The quilt patch titled
Subject: kcsan: avoid passing -g for test
has been removed from the -mm tree. Its filename was
kcsan-avoid-passing-g-for-test.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Marco Elver <elver(a)google.com>
Subject: kcsan: avoid passing -g for test
Date: Thu, 16 Mar 2023 23:47:05 +0100
Nathan reported that when building with GNU as and a version of clang that
defaults to DWARF5, the assembler will complain with:
Error: non-constant .uleb128 is not supported
This is because `-g` defaults to the compiler debug info default. If the
assembler does not support some of the directives used, the above errors
occur. To fix, remove the explicit passing of `-g`.
All the test wants is that stack traces print valid function names, and
debug info is not required for that. (I currently cannot recall why I
added the explicit `-g`.)
Link: https://lkml.kernel.org/r/20230316224705.709984-2-elver@google.com
Fixes: 1fe84fd4a402 ("kcsan: Add test suite")
Signed-off-by: Marco Elver <elver(a)google.com>
Reported-by: Nathan Chancellor <nathan(a)kernel.org>
Cc: Alexander Potapenko <glider(a)google.com>
Cc: Dmitry Vyukov <dvyukov(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/kernel/kcsan/Makefile~kcsan-avoid-passing-g-for-test
+++ a/kernel/kcsan/Makefile
@@ -16,6 +16,6 @@ obj-y := core.o debugfs.o report.o
KCSAN_INSTRUMENT_BARRIERS_selftest.o := y
obj-$(CONFIG_KCSAN_SELFTEST) += selftest.o
-CFLAGS_kcsan_test.o := $(CFLAGS_KCSAN) -g -fno-omit-frame-pointer
+CFLAGS_kcsan_test.o := $(CFLAGS_KCSAN) -fno-omit-frame-pointer
CFLAGS_kcsan_test.o += $(DISABLE_STRUCTLEAK_PLUGIN)
obj-$(CONFIG_KCSAN_KUNIT_TEST) += kcsan_test.o
_
Patches currently in -mm which might be from elver(a)google.com are
The quilt patch titled
Subject: kfence: avoid passing -g for test
has been removed from the -mm tree. Its filename was
kfence-avoid-passing-g-for-test.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Marco Elver <elver(a)google.com>
Subject: kfence: avoid passing -g for test
Date: Thu, 16 Mar 2023 23:47:04 +0100
Nathan reported that when building with GNU as and a version of clang that
defaults to DWARF5:
$ make -skj"$(nproc)" ARCH=riscv CROSS_COMPILE=riscv64-linux-gnu- \
LLVM=1 LLVM_IAS=0 O=build \
mrproper allmodconfig mm/kfence/kfence_test.o
/tmp/kfence_test-08a0a0.s: Assembler messages:
/tmp/kfence_test-08a0a0.s:14627: Error: non-constant .uleb128 is not supported
/tmp/kfence_test-08a0a0.s:14628: Error: non-constant .uleb128 is not supported
/tmp/kfence_test-08a0a0.s:14632: Error: non-constant .uleb128 is not supported
/tmp/kfence_test-08a0a0.s:14633: Error: non-constant .uleb128 is not supported
/tmp/kfence_test-08a0a0.s:14639: Error: non-constant .uleb128 is not supported
...
This is because `-g` defaults to the compiler debug info default. If the
assembler does not support some of the directives used, the above errors
occur. To fix, remove the explicit passing of `-g`.
All the test wants is that stack traces print valid function names, and
debug info is not required for that. (I currently cannot recall why I
added the explicit `-g`.)
Link: https://lkml.kernel.org/r/20230316224705.709984-1-elver@google.com
Fixes: bc8fbc5f305a ("kfence: add test suite")
Signed-off-by: Marco Elver <elver(a)google.com>
Reported-by: Nathan Chancellor <nathan(a)kernel.org>
Cc: Alexander Potapenko <glider(a)google.com>
Cc: Dmitry Vyukov <dvyukov(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/kfence/Makefile~kfence-avoid-passing-g-for-test
+++ a/mm/kfence/Makefile
@@ -2,5 +2,5 @@
obj-y := core.o report.o
-CFLAGS_kfence_test.o := -g -fno-omit-frame-pointer -fno-optimize-sibling-calls
+CFLAGS_kfence_test.o := -fno-omit-frame-pointer -fno-optimize-sibling-calls
obj-$(CONFIG_KFENCE_KUNIT_TEST) += kfence_test.o
_
Patches currently in -mm which might be from elver(a)google.com are
The quilt patch titled
Subject: mm: kfence: fix using kfence_metadata without initialization in show_object()
has been removed from the -mm tree. Its filename was
mm-kfence-fix-using-kfence_metadata-without-initialization-in-show_object.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Muchun Song <songmuchun(a)bytedance.com>
Subject: mm: kfence: fix using kfence_metadata without initialization in show_object()
Date: Wed, 15 Mar 2023 11:44:41 +0800
The variable kfence_metadata is initialized in kfence_init_pool(), then,
it is not initialized if kfence is disabled after booting. In this case,
kfence_metadata will be used (e.g. ->lock and ->state fields) without
initialization when reading /sys/kernel/debug/kfence/objects. There will
be a warning if you enable CONFIG_DEBUG_SPINLOCK. Fix it by creating
debugfs files when necessary.
Link: https://lkml.kernel.org/r/20230315034441.44321-1-songmuchun@bytedance.com
Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")
Signed-off-by: Muchun Song <songmuchun(a)bytedance.com>
Tested-by: Marco Elver <elver(a)google.com>
Reviewed-by: Marco Elver <elver(a)google.com>
Cc: Alexander Potapenko <glider(a)google.com>
Cc: Dmitry Vyukov <dvyukov(a)google.com>
Cc: Jann Horn <jannh(a)google.com>
Cc: SeongJae Park <sjpark(a)amazon.de>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/kfence/core.c~mm-kfence-fix-using-kfence_metadata-without-initialization-in-show_object
+++ a/mm/kfence/core.c
@@ -726,10 +726,14 @@ static const struct seq_operations objec
};
DEFINE_SEQ_ATTRIBUTE(objects);
-static int __init kfence_debugfs_init(void)
+static int kfence_debugfs_init(void)
{
- struct dentry *kfence_dir = debugfs_create_dir("kfence", NULL);
+ struct dentry *kfence_dir;
+ if (!READ_ONCE(kfence_enabled))
+ return 0;
+
+ kfence_dir = debugfs_create_dir("kfence", NULL);
debugfs_create_file("stats", 0444, kfence_dir, NULL, &stats_fops);
debugfs_create_file("objects", 0400, kfence_dir, NULL, &objects_fops);
return 0;
@@ -883,6 +887,8 @@ static int kfence_init_late(void)
}
kfence_init_enable();
+ kfence_debugfs_init();
+
return 0;
}
_
Patches currently in -mm which might be from songmuchun(a)bytedance.com are
mm-kfence-fix-pg_slab-and-memcg_data-clearing.patch
mm-hugetlb_vmemmap-simplify-hugetlb_vmemmap_init-a-bit.patch
The quilt patch titled
Subject: Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare"
has been removed from the -mm tree. Its filename was
revert-kasan-drop-skip_kasan_poison-variable-in-free_pages_prepare.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Peter Collingbourne <pcc(a)google.com>
Subject: Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare"
Date: Thu, 9 Mar 2023 20:29:13 -0800
This reverts commit 487a32ec24be819e747af8c2ab0d5c515508086a.
should_skip_kasan_poison() reads the PG_skip_kasan_poison flag from
page->flags. However, this line of code in free_pages_prepare():
page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP;
clears most of page->flags, including PG_skip_kasan_poison, before calling
should_skip_kasan_poison(), which meant that it would never return true as
a result of the page flag being set. Therefore, fix the code to call
should_skip_kasan_poison() before clearing the flags, as we were doing
before the reverted patch.
This fixes a measurable performance regression introduced in the reverted
commit, where munmap() takes longer than intended if HW tags KASAN is
supported and enabled at runtime. Without this patch, we see a
single-digit percentage performance regression in a particular
mmap()-heavy benchmark when enabling HW tags KASAN, and with the patch,
there is no statistically significant performance impact when enabling HW
tags KASAN.
Link: https://lkml.kernel.org/r/20230310042914.3805818-2-pcc@google.com
Fixes: 487a32ec24be ("kasan: drop skip_kasan_poison variable in free_pages_prepare")
Link: https://linux-review.googlesource.com/id/Ic4f13affeebd20548758438bb9ed9ca40…
Signed-off-by: Peter Collingbourne <pcc(a)google.com>
Reviewed-by: Andrey Konovalov <andreyknvl(a)gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a(a)gmail.com>
Cc: Catalin Marinas <catalin.marinas(a)arm.com> [arm64]
Cc: Evgenii Stepanov <eugenis(a)google.com>
Cc: Vincenzo Frascino <vincenzo.frascino(a)arm.com>
Cc: Will Deacon <will(a)kernel.org>
Cc: <stable(a)vger.kernel.org> [6.1]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/page_alloc.c~revert-kasan-drop-skip_kasan_poison-variable-in-free_pages_prepare
+++ a/mm/page_alloc.c
@@ -1398,6 +1398,7 @@ static __always_inline bool free_pages_p
unsigned int order, bool check_free, fpi_t fpi_flags)
{
int bad = 0;
+ bool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags);
bool init = want_init_on_free();
VM_BUG_ON_PAGE(PageTail(page), page);
@@ -1470,7 +1471,7 @@ static __always_inline bool free_pages_p
* With hardware tag-based KASAN, memory tags must be set before the
* page becomes unavailable via debug_pagealloc or arch_free_page.
*/
- if (!should_skip_kasan_poison(page, fpi_flags)) {
+ if (!skip_kasan_poison) {
kasan_poison_pages(page, order, init);
/* Memory is already initialized if KASAN did it internally. */
_
Patches currently in -mm which might be from pcc(a)google.com are
kasan-call-clear_page-with-a-match-all-tag-instead-of-changing-page-tag.patch
kasan-remove-pg_skip_kasan_poison-flag.patch
The quilt patch titled
Subject: mm/ksm: fix race with VMA iteration and mm_struct teardown
has been removed from the -mm tree. Its filename was
mm-ksm-fix-race-with-vma-iteration-and-mm_struct-teardown.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com>
Subject: mm/ksm: fix race with VMA iteration and mm_struct teardown
Date: Wed, 8 Mar 2023 17:03:10 -0500
exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held
in write mode. Ensure that the maple tree is still valid by checking
ksm_test_exit() after taking the mmap_lock in read mode, but before the
for_each_vma() iterator dereferences a destroyed maple tree.
Since the maple tree is destroyed, the flags telling lockdep to check an
external lock has been cleared. Skip the for_each_vma() iterator to avoid
dereferencing a maple tree without the external lock flag, which would
create a lockdep warning.
