I'm announcing the release of the 4.19.255 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/admin-guide/hw-vuln/spectre.rst | 8 +++
Documentation/networking/ip-sysctl.txt | 9 +++
Makefile | 2
arch/arm/lib/xor-neon.c | 3 -
arch/s390/include/asm/archrandom.h | 9 ++-
arch/x86/include/asm/cpufeatures.h | 2
arch/x86/include/asm/msr-index.h | 4 +
arch/x86/include/asm/nospec-branch.h | 19 +++++++-
arch/x86/kernel/cpu/bugs.c | 61 +++++++++++++++++++++++++-
arch/x86/kernel/cpu/common.c | 12 ++++-
arch/x86/kvm/vmx.c | 6 +-
drivers/acpi/video_detect.c | 55 ++++++++++++++---------
drivers/macintosh/adb.c | 2
drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +
drivers/net/sungem_phy.c | 1
drivers/net/wireless/mediatek/mt7601u/usb.c | 1
drivers/scsi/scsi_lib.c | 3 -
drivers/scsi/ufs/ufshcd-pltfrm.c | 15 +++++-
fs/ntfs/attrib.c | 8 ++-
include/net/bluetooth/l2cap.h | 1
include/net/tcp.h | 2
net/bluetooth/l2cap_core.c | 61 ++++++++++++++++++++------
net/ipv4/igmp.c | 24 +++++-----
net/ipv4/tcp.c | 2
net/ipv4/tcp_input.c | 20 ++++----
net/ipv4/tcp_metrics.c | 2
net/ipv4/tcp_output.c | 2
net/ipv6/ping.c | 6 ++
net/netfilter/nfnetlink_queue.c | 7 ++
net/sctp/stream_sched.c | 2
tools/perf/util/symbol-elf.c | 45 +++++++++++++++++--
31 files changed, 315 insertions(+), 83 deletions(-)
ChenXiaoSong (1):
ntfs: fix use-after-free in ntfs_ucsncmp()
Daniel Sneddon (1):
x86/speculation: Add RSB VM Exit protections
Duoming Zhou (1):
sctp: fix sleep in atomic context bug in timer handlers
Florian Westphal (1):
netfilter: nf_queue: do not allow packet truncation below transport header offset
Greg Kroah-Hartman (2):
ARM: crypto: comment out gcc warning that breaks clang builds
Linux 4.19.255
Harald Freudenberger (1):
s390/archrandom: prevent CPACF trng invocations in interrupt context
Kuniyuki Iwashima (14):
tcp: Fix data-races around sysctl_tcp_dsack.
tcp: Fix a data-race around sysctl_tcp_app_win.
tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
tcp: Fix a data-race around sysctl_tcp_frto.
tcp: Fix a data-race around sysctl_tcp_nometrics_save.
tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
net: ping6: Fix memleak in ipv6_renew_options().
igmp: Fix data-races around sysctl_igmp_qrv.
tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
tcp: Fix a data-race around sysctl_tcp_autocorking.
tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns.
tcp: Fix a data-race around sysctl_tcp_comp_sack_nr.
Leo Yan (1):
perf symbol: Correct address for bss symbols
Liang He (2):
scsi: ufs: host: Hold reference returned by of_parse_phandle()
net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
Luiz Augusto von Dentz (1):
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
Michal Maloszewski (1):
i40e: Fix interface init with MSI interrupts (no MSI-X)
Ming Lei (1):
scsi: core: Fix race between handling STS_RESOURCE and completion
Ning Qiang (1):
macintosh/adb: fix oob read in do_adb_query() function
Pawan Gupta (1):
x86/speculation: Add LFENCE to RSB fill sequence
Wei Mingzhi (1):
mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
Werner Sembach (2):
ACPI: video: Force backlight native for some TongFang devices
ACPI: video: Shortening quirk list by identifying Clevo by board_name only
Xin Long (1):
Documentation: fix sctp_wmem in ip-sysctl.rst
This patch fixes an inconsistency, if not a clear bug, with the extended permissions.
To quote from the original discussion [1]:
> The behavior of dontauditx and auditallowx appears to be broken making them useless.
[1] https://lore.kernel.org/selinux/6a791504-7728-3026-17ee-c22cbff8c3d1@gmail.…
bauen1 (1):
selinux: allow dontauditx and auditallowx rules to take effect without allowx
security/selinux/ss/services.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--
2.25.1
When a route filter is replaced and the old filter has a 0 handle, the old
one won't be removed from the hashtable, while it will still be freed.
The test was there since before commit 1109c00547fc ("net: sched: RCU
cls_route"), when a new filter was not allocated when there was an old one.
The old filter was reused and the reinserting would only be necessary if an
old filter was replaced. That was still wrong for the same case where the
old handle was 0.
Remove the old filter from the list independently from its handle value.
This fixes CVE-2022-2588, also reported as ZDI-CAN-17440.
