October 2024 - Linux-stable-mirror

[PATCH v2] mm: Split critical region in remap_file_pages() and invoke LSMs in between

by Roberto Sassu

From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> Commit ea7e2d5e49c0 ("mm: call the security_mmap_file() LSM hook in remap_file_pages()") fixed a security issue, it added an LSM check when trying to remap file pages, so that LSMs have the opportunity to evaluate such action like for other memory operations such as mmap() and mprotect(). However, that commit called security_mmap_file() inside the mmap_lock lock, while the other calls do it before taking the lock, after commit 8b3ec6814c83 ("take security_mmap_file() outside of ->mmap_sem"). This caused lock inversion issue with IMA which was taking the mmap_lock and i_mutex lock in the opposite way when the remap_file_pages() system call was called. Solve the issue by splitting the critical region in remap_file_pages() in two regions: the first takes a read lock of mmap_lock, retrieves the VMA and the file descriptor associated, and calculates the 'prot' and 'flags' variables; the second takes a write lock on mmap_lock, checks that the VMA flags and the VMA file descriptor are the same as the ones obtained in the first critical region (otherwise the system call fails), and calls do_mmap(). In between, after releasing the read lock and before taking the write lock, call security_mmap_file(), and solve the lock inversion issue. Cc: stable(a)vger.kernel.org # v6.12-rcx Fixes: ea7e2d5e49c0 ("mm: call the security_mmap_file() LSM hook in remap_file_pages()") Reported-by: syzbot+1cd571a672400ef3a930(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-security-module/66f7b10e.050a0220.46d20.0036.… Reviewed-by: Roberto Sassu <roberto.sassu(a)huawei.com> Reviewed-by: Jann Horn <jannh(a)google.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Tested-by: Roberto Sassu <roberto.sassu(a)huawei.com> Tested-by: syzbot+1cd571a672400ef3a930(a)syzkaller.appspotmail.com Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> --- mm/mmap.c | 69 +++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 52 insertions(+), 17 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 9c0fb43064b5..f731dd69e162 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1640,6 +1640,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, unsigned long populate = 0; unsigned long ret = -EINVAL; struct file *file; + vm_flags_t vm_flags; pr_warn_once("%s (%d) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.\n", current->comm, current->pid); @@ -1656,12 +1657,60 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, if (pgoff + (size >> PAGE_SHIFT) < pgoff) return ret; - if (mmap_write_lock_killable(mm)) + if (mmap_read_lock_killable(mm)) return -EINTR; + /* + * Look up VMA under read lock first so we can perform the security + * without holding locks (which can be problematic). We reacquire a + * write lock later and check nothing changed underneath us. + */ vma = vma_lookup(mm, start); - if (!vma || !(vma->vm_flags & VM_SHARED)) + if (!vma || !(vma->vm_flags & VM_SHARED)) { + mmap_read_unlock(mm); + return -EINVAL; + } + + prot |= vma->vm_flags & VM_READ ? PROT_READ : 0; + prot |= vma->vm_flags & VM_WRITE ? PROT_WRITE : 0; + prot |= vma->vm_flags & VM_EXEC ? PROT_EXEC : 0; + + flags &= MAP_NONBLOCK; + flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE; + if (vma->vm_flags & VM_LOCKED) + flags |= MAP_LOCKED; + + /* Save vm_flags used to calculate prot and flags, and recheck later. */ + vm_flags = vma->vm_flags; + file = get_file(vma->vm_file); + + mmap_read_unlock(mm); + + /* Call outside mmap_lock to be consistent with other callers. */ + ret = security_mmap_file(file, prot, flags); + if (ret) { + fput(file); + return ret; + } + + ret = -EINVAL; + + /* OK security check passed, take write lock + let it rip. */ + if (mmap_write_lock_killable(mm)) { + fput(file); + return -EINTR; + } + + vma = vma_lookup(mm, start); + + if (!vma) + goto out; + + /* Make sure things didn't change under us. */ + if (vma->vm_flags != vm_flags) + goto out; + if (vma->vm_file != file) goto out; if (start + size > vma->vm_end) { @@ -1689,25 +1738,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, goto out; } - prot |= vma->vm_flags & VM_READ ? PROT_READ : 0; - prot |= vma->vm_flags & VM_WRITE ? PROT_WRITE : 0; - prot |= vma->vm_flags & VM_EXEC ? PROT_EXEC : 0; - - flags &= MAP_NONBLOCK; - flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE; - if (vma->vm_flags & VM_LOCKED) - flags |= MAP_LOCKED; - - file = get_file(vma->vm_file); - ret = security_mmap_file(vma->vm_file, prot, flags); - if (ret) - goto out_fput; ret = do_mmap(vma->vm_file, start, size, prot, flags, 0, pgoff, &populate, NULL); -out_fput: - fput(file); out: mmap_write_unlock(mm); + fput(file); if (populate) mm_populate(ret, populate); if (!IS_ERR_VALUE(ret)) -- 2.34.1

6 months

5
6
0 0

[PATCH v2] xhci: Fix Link TRB DMA in command ring stopped completion event

by Faisal Hassan

During the aborting of a command, the software receives a command completion event for the command ring stopped, with the TRB pointing to the next TRB after the aborted command. If the command we abort is located just before the Link TRB in the command ring, then during the 'command ring stopped' completion event, the xHC gives the Link TRB in the event's cmd DMA, which causes a mismatch in handling command completion event. To handle this situation, an additional check has been added to ignore the mismatch error and continue the operation. Fixes: 7f84eef0dafb ("USB: xhci: No-op command queueing and irq handler.") Cc: stable(a)vger.kernel.org Signed-off-by: Faisal Hassan <quic_faisalh(a)quicinc.com> --- Changes in v2: - Removed traversing of TRBs with in_range() API. - Simplified the if condition check. v1 link: https://lore.kernel.org/all/20241018195953.12315-1-quic_faisalh@quicinc.com drivers/usb/host/xhci-ring.c | 43 +++++++++++++++++++++++++++++++----- 1 file changed, 38 insertions(+), 5 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index b2950c35c740..de375c9f08ca 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -126,6 +126,29 @@ static void inc_td_cnt(struct urb *urb) urb_priv->num_tds_done++; } +/* + * Return true if the DMA is pointing to a Link TRB in the ring; + * otherwise, return false. + */ +static bool is_dma_link_trb(struct xhci_ring *ring, dma_addr_t dma) +{ + struct xhci_segment *seg; + union xhci_trb *trb; + + seg = ring->first_seg; + do { + if (in_range(dma, seg->dma, TRB_SEGMENT_SIZE)) { + /* found the TRB, check if it's link */ + trb = &seg->trbs[(dma - seg->dma) / sizeof(*trb)]; + return trb_is_link(trb); + } + + seg = seg->next; + } while (seg != ring->first_seg); + + return false; +} + static void trb_to_noop(union xhci_trb *trb, u32 noop_type) { if (trb_is_link(trb)) { @@ -1718,6 +1741,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, trace_xhci_handle_command(xhci->cmd_ring, &cmd_trb->generic); + cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status)); cmd_dequeue_dma = xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg, cmd_trb); /* @@ -1725,17 +1749,26 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, * command. */ if (!cmd_dequeue_dma || cmd_dma != (u64)cmd_dequeue_dma) { - xhci_warn(xhci, - "ERROR mismatched command completion event\n"); - return; + /* + * For the 'command ring stopped' completion event, there + * is a risk of a mismatch in dequeue pointers if we abort + * the command just before the link TRB in the command ring. + * In this scenario, the cmd_dma in the event would point + * to a link TRB, while the software dequeue pointer circles + * back to the start. + */ + if (!(cmd_comp_code == COMP_COMMAND_RING_STOPPED && + is_dma_link_trb(xhci->cmd_ring, cmd_dma))) { + xhci_warn(xhci, + "ERROR mismatched command completion event\n"); + return; + } } cmd = list_first_entry(&xhci->cmd_list, struct xhci_command, cmd_list); cancel_delayed_work(&xhci->cmd_timer); - cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status)); - /* If CMD ring stopped we own the trbs between enqueue and dequeue */ if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) { complete_all(&xhci->cmd_ring_stop_completion); -- 2.17.1