Link: https://lkml.kernel.org/r/20230308220310.3119196-1-Liam.Howlett@oracle.com
Fixes: a5f18ba07276 ("mm/ksm: use vma iterators instead of vma linked list")
Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com>
Reported-by: Pengfei Xu <pengfei.xu(a)intel.com>
Link: https://lore.kernel.org/lkml/ZAdUUhSbaa6fHS36@xpf.sh.intel.com/
Reported-by: syzbot+2ee18845e89ae76342c5(a)syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=64a3e95957cd3deab99df7cd7b5a9475af92c9…
Acked-by: David Hildenbrand <david(a)redhat.com>
Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: <heng.su(a)intel.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/ksm.c~mm-ksm-fix-race-with-vma-iteration-and-mm_struct-teardown
+++ a/mm/ksm.c
@@ -988,9 +988,15 @@ static int unmerge_and_remove_all_rmap_i
mm = mm_slot->slot.mm;
mmap_read_lock(mm);
+
+ /*
+ * Exit right away if mm is exiting to avoid lockdep issue in
+ * the maple tree
+ */
+ if (ksm_test_exit(mm))
+ goto mm_exiting;
+
for_each_vma(vmi, vma) {
- if (ksm_test_exit(mm))
- break;
if (!(vma->vm_flags & VM_MERGEABLE) || !vma->anon_vma)
continue;
err = unmerge_ksm_pages(vma,
@@ -999,6 +1005,7 @@ static int unmerge_and_remove_all_rmap_i
goto error;
}
+mm_exiting:
remove_trailing_rmap_items(&mm_slot->rmap_list);
mmap_read_unlock(mm);
_
Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are
maple_tree-be-more-cautious-about-dead-nodes.patch
maple_tree-detect-dead-nodes-in-mas_start.patch
maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch
maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch
maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode.patch
maple_tree-add-smp_rmb-to-dead-node-detection.patch
maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch
mm-enable-maple-tree-rcu-mode-by-default.patch
The quilt patch titled
Subject: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
has been removed from the -mm tree. Its filename was
nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Subject: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
Date: Tue, 7 Mar 2023 17:55:48 +0900
The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a
metadata array to/from user space, may copy uninitialized buffer regions
to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO
and NILFS_IOCTL_GET_CPINFO.
This can occur when the element size of the user space metadata given by
the v_size member of the argument nilfs_argv structure is larger than the
size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo
structure) on the file system side.
KMSAN-enabled kernels detect this issue as follows:
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
include/linux/instrumented.h:121 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33
instrument_copy_to_user include/linux/instrumented.h:121 [inline]
_copy_to_user+0xc0/0x100 lib/usercopy.c:33
copy_to_user include/linux/uaccess.h:169 [inline]
nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99
nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]
nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290
nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343
__do_compat_sys_ioctl fs/ioctl.c:968 [inline]
__se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910
__ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at:
__alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572
alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287
__get_free_pages+0x34/0xc0 mm/page_alloc.c:5599
nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74
nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]
nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290
nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343
__do_compat_sys_ioctl fs/ioctl.c:968 [inline]
__se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910
__ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Bytes 16-127 of 3968 are uninitialized
...
This eliminates the leak issue by initializing the page allocated as
buffer using get_zeroed_page().
Link: https://lkml.kernel.org/r/20230307085548.6290-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Reported-by: syzbot+132fdd2f1e1805fdc591(a)syzkaller.appspotmail.com
Link: https://lkml.kernel.org/r/000000000000a5bd2d05f63f04ae@google.com
Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/fs/nilfs2/ioctl.c~nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy
+++ a/fs/nilfs2/ioctl.c
@@ -71,7 +71,7 @@ static int nilfs_ioctl_wrap_copy(struct
if (argv->v_index > ~(__u64)0 - argv->v_nmembs)
return -EINVAL;
- buf = (void *)__get_free_pages(GFP_NOFS, 0);
+ buf = (void *)get_zeroed_page(GFP_NOFS);
if (unlikely(!buf))
return -ENOMEM;
maxmembs = PAGE_SIZE / argv->v_size;
_
Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are
The quilt patch titled
Subject: test_maple_tree: add more testing for mas_empty_area()
has been removed from the -mm tree. Its filename was
test_maple_tree-add-more-testing-for-mas_empty_area.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com>
Subject: test_maple_tree: add more testing for mas_empty_area()
Date: Tue, 7 Mar 2023 13:02:47 -0500
Test robust filling of an entire area of the tree, then test one beyond.
This is to test the walking back up the tree at the end of nodes and error
condition. Test inspired by the reproducer code provided by Snild Dolkow.
The last test in the function tests for the case of a corrupted maple
state caused by the incorrect limits set during mas_skip_node(). There
needs to be a gap in the second last child and last child, but the search
must rule out the second last child's gap. This would avoid correcting
the maple state to the correct max limit and return an error.
Link: https://lkml.kernel.org/r/20230307180247.2220303-3-Liam.Howlett@oracle.com
Cc: Snild Dolkow <snild(a)sony.com>
Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.…
Fixes: e15e06a83923 ("lib/test_maple_tree: add testing for maple tree")
Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com>
Cc: Peng Zhang <zhangpeng.00(a)bytedance.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/lib/test_maple_tree.c~test_maple_tree-add-more-testing-for-mas_empty_area
+++ a/lib/test_maple_tree.c
@@ -2670,6 +2670,49 @@ static noinline void check_empty_area_wi
rcu_read_unlock();
}
+static noinline void check_empty_area_fill(struct maple_tree *mt)
+{
+ const unsigned long max = 0x25D78000;
+ unsigned long size;
+ int loop, shift;
+ MA_STATE(mas, mt, 0, 0);
+
+ mt_set_non_kernel(99999);
+ for (shift = 12; shift <= 16; shift++) {
+ loop = 5000;
+ size = 1 << shift;
+ while (loop--) {
+ mas_set(&mas, 0);
+ mas_lock(&mas);
+ MT_BUG_ON(mt, mas_empty_area(&mas, 0, max, size) != 0);
+ MT_BUG_ON(mt, mas.last != mas.index + size - 1);
+ mas_store_gfp(&mas, (void *)size, GFP_KERNEL);
+ mas_unlock(&mas);
+ mas_reset(&mas);
+ }
+ }
+
+ /* No space left. */
+ size = 0x1000;
+ rcu_read_lock();
+ MT_BUG_ON(mt, mas_empty_area(&mas, 0, max, size) != -EBUSY);
+ rcu_read_unlock();
+
+ /* Fill a depth 3 node to the maximum */
+ for (unsigned long i = 629440511; i <= 629440800; i += 6)
+ mtree_store_range(mt, i, i + 5, (void *)i, GFP_KERNEL);
+ /* Make space in the second-last depth 4 node */
+ mtree_erase(mt, 631668735);
+ /* Make space in the last depth 4 node */
+ mtree_erase(mt, 629506047);
+ mas_reset(&mas);
+ /* Search from just after the gap in the second-last depth 4 */
+ rcu_read_lock();
+ MT_BUG_ON(mt, mas_empty_area(&mas, 629506048, 690000000, 0x5000) != 0);
+ rcu_read_unlock();
+ mt_set_non_kernel(0);
+}
+
static DEFINE_MTREE(tree);
static int maple_tree_seed(void)
{
@@ -2926,6 +2969,11 @@ static int maple_tree_seed(void)
check_empty_area_window(&tree);
mtree_destroy(&tree);
+ mt_init_flags(&tree, MT_FLAGS_ALLOC_RANGE);
+ check_empty_area_fill(&tree);
+ mtree_destroy(&tree);
+
+
#if defined(BENCH)
skip:
#endif
_
Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are
maple_tree-be-more-cautious-about-dead-nodes.patch
maple_tree-detect-dead-nodes-in-mas_start.patch
maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch
maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch
maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode.patch
maple_tree-add-smp_rmb-to-dead-node-detection.patch
maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch
mm-enable-maple-tree-rcu-mode-by-default.patch
The quilt patch titled
Subject: maple_tree: fix mas_skip_node() end slot detection
has been removed from the -mm tree. Its filename was
maple_tree-fix-mas_skip_node-end-slot-detection.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com>
Subject: maple_tree: fix mas_skip_node() end slot detection
Date: Tue, 7 Mar 2023 13:02:46 -0500
Patch series "Fix mas_skip_node() for mas_empty_area()", v2.
mas_empty_area() was incorrectly returning an error when there was room.
The issue was tracked down to mas_skip_node() using the incorrect
end-of-slot count. Instead of using the nodes hard limit, the limit of
data should be used.
mas_skip_node() was also setting the min and max to that of the child
node, which was unnecessary. Within these limits being set, there was
also a bug that corrupted the maple state's max if the offset was set to
the maximum node pivot. The bug was without consequence unless there was
a sufficient gap in the next child node which would cause an error to be
returned.
This patch set fixes these errors by removing the limit setting from
mas_skip_node() and uses the mas_data_end() for slot limits, and adds
tests for all failures discovered.
This patch (of 2):
mas_skip_node() is used to move the maple state to the node with a higher
limit. It does this by walking up the tree and increasing the slot count.
Since slot count may not be able to be increased, it may need to walk up
multiple times to find room to walk right to a higher limit node. The
limit of slots that was being used was the node limit and not the last
location of data in the node. This would cause the maple state to be
shifted outside actual data and enter an error state, thus returning
-EBUSY.
The result of the incorrect error state means that mas_awalk() would
return an error instead of finding the allocation space.
The fix is to use mas_data_end() in mas_skip_node() to detect the nodes
data end point and continue walking the tree up until it is safe to move
to a node with a higher limit.
The walk up the tree also sets the maple state limits so remove the buggy
code from mas_skip_node(). Setting the limits had the unfortunate side
effect of triggering another bug if the parent node was full and the there
was no suitable gap in the second last child, but room in the next child.
mas_skip_node() may also be passed a maple state in an error state from
mas_anode_descend() when no allocations are available. Return on such an
error state immediately.