Reported-by: Zhenpeng Lin <zplin(a)u.northwestern.edu>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com>
Reviewed-by: Kamal Mostafa <kamal(a)canonical.com>
Cc: <stable(a)vger.kernel.org>
Cc: Jamal Hadi Salim <jhs(a)mojatatu.com>
---
net/sched/cls_route.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index a35ab8c27866..3f935cbbaff6 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
rcu_assign_pointer(f->next, f1);
rcu_assign_pointer(*fp, f);
- if (fold && fold->handle && f->handle != fold->handle) {
+ if (fold) {
th = to_hash(fold->handle);
h = from_hash(fold->handle >> 16);
b = rtnl_dereference(head->table[th]);
--
2.34.1
The patch titled
Subject: kernel/sys_ni: add compat entry for fadvise64_64
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
kernel-sys_ni-add-compat-entry-for-fadvise64_64.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Randy Dunlap <rdunlap(a)infradead.org>
Subject: kernel/sys_ni: add compat entry for fadvise64_64
Date: Sun, 7 Aug 2022 15:09:34 -0700
When CONFIG_ADVISE_SYSCALLS is not set/enabled and CONFIG_COMPAT is
set/enabled, the riscv compat_syscall_table references
'compat_sys_fadvise64_64', which is not defined:
riscv64-linux-ld: arch/riscv/kernel/compat_syscall_table.o:(.rodata+0x6f8):
undefined reference to `compat_sys_fadvise64_64'
Add 'fadvise64_64' to kernel/sys_ni.c as a conditional COMPAT function so
that when CONFIG_ADVISE_SYSCALLS is not set, there is a fallback function
available.
Link: https://lkml.kernel.org/r/20220807220934.5689-1-rdunlap@infradead.org
Fixes: d3ac21cacc24 ("mm: Support compiling out madvise and fadvise")
Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org>
Suggested-by: Arnd Bergmann <arnd(a)arndb.de>
Reviewed-by: Arnd Bergmann <arnd(a)arndb.de>
Cc: Josh Triplett <josh(a)joshtriplett.org>
Cc: Paul Walmsley <paul.walmsley(a)sifive.com>
Cc: Palmer Dabbelt <palmer(a)dabbelt.com>
Cc: Albert Ou <aou(a)eecs.berkeley.edu>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
kernel/sys_ni.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/sys_ni.c~kernel-sys_ni-add-compat-entry-for-fadvise64_64
+++ a/kernel/sys_ni.c
@@ -277,6 +277,7 @@ COND_SYSCALL(landlock_restrict_self);
/* mm/fadvise.c */
COND_SYSCALL(fadvise64_64);
+COND_SYSCALL_COMPAT(fadvise64_64);
/* mm/, CONFIG_MMU only */
COND_SYSCALL(swapon);
_
Patches currently in -mm which might be from rdunlap(a)infradead.org are
kernel-sys_ni-add-compat-entry-for-fadvise64_64.patch
The patch titled
Subject: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-gup-fix-foll_force-cow-security-issue-and-remove-foll_cow.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: David Hildenbrand <david(a)redhat.com>
Subject: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW
Date: Tue, 9 Aug 2022 22:56:40 +0200
Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know
that FOLL_FORCE can be possibly dangerous, especially if there are races
that can be exploited by user space.
Right now, it would be sufficient to have some code that sets a PTE of a
R/O-mapped shared page dirty, in order for it to erroneously become
writable by FOLL_FORCE. The implications of setting a write-protected PTE
dirty might not be immediately obvious to everyone.
And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set
pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map
a shmem page R/O while marking the pte dirty. This can be used by
unprivileged user space to modify tmpfs/shmem file content even if the
user does not have write permissions to the file, and to bypass memfd
write sealing -- Dirty COW restricted to tmpfs/shmem (CVE-2022-2590).
To fix such security issues for good, the insight is that we really only
need that fancy retry logic (FOLL_COW) for COW mappings that are not
writable (!VM_WRITE). And in a COW mapping, we really only broke COW if
we have an exclusive anonymous page mapped. If we have something else
mapped, or the mapped anonymous page might be shared (!PageAnonExclusive),
we have to trigger a write fault to break COW. If we don't find an
exclusive anonymous page when we retry, we have to trigger COW breaking
once again because something intervened.
Let's move away from this mandatory-retry + dirty handling and rely on our
PageAnonExclusive() flag for making a similar decision, to use the same
COW logic as in other kernel parts here as well. In case we stumble over
a PTE in a COW mapping that does not map an exclusive anonymous page, COW
was not properly broken and we have to trigger a fake write-fault to break
COW.
Just like we do in can_change_pte_writable() added via commit 64fe24a3e05e
("mm/mprotect: try avoiding write faults for exclusive anonymous pages
when changing protection") and commit 76aefad628aa ("mm/mprotect: fix
soft-dirty check in can_change_pte_writable()"), take care of softdirty
and uffd-wp manually.
For example, a write() via /proc/self/mem to a uffd-wp-protected range has
to fail instead of silently granting write access and bypassing the
userspace fault handler. Note that FOLL_FORCE is not only used for debug
access, but also triggered by applications without debug intentions, for
example, when pinning pages via RDMA.
This fixes CVE-2022-2590. Note that only x86_64 and aarch64 are
affected, because only those support CONFIG_HAVE_ARCH_USERFAULTFD_MINOR.
Fortunately, FOLL_COW is no longer required to handle FOLL_FORCE. So
let's just get rid of it.