6 months

2
4
0 0

Linux 6.11.5

by Greg Kroah-Hartman

I'm announcing the release of the 6.11.5 kernel. All users of the 6.11 kernel series must upgrade. The updated 6.11.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.11.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm64/boot/dts/marvell/cn9130-sr-som.dtsi | 2 arch/arm64/include/asm/uprobes.h | 8 - arch/arm64/kernel/probes/decode-insn.c | 16 +- arch/arm64/kernel/probes/simulate-insn.c | 18 +- arch/arm64/kernel/probes/uprobes.c | 4 arch/s390/kvm/diag.c | 2 arch/s390/kvm/gaccess.c | 4 arch/s390/kvm/gaccess.h | 14 +- arch/x86/entry/entry.S | 5 arch/x86/entry/entry_32.S | 6 arch/x86/include/asm/cpufeatures.h | 4 arch/x86/include/asm/nospec-branch.h | 11 + arch/x86/kernel/apic/apic.c | 14 ++ arch/x86/kernel/cpu/amd.c | 3 arch/x86/kernel/cpu/bugs.c | 32 +++++ arch/x86/kernel/cpu/common.c | 3 arch/x86/kernel/cpu/resctrl/core.c | 4 block/blk-mq.c | 8 - block/blk-rq-qos.c | 2 drivers/block/ublk_drv.c | 11 + drivers/bluetooth/btusb.c | 27 +--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 4 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 22 +-- drivers/gpu/drm/i915/display/intel_dp_mst.c | 40 ++++-- drivers/gpu/drm/radeon/radeon_encoders.c | 2 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 30 ---- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 9 - drivers/gpu/drm/xe/xe_sync.c | 2 drivers/gpu/drm/xe/xe_wait_user_fence.c | 3 drivers/iio/accel/Kconfig | 2 drivers/iio/adc/Kconfig | 9 + drivers/iio/amplifiers/Kconfig | 1 drivers/iio/chemical/Kconfig | 2 drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 2 drivers/iio/dac/Kconfig | 7 + drivers/iio/frequency/Kconfig | 1 drivers/iio/light/Kconfig | 2 drivers/iio/light/opt3001.c | 4 drivers/iio/light/veml6030.c | 5 drivers/iio/magnetometer/Kconfig | 2 drivers/iio/pressure/Kconfig | 3 drivers/iio/proximity/Kconfig | 2 drivers/iio/resolver/Kconfig | 3 drivers/input/joystick/xpad.c | 3 drivers/iommu/intel/iommu.c | 4 drivers/irqchip/irq-gic-v3-its.c | 18 +- drivers/irqchip/irq-sifive-plic.c | 29 ++-- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c | 2 drivers/net/ethernet/cadence/macb_main.c | 14 +- drivers/net/ethernet/freescale/enetc/enetc.c | 56 +++++++-- drivers/net/ethernet/freescale/enetc/enetc.h | 1 drivers/net/ethernet/freescale/fec_ptp.c | 58 ++++----- drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 2 drivers/parport/procfs.c | 22 +-- drivers/pinctrl/intel/pinctrl-intel-platform.c | 3 drivers/pinctrl/nuvoton/pinctrl-ma35.c | 2 drivers/pinctrl/pinctrl-apple-gpio.c | 3 drivers/pinctrl/pinctrl-ocelot.c | 8 - drivers/pinctrl/stm32/pinctrl-stm32.c | 9 + drivers/s390/char/sclp.c | 3 drivers/s390/char/sclp_vt220.c | 4 drivers/scsi/mpi3mr/mpi3mr.h | 4 drivers/scsi/mpi3mr/mpi3mr_transport.c | 42 ++++-- drivers/tty/n_gsm.c | 2 drivers/tty/serial/imx.c | 15 ++ drivers/tty/serial/qcom_geni_serial.c | 91 +++++++-------- drivers/tty/vt/vt.c | 2 drivers/ufs/core/ufs-mcq.c | 15 +- drivers/ufs/core/ufshcd.c | 24 +-- drivers/usb/dwc3/core.c | 19 +++ drivers/usb/dwc3/core.h | 3 drivers/usb/dwc3/gadget.c | 10 - drivers/usb/gadget/function/f_uac2.c | 6 drivers/usb/gadget/udc/dummy_hcd.c | 20 ++- drivers/usb/host/xhci-ring.c | 2 drivers/usb/host/xhci-tegra.c | 2 drivers/usb/host/xhci.h | 2 drivers/usb/serial/option.c | 8 + drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 1 fs/btrfs/tree-log.c | 6 fs/fat/namei_vfat.c | 2 fs/nilfs2/dir.c | 48 ++++--- fs/nilfs2/namei.c | 39 ++++-- fs/nilfs2/nilfs.h | 2 fs/smb/server/mgmt/user_session.c | 26 +++- fs/smb/server/mgmt/user_session.h | 4 fs/smb/server/server.c | 2 fs/smb/server/smb2pdu.c | 8 + include/linux/fsl/enetc_mdio.h | 3 include/linux/irqchip/arm-gic-v4.h | 4 include/trace/events/huge_memory.h | 4 include/uapi/linux/ublk_cmd.h | 8 + io_uring/io_uring.h | 10 + kernel/time/posix-clock.c | 3 kernel/trace/fgraph.c | 28 +++- lib/maple_tree.c | 12 - mm/damon/sysfs-test.h | 1 mm/khugepaged.c | 2 mm/mremap.c | 11 + mm/swapfile.c | 2 mm/vmscan.c | 6 net/bluetooth/af_bluetooth.c | 3 net/bluetooth/iso.c | 6 net/ipv4/tcp_output.c | 4 net/ipv4/udp.c | 4 net/ipv6/udp.c | 4 net/mptcp/mib.c | 1 net/mptcp/mib.h | 1 net/mptcp/pm_netlink.c | 3 net/mptcp/protocol.h | 1 net/mptcp/subflow.c | 11 + sound/pci/hda/patch_conexant.c | 19 +++ sound/usb/mixer_scarlett2.c | 2 tools/testing/selftests/hid/Makefile | 1 tools/testing/selftests/mm/uffd-common.c | 5 tools/testing/selftests/mm/uffd-common.h | 3 tools/testing/selftests/mm/uffd-unit-tests.c | 21 ++- tools/testing/selftests/net/mptcp/mptcp_join.sh | 115 ++++++++++++++----- 121 files changed, 858 insertions(+), 451 deletions(-) Aaron Thompson (3): Bluetooth: Call iso_exit() on module unload Bluetooth: Remove debugfs directory on module init failure Bluetooth: ISO: Fix multiple init when debugfs is disabled Alan Stern (1): USB: gadget: dummy-hcd: Fix "task hung" problem Alex Deucher (2): drm/amdgpu/smu13: always apply the powersave optimization drm/amdgpu/swsmu: Only force workload setup on init Benjamin B. Frost (1): USB: serial: option: add support for Quectel EG916Q-GL Charlie Jenkins (1): irqchip/sifive-plic: Return error code on failure Chris Li (1): mm: vmscan.c: fix OOM on swap stress test Christophe JAILLET (1): iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() Csókás, Bence (2): net: fec: Move `fec_ptp_read()` to the top of the file net: fec: Remove duplicated code Daniele Palmas (1): USB: serial: option: add Telit FN920C04 MBIM compositions Edward Liaw (2): selftests/mm: replace atomic_bool with pthread_barrier_t selftests/mm: fix deadlock for fork after pthread_create on ARM Emil Gedenryd (1): iio: light: opt3001: add missing full-scale range value Greg Kroah-Hartman (1): Linux 6.11.5 Harshit Mogalapalli (1): pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func() Heiko Thiery (2): misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for EEPROM device misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for OTP device Henry Lin (1): xhci: tegra: fix checked USB2 port number Imre Deak (2): drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible mode Jakub Sitnicki (1): udp: Compute L4 checksum as usual when not segmenting the skb Jann Horn (1): mm/mremap: fix move_normal_pmd/retract_page_tables race Javier Carrasco (23): iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: light: veml6030: fix ALS sensor resolution iio: light: veml6030: fix IIO device retrieval from embedded device iio: amplifiers: ada4250: add missing select REGMAP_SPI in Kconfig iio: frequency: adf4377: add missing select REMAP_SPI in Kconfig iio: chemical: ens160: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: light: bu27008: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: magnetometer: af8133j: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: resolver: ad2s1210 add missing select REGMAP in Kconfig iio: pressure: bm1390: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: dac: ad5766: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: dac: ad3552r: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: adc: ti-lmp92064: add missing select REGMAP_SPI in Kconfig iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: resolver: ad2s1210: add missing select (TRIGGERED_)BUFFER in Kconfig iio: adc: ad7944: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: accel: kx022a: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig pinctrl: intel: platform: fix error path in device_for_each_child_node() Jens Axboe (2): io_uring/sqpoll: close race on waiting for sqring entries io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work Jeongjun Park (1): vt: prevent kernel-infoleak in con_font_get() Jim Mattson (1): x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET Jinjie Ruan (3): posix-clock: Fix missing timespec64 check in pc_clock_settime() net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test() mm/damon/tests/sysfs-kunit.h: fix memory leak in damon_sysfs_test_add_targets() Johan Hovold (5): serial: qcom-geni: fix polled console initialisation serial: qcom-geni: revert broken hibernation support serial: qcom-geni: fix shutdown race serial: qcom-geni: fix dma rx cancellation serial: qcom-geni: fix receiver enable Johannes Wikner (4): x86/cpufeatures: Add a IBPB_NO_RET BUG flag x86/entry: Have entry_ibpb() invalidate return predictions x86/bugs: Skip RSB fill at VMEXIT x86/bugs: Do not use UNTRAIN_RET with IBPB on entry John Allen (1): x86/CPU/AMD: Only apply Zenbleed fix for Zen2 during late microcode load John Edwards (1): Input: xpad - add support for MSI Claw A1M Jonathan Marek (1): usb: typec: qcom-pmic-typec: fix sink status being overwritten with RP_DEF Josua Mayer (1): arm64: dts: marvell: cn9130-sr-som: fix cp0 mdio pin numbers Kevin Groeneveld (1): usb: gadget: f_uac2: fix return value for UAC2_ATTRIBUTE_STRING store Liu Shixin (1): mm/swapfile: skip HugeTLB pages for unuse_vma Longlong Xia (1): tty: n_gsm: Fix use-after-free in gsm_cleanup_mux Lorenzo Stoakes (1): maple_tree: correct tree corruption on spanning store Lu Baolu (1): iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices Luiz Augusto von Dentz (2): Bluetooth: btusb: Fix not being able to reconnect after suspend Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 Ma Ke (2): pinctrl: stm32: check devm_kasprintf() returned value pinctrl: apple: check devm_kasprintf() returned value Marc Zyngier (1): irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Marek Vasut (1): serial: imx: Update mctrl old_status on RTSD interrupt Mark Rutland (3): arm64: probes: Remove broken LDR (literal) uprobe support arm64: probes: Fix simulate_ldr*_literal() arm64: probes: Fix uprobes for big-endian kernels Mathias Nyman (2): xhci: Fix incorrect stream context type macro xhci: Mitigate failed set dequeue pointer commands Matthew Auld (1): drm/xe/xe_sync: initialise ufence.signalled Matthieu Baerts (NGI0) (1): mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow Michael Chen (1): drm/amdgpu/mes: fix issue of writing to the same log buffer from 2 MES pipes Michael Mueller (1): KVM: s390: Change virtual to physical address access in diag 0x258 handler Ming Lei (2): blk-mq: setup queue ->tag_set before initializing hctx ublk: don't allow user copy for unprivileged device Mohammed Anees (1): drm/amdgpu: prevent BO_HANDLES error from being overwritten Nam Cao (1): irqchip/sifive-plic: Unmask interrupt in plic_irq_enable() Namjae Jeon (1): ksmbd: fix user-after-free from session log off Nathan Chancellor (1): x86/resctrl: Annotate get_mem_config() functions as __init Nico Boehr (1): KVM: s390: gaccess: Check if guest address is in memslot Nikolay Kuratov (1): drm/vmwgfx: Handle surface check failure correctly Nirmoy Das (1): drm/xe/ufence: ufence can be signaled right after wait_woken OGAWA Hirofumi (1): fat: fix uninitialized variable Oleksij Rempel (1): net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY Omar Sandoval (1): blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race Paolo Abeni (3): selftests: mptcp: join: test for prohibited MPC to port-based endp tcp: fix mptcp DSS corruption due to large pmtu xmit mptcp: prevent MPC handshake on port-based signal endpoints Pawan Gupta (3): x86/entry_32: Do not clobber user EFLAGS.ZF x86/entry_32: Clear CPU buffers after register restore in NMI return x86/bugs: Use code segment selector for VERW operand Peter Wang (2): scsi: ufs: core: Fix the issue of ICU failure scsi: ufs: core: Requeue aborted request Prashanth K (1): usb: dwc3: Wait for EndXfer completion before restoring GUSB2PHYCFG Ranjan Kumar (1): scsi: mpi3mr: Validate SAS port assignments Roger Quadros (1): usb: dwc3: core: Fix system suspend on TI AM62 platforms Roi Martin (2): btrfs: fix uninitialized pointer free in add_inode_ref() btrfs: fix uninitialized pointer free on read_alloc_one_name() error Ryusuke Konishi (1): nilfs2: propagate directory read errors from nilfs_find_entry() Sergey Matsievskiy (1): pinctrl: ocelot: fix system hang on level based interrupts Seunghwan Baek (1): scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down Stefan Kerkmann (1): Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller Steven Rostedt (1): fgraph: Use CPU hotplug mechanism to initialize idle shadow stacks Takashi Iwai (1): parport: Proper fix for array out-of-bounds access Thomas Weißschuh (2): s390/sclp: Deactivate sclp after all its users s390/sclp_vt220: Convert newlines to CRLF instead of LFCR Vasiliy Kovalev (2): ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 Ville Syrjälä (1): drm/radeon: Fix encoder->possible_clones Wei Fang (5): net: enetc: remove xdp_drops statistic from enetc_xdp_drop() net: enetc: block concurrent XDP transmissions during ring reconfiguration net: enetc: disable Tx BD rings after they are empty net: enetc: disable NAPI after all rings are disabled net: enetc: add missing static descriptor and inline keyword Wei Xu (1): mm/mglru: only clear kswapd_failures if reclaimable Yang Shi (1): mm: khugepaged: fix the arguments order in khugepaged_collapse_file trace point Yun Lu (1): selftest: hid: add the missing tests directory Zack Rusin (1): drm/vmwgfx: Cleanup kms setup without 3d Zhang Rui (1): x86/apic: Always explicitly disarm TSC-deadline timer Zhu Jun (1): ALSA: scarlett2: Add error check after retrieving PEQ filter values