Link: https://lkml.kernel.org/r/20230307180247.2220303-1-Liam.Howlett@oracle.com
Link: https://lkml.kernel.org/r/20230307180247.2220303-2-Liam.Howlett@oracle.com
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com>
Reported-by: Snild Dolkow <snild(a)sony.com>
Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.…
Tested-by: Snild Dolkow <snild(a)sony.com>
Cc: Peng Zhang <zhangpeng.00(a)bytedance.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/lib/maple_tree.c~maple_tree-fix-mas_skip_node-end-slot-detection
+++ a/lib/maple_tree.c
@@ -5099,35 +5099,21 @@ static inline bool mas_rewind_node(struc
*/
static inline bool mas_skip_node(struct ma_state *mas)
{
- unsigned char slot, slot_count;
- unsigned long *pivots;
- enum maple_type mt;
+ if (mas_is_err(mas))
+ return false;
- mt = mte_node_type(mas->node);
- slot_count = mt_slots[mt] - 1;
do {
if (mte_is_root(mas->node)) {
- slot = mas->offset;
- if (slot > slot_count) {
+ if (mas->offset >= mas_data_end(mas)) {
mas_set_err(mas, -EBUSY);
return false;
}
} else {
mas_ascend(mas);
- slot = mas->offset;
- mt = mte_node_type(mas->node);
- slot_count = mt_slots[mt] - 1;
}
- } while (slot > slot_count);
-
- mas->offset = ++slot;
- pivots = ma_pivots(mas_mn(mas), mt);
- if (slot > 0)
- mas->min = pivots[slot - 1] + 1;
-
- if (slot <= slot_count)
- mas->max = pivots[slot];
+ } while (mas->offset >= mas_data_end(mas));
+ mas->offset++;
return true;
}
_
Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are
maple_tree-be-more-cautious-about-dead-nodes.patch
maple_tree-detect-dead-nodes-in-mas_start.patch
maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch
maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch
maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode.patch
maple_tree-add-smp_rmb-to-dead-node-detection.patch
maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch
mm-enable-maple-tree-rcu-mode-by-default.patch
On Tue, Mar 21, 2023 at 10:25 PM Guenter Roeck <linux(a)roeck-us.net> wrote:
>
> On Tue, Mar 21, 2023 at 08:35:34PM +0800, Xi Ruoyao wrote:
> > On Tue, 2023-03-21 at 14:29 +0800, Tiezhu Yang wrote:
> > > We can see the following messages with CONFIG_PROVE_LOCKING=y on
> > > LoongArch:
> > >
> > > BUG: MAX_STACK_TRACE_ENTRIES too low!
> > > turning off the locking correctness validator.
> > >
> > > This is because stack_trace_save() returns a big value after call
> > > arch_stack_walk(), here is the call trace:
> > >
> > > save_trace()
> > > stack_trace_save()
> > > arch_stack_walk()
> > > stack_trace_consume_entry()
> > >
> > > arch_stack_walk() should return immediately if unwind_next_frame()
> > > failed, no need to do the useless loops to increase the value of
> > > c->len in stack_trace_consume_entry(), then we can fix the above
> > > problem.
> > >
> > > Reported-by: Guenter Roeck <linux(a)roeck-us.net>
> > > Link: https://lore.kernel.org/all/8a44ad71-68d2-4926-892f-72bfc7a67e2a@roeck-us.n…
> > > Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn>
> >
> > The fix makes sense, but I'm asking the same question again (sorry if
> > it's noisy): should we Cc stable(a)vger.kernel.org and/or make a PR for
> > 6.3?
> >
> > To me a bug fixes should be backported into all stable branches affected
> > by the bug, unless there is some serious difficulty. As 6.3 release
> > will work on launched 3A5000 boards out-of-box, people may want to stop
> > staying on the leading edge and use a LTS/stable release series. We
> > can't just say (or behave like) "we don't backport, please use latest
> > mainline" IMO :).
>
> It is a bug fix, isn't it ? It should be backported to v6.1+. Otherwise,
> if your policy is to not backport bug fixes, I might as well stop testing
> loongarch on all but the most recent kernel branch. Let me know if this is
> what you want. If so, I think you should let all other regression testers
> know that they should only test loongarch on mainline and possibly on
> linux-next.
This is of course a bug fix, but should Tiezhu resend this patch? Or
just replying to this message with CC stable(a)vger.kernel.org is
enough?
Huacai
>
> Thanks,
> Guenter
From: Dean Luick <dean.luick(a)cornelisnetworks.com>
[ Upstream commit 892ede5a77f337831609fb9c248ac60948061894 ]
Fix possible RMT overflow: Use the correct netdev size.
Don't allow adjusted user contexts to go negative.
Fix QOS calculation: Send kernel context count as an argument since
dd->n_krcv_queues is not yet set up in earliest call. Do not include
the control context in the QOS calculation. Use the same sized
variable to find the max of krcvq[] entries.
Update the RMT count explanation to make more sense.
Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com>
Link: https://lore.kernel.org/r/167329106946.1472990.18385495251650939054.stgit@a…
Signed-off-by: Leon Romanovsky <leon(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/infiniband/hw/hfi1/chip.c | 59 +++++++++++++++++--------------
1 file changed, 32 insertions(+), 27 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index ebe970f76232d..90b672feed83d 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -1056,7 +1056,7 @@ static void read_link_down_reason(struct hfi1_devdata *dd, u8 *ldr);
static void handle_temp_err(struct hfi1_devdata *dd);
static void dc_shutdown(struct hfi1_devdata *dd);
static void dc_start(struct hfi1_devdata *dd);
-static int qos_rmt_entries(struct hfi1_devdata *dd, unsigned int *mp,
+static int qos_rmt_entries(unsigned int n_krcv_queues, unsigned int *mp,
unsigned int *np);
static void clear_full_mgmt_pkey(struct hfi1_pportdata *ppd);
static int wait_link_transfer_active(struct hfi1_devdata *dd, int wait_ms);
@@ -13362,7 +13362,6 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
int ret;
unsigned ngroups;
int rmt_count;
- int user_rmt_reduced;
u32 n_usr_ctxts;
u32 send_contexts = chip_send_contexts(dd);
u32 rcv_contexts = chip_rcv_contexts(dd);
@@ -13421,28 +13420,34 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
(num_kernel_contexts + n_usr_ctxts),
&node_affinity.real_cpu_mask);
/*
- * The RMT entries are currently allocated as shown below:
- * 1. QOS (0 to 128 entries);
- * 2. FECN (num_kernel_context - 1 + num_user_contexts +
- * num_netdev_contexts);
- * 3. netdev (num_netdev_contexts).
- * It should be noted that FECN oversubscribe num_netdev_contexts
- * entries of RMT because both netdev and PSM could allocate any receive
- * context between dd->first_dyn_alloc_text and dd->num_rcv_contexts,
- * and PSM FECN must reserve an RMT entry for each possible PSM receive
- * context.
+ * RMT entries are allocated as follows:
+ * 1. QOS (0 to 128 entries)
+ * 2. FECN (num_kernel_context - 1 [a] + num_user_contexts +
+ * num_netdev_contexts [b])
+ * 3. netdev (NUM_NETDEV_MAP_ENTRIES)
+ *
+ * Notes:
+ * [a] Kernel contexts (except control) are included in FECN if kernel
+ * TID_RDMA is active.
+ * [b] Netdev and user contexts are randomly allocated from the same
+ * context pool, so FECN must cover all contexts in the pool.
*/
- rmt_count = qos_rmt_entries(dd, NULL, NULL) + (num_netdev_contexts * 2);
- if (HFI1_CAP_IS_KSET(TID_RDMA))
- rmt_count += num_kernel_contexts - 1;
- if (rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) {
- user_rmt_reduced = NUM_MAP_ENTRIES - rmt_count;
- dd_dev_err(dd,
- "RMT size is reducing the number of user receive contexts from %u to %d\n",
- n_usr_ctxts,
- user_rmt_reduced);
- /* recalculate */
- n_usr_ctxts = user_rmt_reduced;
+ rmt_count = qos_rmt_entries(num_kernel_contexts - 1, NULL, NULL)
+ + (HFI1_CAP_IS_KSET(TID_RDMA) ? num_kernel_contexts - 1
+ : 0)
+ + n_usr_ctxts
+ + num_netdev_contexts
+ + NUM_NETDEV_MAP_ENTRIES;
+ if (rmt_count > NUM_MAP_ENTRIES) {
+ int over = rmt_count - NUM_MAP_ENTRIES;
+ /* try to squish user contexts, minimum of 1 */
+ if (over >= n_usr_ctxts) {
+ dd_dev_err(dd, "RMT overflow: reduce the requested number of contexts\n");
+ return -EINVAL;
+ }
+ dd_dev_err(dd, "RMT overflow: reducing # user contexts from %u to %u\n",
+ n_usr_ctxts, n_usr_ctxts - over);
+ n_usr_ctxts -= over;
}
/* the first N are kernel contexts, the rest are user/netdev contexts */
@@ -14299,15 +14304,15 @@ static void clear_rsm_rule(struct hfi1_devdata *dd, u8 rule_index)
}
/* return the number of RSM map table entries that will be used for QOS */
-static int qos_rmt_entries(struct hfi1_devdata *dd, unsigned int *mp,
+static int qos_rmt_entries(unsigned int n_krcv_queues, unsigned int *mp,
unsigned int *np)
{
int i;
unsigned int m, n;
- u8 max_by_vl = 0;
+ uint max_by_vl = 0;
/* is QOS active at all? */
- if (dd->n_krcv_queues <= MIN_KERNEL_KCTXTS ||
+ if (n_krcv_queues < MIN_KERNEL_KCTXTS ||
num_vls == 1 ||
krcvqsset <= 1)
goto no_qos;
@@ -14365,7 +14370,7 @@ static void init_qos(struct hfi1_devdata *dd, struct rsm_map_table *rmt)
if (!rmt)
goto bail;
- rmt_entries = qos_rmt_entries(dd, &m, &n);
+ rmt_entries = qos_rmt_entries(dd->n_krcv_queues - 1, &m, &n);
if (rmt_entries == 0)
goto bail;
qpns_per_vl = 1 << m;
--
2.39.2
[Public]
Hi,
The commit "Remove OTG DIV register write for Virtual" was CC to stable but failed to apply 6.2.y and 6.1.y due to some small missing dependencies.
Here is the series of commits for 6.2.y needed:
3b214bb7185d ("drm/amd/display: fix k1 k2 divider programming for phantom streams")
709671ffb15d ("drm/amd/display: Remove OTG DIV register write for Virtual signals.")
Here is the series of commits for 6.1.y needed:
368307cef69c ("drm/amd/display: Include virtual signal to set k1 and k2 values")
3b214bb7185d ("drm/amd/display: fix k1 k2 divider programming for phantom streams")
709671ffb15d ("drm/amd/display: Remove OTG DIV register write for Virtual signals.")
Can you please apply for a future stable release?
Thanks!
From: NeilBrown <neilb(a)suse.de>
[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
slot_store() uses kstrtouint() to get a slot number, but stores the
result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is
very large.
A negative number means that the slot is empty, but setting a negative
slot number this way will not remove the device from the array. I don't
think this is a serious problem, but it could cause confusion and it is
best to fix it.
