10 deletions(-)
diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
index 9ec34690e255..5ed6a585f21f 100644
--- a/arch/arm64/kernel/kexec_image.c
+++ b/arch/arm64/kernel/kexec_image.c
@@ -14,7 +14,6 @@
#include <linux/kexec.h>
#include <linux/pe.h>
#include <linux/string.h>
-#include <linux/verification.h>
#include <asm/byteorder.h>
#include <asm/cpufeature.h>
#include <asm/image.h>
@@ -130,18 +129,10 @@ static void *image_load(struct kimage *image,
return NULL;
}
-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-static int image_verify_sig(const char *kernel, unsigned long kernel_len)
-{
- return verify_pefile_signature(kernel, kernel_len, NULL,
- VERIFYING_KEXEC_PE_SIGNATURE);
-}
-#endif
-
const struct kexec_file_ops kexec_image_ops = {
.probe = image_probe,
.load = image_load,
#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
- .verify_sig = image_verify_sig,
+ .verify_sig = kexec_kernel_verify_pe_sig,
#endif
};
--
2.35.3
Currently there is no arch-specific implementation of
arch_kexec_kernel_verify_sig. Even if we want to add an implementation
for an architecture in the future, we can simply use "(struct
kexec_file_ops*)->verify_sig". So clean it up.
Note this patch is needed by later patches so Cc it to the stable tree
as well.
Cc: stable(a)vger.kernel.org
Suggested-by: Eric W. Biederman <ebiederm(a)xmission.com>
Reviewed-by: Michal Suchanek <msuchanek(a)suse.de>
Acked-by: Baoquan He <bhe(a)redhat.com>
Signed-off-by: Coiby Xu <coxu(a)redhat.com>
---
include/linux/kexec.h | 4 ----
kernel/kexec_file.c | 34 +++++++++++++---------------------
2 files changed, 13 insertions(+), 25 deletions(-)
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 58d1b58a971e..413235c6c797 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -202,10 +202,6 @@ int arch_kexec_apply_relocations(struct purgatory_info *pi,
const Elf_Shdr *relsec,
const Elf_Shdr *symtab);
int arch_kimage_file_post_load_cleanup(struct kimage *image);
-#ifdef CONFIG_KEXEC_SIG
-int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
- unsigned long buf_len);
-#endif
int arch_kexec_locate_mem_hole(struct kexec_buf *kbuf);
extern int kexec_add_buffer(struct kexec_buf *kbuf);
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 8347fc158d2b..3720435807eb 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -89,25 +89,6 @@ int __weak arch_kimage_file_post_load_cleanup(struct kimage *image)
return kexec_image_post_load_cleanup_default(image);
}
-#ifdef CONFIG_KEXEC_SIG
-static int kexec_image_verify_sig_default(struct kimage *image, void *buf,
- unsigned long buf_len)
-{
- if (!image->fops || !image->fops->verify_sig) {
- pr_debug("kernel loader does not support signature verification.\n");
- return -EKEYREJECTED;
- }
-
- return image->fops->verify_sig(buf, buf_len);
-}
-
-int __weak arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
- unsigned long buf_len)
-{
- return kexec_image_verify_sig_default(image, buf, buf_len);
-}
-#endif
-
/*
* arch_kexec_apply_relocations_add - apply relocations of type RELA
* @pi: Purgatory to be relocated.