Thanks to Nadav Amit for pointing out that the pte_dirty() check in
FOLL_FORCE code is problematic and might be exploitable.
Note 1: We don't check for the PTE being dirty because it doesn't matter
for making a "was COWed" decision anymore, and whoever modifies the
page has to set the page dirty either way.
Note 2: Kernels before extended uffd-wp support and before
PageAnonExclusive (< 5.19) can simply revert the problematic
commit instead and be safe regarding UFFDIO_CONTINUE. A backport to
v5.19 requires minor adjustments due to lack of
vma_soft_dirty_enabled().
Link: https://lkml.kernel.org/r/20220809205640.70916-1-david@redhat.com
Fixes: 9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte")
Signed-off-by: David Hildenbrand <david(a)redhat.com>
Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Cc: Axel Rasmussen <axelrasmussen(a)google.com>
Cc: Nadav Amit <nadav.amit(a)gmail.com>
Cc: Peter Xu <peterx(a)redhat.com>
Cc: Hugh Dickins <hughd(a)google.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: Vlastimil Babka <vbabka(a)suse.cz>
Cc: John Hubbard <jhubbard(a)nvidia.com>
Cc: Jason Gunthorpe <jgg(a)nvidia.com>
Cc: David Laight <David.Laight(a)ACULAB.COM>
Cc: <stable(a)vger.kernel.org> [5.16]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/mm.h | 1
mm/gup.c | 68 +++++++++++++++++++++++++++++--------------
mm/huge_memory.c | 64 +++++++++++++++++++++++++++-------------
3 files changed, 89 insertions(+), 44 deletions(-)
--- a/include/linux/mm.h~mm-gup-fix-foll_force-cow-security-issue-and-remove-foll_cow
+++ a/include/linux/mm.h
@@ -2896,7 +2896,6 @@ struct page *follow_page(struct vm_area_
#define FOLL_MIGRATION 0x400 /* wait for page to replace migration entry */
#define FOLL_TRIED 0x800 /* a retry, previous pass started an IO */
#define FOLL_REMOTE 0x2000 /* we are working on non-current tsk/mm */
-#define FOLL_COW 0x4000 /* internal GUP flag */
#define FOLL_ANON 0x8000 /* don't do file mappings */
#define FOLL_LONGTERM 0x10000 /* mapping lifetime is indefinite: see below */
#define FOLL_SPLIT_PMD 0x20000 /* split huge pmd before returning */
--- a/mm/gup.c~mm-gup-fix-foll_force-cow-security-issue-and-remove-foll_cow
+++ a/mm/gup.c
@@ -478,14 +478,42 @@ static int follow_pfn_pte(struct vm_area
return -EEXIST;
}
-/*
- * FOLL_FORCE can write to even unwritable pte's, but only
- * after we've gone through a COW cycle and they are dirty.
- */
-static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
+/* FOLL_FORCE can write to even unwritable PTEs in COW mappings. */
+static inline bool can_follow_write_pte(pte_t pte, struct page *page,
+ struct vm_area_struct *vma,
+ unsigned int flags)
{
- return pte_write(pte) ||
- ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
+ /* If the pte is writable, we can write to the page. */
+ if (pte_write(pte))
+ return true;
+
+ /* Maybe FOLL_FORCE is set to override it? */
+ if (!(flags & FOLL_FORCE))
+ return false;
+
+ /* But FOLL_FORCE has no effect on shared mappings */
+ if (vma->vm_flags & (VM_MAYSHARE | VM_SHARED))
+ return false;
+
+ /* ... or read-only private ones */
+ if (!(vma->vm_flags & VM_MAYWRITE))
+ return false;
+
+ /* ... or already writable ones that just need to take a write fault */
+ if (vma->vm_flags & VM_WRITE)
+ return false;
+
+ /*
+ * See can_change_pte_writable(): we broke COW and could map the page
+ * writable if we have an exclusive anonymous page ...
+ */
+ if (!page || !PageAnon(page) || !PageAnonExclusive(page))
+ return false;
+
+ /* ... and a write-fault isn't required for other reasons. */
+ if (vma_soft_dirty_enabled(vma) && !pte_soft_dirty(pte))
+ return false;
+ return !userfaultfd_pte_wp(vma, pte);
}
static struct page *follow_page_pte(struct vm_area_struct *vma,
@@ -528,12 +556,19 @@ retry:
}
if ((flags & FOLL_NUMA) && pte_protnone(pte))
goto no_page;
- if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) {
- pte_unmap_unlock(ptep, ptl);
- return NULL;
- }
page = vm_normal_page(vma, address, pte);
+
+ /*
+ * We only care about anon pages in can_follow_write_pte() and don't
+ * have to worry about pte_devmap() because they are never anon.
+ */
+ if ((flags & FOLL_WRITE) &&
+ !can_follow_write_pte(pte, page, vma, flags)) {
+ page = NULL;
+ goto out;
+ }
+
if (!page && pte_devmap(pte) && (flags & (FOLL_GET | FOLL_PIN))) {
/*
* Only return device mapping pages in the FOLL_GET or FOLL_PIN
@@ -986,17 +1021,6 @@ static int faultin_page(struct vm_area_s
return -EBUSY;
}
- /*
- * The VM_FAULT_WRITE bit tells us that do_wp_page has broken COW when
- * necessary, even if maybe_mkwrite decided not to set pte_write. We
- * can thus safely do subsequent page lookups as if they were reads.