Reported-by: Dan Carpenter <error27(a)gmail.com>
Signed-off-by: NeilBrown <neilb(a)suse.de>
Signed-off-by: Song Liu <song(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/md/md.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 880a0ebca8660..69d1501d9160e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2967,6 +2967,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
err = kstrtouint(buf, 10, (unsigned int *)&slot);
if (err < 0)
return err;
+ if (slot < 0)
+ /* overflow */
+ return -ENOSPC;
}
if (rdev->mddev->pers && slot == -1) {
/* Setting 'slot' on an active array requires also
--
2.39.2
From: NeilBrown <neilb(a)suse.de>
[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
slot_store() uses kstrtouint() to get a slot number, but stores the
result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is
very large.
A negative number means that the slot is empty, but setting a negative
slot number this way will not remove the device from the array. I don't
think this is a serious problem, but it could cause confusion and it is
best to fix it.
Reported-by: Dan Carpenter <error27(a)gmail.com>
Signed-off-by: NeilBrown <neilb(a)suse.de>
Signed-off-by: Song Liu <song(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/md/md.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index aa2993d5d5d38..64558991ce0a0 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3082,6 +3082,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
err = kstrtouint(buf, 10, (unsigned int *)&slot);
if (err < 0)
return err;
+ if (slot < 0)
+ /* overflow */
+ return -ENOSPC;
}
if (rdev->mddev->pers && slot == -1) {
/* Setting 'slot' on an active array requires also
--
2.39.2
From: NeilBrown <neilb(a)suse.de>
[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
slot_store() uses kstrtouint() to get a slot number, but stores the
result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is
very large.
A negative number means that the slot is empty, but setting a negative
slot number this way will not remove the device from the array. I don't
think this is a serious problem, but it could cause confusion and it is
best to fix it.
Reported-by: Dan Carpenter <error27(a)gmail.com>
Signed-off-by: NeilBrown <neilb(a)suse.de>
Signed-off-by: Song Liu <song(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/md/md.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c0b34637bd667..1553c2495841b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3207,6 +3207,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
err = kstrtouint(buf, 10, (unsigned int *)&slot);
if (err < 0)
return err;
+ if (slot < 0)
+ /* overflow */
+ return -ENOSPC;
}
if (rdev->mddev->pers && slot == -1) {
/* Setting 'slot' on an active array requires also
--
2.39.2
Could we please get:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
'net: retrieve netns cookie via getsocketopt'
included in 5.10 LTS.
This is technically a feature, but it's absolutely trivial - it just
adds a new getsockopt to fetch a u64.
Using netns cookies from bpf without it is pretty annoying.
It doesn't cherrypick to 5.10 cleanly, due to trivial conflicts in
header files (previous constants haven't yet been defined),
and because of a post 5.10 change from atomic64_t to u64 - which
requires adding in an atomic_read(&).
I've uploaded a compiling version to:
https://android-review.googlesource.com/c/kernel/common/+/2503056
I think you should be able to cherrypick it via:
git fetch https://android.googlesource.com/kernel/common
refs/changes/56/2503056/2 && git cherry-pick FETCH_HEAD
Thanks!
Maciej Żenczykowski, Kernel Networking Developer @ Google
I'm announcing the release of the 5.4.238 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/filesystems/vfs.rst | 2 -
Makefile | 2 -
arch/s390/boot/ipl_report.c | 8 ++++
arch/x86/kvm/vmx/nested.c | 10 ++++-
arch/x86/mm/mem_encrypt_identity.c | 3 +
drivers/block/sunvdc.c | 2 +
drivers/clk/Kconfig | 2 -
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +---
drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 5 +-
drivers/gpu/drm/meson/meson_vpp.c | 2 +
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 -
drivers/hid/hid-core.c | 18 ++++++---
drivers/hid/uhid.c | 1
drivers/hwmon/adt7475.c | 8 ++--
drivers/hwmon/ina3221.c | 2 -
drivers/hwmon/xgene-hwmon.c | 1
drivers/interconnect/core.c | 4 ++
drivers/media/i2c/m5mols/m5mols_core.c | 2 -
drivers/mmc/host/atmel-mci.c | 3 -
drivers/net/ethernet/intel/i40e/i40e_main.c | 1
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 ++
drivers/net/ethernet/sun/ldmvsw.c | 3 +
drivers/net/ethernet/sun/sunvnet.c | 3 +
drivers/net/ipvlan/ipvlan_l3s.c | 1
drivers/net/phy/smsc.c | 5 ++
drivers/net/usb/smsc75xx.c | 7 +++
drivers/nfc/pn533/usb.c | 1
drivers/nfc/st-nci/ndlc.c | 6 ++-
drivers/nvme/target/core.c | 4 +-
drivers/pci/pci-driver.c | 4 +-
drivers/pci/pci.c | 54 ++++++++++++----------------
drivers/pci/pci.h | 10 ++++-
drivers/scsi/hosts.c | 5 --
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++-
drivers/tty/serial/8250/8250_em.c | 4 +-
drivers/tty/serial/fsl_lpuart.c | 12 ++++--
drivers/video/fbdev/stifb.c | 27 ++++++++++++++
fs/cifs/transport.c | 21 ++++------
fs/ext4/inode.c | 18 ++++-----
fs/ext4/namei.c | 4 --
fs/ext4/page-io.c | 10 +++--
fs/ext4/xattr.c | 11 +++++
fs/jffs2/file.c | 15 +++----
include/linux/hid.h | 3 +
include/linux/netdevice.h | 6 ++-
include/linux/sh_intc.h | 5 ++
include/linux/tracepoint.h | 15 +++----
kernel/trace/ftrace.c | 3 +
kernel/trace/trace_events_hist.c | 3 +
net/ipv4/fib_frontend.c | 3 +
net/ipv4/ip_tunnel.c | 12 +++---
net/ipv4/tcp_output.c | 2 -
net/ipv6/ip6_tunnel.c | 4 +-
net/iucv/iucv.c | 2 -
net/netfilter/nft_redir.c | 2 -
net/xfrm/xfrm_state.c | 3 -
sound/pci/hda/hda_intel.c | 22 ++++++++++-
sound/pci/hda/patch_hdmi.c | 3 +
58 files changed, 276 insertions(+), 143 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Bart Van Assche (1):
scsi: core: Fix a procfs host directory removal regression
Biju Das (1):
serial: 8250_em: Fix UART port type
Bjorn Helgaas (1):
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Christian Hewitt (1):
drm/meson: fix 1px pink line on GXM when scaling video overlay
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Dmitry Osipenko (1):
drm/panfrost: Don't sync rpm suspension after mmu flushing
Eric Biggers (1):
ext4: fix cgroup writeback accounting with fs-layer encryption
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Glenn Washburn (1):
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Greg Kroah-Hartman (1):
Linux 5.4.238
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Herbert Xu (1):
xfrm: Allow transport-mode states with AF_UNSPEC selector
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
Ivan Vecera (1):
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jeremy Sowden (1):
netfilter: nft_redir: correct value of inet type `.maxattrs`
Jianguo Wu (1):
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Johan Hovold (1):
interconnect: fix mem leak when freeing nodes
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Kai Vehmanen (4):
ALSA: hda - add Intel DG1 PCI and HDMI ids
ALSA: hda - controller is in GPU on the DG1
ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Lukas Wunner (1):
PCI: Unify delay handling for reset and resume
Marcus Folkesson (1):
hwmon: (ina3221) return prober error code
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Nikita Zhandarovich (1):
x86/mm: Fix use of uninitialized buffer in sme_enable()
Paolo Bonzini (1):
KVM: nVMX: add missing consistency checks for CR0 and CR4
Qu Huang (1):
drm/amdkfd: Fix an illegal memory access
Randy Dunlap (1):
clk: HI655X: select REGMAP instead of depending on it
Sherry Sun (1):
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Steven Rostedt (Google) (2):
tracing: Check field value in hist_field_name()
tracing: Make tracepoint lockdep check actually test something
Sven Schnelle (1):
s390/ipl: add missing intersection check to ipl_report handling
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Theodore Ts'o (1):
ext4: fix possible double unlock when moving a directory
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Wenchao Hao (1):
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Xiang Chen (1):
scsi: core: Fix a comment in function scsi_host_dev_release()
Yifei Liu (1):
jffs2: correct logic when creating a hole in jffs2_write_begin
Zhang Xiaoxu (1):
cifs: Move the in_send statistic to __smb_send_rqst()
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
I'm announcing the release of the 4.19.279 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/x86/mm/mem_encrypt_identity.c | 3 ++-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +++------
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/jffs2/file.c | 15 +++++++--------
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
include/linux/tracepoint.h | 15 ++++++---------
kernel/trace/ftrace.c | 3 ++-
kernel/trace/trace_events_hist.c | 3 +++
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
38 files changed, 159 insertions(+), 77 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Biju Das (1):
serial: 8250_em: Fix UART port type
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Eric Biggers (2):
ext4: fix cgroup writeback accounting with fs-layer encryption
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Greg Kroah-Hartman (1):
Linux 4.19.279
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Nikita Zhandarovich (1):
x86/mm: Fix use of uninitialized buffer in sme_enable()
Qu Huang (1):
drm/amdkfd: Fix an illegal memory access
Randy Dunlap (1):
clk: HI655X: select REGMAP instead of depending on it
Steven Rostedt (Google) (2):
tracing: Check field value in hist_field_name()
tracing: Make tracepoint lockdep check actually test something
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Yifei Liu (1):
jffs2: correct logic when creating a hole in jffs2_write_begin
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
I'm announcing the release of the 4.14.311 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/block/sunvdc.c | 2 ++
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
kernel/trace/ftrace.c | 3 ++-
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
32 files changed, 137 insertions(+), 52 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Biju Das (1):
serial: 8250_em: Fix UART port type
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Eric Biggers (2):
ext4: fix cgroup writeback accounting with fs-layer encryption
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Greg Kroah-Hartman (1):
Linux 4.14.311
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: b15888840207c2bfe678dd1f68a32db54315e71f
Gitweb: https://git.kernel.org/tip/b15888840207c2bfe678dd1f68a32db54315e71f
Author: Chang S. Bae <chang.seok.bae(a)intel.com>
AuthorDate: Mon, 27 Feb 2023 13:05:03 -08:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Wed, 22 Mar 2023 10:59:13 -07:00
x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf()
__copy_xstate_to_uabi_buf() copies either from the tasks XSAVE buffer
or from init_fpstate into the ptrace buffer. Dynamic features, like
XTILEDATA, have an all zeroes init state and are not saved in
init_fpstate, which means the corresponding bit is not set in the
xfeatures bitmap of the init_fpstate header.
But __copy_xstate_to_uabi_buf() retrieves addresses for both the tasks
xstate and init_fpstate unconditionally via __raw_xsave_addr().
So if the tasks XSAVE buffer has a dynamic feature set, then the
address retrieval for init_fpstate triggers the warning in
__raw_xsave_addr() which checks the feature bit in the init_fpstate
header.