@@ -184,13 +165,24 @@ void kimage_file_post_load_cleanup(struct kimage *image)
}
#ifdef CONFIG_KEXEC_SIG
+static int kexec_image_verify_sig(struct kimage *image, void *buf,
+ unsigned long buf_len)
+{
+ if (!image->fops || !image->fops->verify_sig) {
+ pr_debug("kernel loader does not support signature verification.\n");
+ return -EKEYREJECTED;
+ }
+
+ return image->fops->verify_sig(buf, buf_len);
+}
+
static int
kimage_validate_signature(struct kimage *image)
{
int ret;
- ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
- image->kernel_buf_len);
+ ret = kexec_image_verify_sig(image, image->kernel_buf,
+ image->kernel_buf_len);
if (ret) {
if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
--
2.35.3
The patch titled
Subject: lib/assoc_array.c: fix BUG_ON during garbage collect
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
assoc_array-fix-bug_on-during-garbage-collect.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Stephen Brennan <stephen.s.brennan(a)oracle.com>
Subject: lib/assoc_array.c: fix BUG_ON during garbage collect
A rare BUG_ON triggered in assoc_array_gc:
[3430308.818153] kernel BUG at lib/assoc_array.c:1609!
Which corresponded to the statement currently at line 1593 upstream:
BUG_ON(assoc_array_ptr_is_meta(p));
Using the data from the core dump, I was able to generate a userspace
reproducer[1] and determine the cause of the bug.
[1]: https://github.com/brenns10/kernel_stuff/tree/master/assoc_array_gc
After running the iterator on the entire branch, an internal tree node
looked like the following:
NODE (nr_leaves_on_branch: 3)
SLOT [0] NODE (2 leaves)
SLOT [1] NODE (1 leaf)
SLOT [2..f] NODE (empty)
In the userspace reproducer, the pr_devel output when compressing this
node was:
-- compress node 0x5607cc089380 --
free=0, leaves=0
[0] retain node 2/1 [nx 0]
[1] fold node 1/1 [nx 0]
[2] fold node 0/1 [nx 2]
[3] fold node 0/2 [nx 2]
[4] fold node 0/3 [nx 2]
[5] fold node 0/4 [nx 2]
[6] fold node 0/5 [nx 2]
[7] fold node 0/6 [nx 2]
[8] fold node 0/7 [nx 2]
[9] fold node 0/8 [nx 2]
[10] fold node 0/9 [nx 2]
[11] fold node 0/10 [nx 2]
[12] fold node 0/11 [nx 2]
[13] fold node 0/12 [nx 2]
[14] fold node 0/13 [nx 2]
[15] fold node 0/14 [nx 2]
after: 3
At slot 0, an internal node with 2 leaves could not be folded into the
node, because there was only one available slot (slot 0). Thus, the
internal node was retained. At slot 1, the node had one leaf, and was
able to be folded in successfully. The remaining nodes had no leaves, and
so were removed. By the end of the compression stage, there were 14 free
slots, and only 3 leaf nodes. The tree was ascended and then its parent
node was compressed. When this node was seen, it could not be folded, due
to the internal node it contained.
The invariant for compression in this function is: whenever
nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT, the node should contain all
leaf nodes. The compression step currently cannot guarantee this, given
the corner case shown above.
To fix this issue, retry compression whenever we have retained a node, and
yet nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT. This second compression
will then allow the node in slot 1 to be folded in, satisfying the
invariant. Below is the output of the reproducer once the fix is applied:
-- compress node 0x560e9c562380 --
free=0, leaves=0
[0] retain node 2/1 [nx 0]
[1] fold node 1/1 [nx 0]
[2] fold node 0/1 [nx 2]
[3] fold node 0/2 [nx 2]
[4] fold node 0/3 [nx 2]
[5] fold node 0/4 [nx 2]
[6] fold node 0/5 [nx 2]
[7] fold node 0/6 [nx 2]
[8] fold node 0/7 [nx 2]
[9] fold node 0/8 [nx 2]
[10] fold node 0/9 [nx 2]
[11] fold node 0/10 [nx 2]
[12] fold node 0/11 [nx 2]
[13] fold node 0/12 [nx 2]
[14] fold node 0/13 [nx 2]
[15] fold node 0/14 [nx 2]
internal nodes remain despite enough space, retrying
-- compress node 0x560e9c562380 --
free=14, leaves=1
[0] fold node 2/15 [nx 0]
after: 3
Link: https://lkml.kernel.org/r/20220511225517.407935-1-stephen.s.brennan@oracle.…
Fixes: 3cb989501c26 ("Add a generic associative array implementation.")