- * But only do so when looping for pte_write is futile: in some cases
- * userspace may also be wanting to write to the gotten user page,
- * which a read fault here might prevent (a readonly page might get
- * reCOWed by userspace write).
- */
- if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE))
- *flags |= FOLL_COW;
return 0;
}
--- a/mm/huge_memory.c~mm-gup-fix-foll_force-cow-security-issue-and-remove-foll_cow
+++ a/mm/huge_memory.c
@@ -1040,12 +1040,6 @@ struct page *follow_devmap_pmd(struct vm
assert_spin_locked(pmd_lockptr(mm, pmd));
- /*
- * When we COW a devmap PMD entry, we split it into PTEs, so we should
- * not be in this function with `flags & FOLL_COW` set.
- */
- WARN_ONCE(flags & FOLL_COW, "mm: In follow_devmap_pmd with FOLL_COW set");
-
/* FOLL_GET and FOLL_PIN are mutually exclusive. */
if (WARN_ON_ONCE((flags & (FOLL_PIN | FOLL_GET)) ==
(FOLL_PIN | FOLL_GET)))
@@ -1395,14 +1389,42 @@ fallback:
return VM_FAULT_FALLBACK;
}
-/*
- * FOLL_FORCE can write to even unwritable pmd's, but only
- * after we've gone through a COW cycle and they are dirty.
- */
-static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags)
+/* FOLL_FORCE can write to even unwritable PMDs in COW mappings. */
+static inline bool can_follow_write_pmd(pmd_t pmd, struct page *page,
+ struct vm_area_struct *vma,
+ unsigned int flags)
{
- return pmd_write(pmd) ||
- ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd));
+ /* If the pmd is writable, we can write to the page. */
+ if (pmd_write(pmd))
+ return true;
+
+ /* Maybe FOLL_FORCE is set to override it? */
+ if (!(flags & FOLL_FORCE))
+ return false;
+
+ /* But FOLL_FORCE has no effect on shared mappings */
+ if (vma->vm_flags & (VM_MAYSHARE | VM_SHARED))
+ return false;
+
+ /* ... or read-only private ones */
+ if (!(vma->vm_flags & VM_MAYWRITE))
+ return false;
+
+ /* ... or already writable ones that just need to take a write fault */
+ if (vma->vm_flags & VM_WRITE)
+ return false;
+
+ /*
+ * See can_change_pte_writable(): we broke COW and could map the page
+ * writable if we have an exclusive anonymous page ...
+ */
+ if (!page || !PageAnon(page) || !PageAnonExclusive(page))
+ return false;
+
+ /* ... and a write-fault isn't required for other reasons. */
+ if (vma_soft_dirty_enabled(vma) && !pmd_soft_dirty(pmd))
+ return false;
+ return !userfaultfd_huge_pmd_wp(vma, pmd);
}
struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
@@ -1411,12 +1433,16 @@ struct page *follow_trans_huge_pmd(struc
unsigned int flags)
{
struct mm_struct *mm = vma->vm_mm;
- struct page *page = NULL;
+ struct page *page;
assert_spin_locked(pmd_lockptr(mm, pmd));
- if (flags & FOLL_WRITE && !can_follow_write_pmd(*pmd, flags))
- goto out;
+ page = pmd_page(*pmd);
+ VM_BUG_ON_PAGE(!PageHead(page) && !is_zone_device_page(page), page);
+
+ if ((flags & FOLL_WRITE) &&
+ !can_follow_write_pmd(*pmd, page, vma, flags))
+ return NULL;
/* Avoid dumping huge zero page */
if ((flags & FOLL_DUMP) && is_huge_zero_pmd(*pmd))
@@ -1424,10 +1450,7 @@ struct page *follow_trans_huge_pmd(struc
/* Full NUMA hinting faults to serialise migration in fault paths */
if ((flags & FOLL_NUMA) && pmd_protnone(*pmd))
- goto out;
-
- page = pmd_page(*pmd);
- VM_BUG_ON_PAGE(!PageHead(page) && !is_zone_device_page(page), page);
+ return NULL;
if (!pmd_write(*pmd) && gup_must_unshare(flags, page))
return ERR_PTR(-EMLINK);
@@ -1444,7 +1467,6 @@ struct page *follow_trans_huge_pmd(struc
page += (addr & ~HPAGE_PMD_MASK) >> PAGE_SHIFT;
VM_BUG_ON_PAGE(!PageCompound(page) && !is_zone_device_page(page), page);
-out:
return page;
}
_
Patches currently in -mm which might be from david(a)redhat.com are
mm-gup-fix-foll_force-cow-security-issue-and-remove-foll_cow.patch
The patch titled
Subject: Revert "zram: remove double compression logic"
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
revert-zram-remove-double-compression-logic.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Jiri Slaby <jslaby(a)suse.cz>
Subject: Revert "zram: remove double compression logic"
Date: Wed, 10 Aug 2022 09:06:09 +0200
This reverts commit e7be8d1dd983156b ("zram: remove double compression
logic") as it causes zram failures. It does not revert cleanly, PTR_ERR
handling was introduced in the meantime. This is handled by appropriate
IS_ERR.