Remove the address retrieval from init_fpstate for extended features.
They have an all zeroes init state so init_fpstate has zeros for them.
Then zeroing the user buffer for the init state is the same as copying
them from init_fpstate.
Fixes: 2308ee57d93d ("x86/fpu/amx: Enable the AMX feature in 64-bit mode")
Reported-by: Mingwei Zhang <mizhang(a)google.com>
Link: https://lore.kernel.org/kvm/20230221163655.920289-2-mizhang@google.com/
Signed-off-by: Chang S. Bae <chang.seok.bae(a)intel.com>
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Tested-by: Mingwei Zhang <mizhang(a)google.com>
Link: https://lore.kernel.org/all/20230227210504.18520-2-chang.seok.bae%40intel.c…
Cc: stable(a)vger.kernel.org
---
arch/x86/kernel/fpu/xstate.c | 30 ++++++++++++++----------------
1 file changed, 14 insertions(+), 16 deletions(-)
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 714166c..0bab497 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1118,21 +1118,20 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
zerofrom = offsetof(struct xregs_state, extended_state_area);
/*
- * The ptrace buffer is in non-compacted XSAVE format. In
- * non-compacted format disabled features still occupy state space,
- * but there is no state to copy from in the compacted
- * init_fpstate. The gap tracking will zero these states.
- */
- mask = fpstate->user_xfeatures;
-
- /*
- * Dynamic features are not present in init_fpstate. When they are
- * in an all zeros init state, remove those from 'mask' to zero
- * those features in the user buffer instead of retrieving them
- * from init_fpstate.
+ * This 'mask' indicates which states to copy from fpstate.
+ * Those extended states that are not present in fpstate are
+ * either disabled or initialized:
+ *
+ * In non-compacted format, disabled features still occupy
+ * state space but there is no state to copy from in the
+ * compacted init_fpstate. The gap tracking will zero these
+ * states.
+ *
+ * The extended features have an all zeroes init state. Thus,
+ * remove them from 'mask' to zero those features in the user
+ * buffer instead of retrieving them from init_fpstate.
*/
- if (fpu_state_size_dynamic())
- mask &= (header.xfeatures | xinit->header.xcomp_bv);
+ mask = header.xfeatures;
for_each_extended_xfeature(i, mask) {
/*
@@ -1151,9 +1150,8 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
pkru.pkru = pkru_val;
membuf_write(&to, &pkru, sizeof(pkru));
} else {
- copy_feature(header.xfeatures & BIT_ULL(i), &to,
+ membuf_write(&to,
__raw_xsave_addr(xsave, i),
- __raw_xsave_addr(xinit, i),
xstate_sizes[i]);
}
/*
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: a3f547addcaa10df5a226526bc9e2d9a94542344
Gitweb: https://git.kernel.org/tip/a3f547addcaa10df5a226526bc9e2d9a94542344
Author: Michal Koutný <mkoutny(a)suse.com>
AuthorDate: Mon, 06 Mar 2023 20:31:44 +01:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Wed, 22 Mar 2023 10:42:47 -07:00
x86/mm: Do not shuffle CPU entry areas without KASLR
The commit 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area") fixed
an omission of KASLR on CPU entry areas. It doesn't take into account
KASLR switches though, which may result in unintended non-determinism
when a user wants to avoid it (e.g. debugging, benchmarking).
Generate only a single combination of CPU entry areas offsets -- the
linear array that existed prior randomization when KASLR is turned off.
Since we have 3f148f331814 ("x86/kasan: Map shadow for percpu pages on
demand") and followups, we can use the more relaxed guard
kasrl_enabled() (in contrast to kaslr_memory_enabled()).
Fixes: 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area")
Signed-off-by: Michal Koutný <mkoutny(a)suse.com>
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/all/20230306193144.24605-1-mkoutny%40suse.com
---
arch/x86/mm/cpu_entry_area.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c
index 7316a82..e91500a 100644
--- a/arch/x86/mm/cpu_entry_area.c
+++ b/arch/x86/mm/cpu_entry_area.c
@@ -10,6 +10,7 @@
#include <asm/fixmap.h>
#include <asm/desc.h>
#include <asm/kasan.h>
+#include <asm/setup.h>
static DEFINE_PER_CPU_PAGE_ALIGNED(struct entry_stack_page, entry_stack_storage);
@@ -29,6 +30,12 @@ static __init void init_cea_offsets(void)
unsigned int max_cea;
unsigned int i, j;
+ if (!kaslr_enabled()) {
+ for_each_possible_cpu(i)
+ per_cpu(_cea_offset, i) = i;
+ return;
+ }
+
max_cea = (CPU_ENTRY_AREA_MAP_SIZE - PAGE_SIZE) / CPU_ENTRY_AREA_SIZE;
/* O(sodding terrible) */
From: Matheus Castello <matheus.castello(a)toradex.com>
Returns EPROBE_DEFER when of_drm_find_bridge() fails, this is consistent
with what all the other DRM bridge drivers are doing and this is
required since the bridge might not be there when the driver is probed
and this should not be a fatal failure.
Cc: <stable(a)vger.kernel.org>
Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
Signed-off-by: Matheus Castello <matheus.castello(a)toradex.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini(a)toradex.com>
---
v2: use dev_err_probe() instead of dev_dbg() (Laurent)
---
drivers/gpu/drm/bridge/lontium-lt8912b.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
index 2019a8167d69..b40baced1331 100644
--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
+++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
@@ -676,8 +676,8 @@ static int lt8912_parse_dt(struct lt8912 *lt)
lt->hdmi_port = of_drm_find_bridge(port_node);
if (!lt->hdmi_port) {
- dev_err(lt->dev, "%s: Failed to get hdmi port\n", __func__);
- ret = -ENODEV;
+ ret = -EPROBE_DEFER;
+ dev_err_probe(lt->dev, ret, "%s: Failed to get hdmi port\n", __func__);
goto err_free_host_node;
}
--
2.25.1
From: Matheus Castello <matheus.castello(a)toradex.com>
Returns EPROBE_DEFER when of_drm_find_bridge() fails, this is consistent
with what all the other DRM bridge drivers are doing and this is
required since the bridge might not be there when the driver is probed
and this should not be a fatal failure.
Cc: <stable(a)vger.kernel.org>
Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
Signed-off-by: Matheus Castello <matheus.castello(a)toradex.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini(a)toradex.com>
---
drivers/gpu/drm/bridge/lontium-lt8912b.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
index 2019a8167d69..fec02e47cfdb 100644
--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
+++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
@@ -676,8 +676,8 @@ static int lt8912_parse_dt(struct lt8912 *lt)
lt->hdmi_port = of_drm_find_bridge(port_node);
if (!lt->hdmi_port) {
- dev_err(lt->dev, "%s: Failed to get hdmi port\n", __func__);
- ret = -ENODEV;
+ dev_dbg(lt->dev, "%s: Failed to get hdmi port\n", __func__);
+ ret = -EPROBE_DEFER;
goto err_free_host_node;
}
--
2.25.1
This is the start of the stable review cycle for the 4.19.278 release.
There are 27 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 18 Mar 2023 09:41:20 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.278-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.278-rc3
Eric Dumazet <edumazet(a)google.com>
ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
Kang Chen <void0red(a)gmail.com>
nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
Shigeru Yoshida <syoshida(a)redhat.com>
net: caif: Fix use-after-free in cfusbl_device_notify()
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use BAR mappings for ring buffers with LLC
Tung Nguyen <tung.q.nguyen(a)dektech.com.au>
tipc: improve function tipc_wait_for_cond()
Paul Elder <paul.elder(a)ideasonboard.com>
media: ov5640: Fix analogue gain control
Alvaro Karsz <alvaro.karsz(a)solid-run.com>
PCI: Add SolidRun vendor ID
Nathan Chancellor <nathan(a)kernel.org>
macintosh: windfarm: Use unsigned type for 1-bit bitfields
Edward Humes <aurxenon(a)lunos.org>
alpha: fix R_ALPHA_LITERAL reloc for large modules
xurui <xurui(a)kylinos.cn>
MIPS: Fix a compilation issue
Nobuhiro Iwamatsu <nobuhiro1.iwamatsu(a)toshiba.co.jp>
Revert "spi: mt7621: Fix an error message in mt7621_spi_probe()"
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: generate modules.order only in directories visited by obj-y/m
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: fix false-positive need-builtin calculation
Jan Kara <jack(a)suse.cz>
udf: Detect system inodes linked into directory hierarchy
Jan Kara <jack(a)suse.cz>
udf: Preserve link count of system files
Jan Kara <jack(a)suse.cz>
udf: Remove pointless union in udf_inode_info
Steven J. Magnani <steve.magnani(a)digidescorp.com>
udf: reduce leakage of blocks related to named streams
Jan Kara <jack(a)suse.cz>
udf: Explain handling of load_nls() failure
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: change order inside nfc_se_io error path
Zhihao Cheng <chengzhihao1(a)huawei.com>
ext4: zero i_disksize when initializing the bootloader inode
Ye Bin <yebin10(a)huawei.com>
ext4: fix WARNING in ext4_update_inline_data
Ye Bin <yebin10(a)huawei.com>
ext4: move where set the MAY_INLINE_DATA flag is set
Darrick J. Wong <djwong(a)kernel.org>
ext4: fix another off-by-one fsmap error on 1k block filesystems
Eric Whitney <enwlinux(a)gmail.com>
ext4: fix RENAME_WHITEOUT handling for inline directories
Andrew Cooper <andrew.cooper3(a)citrix.com>
x86/CPU/AMD: Disable XSAVES on AMD family 0x17
Theodore Ts'o <tytso(a)mit.edu>
fs: prevent out-of-bounds array speculation when closing a file descriptor
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/kernel/module.c | 4 +-
arch/mips/include/asm/mach-rc32434/pci.h | 2 +-
arch/x86/kernel/cpu/amd.c | 9 ++++
drivers/gpu/drm/i915/intel_ringbuffer.c | 4 +-
drivers/macintosh/windfarm_lm75_sensor.c | 4 +-
drivers/macintosh/windfarm_smu_sensors.c | 4 +-
drivers/media/i2c/ov5640.c | 2 +-
drivers/nfc/fdp/i2c.c | 4 ++
drivers/scsi/hosts.c | 2 +
drivers/staging/mt7621-spi/spi-mt7621.c | 8 ++--
fs/ext4/fsmap.c | 2 +
fs/ext4/inline.c | 1 -
fs/ext4/inode.c | 7 ++-
fs/ext4/ioctl.c | 1 +
fs/ext4/namei.c | 13 +++---
fs/ext4/xattr.c | 3 ++
fs/file.c | 1 +
fs/udf/directory.c | 2 +-
fs/udf/file.c | 7 ++-
fs/udf/ialloc.c | 14 +++---
fs/udf/inode.c | 76 ++++++++++++++++++++++----------
fs/udf/misc.c | 6 +--
fs/udf/namei.c | 7 ++-
fs/udf/partition.c | 2 +-
fs/udf/super.c | 12 ++++-
fs/udf/symlink.c | 2 +-
fs/udf/udf_i.h | 12 ++---
include/linux/pci_ids.h | 2 +
net/caif/caif_usb.c | 3 ++
net/ipv6/ila/ila_xlat.c | 1 +
net/nfc/netlink.c | 2 +-
net/tipc/socket.c | 2 +-
scripts/Makefile.build | 4 +-
34 files changed, 150 insertions(+), 79 deletions(-)
The s11b supply is used by the wlan module (as well as some of the
pmics) which are not yet fully described in the devicetree.