Signed-off-by: Stephen Brennan <stephen.s.brennan(a)oracle.com>
Cc: David Howells <dhowells(a)redhat.com>
Cc: Len Baker <len.baker(a)gmx.com>
Cc: "Gustavo A. R. Silva" <gustavoars(a)kernel.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
lib/assoc_array.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/lib/assoc_array.c~assoc_array-fix-bug_on-during-garbage-collect
+++ a/lib/assoc_array.c
@@ -1462,6 +1462,7 @@ int assoc_array_gc(struct assoc_array *a
struct assoc_array_ptr *new_root, *new_parent, **new_ptr_pp;
unsigned long nr_leaves_on_tree;
int keylen, slot, nr_free, next_slot, i;
+ bool retained;
pr_devel("-->%s()\n", __func__);
@@ -1536,6 +1537,7 @@ continue_node:
goto descend;
}
+retry_compress:
pr_devel("-- compress node %p --\n", new_n);
/* Count up the number of empty slots in this node and work out the
@@ -1554,6 +1556,7 @@ continue_node:
/* See what we can fold in */
next_slot = 0;
+ retained = 0;
for (slot = 0; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
struct assoc_array_shortcut *s;
struct assoc_array_node *child;
@@ -1602,9 +1605,14 @@ continue_node:
pr_devel("[%d] retain node %lu/%d [nx %d]\n",
slot, child->nr_leaves_on_branch, nr_free + 1,
next_slot);
+ retained = true;
}
}
+ if (retained && new_n->nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT) {
+ pr_devel("internal nodes remain despite neough space, retrying\n");
+ goto retry_compress;
+ }
pr_devel("after: %lu\n", new_n->nr_leaves_on_branch);
nr_leaves_on_tree = new_n->nr_leaves_on_branch;
_
Patches currently in -mm which might be from stephen.s.brennan(a)oracle.com are
assoc_array-fix-bug_on-during-garbage-collect.patch
From: Sultan Alsawaf <sultan(a)kerneltoast.com>
The asynchronous zspage free worker tries to lock a zspage's entire page
list without defending against page migration. Since pages which haven't
yet been locked can concurrently migrate off the zspage page list while
lock_zspage() churns away, lock_zspage() can suffer from a few different
lethal races. It can lock a page which no longer belongs to the zspage and
unsafely dereference page_private(), it can unsafely dereference a torn
pointer to the next page (since there's a data race), and it can observe a
spurious NULL pointer to the next page and thus not lock all of the
zspage's pages (since a single page migration will reconstruct the entire
page list, and create_page_chain() unconditionally zeroes out each list
pointer in the process).
Fix the races by using migrate_read_lock() in lock_zspage() to synchronize
with page migration.
Cc: stable(a)vger.kernel.org
Fixes: 48b4800a1c6a ("zsmalloc: page migration support")
Signed-off-by: Sultan Alsawaf <sultan(a)kerneltoast.com>
---
mm/zsmalloc.c | 37 +++++++++++++++++++++++++++++++++----
1 file changed, 33 insertions(+), 4 deletions(-)
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 9152fbde33b5..5d5fc04385b8 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -1718,11 +1718,40 @@ static enum fullness_group putback_zspage(struct size_class *class,
*/
static void lock_zspage(struct zspage *zspage)
{
- struct page *page = get_first_page(zspage);
+ struct page *curr_page, *page;
- do {
- lock_page(page);
- } while ((page = get_next_page(page)) != NULL);
+ /*
+ * Pages we haven't locked yet can be migrated off the list while we're
+ * trying to lock them, so we need to be careful and only attempt to
+ * lock each page under migrate_read_lock(). Otherwise, the page we lock
+ * may no longer belong to the zspage. This means that we may wait for
+ * the wrong page to unlock, so we must take a reference to the page
+ * prior to waiting for it to unlock outside migrate_read_lock().