6 months

1
1
0 0

Linux 6.6.58

by Greg Kroah-Hartman

I'm announcing the release of the 6.6.58 kernel. All users of the 6.6 kernel series must upgrade. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm64/include/asm/uprobes.h | 8 - arch/arm64/kernel/probes/decode-insn.c | 16 +- arch/arm64/kernel/probes/simulate-insn.c | 18 -- arch/arm64/kernel/probes/uprobes.c | 4 arch/s390/kvm/diag.c | 2 arch/s390/kvm/gaccess.c | 4 arch/s390/kvm/gaccess.h | 14 + arch/x86/entry/entry.S | 5 arch/x86/entry/entry_32.S | 6 arch/x86/include/asm/cpufeatures.h | 4 arch/x86/include/asm/nospec-branch.h | 11 + arch/x86/kernel/apic/apic.c | 14 + arch/x86/kernel/cpu/amd.c | 3 arch/x86/kernel/cpu/bugs.c | 32 ++++ arch/x86/kernel/cpu/common.c | 3 arch/x86/kernel/cpu/resctrl/core.c | 4 block/blk-rq-qos.c | 2 drivers/block/ublk_drv.c | 11 + drivers/bluetooth/btusb.c | 13 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 drivers/gpu/drm/radeon/radeon_encoders.c | 2 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 drivers/iio/accel/Kconfig | 2 drivers/iio/adc/Kconfig | 5 drivers/iio/amplifiers/Kconfig | 1 drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 2 drivers/iio/dac/Kconfig | 7 drivers/iio/frequency/Kconfig | 1 drivers/iio/light/Kconfig | 2 drivers/iio/light/opt3001.c | 4 drivers/iio/light/veml6030.c | 5 drivers/iio/proximity/Kconfig | 2 drivers/input/joystick/xpad.c | 2 drivers/iommu/intel/iommu.c | 4 drivers/irqchip/irq-gic-v3-its.c | 26 ++- drivers/irqchip/irq-sifive-plic.c | 21 +- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c | 2 drivers/net/ethernet/cadence/macb_main.c | 14 + drivers/net/ethernet/freescale/enetc/enetc.c | 56 ++++++- drivers/net/ethernet/freescale/enetc/enetc.h | 1 drivers/net/ethernet/freescale/fec_ptp.c | 58 +++----- drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 2 drivers/parport/procfs.c | 22 +-- drivers/pinctrl/pinctrl-apple-gpio.c | 3 drivers/pinctrl/pinctrl-ocelot.c | 8 - drivers/pinctrl/stm32/pinctrl-stm32.c | 9 - drivers/s390/char/sclp.c | 3 drivers/s390/char/sclp_vt220.c | 4 drivers/tty/n_gsm.c | 2 drivers/tty/serial/imx.c | 15 ++ drivers/tty/serial/qcom_geni_serial.c | 90 +++++------- drivers/tty/vt/vt.c | 2 drivers/ufs/core/ufs-mcq.c | 15 +- drivers/ufs/core/ufshcd.c | 4 drivers/usb/dwc3/gadget.c | 10 - drivers/usb/host/xhci-ring.c | 2 drivers/usb/host/xhci-tegra.c | 2 drivers/usb/host/xhci.h | 2 drivers/usb/serial/option.c | 8 + drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 1 fs/btrfs/tree-log.c | 6 fs/fat/namei_vfat.c | 2 fs/nilfs2/dir.c | 50 +++---- fs/nilfs2/namei.c | 39 +++-- fs/nilfs2/nilfs.h | 2 fs/smb/server/mgmt/user_session.c | 26 ++- fs/smb/server/mgmt/user_session.h | 4 fs/smb/server/server.c | 2 fs/smb/server/smb2pdu.c | 8 - fs/xfs/libxfs/xfs_attr.c | 11 + fs/xfs/libxfs/xfs_attr.h | 4 fs/xfs/libxfs/xfs_attr_leaf.c | 6 fs/xfs/libxfs/xfs_attr_remote.c | 1 fs/xfs/libxfs/xfs_bmap.c | 130 +++++++++++++++--- fs/xfs/libxfs/xfs_da_btree.c | 20 -- fs/xfs/libxfs/xfs_da_format.h | 5 fs/xfs/libxfs/xfs_inode_buf.c | 47 +++++- fs/xfs/libxfs/xfs_sb.c | 7 fs/xfs/scrub/attr.c | 47 +++--- fs/xfs/scrub/common.c | 12 - fs/xfs/scrub/scrub.h | 7 fs/xfs/xfs_aops.c | 54 +------ fs/xfs/xfs_attr_item.c | 98 +++++++++++-- fs/xfs/xfs_attr_list.c | 11 - fs/xfs/xfs_bmap_util.c | 61 +++++--- fs/xfs/xfs_bmap_util.h | 2 fs/xfs/xfs_dquot.c | 1 fs/xfs/xfs_icache.c | 2 fs/xfs/xfs_inode.c | 37 +++-- fs/xfs/xfs_iomap.c | 81 ++++++----- fs/xfs/xfs_reflink.c | 20 -- fs/xfs/xfs_rtalloc.c | 2 include/linux/fsl/enetc_mdio.h | 3 include/linux/irqchip/arm-gic-v4.h | 4 include/uapi/linux/ublk_cmd.h | 8 - io_uring/io_uring.h | 9 + kernel/time/posix-clock.c | 3 lib/maple_tree.c | 12 - mm/mremap.c | 11 + mm/swapfile.c | 2 mm/vmscan.c | 4 net/bluetooth/af_bluetooth.c | 3 net/bluetooth/iso.c | 6 net/ipv4/tcp_output.c | 4 net/mptcp/mib.c | 1 net/mptcp/mib.h | 1 net/mptcp/pm_netlink.c | 3 net/mptcp/protocol.h | 1 net/mptcp/subflow.c | 11 + sound/pci/hda/patch_conexant.c | 19 ++ tools/testing/selftests/hid/Makefile | 1 tools/testing/selftests/mm/uffd-common.c | 5 tools/testing/selftests/mm/uffd-common.h | 3 tools/testing/selftests/mm/uffd-unit-tests.c | 21 ++ tools/testing/selftests/net/mptcp/mptcp_join.sh | 135 +++++++++++++------ tools/testing/selftests/net/mptcp/mptcp_lib.sh | 11 - 118 files changed, 1122 insertions(+), 570 deletions(-) Aaron Thompson (3): Bluetooth: Call iso_exit() on module unload Bluetooth: Remove debugfs directory on module init failure Bluetooth: ISO: Fix multiple init when debugfs is disabled Alex Deucher (1): drm/amdgpu/swsmu: Only force workload setup on init Benjamin B. Frost (1): USB: serial: option: add support for Quectel EG916Q-GL Christoph Hellwig (4): xfs: fix error returns from xfs_bmapi_write xfs: fix xfs_bmap_add_extent_delay_real for partial conversions xfs: remove a racy if_bytes check in xfs_reflink_end_cow_extent xfs: fix freeing speculative preallocations for preallocated files Christophe JAILLET (1): iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() Csókás, Bence (2): net: fec: Move `fec_ptp_read()` to the top of the file net: fec: Remove duplicated code Daniele Palmas (1): USB: serial: option: add Telit FN920C04 MBIM compositions Darrick J. Wong (11): xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log intent item recovery xfs: check opcode and iovec count match in xlog_recover_attri_commit_pass2 xfs: fix missing check for invalid attr flags xfs: check shortform attr entry flags specifically xfs: validate recovered name buffers when recovering xattr items xfs: enforce one namespace per attribute xfs: revert commit 44af6c7e59b12 xfs: use dontcache for grabbing inodes during scrub xfs: allow symlinks with short remote targets xfs: allow unlinked symlinks and dirs with zero size xfs: restrict when we try to align cow fork delalloc to cowextsz hints Dave Chinner (1): xfs: fix unlink vs cluster buffer instantiation race Edward Liaw (2): selftests/mm: replace atomic_bool with pthread_barrier_t selftests/mm: fix deadlock for fork after pthread_create on ARM Emil Gedenryd (1): iio: light: opt3001: add missing full-scale range value Geliang Tang (1): selftests: mptcp: join: change capture/checksum as bool Greg Kroah-Hartman (1): Linux 6.6.58 Heiko Thiery (2): misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for EEPROM device misc: microchip: pci1xxxx: add support for NVMEM_DEVID_AUTO for OTP device Henry Lin (1): xhci: tegra: fix checked USB2 port number Jann Horn (1): mm/mremap: fix move_normal_pmd/retract_page_tables race Javier Carrasco (15): iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: light: veml6030: fix ALS sensor resolution iio: light: veml6030: fix IIO device retrieval from embedded device iio: amplifiers: ada4250: add missing select REGMAP_SPI in Kconfig iio: frequency: adf4377: add missing select REMAP_SPI in Kconfig iio: light: bu27008: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: dac: ad5766: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: dac: ad3552r: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: adc: ti-lmp92064: add missing select REGMAP_SPI in Kconfig iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: accel: kx022a: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig Jens Axboe (1): io_uring/sqpoll: close race on waiting for sqring entries Jeongjun Park (1): vt: prevent kernel-infoleak in con_font_get() Jim Mattson (1): x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET Jinjie Ruan (2): posix-clock: Fix missing timespec64 check in pc_clock_settime() net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test() Johan Hovold (4): serial: qcom-geni: fix polled console initialisation serial: qcom-geni: revert broken hibernation support serial: qcom-geni: fix dma rx cancellation serial: qcom-geni: fix receiver enable Johannes Wikner (4): x86/cpufeatures: Add a IBPB_NO_RET BUG flag x86/entry: Have entry_ibpb() invalidate return predictions x86/bugs: Skip RSB fill at VMEXIT x86/bugs: Do not use UNTRAIN_RET with IBPB on entry John Allen (1): x86/CPU/AMD: Only apply Zenbleed fix for Zen2 during late microcode load John Edwards (1): Input: xpad - add support for MSI Claw A1M Jonathan Marek (1): usb: typec: qcom-pmic-typec: fix sink status being overwritten with RP_DEF Liu Shixin (1): mm/swapfile: skip HugeTLB pages for unuse_vma Longlong Xia (1): tty: n_gsm: Fix use-after-free in gsm_cleanup_mux Lorenzo Stoakes (1): maple_tree: correct tree corruption on spanning store Lu Baolu (1): iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices Luiz Augusto von Dentz (1): Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 Ma Ke (2): pinctrl: stm32: check devm_kasprintf() returned value pinctrl: apple: check devm_kasprintf() returned value Marc Zyngier (1): irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Marek Vasut (1): serial: imx: Update mctrl old_status on RTSD interrupt Mark Rutland (3): arm64: probes: Remove broken LDR (literal) uprobe support arm64: probes: Fix simulate_ldr*_literal() arm64: probes: Fix uprobes for big-endian kernels Mathias Nyman (2): xhci: Fix incorrect stream context type macro xhci: Mitigate failed set dequeue pointer commands Matthieu Baerts (NGI0) (2): mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow selftests: mptcp: remove duplicated variables Michael Mueller (1): KVM: s390: Change virtual to physical address access in diag 0x258 handler Ming Lei (1): ublk: don't allow user copy for unprivileged device Mohammed Anees (1): drm/amdgpu: prevent BO_HANDLES error from being overwritten Nam Cao (1): irqchip/sifive-plic: Unmask interrupt in plic_irq_enable() Namjae Jeon (1): ksmbd: fix user-after-free from session log off Nathan Chancellor (1): x86/resctrl: Annotate get_mem_config() functions as __init Nianyao Tang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 Nico Boehr (1): KVM: s390: gaccess: Check if guest address is in memslot Nikolay Kuratov (1): drm/vmwgfx: Handle surface check failure correctly OGAWA Hirofumi (1): fat: fix uninitialized variable Oleksij Rempel (1): net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY Omar Sandoval (1): blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race Paolo Abeni (3): mptcp: prevent MPC handshake on port-based signal endpoints tcp: fix mptcp DSS corruption due to large pmtu xmit selftests: mptcp: join: test for prohibited MPC to port-based endp Pawan Gupta (3): x86/entry_32: Do not clobber user EFLAGS.ZF x86/entry_32: Clear CPU buffers after register restore in NMI return x86/bugs: Use code segment selector for VERW operand Peter Wang (1): scsi: ufs: core: Fix the issue of ICU failure Prashanth K (1): usb: dwc3: Wait for EndXfer completion before restoring GUSB2PHYCFG Roi Martin (2): btrfs: fix uninitialized pointer free in add_inode_ref() btrfs: fix uninitialized pointer free on read_alloc_one_name() error Ryusuke Konishi (1): nilfs2: propagate directory read errors from nilfs_find_entry() Sergey Matsievskiy (1): pinctrl: ocelot: fix system hang on level based interrupts Seunghwan Baek (1): scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down Takashi Iwai (1): parport: Proper fix for array out-of-bounds access Thomas Weißschuh (2): s390/sclp: Deactivate sclp after all its users s390/sclp_vt220: Convert newlines to CRLF instead of LFCR Vasiliy Kovalev (2): ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 Ville Syrjälä (1): drm/radeon: Fix encoder->possible_clones Wei Fang (5): net: enetc: remove xdp_drops statistic from enetc_xdp_drop() net: enetc: block concurrent XDP transmissions during ring reconfiguration net: enetc: disable Tx BD rings after they are empty net: enetc: disable NAPI after all rings are disabled net: enetc: add missing static descriptor and inline keyword Wei Xu (1): mm/mglru: only clear kswapd_failures if reclaimable Wengang Wang (1): xfs: make sure sb_fdblocks is non-negative Yun Lu (1): selftest: hid: add the missing tests directory Zhang Rui (1): x86/apic: Always explicitly disarm TSC-deadline timer Zhang Yi (4): xfs: match lock mode in xfs_buffered_write_iomap_begin() xfs: make the seq argument to xfs_bmapi_convert_delalloc() optional xfs: make xfs_bmapi_convert_delalloc() to allocate the target offset xfs: convert delayed extents to unwritten when zeroing post eof blocks