Mark the regulator as always-on for now.
Fixes: 123b30a75623 ("arm64: dts: qcom: sc8280xp-x13s: enable WiFi controller")
Cc: stable(a)vger.kernel.org # 6.2
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
index 26dbba9f51fb..c79559e4b22e 100644
--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
+++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
@@ -386,6 +386,7 @@ vreg_s11b: smps11 {
regulator-min-microvolt = <1272000>;
regulator-max-microvolt = <1272000>;
regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-always-on;
};
vreg_s12b: smps12 {
--
2.39.2
This is the start of the stable review cycle for the 5.4.238 release.
There are 57 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 23 Mar 2023 08:06:33 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.238-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.238-rc2
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Xiang Chen <chenxiang66(a)hisilicon.com>
scsi: core: Fix a comment in function scsi_host_dev_release()
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda - controller is in GPU on the DG1
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda - add Intel DG1 PCI and HDMI ids
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Makefile | 4 +--
arch/s390/boot/ipl_report.c | 8 +++++
arch/x86/kvm/vmx/nested.c | 10 ++++--
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 ++---
drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 5 +--
drivers/gpu/drm/meson/meson_vpp.c | 2 ++
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/hid/hid-core.c | 18 +++++++---
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++---
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 +++
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 --
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++
drivers/net/ethernet/sun/ldmvsw.c | 3 ++
drivers/net/ethernet/sun/sunvnet.c | 3 ++
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/smsc.c | 5 ++-
drivers/net/usb/smsc75xx.c | 7 ++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++--
drivers/nvme/target/core.c | 4 ++-
drivers/pci/pci-driver.c | 4 +--
drivers/pci/pci.c | 54 +++++++++++++----------------
drivers/pci/pci.h | 10 +++++-
drivers/scsi/hosts.c | 5 +--
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++--
drivers/tty/serial/8250/8250_em.c | 4 +--
drivers/tty/serial/fsl_lpuart.c | 12 +++++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++
fs/cifs/transport.c | 21 +++++------
fs/ext4/inode.c | 18 +++++-----
fs/ext4/namei.c | 4 +--
fs/ext4/page-io.c | 10 +++---
fs/ext4/xattr.c | 11 ++++++
fs/jffs2/file.c | 15 ++++----
include/linux/hid.h | 3 ++
include/linux/netdevice.h | 6 ++--
include/linux/sh_intc.h | 5 ++-
include/linux/tracepoint.h | 15 ++++----
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace_events_hist.c | 3 ++
net/ipv4/fib_frontend.c | 3 ++
net/ipv4/ip_tunnel.c | 12 +++----
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +--
net/iucv/iucv.c | 2 +-
net/netfilter/nft_redir.c | 2 +-
net/xfrm/xfrm_state.c | 3 --
sound/pci/hda/hda_intel.c | 22 ++++++++++--
sound/pci/hda/patch_hdmi.c | 3 ++
58 files changed, 277 insertions(+), 144 deletions(-)
The bug was obswerved while reading code. There are not many users of
addr_mode_nbytes. Anyway, we should update the flash's current address
mode when changing the address mode, fix it. We don't care for now about
the set_4byte_addr_mode(nor, false) from spi_nor_restore(), as it is
used at driver remove and shutdown.
Cc: stable(a)vger.kernel.org
Fixes: d7931a215063 ("mtd: spi-nor: core: Track flash's internal address mode")
Signed-off-by: Tudor Ambarus <tudor.ambarus(a)linaro.org>
---
drivers/mtd/spi-nor/core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index 1cf566fed9c6..868414017399 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -2769,6 +2769,7 @@ static int spi_nor_quad_enable(struct spi_nor *nor)
static int spi_nor_init(struct spi_nor *nor)
{
+ struct spi_nor_flash_parameter *params = nor->params;
int err;
err = spi_nor_octal_dtr_enable(nor, true);
@@ -2810,9 +2811,10 @@ static int spi_nor_init(struct spi_nor *nor)
*/
WARN_ONCE(nor->flags & SNOR_F_BROKEN_RESET,
"enabling reset hack; may not recover from unexpected reboots\n");
- err = nor->params->set_4byte_addr_mode(nor, true);
+ err = params->set_4byte_addr_mode(nor, true);
if (err && err != -ENOTSUPP)
return err;
+ params->addr_mode_nbytes = 4;
}
return 0;
--
2.40.0.rc1.284.g88254d51c5-goog
This is the start of the stable review cycle for the 5.15.104 release.
There are 115 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:26 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.104-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.104-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Lukas Wunner <lukas(a)wunner.de>
PCI/DPC: Await readiness of secondary bus after reset
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Fedor Pchelkin <pchelkin(a)ispras.ru>
io_uring: avoid null-ptr-deref in io_arm_poll_handler
Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com>
drm/i915/active: Fix misuse of non-idle barriers as fence trackers
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Shawn Wang <shawnwang(a)linux.alibaba.com>
x86/resctrl: Clear staged_config[] before and after it is used
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Yazen Ghannam <yazen.ghannam(a)amd.com>
x86/mce: Make sure logged MCEs are processed after sysfs update
Shawn Guo <shawn.guo(a)linaro.org>
cpuidle: psci: Iterate backwards over list in psci_pd_remove()
Radu Pirea (OSS) <radu-nicolae.pirea(a)oss.nxp.com>
net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit
Tero Kristo <tero.kristo(a)linux.intel.com>
trace/hwlat: Do not wipe the contents of per-cpu thread data
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Francesco Dolcini <francesco.dolcini(a)toradex.com>
mmc: sdhci_am654: lower power-on failed message severity
David Hildenbrand <david(a)redhat.com>
mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
Dave Ertman <david.m.ertman(a)intel.com>
ice: avoid bonding causing auxiliary plug/unplug under RTNL lock
Elmer Miroslav Mosher Golovin <miroslav(a)mishamosher.com>
nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Paolo Abeni <pabeni(a)redhat.com>
mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket()
Matthieu Baerts <matthieu.baerts(a)tessares.net>
mptcp: avoid setting TCP_CLOSE state twice
Geliang Tang <geliang.tang(a)suse.com>
mptcp: add ro_after_init for tcp{,v6}_prot_override
Paolo Abeni <pabeni(a)redhat.com>
mptcp: fix possible deadlock in subflow_error_report
Błażej Szczygieł <mumei6102(a)gmail.com>
drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume
Johan Hovold <johan+linaro(a)kernel.org>
drm/sun4i: fix missing component unbind on bind errors
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/shmem-helper: Remove another errant put in error path
Guo Ren <guoren(a)linux.alibaba.com>
riscv: asid: Fixup stale TLB entry cause application crash
Sergey Matyukevich <sergey.matyukevich(a)syntacore.com>
Revert "riscv: mm: notify remote harts about mmu cache updates"
Hamidreza H. Fard <nitocris(a)posteo.net>
ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
Bard Liao <yung-chuan.liao(a)linux.intel.com>
ALSA: hda: intel-dsp-config: add MTL PCI id
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Volker Lendecke <vl(a)samba.org>
cifs: Fix smb2_set_path_size()
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Sung-hun Kim <sfoon.kim(a)samsung.com>
tracing: Make splice_read available again
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: exynos: fix node leak in probe PM QoS error path
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Roman Gushchin <roman.gushchin(a)linux.dev>
firmware: xilinx: don't make a sleepable memory allocation from an atomic context
Johan Hovold <johan(a)kernel.org>
serial: 8250_fsl: fix handle_irq locking
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Alex Hung <alex.hung(a)amd.com>
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Eric Van Hensbergen <ericvh(a)kernel.org>
net/9p: fix bug in client create for .L
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: update s_journal_inum if it changes after journal replay
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
Jurica Vukadin <jura(a)vukad.in>
kconfig: Update config changed flag before calling callback
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
hwmon: tmp512: drop of_match_ptr for ID table
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (ucd90320) Add minimum delay between bus accesses
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Nikolay Aleksandrov <razor(a)blackwall.org>
bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
Nikolay Aleksandrov <razor(a)blackwall.org>
bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
Po-Hsu Lin <po-hsu.lin(a)canonical.com>
selftests: net: devlink_port_split.py: skip test if no suitable device available
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
sh_eth: avoid PHY being resumed when interface is not up
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
ravb: avoid PHY being resumed when interface is not up
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
Maciej Fijalkowski <maciej.fijalkowski(a)intel.com>
ice: xsk: disable txq irq before flushing hw
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Ming Lei <ming.lei(a)redhat.com>
nvme: fix handling single range discard request
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
block: null_blk: Fix handling of fake timeout request
Liu Ying <victor.liu(a)nxp.com>
drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Wenjia Zhang <wenjia(a)linux.ibm.com>
net/smc: fix deadlock triggered by cancel_delayed_work_syn()
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Bart Van Assche <bvanassche(a)acm.org>
loop: Fix use-after-free issues
Arınç ÜNAL <arinc.unal(a)arinc9.com>
net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used
Arınç ÜNAL <arinc.unal(a)arinc9.com>
net: dsa: mt7530: remove now incorrect comment regarding port 5
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
D. Wythe <alibuda(a)linux.alibaba.com>
net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
Jouni Högander <jouni.hogander(a)intel.com>
drm/i915/psr: Use calculated io and fast wake lines
Tom Rix <trix(a)redhat.com>
drm/i915/display: clean up comments