When under memory pressure, zs_malloc() can fail. Before the above
commit, the allocation was retried with direct reclaim enabled (GFP_NOIO).
After the commit, it is not -- only __GFP_KSWAPD_RECLAIM is tried.
So when the failure occurs under memory pressure, the overlaying
filesystem such as ext2 (mounted by ext4 module in this case) can emit
failures, making the (file)system unusable:
EXT4-fs warning (device zram0): ext4_end_bio:343: I/O error 10 writing to inode 16386 starting block 159744)
Buffer I/O error on device zram0, logical block 159744
With direct reclaim, memory is really reclaimed and allocation succeeds,
eventually. In the worst case, the oom killer is invoked, which is proper
outcome if user sets up zram too large (in comparison to available RAM).
This very diff doesn't apply to 5.19 (stable) cleanly (see PTR_ERR note
above). Use revert of e7be8d1dd983 directly.
Link: https://bugzilla.suse.com/show_bug.cgi?id=1202203
Link: https://lkml.kernel.org/r/20220810070609.14402-1-jslaby@suse.cz
Fixes: e7be8d1dd983 ("zram: remove double compression logic")
Signed-off-by: Jiri Slaby <jslaby(a)suse.cz>
Reviewed-by: Sergey Senozhatsky <senozhatsky(a)chromium.org>
Cc: Minchan Kim <minchan(a)kernel.org>
Cc: Nitin Gupta <ngupta(a)vflare.org>
Cc: Alexey Romanov <avromanov(a)sberdevices.ru>
Cc: Dmitry Rokosov <ddrokosov(a)sberdevices.ru>
Cc: Lukas Czerner <lczerner(a)redhat.com>
Cc: <stable(a)vger.kernel.org> [5.19]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
drivers/block/zram/zram_drv.c | 42 ++++++++++++++++++++++++--------
drivers/block/zram/zram_drv.h | 1
2 files changed, 33 insertions(+), 10 deletions(-)
--- a/drivers/block/zram/zram_drv.c~revert-zram-remove-double-compression-logic
+++ a/drivers/block/zram/zram_drv.c
@@ -1146,14 +1146,15 @@ static ssize_t bd_stat_show(struct devic
static ssize_t debug_stat_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
- int version = 2;
+ int version = 1;
struct zram *zram = dev_to_zram(dev);
ssize_t ret;
down_read(&zram->init_lock);
ret = scnprintf(buf, PAGE_SIZE,
- "version: %d\n%8llu\n",
+ "version: %d\n%8llu %8llu\n",
version,
+ (u64)atomic64_read(&zram->stats.writestall),
(u64)atomic64_read(&zram->stats.miss_free));
up_read(&zram->init_lock);
@@ -1351,7 +1352,7 @@ static int __zram_bvec_write(struct zram
{
int ret = 0;
unsigned long alloced_pages;
- unsigned long handle = 0;
+ unsigned long handle = -ENOMEM;
unsigned int comp_len = 0;
void *src, *dst, *mem;
struct zcomp_strm *zstrm;
@@ -1369,6 +1370,7 @@ static int __zram_bvec_write(struct zram
}
kunmap_atomic(mem);
+compress_again:
zstrm = zcomp_stream_get(zram->comp);
src = kmap_atomic(page);
ret = zcomp_compress(zstrm, src, &comp_len);
@@ -1377,20 +1379,39 @@ static int __zram_bvec_write(struct zram
if (unlikely(ret)) {
zcomp_stream_put(zram->comp);
pr_err("Compression failed! err=%d\n", ret);
+ zs_free(zram->mem_pool, handle);
return ret;
}
if (comp_len >= huge_class_size)
comp_len = PAGE_SIZE;
-
- handle = zs_malloc(zram->mem_pool, comp_len,
- __GFP_KSWAPD_RECLAIM |
- __GFP_NOWARN |
- __GFP_HIGHMEM |
- __GFP_MOVABLE);
-
+ /*
+ * handle allocation has 2 paths:
+ * a) fast path is executed with preemption disabled (for
+ * per-cpu streams) and has __GFP_DIRECT_RECLAIM bit clear,
+ * since we can't sleep;
+ * b) slow path enables preemption and attempts to allocate
+ * the page with __GFP_DIRECT_RECLAIM bit set. we have to
+ * put per-cpu compression stream and, thus, to re-do
+ * the compression once handle is allocated.
+ *
+ * if we have a 'non-null' handle here then we are coming
+ * from the slow path and handle has already been allocated.