+ */
+ while (1) {
+ migrate_read_lock(zspage);
+ page = get_first_page(zspage);
+ if (trylock_page(page))
+ break;
+ get_page(page);
+ migrate_read_unlock(zspage);
+ wait_on_page_locked(page);
+ put_page(page);
+ }
+
+ curr_page = page;
+ while ((page = get_next_page(curr_page))) {
+ if (trylock_page(page)) {
+ curr_page = page;
+ } else {
+ get_page(page);
+ migrate_read_unlock(zspage);
+ wait_on_page_locked(page);
+ put_page(page);
+ migrate_read_lock(zspage);
+ }
+ }
+ migrate_read_unlock(zspage);
}
static int zs_init_fs_context(struct fs_context *fc)
--
2.36.0
From: Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
The bug is here:
ret = i40e_add_macvlan_filter(hw, ch->seid, vdev->dev_addr, &aq_err);
The list iterator 'ch' will point to a bogus position containing
HEAD if the list is empty or no element is found. This case must
be checked before any use of the iterator, otherwise it will
lead to a invalid memory access.
To fix this bug, use a new variable 'iter' as the list iterator,
while use the origin variable 'ch' as a dedicated pointer to
point to the found element.
Cc: stable(a)vger.kernel.org
Fixes: 1d8d80b4e4ff6 ("i40e: Add macvlan support on i40e")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
Tested-by: Gurucharan <gurucharanx.g(a)intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com>
---
v2: Dropped patch "iavf: Fix error when changing ring parameters on ice PF"
as its being reworked
drivers/net/ethernet/intel/i40e/i40e_main.c | 27 +++++++++++----------
1 file changed, 14 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 6778df2177a1..98871f014994 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -7549,42 +7549,43 @@ static void i40e_free_macvlan_channels(struct i40e_vsi *vsi)
static int i40e_fwd_ring_up(struct i40e_vsi *vsi, struct net_device *vdev,
struct i40e_fwd_adapter *fwd)
{
+ struct i40e_channel *ch = NULL, *ch_tmp, *iter;
int ret = 0, num_tc = 1, i, aq_err;
- struct i40e_channel *ch, *ch_tmp;
struct i40e_pf *pf = vsi->back;
struct i40e_hw *hw = &pf->hw;
- if (list_empty(&vsi->macvlan_list))
- return -EINVAL;
-
/* Go through the list and find an available channel */
- list_for_each_entry_safe(ch, ch_tmp, &vsi->macvlan_list, list) {
- if (!i40e_is_channel_macvlan(ch)) {
- ch->fwd = fwd;
+ list_for_each_entry_safe(iter, ch_tmp, &vsi->macvlan_list, list) {
+ if (!i40e_is_channel_macvlan(iter)) {
+ iter->fwd = fwd;
/* record configuration for macvlan interface in vdev */
for (i = 0; i < num_tc; i++)
netdev_bind_sb_channel_queue(vsi->netdev, vdev,
i,
- ch->num_queue_pairs,
- ch->base_queue);
- for (i = 0; i < ch->num_queue_pairs; i++) {
+ iter->num_queue_pairs,
+ iter->base_queue);
+ for (i = 0; i < iter->num_queue_pairs; i++) {
struct i40e_ring *tx_ring, *rx_ring;
u16 pf_q;
- pf_q = ch->base_queue + i;
+ pf_q = iter->base_queue + i;
/* Get to TX ring ptr */
tx_ring = vsi->tx_rings[pf_q];
- tx_ring->ch = ch;
+ tx_ring->ch = iter;
/* Get the RX ring ptr */
rx_ring = vsi->rx_rings[pf_q];
- rx_ring->ch = ch;
+ rx_ring->ch = iter;
}
+ ch = iter;
break;
}
}
+ if (!ch)
+ return -EINVAL;
+
/* Guarantee all rings are updated before we update the
* MAC address filter.
*/
--
2.35.1