José Roberto de Souza <jose.souza(a)intel.com>
drm/i915/display/psr: Handle plane and pipe restrictions at every page flip
José Roberto de Souza <jose.souza(a)intel.com>
drm/i915/display/psr: Use drm damage helpers to calculate plane damaged area
José Roberto de Souza <jose.souza(a)intel.com>
drm/i915/display: Workaround cursor left overs with PSR2 selective fetch enabled
Niklas Schnelle <schnelle(a)linux.ibm.com>
PCI: s390: Fix use-after-free of PCI resources with per-function hotplug
Eugenio Pérez <eperezma(a)redhat.com>
vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready
Eugenio Pérez <eperezma(a)redhat.com>
vdpa_sim: not reset state in vdpasim_queue_ready
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_masq: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_nat: correct length for loading protocol registers
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Makefile | 4 +-
arch/riscv/include/asm/mmu.h | 2 -
arch/riscv/include/asm/tlbflush.h | 18 --
arch/riscv/mm/context.c | 40 ++--
arch/riscv/mm/tlbflush.c | 28 +--
arch/s390/boot/ipl_report.c | 8 +
arch/s390/pci/pci.c | 16 +-
arch/s390/pci/pci_bus.c | 12 +-
arch/s390/pci/pci_bus.h | 3 +-
arch/x86/Makefile.um | 6 +
arch/x86/kernel/cpu/mce/core.c | 1 +
arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 7 +-
arch/x86/kernel/cpu/resctrl/internal.h | 1 +
arch/x86/kernel/cpu/resctrl/rdtgroup.c | 25 ++-
arch/x86/kvm/vmx/nested.c | 10 +-
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/loop.c | 25 ++-
drivers/block/null_blk/main.c | 6 +-
drivers/block/sunvdc.c | 2 +
drivers/clk/Kconfig | 2 +-
drivers/cpuidle/cpuidle-psci-domain.c | 3 +-
drivers/firmware/xilinx/zynqmp.c | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +-
.../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 5 +-
.../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 43 ++++-
drivers/gpu/drm/drm_gem_shmem_helper.c | 9 +-
drivers/gpu/drm/i915/display/intel_display_types.h | 2 +
drivers/gpu/drm/i915/display/intel_psr.c | 207 +++++++++++++++------
drivers/gpu/drm/i915/gt/intel_ring.c | 2 +-
drivers/gpu/drm/i915/i915_active.c | 24 +--
drivers/gpu/drm/meson/meson_vpp.c | 2 +
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/gpu/drm/sun4i/sun4i_drv.c | 6 +-
drivers/hid/hid-core.c | 18 +-
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 +-
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/ltc2992.c | 1 +
drivers/hwmon/pmbus/adm1266.c | 1 +
drivers/hwmon/pmbus/ucd9000.c | 75 ++++++++
drivers/hwmon/tmp513.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 +
drivers/interconnect/samsung/exynos.c | 6 +-
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 -
drivers/mmc/host/sdhci_am654.c | 2 +-
drivers/net/bonding/bond_main.c | 23 ++-
drivers/net/dsa/mt7530.c | 64 +++----
drivers/net/dsa/mv88e6xxx/chip.c | 16 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/intel/ice/ice.h | 14 +-
drivers/net/ethernet/intel/ice/ice_main.c | 19 +-
drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +-
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +
drivers/net/ethernet/qlogic/qed/qed_mng_tlv.c | 2 +-
drivers/net/ethernet/renesas/ravb_main.c | 12 +-
drivers/net/ethernet/renesas/sh_eth.c | 12 +-
drivers/net/ethernet/sun/ldmvsw.c | 3 +
drivers/net/ethernet/sun/sunvnet.c | 3 +
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/nxp-c45-tja11xx.c | 2 +-
drivers/net/phy/smsc.c | 5 +-
drivers/net/usb/smsc75xx.c | 7 +
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 +-
drivers/nvme/host/core.c | 28 ++-
drivers/nvme/host/pci.c | 2 +
drivers/nvme/target/core.c | 4 +-
drivers/pci/bus.c | 21 +++
drivers/pci/pci-driver.c | 4 +-
drivers/pci/pci.c | 57 +++---
drivers/pci/pci.h | 16 +-
drivers/pci/pcie/dpc.c | 4 +-
drivers/scsi/hosts.c | 3 -
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 +-
drivers/tty/serial/8250/8250_em.c | 4 +-
drivers/tty/serial/8250/8250_fsl.c | 4 +-
drivers/tty/serial/fsl_lpuart.c | 12 +-
drivers/vdpa/vdpa_sim/vdpa_sim.c | 13 ++
drivers/video/fbdev/stifb.c | 27 +++
fs/cifs/smb2inode.c | 31 ++-
fs/cifs/transport.c | 21 +--
fs/ext4/inode.c | 18 +-
fs/ext4/namei.c | 4 +-
fs/ext4/super.c | 7 +-
fs/ext4/xattr.c | 11 ++
fs/jffs2/file.c | 15 +-
include/drm/drm_bridge.h | 4 +-
include/linux/hid.h | 3 +
include/linux/netdevice.h | 6 +-
include/linux/pci.h | 1 +
include/linux/sh_intc.h | 5 +-
include/linux/tracepoint.h | 15 +-
io_uring/io_uring.c | 4 +-
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace.c | 2 +
kernel/trace/trace_events_hist.c | 3 +
kernel/trace/trace_hwlat.c | 3 -
mm/huge_memory.c | 6 +-
net/9p/client.c | 2 +-
net/ipv4/fib_frontend.c | 3 +
net/ipv4/ip_tunnel.c | 12 +-
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +-
net/iucv/iucv.c | 2 +-
net/mptcp/pm_netlink.c | 16 ++
net/mptcp/subflow.c | 12 +-
net/netfilter/nft_masq.c | 2 +-
net/netfilter/nft_nat.c | 2 +-
net/netfilter/nft_redir.c | 4 +-
net/smc/smc_cdc.c | 3 +
net/smc/smc_core.c | 2 +-
net/xfrm/xfrm_state.c | 3 -
scripts/kconfig/confdata.c | 6 +-
sound/hda/intel-dsp-config.c | 9 +
sound/pci/hda/hda_intel.c | 5 +-
sound/pci/hda/patch_realtek.c | 1 +
tools/testing/selftests/net/devlink_port_split.py | 36 +++-
120 files changed, 925 insertions(+), 439 deletions(-)
This is the start of the stable review cycle for the 5.10.176 release.
There are 99 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.176-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.176-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Gaosheng Cui <cuigaosheng1(a)huawei.com>
xfs: remove xfs_setattr_time() declaration
Christian Brauner <brauner(a)kernel.org>
fs: use consistent setgid checks in is_sxid()
Amir Goldstein <amir73il(a)gmail.com>
attr: use consistent sgid stripping checks
Amir Goldstein <amir73il(a)gmail.com>
attr: add setattr_should_drop_sgid()
Amir Goldstein <amir73il(a)gmail.com>
fs: move should_remove_suid()
Amir Goldstein <amir73il(a)gmail.com>
attr: add in_group_or_capable()
Yang Xu <xuyang2018.jy(a)fujitsu.com>
fs: move S_ISGID stripping into the vfs_*() helpers
Yang Xu <xuyang2018.jy(a)fujitsu.com>
fs: add mode_strip_sgid() helper
Darrick J. Wong <djwong(a)kernel.org>
xfs: use setattr_copy to set vfs inode attributes
Dave Chinner <dchinner(a)redhat.com>
xfs: set prealloc flag in xfs_alloc_file_space()
Dave Chinner <dchinner(a)redhat.com>
xfs: fallocate() should call file_modified()
Dave Chinner <dchinner(a)redhat.com>
xfs: remove XFS_PREALLOC_SYNC
Darrick J. Wong <djwong(a)kernel.org>
xfs: don't leak btree cursor when insrec fails after a split
Darrick J. Wong <djwong(a)kernel.org>
xfs: purge dquots after inode walk fails during quotacheck
Dave Chinner <dchinner(a)redhat.com>
xfs: don't assert fail on perag references on teardown
Lukas Wunner <lukas(a)wunner.de>
PCI/DPC: Await readiness of secondary bus after reset
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Fedor Pchelkin <pchelkin(a)ispras.ru>
io_uring: avoid null-ptr-deref in io_arm_poll_handler
Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com>
drm/i915/active: Fix misuse of non-idle barriers as fence trackers
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Yazen Ghannam <yazen.ghannam(a)amd.com>
x86/mce: Make sure logged MCEs are processed after sysfs update
Shawn Guo <shawn.guo(a)linaro.org>
cpuidle: psci: Iterate backwards over list in psci_pd_remove()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Francesco Dolcini <francesco.dolcini(a)toradex.com>
mmc: sdhci_am654: lower power-on failed message severity
David Hildenbrand <david(a)redhat.com>
mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Matthieu Baerts <matthieu.baerts(a)tessares.net>
mptcp: avoid setting TCP_CLOSE state twice
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/shmem-helper: Remove another errant put in error path
Hamidreza H. Fard <nitocris(a)posteo.net>
ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
Bard Liao <yung-chuan.liao(a)linux.intel.com>
ALSA: hda: intel-dsp-config: add MTL PCI id
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Volker Lendecke <vl(a)samba.org>
cifs: Fix smb2_set_path_size()
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Sung-hun Kim <sfoon.kim(a)samsung.com>
tracing: Make splice_read available again
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Roman Gushchin <roman.gushchin(a)linux.dev>
firmware: xilinx: don't make a sleepable memory allocation from an atomic context
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Alex Hung <alex.hung(a)amd.com>
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
hwmon: tmp512: drop of_match_ptr for ID table
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (ucd90320) Add minimum delay between bus accesses
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
Po-Hsu Lin <po-hsu.lin(a)canonical.com>
selftests: net: devlink_port_split.py: skip test if no suitable device available
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
Maciej Fijalkowski <maciej.fijalkowski(a)intel.com>
ice: xsk: disable txq irq before flushing hw
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Ming Lei <ming.lei(a)redhat.com>
nvme: fix handling single range discard request
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
block: null_blk: Fix handling of fake timeout request
Damien Le Moal <damien.lemoal(a)wdc.com>
null_blk: Move driver into its own directory
Liu Ying <victor.liu(a)nxp.com>
drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Wenjia Zhang <wenjia(a)linux.ibm.com>
net/smc: fix deadlock triggered by cancel_delayed_work_syn()
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
D. Wythe <alibuda(a)linux.alibaba.com>
net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Xiang Chen <chenxiang66(a)hisilicon.com>
scsi: core: Fix a comment in function scsi_host_dev_release()
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_masq: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_nat: correct length for loading protocol registers
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Documentation/trace/ftrace.rst | 2 +-
Makefile | 4 +-
arch/s390/boot/ipl_report.c | 8 +++
arch/x86/Makefile.um | 6 ++
arch/x86/kernel/cpu/mce/core.c | 1 +
arch/x86/kvm/vmx/nested.c | 10 ++-
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/Kconfig | 8 +--
drivers/block/Makefile | 7 +-
drivers/block/null_blk/Kconfig | 12 ++++
drivers/block/null_blk/Makefile | 11 +++
drivers/block/{null_blk_main.c => null_blk/main.c} | 6 +-