+ */
+ if (IS_ERR((void *)handle))
+ handle = zs_malloc(zram->mem_pool, comp_len,
+ __GFP_KSWAPD_RECLAIM |
+ __GFP_NOWARN |
+ __GFP_HIGHMEM |
+ __GFP_MOVABLE);
if (IS_ERR((void *)handle)) {
zcomp_stream_put(zram->comp);
+ atomic64_inc(&zram->stats.writestall);
+ handle = zs_malloc(zram->mem_pool, comp_len,
+ GFP_NOIO | __GFP_HIGHMEM |
+ __GFP_MOVABLE);
+ if (!IS_ERR((void *)handle))
+ goto compress_again;
return PTR_ERR((void *)handle);
}
@@ -1948,6 +1969,7 @@ static int zram_add(void)
if (ZRAM_LOGICAL_BLOCK_SIZE == PAGE_SIZE)
blk_queue_max_write_zeroes_sectors(zram->disk->queue, UINT_MAX);
+ blk_queue_flag_set(QUEUE_FLAG_STABLE_WRITES, zram->disk->queue);
ret = device_add_disk(NULL, zram->disk, zram_disk_groups);
if (ret)
goto out_cleanup_disk;
--- a/drivers/block/zram/zram_drv.h~revert-zram-remove-double-compression-logic
+++ a/drivers/block/zram/zram_drv.h
@@ -81,6 +81,7 @@ struct zram_stats {
atomic64_t huge_pages_since; /* no. of huge pages since zram set up */
atomic64_t pages_stored; /* no. of pages currently stored */
atomic_long_t max_used_pages; /* no. of maximum pages stored */
+ atomic64_t writestall; /* no. of write slow paths */
atomic64_t miss_free; /* no. of missed free */
#ifdef CONFIG_ZRAM_WRITEBACK
atomic64_t bd_count; /* no. of pages in backing device */
_
Patches currently in -mm which might be from jslaby(a)suse.cz are
revert-zram-remove-double-compression-logic.patch
This is the start of the stable review cycle for the 5.15.60 release.
There are 30 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 11 Aug 2022 17:55:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.60-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.60-rc1
Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com>
x86/speculation: Add LFENCE to RSB fill sequence
Daniel Sneddon <daniel.sneddon(a)linux.intel.com>
x86/speculation: Add RSB VM Exit protections
Ning Qiang <sohu0106(a)126.com>
macintosh/adb: fix oob read in do_adb_query() function
Hilda Wu <hildawu(a)realtek.com>
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3586
Hilda Wu <hildawu(a)realtek.com>
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x13D3:0x3587
Hilda Wu <hildawu(a)realtek.com>
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0CB8:0xC558
Hilda Wu <hildawu(a)realtek.com>
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04C5:0x1675
Hilda Wu <hildawu(a)realtek.com>
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04CA:0x4007
Aaron Ma <aaron.ma(a)canonical.com>
Bluetooth: btusb: Add support of IMC Networks PID 0x3568
Ahmad Fatoum <a.fatoum(a)pengutronix.de>
dt-bindings: bluetooth: broadcom: Add BCM4349B1 DT binding
Hakan Jansson <hakan.jansson(a)infineon.com>
Bluetooth: hci_bcm: Add DT compatible for CYW55572
Ahmad Fatoum <a.fatoum(a)pengutronix.de>
Bluetooth: hci_bcm: Add BCM4349B1 variant
Naohiro Aota <naohiro.aota(a)wdc.com>
btrfs: zoned: fix critical section of relocation inode writeback
Naohiro Aota <naohiro.aota(a)wdc.com>
btrfs: zoned: prevent allocation from previous data relocation BG
Peter Collingbourne <pcc(a)google.com>
arm64: set UXN on swapper page tables
Mingwei Zhang <mizhang(a)google.com>
KVM: x86/svm: add __GFP_ACCOUNT to __sev_dbg_{en,de}crypt_user()
Raghavendra Rao Ananta <rananta(a)google.com>
selftests: KVM: Handle compiler optimizations in ucall
Dmitry Klochkov <kdmitry556(a)gmail.com>
tools/kvm_stat: fix display of error when multiple processes are found
Vitaly Kuznetsov <vkuznets(a)redhat.com>
KVM: selftests: Make hyperv_clock selftest more stable
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: do not set st->preempted when going back to user space
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: do not report a vCPU as preempted outside instruction boundaries
GUO Zihua <guozihua(a)huawei.com>
crypto: arm64/poly1305 - fix a read out-of-bound
Tony Luck <tony.luck(a)intel.com>
ACPI: APEI: Better fix to avoid spamming the console with old error logs
Werner Sembach <wse(a)tuxedocomputers.com>
ACPI: video: Shortening quirk list by identifying Clevo by board_name only
Werner Sembach <wse(a)tuxedocomputers.com>
ACPI: video: Force backlight native for some TongFang devices
Stéphane Graber <stgraber(a)ubuntu.com>
tools/vm/slabinfo: Handle files in debugfs
Jan Kara <jack(a)suse.cz>
block: fix default IO priority handling again
Jakub Sitnicki <jakub(a)cloudflare.com>
selftests/bpf: Check dst_port only on the client socket