6 months

1
1
0 0

Linux 6.1.114

by Greg Kroah-Hartman

I'm announcing the release of the 6.1.114 kernel. All users of the 6.1 kernel series must upgrade. The updated 6.1.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm64/kernel/probes/decode-insn.c | 16 arch/arm64/kernel/probes/simulate-insn.c | 18 arch/s390/kvm/diag.c | 2 arch/s390/kvm/gaccess.c | 4 arch/s390/kvm/gaccess.h | 14 arch/x86/entry/entry.S | 5 arch/x86/entry/entry_32.S | 6 arch/x86/include/asm/cpufeatures.h | 4 arch/x86/kernel/apic/apic.c | 14 arch/x86/kernel/cpu/bugs.c | 32 arch/x86/kernel/cpu/common.c | 3 arch/x86/kernel/cpu/resctrl/core.c | 4 block/blk-rq-qos.c | 2 drivers/bluetooth/btusb.c | 13 drivers/crypto/vmx/Makefile | 12 drivers/crypto/vmx/ppc-xlate.pl | 10 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 drivers/gpu/drm/drm_gem_shmem_helper.c | 3 drivers/gpu/drm/radeon/radeon_encoders.c | 2 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 drivers/iio/adc/Kconfig | 4 drivers/iio/amplifiers/Kconfig | 1 drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 2 drivers/iio/dac/Kconfig | 7 drivers/iio/light/opt3001.c | 4 drivers/iio/light/veml6030.c | 5 drivers/iio/proximity/Kconfig | 2 drivers/iommu/intel/iommu.c | 4 drivers/irqchip/irq-gic-v3-its.c | 26 drivers/irqchip/irq-sifive-plic.c | 21 drivers/net/ethernet/cadence/macb_main.c | 14 drivers/net/ethernet/freescale/enetc/enetc.c | 2 drivers/parport/procfs.c | 22 drivers/pinctrl/pinctrl-apple-gpio.c | 3 drivers/pinctrl/pinctrl-ocelot.c | 8 drivers/s390/char/sclp.c | 3 drivers/s390/char/sclp_vt220.c | 4 drivers/tty/n_gsm.c | 2 drivers/ufs/core/ufshcd.c | 4 drivers/usb/dwc3/gadget.c | 10 drivers/usb/host/xhci-ring.c | 2 drivers/usb/host/xhci.h | 2 drivers/usb/serial/option.c | 8 fs/btrfs/tree-log.c | 6 fs/fat/namei_vfat.c | 2 fs/nilfs2/dir.c | 50 fs/nilfs2/namei.c | 39 fs/nilfs2/nilfs.h | 2 fs/smb/server/mgmt/user_session.c | 26 fs/smb/server/mgmt/user_session.h | 4 fs/smb/server/server.c | 2 fs/smb/server/smb2pdu.c | 8 fs/udf/dir.c | 148 -- fs/udf/directory.c | 570 ++++++++-- fs/udf/inode.c | 90 - fs/udf/namei.c | 1049 ++++++-------------- fs/udf/udfdecl.h | 45 include/linux/fsl/enetc_mdio.h | 3 include/linux/irqchip/arm-gic-v4.h | 4 io_uring/io_uring.h | 9 kernel/time/posix-clock.c | 3 lib/maple_tree.c | 12 mm/swapfile.c | 2 net/bluetooth/af_bluetooth.c | 3 net/bluetooth/iso.c | 6 net/devlink/leftover.c | 40 net/ipv4/tcp_output.c | 4 net/mptcp/mib.c | 1 net/mptcp/mib.h | 1 net/mptcp/pm_netlink.c | 3 net/mptcp/protocol.h | 1 net/mptcp/subflow.c | 11 sound/pci/hda/patch_conexant.c | 19 75 files changed, 1235 insertions(+), 1263 deletions(-) Aaron Thompson (3): Bluetooth: Call iso_exit() on module unload Bluetooth: Remove debugfs directory on module init failure Bluetooth: ISO: Fix multiple init when debugfs is disabled Alex Deucher (1): drm/amdgpu/swsmu: Only force workload setup on init Benjamin B. Frost (1): USB: serial: option: add support for Quectel EG916Q-GL Christophe JAILLET (1): iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() Daniele Palmas (1): USB: serial: option: add Telit FN920C04 MBIM compositions Emil Gedenryd (1): iio: light: opt3001: add missing full-scale range value Greg Kroah-Hartman (1): Linux 6.1.114 Jakub Kicinski (2): devlink: drop the filter argument from devlinks_xa_find_get devlink: bump the instance index directly when iterating Jan Kara (21): udf: New directory iteration code udf: Convert udf_expand_dir_adinicb() to new directory iteration udf: Move udf_expand_dir_adinicb() to its callsite udf: Implement searching for directory entry using new iteration code udf: Provide function to mark entry as deleted using new directory iteration code udf: Convert udf_rename() to new directory iteration code udf: Convert udf_readdir() to new directory iteration udf: Convert udf_lookup() to use new directory iteration code udf: Convert udf_get_parent() to new directory iteration code udf: Convert empty_dir() to new directory iteration code udf: Convert udf_rmdir() to new directory iteration code udf: Convert udf_unlink() to new directory iteration code udf: Implement adding of dir entries using new iteration code udf: Convert udf_add_nondir() to new directory iteration udf: Convert udf_mkdir() to new directory iteration code udf: Convert udf_link() to new directory iteration code udf: Remove old directory iteration code udf: Handle error when expanding directory udf: Don't return bh from udf_expand_dir_adinicb() udf: Allocate name buffer in directory iterator on heap udf: Avoid directory type conversion failure due to ENOMEM Javier Carrasco (11): iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: light: veml6030: fix ALS sensor resolution iio: light: veml6030: fix IIO device retrieval from embedded device iio: amplifiers: ada4250: add missing select REGMAP_SPI in Kconfig iio: dac: ad5766: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: dac: ad3552r: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig Jens Axboe (1): io_uring/sqpoll: close race on waiting for sqring entries Jim Mattson (1): x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET Jinjie Ruan (1): posix-clock: Fix missing timespec64 check in pc_clock_settime() Johannes Wikner (4): x86/cpufeatures: Add a IBPB_NO_RET BUG flag x86/entry: Have entry_ibpb() invalidate return predictions x86/bugs: Skip RSB fill at VMEXIT x86/bugs: Do not use UNTRAIN_RET with IBPB on entry Liu Shixin (1): mm/swapfile: skip HugeTLB pages for unuse_vma Longlong Xia (1): tty: n_gsm: Fix use-after-free in gsm_cleanup_mux Lorenzo Stoakes (1): maple_tree: correct tree corruption on spanning store Lu Baolu (1): iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices Luiz Augusto von Dentz (1): Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 Ma Ke (1): pinctrl: apple: check devm_kasprintf() returned value Marc Zyngier (1): irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Mark Rutland (2): arm64: probes: Remove broken LDR (literal) uprobe support arm64: probes: Fix simulate_ldr*_literal() Mathias Nyman (2): xhci: Fix incorrect stream context type macro xhci: Mitigate failed set dequeue pointer commands Matthieu Baerts (NGI0) (1): mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow Michael Mueller (1): KVM: s390: Change virtual to physical address access in diag 0x258 handler Mohammed Anees (1): drm/amdgpu: prevent BO_HANDLES error from being overwritten Nam Cao (1): irqchip/sifive-plic: Unmask interrupt in plic_irq_enable() Namjae Jeon (1): ksmbd: fix user-after-free from session log off Nathan Chancellor (1): x86/resctrl: Annotate get_mem_config() functions as __init Nianyao Tang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 Nicholas Piggin (1): powerpc/64: Add big-endian ELFv2 flavour to crypto VMX asm generation Nico Boehr (1): KVM: s390: gaccess: Check if guest address is in memslot Nikolay Kuratov (1): drm/vmwgfx: Handle surface check failure correctly OGAWA Hirofumi (1): fat: fix uninitialized variable Oleksij Rempel (1): net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY Omar Sandoval (1): blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race Paolo Abeni (2): tcp: fix mptcp DSS corruption due to large pmtu xmit mptcp: prevent MPC handshake on port-based signal endpoints Pawan Gupta (2): x86/entry_32: Do not clobber user EFLAGS.ZF x86/entry_32: Clear CPU buffers after register restore in NMI return Prashanth K (1): usb: dwc3: Wait for EndXfer completion before restoring GUSB2PHYCFG Roi Martin (2): btrfs: fix uninitialized pointer free in add_inode_ref() btrfs: fix uninitialized pointer free on read_alloc_one_name() error Ryusuke Konishi (1): nilfs2: propagate directory read errors from nilfs_find_entry() Sergey Matsievskiy (1): pinctrl: ocelot: fix system hang on level based interrupts Seunghwan Baek (1): scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down Takashi Iwai (1): parport: Proper fix for array out-of-bounds access Thomas Weißschuh (2): s390/sclp: Deactivate sclp after all its users s390/sclp_vt220: Convert newlines to CRLF instead of LFCR Vasiliy Kovalev (2): ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 Ville Syrjälä (1): drm/radeon: Fix encoder->possible_clones Wachowski, Karol (1): drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) Wei Fang (2): net: enetc: remove xdp_drops statistic from enetc_xdp_drop() net: enetc: add missing static descriptor and inline keyword Zhang Rui (1): x86/apic: Always explicitly disarm TSC-deadline timer