Jakub Sitnicki <jakub(a)cloudflare.com>
selftests/bpf: Extend verifier and bpf_sock tests for dst_port loads
Ben Hutchings <ben(a)decadent.org.uk>
x86/speculation: Make all RETbleed mitigations 64-bit only
-------------
Diffstat:
Documentation/admin-guide/hw-vuln/spectre.rst | 8 ++
.../bindings/net/broadcom-bluetooth.yaml | 1 +
Makefile | 4 +-
arch/arm64/crypto/poly1305-glue.c | 2 +-
arch/arm64/include/asm/kernel-pgtable.h | 4 +-
arch/arm64/kernel/head.S | 2 +-
arch/x86/Kconfig | 8 +-
arch/x86/include/asm/cpufeatures.h | 2 +
arch/x86/include/asm/kvm_host.h | 3 +
arch/x86/include/asm/msr-index.h | 4 +
arch/x86/include/asm/nospec-branch.h | 21 +++++-
arch/x86/kernel/cpu/bugs.c | 86 ++++++++++++++++------
arch/x86/kernel/cpu/common.c | 12 ++-
arch/x86/kvm/svm/sev.c | 4 +-
arch/x86/kvm/svm/svm.c | 2 +
arch/x86/kvm/vmx/vmenter.S | 8 +-
arch/x86/kvm/vmx/vmx.c | 1 +
arch/x86/kvm/x86.c | 48 +++++++++---
arch/x86/kvm/xen.h | 6 +-
block/blk-ioc.c | 1 +
block/ioprio.c | 4 +-
drivers/acpi/apei/bert.c | 31 ++++++--
drivers/acpi/video_detect.c | 55 +++++++++-----
drivers/bluetooth/btbcm.c | 2 +
drivers/bluetooth/btusb.c | 15 ++++
drivers/bluetooth/hci_bcm.c | 2 +
drivers/macintosh/adb.c | 2 +-
fs/btrfs/block-group.h | 1 +
fs/btrfs/extent-tree.c | 20 ++++-
fs/btrfs/extent_io.c | 3 +-
fs/btrfs/inode.c | 2 +
fs/btrfs/zoned.c | 27 +++++++
fs/btrfs/zoned.h | 5 ++
include/linux/ioprio.h | 2 +-
tools/arch/x86/include/asm/cpufeatures.h | 1 +
tools/arch/x86/include/asm/msr-index.h | 4 +
tools/include/uapi/linux/bpf.h | 3 +-
tools/kvm/kvm_stat/kvm_stat | 3 +-
.../testing/selftests/bpf/prog_tests/sock_fields.c | 58 ++++++++++-----
.../testing/selftests/bpf/progs/test_sock_fields.c | 45 +++++++++++
tools/testing/selftests/bpf/verifier/sock.c | 81 +++++++++++++++++++-
tools/testing/selftests/kvm/lib/aarch64/ucall.c | 9 +--
tools/testing/selftests/kvm/x86_64/hyperv_clock.c | 10 ++-
tools/vm/slabinfo.c | 26 ++++++-
44 files changed, 515 insertions(+), 123 deletions(-)
This is the start of the stable review cycle for the 4.19.255 release.
There are 32 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 11 Aug 2022 17:55:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.255-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.255-rc1
Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com>
x86/speculation: Add LFENCE to RSB fill sequence
Daniel Sneddon <daniel.sneddon(a)linux.intel.com>
x86/speculation: Add RSB VM Exit protections
Ning Qiang <sohu0106(a)126.com>
macintosh/adb: fix oob read in do_adb_query() function
Werner Sembach <wse(a)tuxedocomputers.com>
ACPI: video: Shortening quirk list by identifying Clevo by board_name only
Werner Sembach <wse(a)tuxedocomputers.com>
ACPI: video: Force backlight native for some TongFang devices
Ming Lei <ming.lei(a)redhat.com>
scsi: core: Fix race between handling STS_RESOURCE and completion
Wei Mingzhi <whistler(a)member.fsf.org>
mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
ARM: crypto: comment out gcc warning that breaks clang builds
Leo Yan <leo.yan(a)linaro.org>
perf symbol: Correct address for bss symbols
Florian Westphal <fw(a)strlen.de>
netfilter: nf_queue: do not allow packet truncation below transport header offset
Duoming Zhou <duoming(a)zju.edu.cn>
sctp: fix sleep in atomic context bug in timer handlers
Michal Maloszewski <michal.maloszewski(a)intel.com>
i40e: Fix interface init with MSI interrupts (no MSI-X)
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_comp_sack_nr.
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns.
Xin Long <lucien.xin(a)gmail.com>
Documentation: fix sctp_wmem in ip-sysctl.rst
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_autocorking.
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
Liang He <windhl(a)126.com>
net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
Kuniyuki Iwashima <kuniyu(a)amazon.com>
igmp: Fix data-races around sysctl_igmp_qrv.
Kuniyuki Iwashima <kuniyu(a)amazon.com>
net: ping6: Fix memleak in ipv6_renew_options().
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
Liang He <windhl(a)126.com>
scsi: ufs: host: Hold reference returned by of_parse_phandle()
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_nometrics_save.
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_frto.
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix a data-race around sysctl_tcp_app_win.
Kuniyuki Iwashima <kuniyu(a)amazon.com>
tcp: Fix data-races around sysctl_tcp_dsack.