6 months

1
1
0 0

Linux 5.15.169

by Greg Kroah-Hartman

I'm announcing the release of the 5.15.169 kernel. All users of the 5.15 kernel series must upgrade. The updated 5.15.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm64/kernel/probes/decode-insn.c | 16 arch/arm64/kernel/probes/simulate-insn.c | 18 arch/powerpc/mm/numa.c | 6 arch/s390/kvm/diag.c | 2 arch/x86/entry/entry.S | 5 arch/x86/entry/entry_32.S | 6 arch/x86/include/asm/cpufeatures.h | 4 arch/x86/kernel/apic/apic.c | 14 arch/x86/kernel/cpu/bugs.c | 32 arch/x86/kernel/cpu/common.c | 3 arch/x86/kernel/cpu/resctrl/core.c | 4 block/blk-rq-qos.c | 2 drivers/bluetooth/btusb.c | 13 drivers/gpu/drm/drm_gem_shmem_helper.c | 3 drivers/gpu/drm/radeon/radeon_encoders.c | 2 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 drivers/iio/adc/Kconfig | 4 drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 2 drivers/iio/dac/Kconfig | 3 drivers/iio/light/opt3001.c | 4 drivers/iio/light/veml6030.c | 5 drivers/iio/proximity/Kconfig | 2 drivers/iommu/intel/iommu.c | 4 drivers/irqchip/irq-gic-v3-its.c | 26 drivers/md/dm-crypt.c | 37 drivers/net/ethernet/cadence/macb_main.c | 14 drivers/net/ethernet/freescale/enetc/enetc.c | 2 drivers/parport/procfs.c | 22 drivers/pinctrl/pinctrl-ocelot.c | 8 drivers/s390/char/sclp_vt220.c | 4 drivers/usb/host/xhci-ring.c | 2 drivers/usb/host/xhci.h | 2 drivers/usb/serial/option.c | 8 fs/fat/namei_vfat.c | 2 fs/nilfs2/dir.c | 50 fs/nilfs2/namei.c | 39 fs/nilfs2/nilfs.h | 2 fs/udf/dir.c | 148 -- fs/udf/directory.c | 564 +++++++--- fs/udf/inode.c | 90 - fs/udf/namei.c | 1050 ++++++-------------- fs/udf/udfdecl.h | 45 include/linux/fsl/enetc_mdio.h | 3 include/linux/irqchip/arm-gic-v4.h | 4 io_uring/io_uring.c | 21 kernel/time/posix-clock.c | 3 mm/secretmem.c | 4 mm/swapfile.c | 2 net/bluetooth/af_bluetooth.c | 1 net/ipv4/tcp_output.c | 2 net/mac80211/cfg.c | 3 net/mac80211/key.c | 2 net/mptcp/mib.c | 3 net/mptcp/mib.h | 3 net/mptcp/pm_netlink.c | 3 net/mptcp/protocol.c | 23 net/mptcp/protocol.h | 2 net/mptcp/subflow.c | 19 sound/pci/hda/patch_conexant.c | 19 virt/kvm/kvm_main.c | 5 61 files changed, 1162 insertions(+), 1232 deletions(-) Aaron Thompson (1): Bluetooth: Remove debugfs directory on module init failure Aneesh Kumar K.V (1): powerpc/mm: Always update max/min_low_pfn in mem_topology_setup() Benjamin B. Frost (1): USB: serial: option: add support for Quectel EG916Q-GL Breno Leitao (1): KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() Christophe JAILLET (1): iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() Daniele Palmas (1): USB: serial: option: add Telit FN920C04 MBIM compositions Emil Gedenryd (1): iio: light: opt3001: add missing full-scale range value Felix Moessbauer (2): io_uring/sqpoll: do not allow pinning outside of cpuset io_uring/sqpoll: do not put cpumask on stack Geliang Tang (1): mptcp: track and update contiguous data status Greg Kroah-Hartman (1): Linux 5.15.169 Jan Kara (20): udf: New directory iteration code udf: Convert udf_expand_dir_adinicb() to new directory iteration udf: Move udf_expand_dir_adinicb() to its callsite udf: Implement searching for directory entry using new iteration code udf: Provide function to mark entry as deleted using new directory iteration code udf: Convert udf_rename() to new directory iteration code udf: Convert udf_readdir() to new directory iteration udf: Convert udf_lookup() to use new directory iteration code udf: Convert udf_get_parent() to new directory iteration code udf: Convert empty_dir() to new directory iteration code udf: Convert udf_rmdir() to new directory iteration code udf: Convert udf_unlink() to new directory iteration code udf: Implement adding of dir entries using new iteration code udf: Convert udf_add_nondir() to new directory iteration udf: Convert udf_mkdir() to new directory iteration code udf: Convert udf_link() to new directory iteration code udf: Remove old directory iteration code udf: Handle error when expanding directory udf: Don't return bh from udf_expand_dir_adinicb() udf: Fix bogus checksum computation in udf_rename() Javier Carrasco (8): iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: light: veml6030: fix ALS sensor resolution iio: light: veml6030: fix IIO device retrieval from embedded device iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig Jens Axboe (2): io_uring/sqpoll: retain test for whether the CPU is valid io_uring/sqpoll: close race on waiting for sqring entries Jim Mattson (1): x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET Jinjie Ruan (1): posix-clock: Fix missing timespec64 check in pc_clock_settime() Johannes Berg (1): wifi: mac80211: fix potential key use-after-free Johannes Wikner (4): x86/cpufeatures: Add a IBPB_NO_RET BUG flag x86/entry: Have entry_ibpb() invalidate return predictions x86/bugs: Skip RSB fill at VMEXIT x86/bugs: Do not use UNTRAIN_RET with IBPB on entry Liu Shixin (1): mm/swapfile: skip HugeTLB pages for unuse_vma Lu Baolu (1): iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices Luiz Augusto von Dentz (1): Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 Marc Zyngier (1): irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Mark Rutland (2): arm64: probes: Remove broken LDR (literal) uprobe support arm64: probes: Fix simulate_ldr*_literal() Mathias Nyman (2): xhci: Fix incorrect stream context type macro xhci: Mitigate failed set dequeue pointer commands Matthieu Baerts (NGI0) (2): mptcp: fallback when MPTCP opts are dropped after 1st data mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow Michael Mueller (1): KVM: s390: Change virtual to physical address access in diag 0x258 handler Mikulas Patocka (1): dm-crypt, dm-verity: disable tasklets Nathan Chancellor (1): x86/resctrl: Annotate get_mem_config() functions as __init Nianyao Tang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 Nikolay Kuratov (1): drm/vmwgfx: Handle surface check failure correctly OGAWA Hirofumi (1): fat: fix uninitialized variable Oleksij Rempel (1): net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY Omar Sandoval (1): blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race Paolo Abeni (3): mptcp: handle consistently DSS corruption tcp: fix mptcp DSS corruption due to large pmtu xmit mptcp: prevent MPC handshake on port-based signal endpoints Patrick Roy (1): secretmem: disable memfd_secret() if arch cannot set direct map Pawan Gupta (2): x86/entry_32: Do not clobber user EFLAGS.ZF x86/entry_32: Clear CPU buffers after register restore in NMI return Ryusuke Konishi (1): nilfs2: propagate directory read errors from nilfs_find_entry() Sergey Matsievskiy (1): pinctrl: ocelot: fix system hang on level based interrupts Takashi Iwai (1): parport: Proper fix for array out-of-bounds access Thomas Weißschuh (1): s390/sclp_vt220: Convert newlines to CRLF instead of LFCR Vasiliy Kovalev (2): ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 Ville Syrjälä (1): drm/radeon: Fix encoder->possible_clones Wachowski, Karol (1): drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) Wei Fang (2): net: enetc: remove xdp_drops statistic from enetc_xdp_drop() net: enetc: add missing static descriptor and inline keyword Zhang Rui (1): x86/apic: Always explicitly disarm TSC-deadline timer