Harald Freudenberger <freude(a)linux.ibm.com>
s390/archrandom: prevent CPACF trng invocations in interrupt context
ChenXiaoSong <chenxiaosong2(a)huawei.com>
ntfs: fix use-after-free in ntfs_ucsncmp()
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
-------------
Diffstat:
Documentation/admin-guide/hw-vuln/spectre.rst | 8 ++++
Documentation/networking/ip-sysctl.txt | 9 +++-
Makefile | 4 +-
arch/arm/lib/xor-neon.c | 3 +-
arch/s390/include/asm/archrandom.h | 9 ++--
arch/x86/include/asm/cpufeatures.h | 2 +
arch/x86/include/asm/msr-index.h | 4 ++
arch/x86/include/asm/nospec-branch.h | 19 ++++++++-
arch/x86/kernel/cpu/bugs.c | 61 ++++++++++++++++++++++++++-
arch/x86/kernel/cpu/common.c | 12 +++++-
arch/x86/kvm/vmx.c | 6 +--
drivers/acpi/video_detect.c | 55 +++++++++++++++---------
drivers/macintosh/adb.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++
drivers/net/sungem_phy.c | 1 +
drivers/net/wireless/mediatek/mt7601u/usb.c | 1 +
drivers/scsi/scsi_lib.c | 3 +-
drivers/scsi/ufs/ufshcd-pltfrm.c | 15 ++++++-
fs/ntfs/attrib.c | 8 +++-
include/net/bluetooth/l2cap.h | 1 +
include/net/tcp.h | 2 +-
net/bluetooth/l2cap_core.c | 61 +++++++++++++++++++++------
net/ipv4/igmp.c | 24 ++++++-----
net/ipv4/tcp.c | 2 +-
net/ipv4/tcp_input.c | 20 +++++----
net/ipv4/tcp_metrics.c | 2 +-
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ping.c | 6 +++
net/netfilter/nfnetlink_queue.c | 7 ++-
net/sctp/stream_sched.c | 2 +-
tools/perf/util/symbol-elf.c | 45 ++++++++++++++++++--
31 files changed, 316 insertions(+), 84 deletions(-)
This is the start of the stable review cycle for the 5.4.210 release.
There are 15 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 11 Aug 2022 17:55:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.210-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.210-rc1
Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com>
x86/speculation: Add LFENCE to RSB fill sequence
Daniel Sneddon <daniel.sneddon(a)linux.intel.com>
x86/speculation: Add RSB VM Exit protections
Ning Qiang <sohu0106(a)126.com>
macintosh/adb: fix oob read in do_adb_query() function
Chen-Yu Tsai <wenst(a)chromium.org>
media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
Raghavendra Rao Ananta <rananta(a)google.com>
selftests: KVM: Handle compiler optimizations in ucall
Alexey Kardashevskiy <aik(a)ozlabs.ru>
KVM: Don't null dereference ops->destroy
Jean-Philippe Brucker <jean-philippe(a)linaro.org>
selftests/bpf: Fix "dubious pointer arithmetic" test
Stanislav Fomichev <sdf(a)google.com>
selftests/bpf: Fix test_align verifier log patterns
John Fastabend <john.fastabend(a)gmail.com>
bpf: Test_verifier, #70 error message updates for 32-bit right shift
Jakub Sitnicki <jakub(a)cloudflare.com>
selftests/bpf: Extend verifier and bpf_sock tests for dst_port loads
John Fastabend <john.fastabend(a)gmail.com>
bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()
Tony Luck <tony.luck(a)intel.com>
ACPI: APEI: Better fix to avoid spamming the console with old error logs
Werner Sembach <wse(a)tuxedocomputers.com>
ACPI: video: Shortening quirk list by identifying Clevo by board_name only
Werner Sembach <wse(a)tuxedocomputers.com>
ACPI: video: Force backlight native for some TongFang devices
Subbaraman Narayanamurthy <quic_subbaram(a)quicinc.com>
thermal: Fix NULL pointer dereferences in of_thermal_ functions
-------------
Diffstat:
Documentation/admin-guide/hw-vuln/spectre.rst | 8 +++
Makefile | 4 +-
arch/x86/include/asm/cpufeatures.h | 2 +
arch/x86/include/asm/msr-index.h | 4 ++
arch/x86/include/asm/nospec-branch.h | 19 +++++-
arch/x86/kernel/cpu/bugs.c | 61 ++++++++++++++++++-
arch/x86/kernel/cpu/common.c | 12 +++-
arch/x86/kvm/vmx/vmenter.S | 1 +
drivers/acpi/apei/bert.c | 31 +++++++---
drivers/acpi/video_detect.c | 55 +++++++++++------
drivers/macintosh/adb.c | 2 +-
drivers/media/v4l2-core/v4l2-mem2mem.c | 60 +++++++++++++-----
drivers/thermal/of-thermal.c | 9 ++-
kernel/bpf/verifier.c | 1 +
tools/arch/x86/include/asm/cpufeatures.h | 1 +
tools/include/uapi/linux/bpf.h | 3 +-
tools/testing/selftests/bpf/test_align.c | 41 +++++++------
tools/testing/selftests/bpf/verifier/bounds.c | 6 +-
tools/testing/selftests/bpf/verifier/sock.c | 81 ++++++++++++++++++++++++-
tools/testing/selftests/kvm/lib/aarch64/ucall.c | 9 ++-
virt/kvm/kvm_main.c | 5 +-
21 files changed, 329 insertions(+), 86 deletions(-)