6 months

1
1
0 0

Linux 5.10.228

by Greg Kroah-Hartman

I'm announcing the release of the 5.10.228 kernel. All users of the 5.10 kernel series must upgrade. The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm64/kernel/probes/decode-insn.c | 16 ++++-- arch/arm64/kernel/probes/simulate-insn.c | 18 ++----- arch/powerpc/mm/numa.c | 6 +- arch/s390/kvm/diag.c | 2 arch/x86/entry/entry.S | 5 ++ arch/x86/entry/entry_32.S | 6 +- arch/x86/include/asm/cpufeatures.h | 5 +- arch/x86/kernel/apic/apic.c | 14 +++++ arch/x86/kernel/cpu/bugs.c | 32 ++++++++++++ arch/x86/kernel/cpu/common.c | 3 + arch/x86/kernel/cpu/resctrl/core.c | 4 - block/blk-rq-qos.c | 2 drivers/bluetooth/btusb.c | 13 +++-- drivers/gpu/drm/radeon/radeon_encoders.c | 2 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 drivers/iio/adc/Kconfig | 4 + drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 2 drivers/iio/dac/Kconfig | 3 + drivers/iio/light/opt3001.c | 4 + drivers/iio/light/veml6030.c | 5 -- drivers/iio/proximity/Kconfig | 2 drivers/irqchip/irq-gic-v3-its.c | 26 +++++++--- drivers/net/ethernet/cadence/macb_main.c | 14 ++++- drivers/parport/procfs.c | 22 ++++---- drivers/s390/char/sclp_vt220.c | 4 - drivers/usb/host/xhci.h | 2 drivers/usb/serial/option.c | 8 +++ fs/fat/namei_vfat.c | 2 fs/nilfs2/dir.c | 50 ++++++++++---------- fs/nilfs2/namei.c | 39 ++++++++++----- fs/nilfs2/nilfs.h | 2 include/linux/fsl/enetc_mdio.h | 3 - include/linux/irqchip/arm-gic-v4.h | 4 + io_uring/io_uring.c | 21 ++++++++ kernel/time/posix-clock.c | 3 + mm/swapfile.c | 2 net/bluetooth/af_bluetooth.c | 1 net/ipv4/tcp_output.c | 2 net/mac80211/cfg.c | 3 + net/mac80211/key.c | 2 net/mptcp/mib.c | 2 net/mptcp/mib.h | 2 net/mptcp/protocol.c | 26 ++++++++-- net/mptcp/protocol.h | 1 net/mptcp/subflow.c | 3 - sound/pci/hda/patch_conexant.c | 19 +++++++ virt/kvm/kvm_main.c | 5 +- 48 files changed, 307 insertions(+), 112 deletions(-) Aaron Thompson (1): Bluetooth: Remove debugfs directory on module init failure Aneesh Kumar K.V (1): powerpc/mm: Always update max/min_low_pfn in mem_topology_setup() Benjamin B. Frost (1): USB: serial: option: add support for Quectel EG916Q-GL Breno Leitao (1): KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() Christophe JAILLET (1): iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() Daniele Palmas (1): USB: serial: option: add Telit FN920C04 MBIM compositions Emil Gedenryd (1): iio: light: opt3001: add missing full-scale range value Felix Moessbauer (2): io_uring/sqpoll: do not allow pinning outside of cpuset io_uring/sqpoll: do not put cpumask on stack Geliang Tang (1): mptcp: track and update contiguous data status Greg Kroah-Hartman (1): Linux 5.10.228 Javier Carrasco (8): iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: light: veml6030: fix ALS sensor resolution iio: light: veml6030: fix IIO device retrieval from embedded device iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig Jens Axboe (2): io_uring/sqpoll: retain test for whether the CPU is valid io_uring/sqpoll: close race on waiting for sqring entries Jim Mattson (1): x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET Jinjie Ruan (1): posix-clock: Fix missing timespec64 check in pc_clock_settime() Johannes Berg (1): wifi: mac80211: fix potential key use-after-free Johannes Wikner (4): x86/cpufeatures: Add a IBPB_NO_RET BUG flag x86/entry: Have entry_ibpb() invalidate return predictions x86/bugs: Skip RSB fill at VMEXIT x86/bugs: Do not use UNTRAIN_RET with IBPB on entry Liu Shixin (1): mm/swapfile: skip HugeTLB pages for unuse_vma Luiz Augusto von Dentz (1): Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 Marc Zyngier (1): irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Mark Rutland (2): arm64: probes: Remove broken LDR (literal) uprobe support arm64: probes: Fix simulate_ldr*_literal() Mathias Nyman (1): xhci: Fix incorrect stream context type macro Michael Mueller (1): KVM: s390: Change virtual to physical address access in diag 0x258 handler Nathan Chancellor (1): x86/resctrl: Annotate get_mem_config() functions as __init Nianyao Tang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 Nikolay Kuratov (1): drm/vmwgfx: Handle surface check failure correctly OGAWA Hirofumi (1): fat: fix uninitialized variable Oleksij Rempel (1): net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY Omar Sandoval (1): blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race Paolo Abeni (2): mptcp: handle consistently DSS corruption tcp: fix mptcp DSS corruption due to large pmtu xmit Pawan Gupta (2): x86/entry_32: Do not clobber user EFLAGS.ZF x86/entry_32: Clear CPU buffers after register restore in NMI return Ryusuke Konishi (1): nilfs2: propagate directory read errors from nilfs_find_entry() Takashi Iwai (1): parport: Proper fix for array out-of-bounds access Thomas Weißschuh (1): s390/sclp_vt220: Convert newlines to CRLF instead of LFCR Vasiliy Kovalev (2): ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2 ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2 Ville Syrjälä (1): drm/radeon: Fix encoder->possible_clones Wei Fang (1): net: enetc: add missing static descriptor and inline keyword Zhang Rui (1): x86/apic: Always explicitly disarm TSC-deadline timer

6 months

1
1
0 0

[PATCH] lib: string_helpers: fix potential snprintf() output truncation

by Bartosz Golaszewski

From: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> The output of ".%03u" with the unsigned int in range [0, 4294966295] may get truncated if the target buffer is not 12 bytes. Fixes: 3c9f3681d0b4 ("[SCSI] lib: add generic helper to print sizes rounded to the correct SI range") Cc: stable(a)vger.kernel.org Reviewed-by: Andy Shevchenko <andy(a)kernel.org> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> --- lib/string_helpers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/string_helpers.c b/lib/string_helpers.c index 4f887aa62fa0..91fa37b5c510 100644 --- a/lib/string_helpers.c +++ b/lib/string_helpers.c @@ -57,7 +57,7 @@ int string_get_size(u64 size, u64 blk_size, const enum string_size_units units, static const unsigned int rounding[] = { 500, 50, 5 }; int i = 0, j; u32 remainder = 0, sf_cap; - char tmp[8]; + char tmp[12]; const char *unit; tmp[0] = '\0'; -- 2.43.0

6 months

6
8
0 0

[PATCH] wifi: cfg80211: clear wdev->cqm_config pointer on free

by Johannes Berg

From: Johannes Berg <johannes.berg(a)intel.com> When we free wdev->cqm_config when unregistering, we also need to clear out the pointer since the same wdev/netdev may get re-registered in another network namespace, then destroyed later, running this code again, which results in a double-free. Reported-by: syzbot+36218cddfd84b5cc263e(a)syzkaller.appspotmail.com Fixes: 37c20b2effe9 ("wifi: cfg80211: fix cqm_config access race") Cc: stable(a)vger.kernel.org # 6.6+ Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> --- net/wireless/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/core.c b/net/wireless/core.c index 4c8d8f167409..d3c7b7978f00 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1280,6 +1280,7 @@ static void _cfg80211_unregister_wdev(struct wireless_dev *wdev, /* deleted from the list, so can't be found from nl80211 any more */ cqm_config = rcu_access_pointer(wdev->cqm_config); kfree_rcu(cqm_config, rcu_head); + RCU_INIT_POINTER(wdev->cqm_config, NULL); /* * Ensure that all events have been processed and -- 2.47.0

6 months

1
0
0 0

[PATCH v4 1/1] dmaengine: dw: Select only supported masters for ACPI devices

by Andy Shevchenko

From: Serge Semin <fancer.lancer(a)gmail.com> The recently submitted fix-commit revealed a problem in the iDMA 32-bit platform code. Even though the controller supported only a single master the dw_dma_acpi_filter() method hard-coded two master interfaces with IDs 0 and 1. As a result the sanity check implemented in the commit b336268dde75 ("dmaengine: dw: Add peripheral bus width verification") got incorrect interface data width and thus prevented the client drivers from configuring the DMA-channel with the EINVAL error returned. E.g., the next error was printed for the PXA2xx SPI controller driver trying to configure the requested channels: > [ 164.525604] pxa2xx_spi_pci 0000:00:07.1: DMA slave config failed > [ 164.536105] pxa2xx_spi_pci 0000:00:07.1: failed to get DMA TX descriptor > [ 164.543213] spidev spi-SPT0001:00: SPI transfer failed: -16 The problem would have been spotted much earlier if the iDMA 32-bit controller supported more than one master interfaces. But since it supports just a single master and the iDMA 32-bit specific code just ignores the master IDs in the CTLLO preparation method, the issue has been gone unnoticed so far. Fix the problem by specifying the default master ID for both memory and peripheral devices in the driver data. Thus the issue noticed for the iDMA 32-bit controllers will be eliminated and the ACPI-probed DW DMA controllers will be configured with the correct master ID by default. Cc: stable(a)vger.kernel.org Fixes: b336268dde75 ("dmaengine: dw: Add peripheral bus width verification") Fixes: 199244d69458 ("dmaengine: dw: add support of iDMA 32-bit hardware") Reported-by: Ferry Toth <fntoth(a)gmail.com> Closes: https://lore.kernel.org/dmaengine/ZuXbCKUs1iOqFu51@black.fi.intel.com/ Reported-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Closes: https://lore.kernel.org/dmaengine/ZuXgI-VcHpMgbZ91@black.fi.intel.com/ Co-developed-by: Serge Semin <fancer.lancer(a)gmail.com> Signed-off-by: Serge Semin <fancer.lancer(a)gmail.com> Tested-by: Ferry Toth <fntoth(a)gmail.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> --- v4: gathered tag (Ferry), left the code as agreed with Serge and Andy drivers/dma/dw/acpi.c | 6 ++++-- drivers/dma/dw/internal.h | 8 ++++++++ drivers/dma/dw/pci.c | 4 ++-- 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/dma/dw/acpi.c b/drivers/dma/dw/acpi.c index c510c109d2c3..b6452fffa657 100644 --- a/drivers/dma/dw/acpi.c +++ b/drivers/dma/dw/acpi.c @@ -8,13 +8,15 @@ static bool dw_dma_acpi_filter(struct dma_chan *chan, void *param) { + struct dw_dma *dw = to_dw_dma(chan->device); + struct dw_dma_chip_pdata *data = dev_get_drvdata(dw->dma.dev); struct acpi_dma_spec *dma_spec = param; struct dw_dma_slave slave = { .dma_dev = dma_spec->dev, .src_id = dma_spec->slave_id, .dst_id = dma_spec->slave_id, - .m_master = 0, - .p_master = 1, + .m_master = data->m_master, + .p_master = data->p_master, }; return dw_dma_filter(chan, &slave); diff --git a/drivers/dma/dw/internal.h b/drivers/dma/dw/internal.h index 563ce73488db..f1bd06a20cd6 100644 --- a/drivers/dma/dw/internal.h +++ b/drivers/dma/dw/internal.h @@ -51,11 +51,15 @@ struct dw_dma_chip_pdata { int (*probe)(struct dw_dma_chip *chip); int (*remove)(struct dw_dma_chip *chip); struct dw_dma_chip *chip; + u8 m_master; + u8 p_master; }; static __maybe_unused const struct dw_dma_chip_pdata dw_dma_chip_pdata = { .probe = dw_dma_probe, .remove = dw_dma_remove, + .m_master = 0, + .p_master = 1, }; static const struct dw_dma_platform_data idma32_pdata = { @@ -72,6 +76,8 @@ static __maybe_unused const struct dw_dma_chip_pdata idma32_chip_pdata = { .pdata = &idma32_pdata, .probe = idma32_dma_probe, .remove = idma32_dma_remove, + .m_master = 0, + .p_master = 0, }; static const struct dw_dma_platform_data xbar_pdata = { @@ -88,6 +94,8 @@ static __maybe_unused const struct dw_dma_chip_pdata xbar_chip_pdata = { .pdata = &xbar_pdata, .probe = idma32_dma_probe, .remove = idma32_dma_remove, + .m_master = 0, + .p_master = 0, }; #endif /* _DMA_DW_INTERNAL_H */ diff --git a/drivers/dma/dw/pci.c b/drivers/dma/dw/pci.c index ad2d4d012cf7..e8a0eb81726a 100644 --- a/drivers/dma/dw/pci.c +++ b/drivers/dma/dw/pci.c @@ -56,10 +56,10 @@ static int dw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *pid) if (ret) return ret; - dw_dma_acpi_controller_register(chip->dw); - pci_set_drvdata(pdev, data); + dw_dma_acpi_controller_register(chip->dw); + return 0; } -- 2.43.0.rc1.1336.g36b5255a03ac

6 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror October 2024