drivers/block/{ => null_blk}/null_blk.h | 0
.../block/{null_blk_trace.c => null_blk/trace.c} | 2 +-
.../block/{null_blk_trace.h => null_blk/trace.h} | 2 +-
.../block/{null_blk_zoned.c => null_blk/zoned.c} | 2 +-
drivers/block/sunvdc.c | 2 +
drivers/clk/Kconfig | 2 +-
drivers/cpuidle/cpuidle-psci-domain.c | 3 +-
drivers/firmware/xilinx/zynqmp.c | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +--
.../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 5 +-
drivers/gpu/drm/drm_gem_shmem_helper.c | 9 ++-
drivers/gpu/drm/i915/gt/intel_ring.c | 2 +-
drivers/gpu/drm/i915/i915_active.c | 24 ++++---
drivers/gpu/drm/meson/meson_vpp.c | 2 +
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/hid/hid-core.c | 18 +++--
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 +--
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/pmbus/adm1266.c | 1 +
drivers/hwmon/pmbus/ucd9000.c | 75 ++++++++++++++++++++
drivers/hwmon/tmp513.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 ++
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 -
drivers/mmc/host/sdhci_am654.c | 2 +-
drivers/net/dsa/mv88e6xxx/chip.c | 16 +++--
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +-
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 ++
drivers/net/ethernet/qlogic/qed/qed_mng_tlv.c | 2 +-
drivers/net/ethernet/sun/ldmvsw.c | 3 +
drivers/net/ethernet/sun/sunvnet.c | 3 +
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/smsc.c | 5 +-
drivers/net/usb/smsc75xx.c | 7 ++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 +-
drivers/nvme/host/core.c | 28 +++++---
drivers/nvme/target/core.c | 4 +-
drivers/pci/pci-driver.c | 4 +-
drivers/pci/pci.c | 57 +++++++--------
drivers/pci/pci.h | 16 ++++-
drivers/pci/pcie/dpc.c | 4 +-
drivers/scsi/hosts.c | 5 +-
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 +++-
drivers/tty/serial/8250/8250_em.c | 4 +-
drivers/tty/serial/fsl_lpuart.c | 12 +++-
drivers/video/fbdev/stifb.c | 27 ++++++++
fs/attr.c | 70 +++++++++++++++++--
fs/cifs/smb2inode.c | 31 +++++++--
fs/cifs/transport.c | 21 +++---
fs/ext4/inode.c | 18 +++--
fs/ext4/namei.c | 4 +-
fs/ext4/xattr.c | 11 +++
fs/inode.c | 80 +++++++++++++---------
fs/internal.h | 6 ++
fs/jffs2/file.c | 15 ++--
fs/namei.c | 80 ++++++++++++++++++----
fs/ocfs2/file.c | 4 +-
fs/ocfs2/namei.c | 1 +
fs/open.c | 6 +-
fs/xfs/libxfs/xfs_btree.c | 8 ++-
fs/xfs/xfs_bmap_util.c | 9 +--
fs/xfs/xfs_file.c | 24 +++----
fs/xfs/xfs_iops.c | 56 +--------------
fs/xfs/xfs_iops.h | 1 -
fs/xfs/xfs_mount.c | 3 +-
fs/xfs/xfs_pnfs.c | 9 ++-
fs/xfs/xfs_qm.c | 9 ++-
include/drm/drm_bridge.h | 4 +-
include/linux/fs.h | 5 +-
include/linux/hid.h | 3 +
include/linux/netdevice.h | 6 +-
include/linux/sh_intc.h | 5 +-
include/linux/tracepoint.h | 15 ++--
io_uring/io_uring.c | 4 +-
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace.c | 2 +
kernel/trace/trace_events_hist.c | 3 +
mm/huge_memory.c | 6 +-
net/ipv4/fib_frontend.c | 3 +
net/ipv4/ip_tunnel.c | 12 ++--
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +-
net/iucv/iucv.c | 2 +-
net/mptcp/subflow.c | 1 -
net/netfilter/nft_masq.c | 2 +-
net/netfilter/nft_nat.c | 2 +-
net/netfilter/nft_redir.c | 4 +-
net/smc/smc_cdc.c | 3 +
net/smc/smc_core.c | 2 +-
net/xfrm/xfrm_state.c | 3 -
sound/hda/intel-dsp-config.c | 9 +++
sound/pci/hda/hda_intel.c | 5 +-
sound/pci/hda/patch_realtek.c | 1 +
tools/testing/selftests/net/devlink_port_split.py | 30 ++++++++
111 files changed, 743 insertions(+), 360 deletions(-)
This is the start of the stable review cycle for the 4.19.279 release.
There are 36 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:13 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.279-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.279-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Eric Biggers <ebiggers(a)kernel.org>
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Makefile | 4 ++--
arch/x86/Makefile.um | 6 ++++++
arch/x86/mm/mem_encrypt_identity.c | 3 ++-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +++------
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/jffs2/file.c | 15 +++++++--------
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
include/linux/tracepoint.h | 15 ++++++---------
kernel/trace/ftrace.c | 3 ++-
kernel/trace/trace_events_hist.c | 3 +++
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
39 files changed, 166 insertions(+), 78 deletions(-)
This is the start of the stable review cycle for the 4.14.311 release.
There are 30 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.311-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.311-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Eric Biggers <ebiggers(a)kernel.org>
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Makefile | 4 ++--
arch/x86/Makefile.um | 6 ++++++
drivers/block/sunvdc.c | 2 ++
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
kernel/trace/ftrace.c | 3 ++-
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
33 files changed, 144 insertions(+), 53 deletions(-)
The patch titled
Subject: mm/hugetlb: fix uffd wr-protection for CoW optimization path
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Peter Xu <peterx(a)redhat.com>
Subject: mm/hugetlb: fix uffd wr-protection for CoW optimization path
Date: Tue, 21 Mar 2023 15:18:40 -0400
This patch fixes an issue that a hugetlb uffd-wr-protected mapping can be
writable even with uffd-wp bit set. It only happens with all these
conditions met: (1) hugetlb memory (2) private mapping (3) original
mapping was missing, then (4) being wr-protected (IOW, pte marker
installed). Then write to the page to trigger.
Userfaultfd-wp trap for hugetlb was implemented in hugetlb_fault() before
even reaching hugetlb_wp() to avoid taking more locks that userfault won't
need. However there's one CoW optimization path for missing hugetlb page
that can trigger hugetlb_wp() inside hugetlb_no_page(), that can bypass
the userfaultfd-wp traps.
A few ways to resolve this:
(1) Skip the CoW optimization for hugetlb private mapping, considering
that private mappings for hugetlb should be very rare, so it may not
really be helpful to major workloads. The worst case is we only skip the
optimization if userfaultfd_wp(vma)==true, because uffd-wp needs another
fault anyway.
(2) Move the userfaultfd-wp handling for hugetlb from hugetlb_fault()
into hugetlb_wp(). The major cons is there're a bunch of locks taken
when calling hugetlb_wp(), and that will make the changeset unnecessarily
complicated due to the lock operations.
(3) Carry over uffd-wp bit in hugetlb_wp(), so it'll need to fault again
for uffd-wp privately mapped pages.
This patch chose option (3) which contains the minimum changeset (simplest
for backport) and also make sure hugetlb_wp() itself will start to be
always safe with uffd-wp ptes even if called elsewhere in the future.
This patch will be needed for v5.19+ hence copy stable.
Link: https://lkml.kernel.org/r/20230321191840.1897940-1-peterx@redhat.com
Fixes: 166f3ecc0daf ("mm/hugetlb: hook page faults for uffd write protection")
Signed-off-by: Peter Xu <peterx(a)redhat.com>
Reported-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com>
Acked-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Axel Rasmussen <axelrasmussen(a)google.com>
Cc: Mike Rapoport <rppt(a)linux.vnet.ibm.com>
Cc: Nadav Amit <nadav.amit(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/hugetlb.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/mm/hugetlb.c~mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path
+++ a/mm/hugetlb.c
@@ -5478,7 +5478,7 @@ static vm_fault_t hugetlb_wp(struct mm_s
struct folio *pagecache_folio, spinlock_t *ptl)
{
const bool unshare = flags & FAULT_FLAG_UNSHARE;
- pte_t pte;
+ pte_t pte, newpte;
struct hstate *h = hstate_vma(vma);
struct page *old_page;
struct folio *new_folio;
@@ -5622,8 +5622,10 @@ retry_avoidcopy:
mmu_notifier_invalidate_range(mm, range.start, range.end);
page_remove_rmap(old_page, vma, true);
hugepage_add_new_anon_rmap(new_folio, vma, haddr);
- set_huge_pte_at(mm, haddr, ptep,
- make_huge_pte(vma, &new_folio->page, !unshare));
+ newpte = make_huge_pte(vma, &new_folio->page, !unshare);
+ if (huge_pte_uffd_wp(pte))
+ newpte = huge_pte_mkuffd_wp(newpte);
+ set_huge_pte_at(mm, haddr, ptep, newpte);
folio_set_hugetlb_migratable(new_folio);
/* Make the old page be freed below */
new_folio = page_folio(old_page);
_
Patches currently in -mm which might be from peterx(a)redhat.com are
kselftest-vm-fix-unused-variable-warning.patch
tools-headers-uapi-sync-linux-prctlh-with-the-kernel-sources.patch
mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path.patch
mm-khugepaged-alloc_charge_hpage-take-care-of-mem-charge-errors.patch
mm-khugepaged-cleanup-memcg-uncharge-for-failure-path.patch
mm-uffd-uffd_feature_wp_unpopulated.patch
selftests-mm-smoke-test-uffd_feature_wp_unpopulated.patch
mm-thp-rename-transparent_hugepage_never_dax-to-_unsupported.patch
mm-thp-rename-transparent_hugepage_never_dax-to-_unsupported-fix.patch
The conditional MOVS instruction that appears to have been added to test
for the TIF_USING_IWMMXT thread_info flag only sets the N and Z
condition flags and register R7, none of which are referenced in the
subsequent code. This means that the instruction does nothing, which
means that we might misidentify faulting FPE instructions as iWMMXT
instructions on kernels that were built to support both.
This seems to have been part of the original submission of the code, and
so this has never worked as intended, and nobody ever noticed, and so we
might decide to just leave this as-is. However, with the ongoing move
towards multiplatform kernels, the issue becomes more likely to
manifest, and so it is better to fix it.
So check whether we are dealing with an undef exception regarding
coprocessor index #0 or #1, and if so, load the thread_info flag and
only dispatch it as a iWMMXT trap if the flag is set.
Cc: <stable(a)vger.kernel.org> # v2.6.9+
Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org>
---
arch/arm/kernel/entry-armv.S | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index c39303e5c23470e6..c5d2f07994fb0d87 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -606,10 +606,11 @@ call_fpe:
strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[]
#ifdef CONFIG_IWMMXT
@ Test if we need to give access to iWMMXt coprocessors
- ldr r5, [r10, #TI_FLAGS]
- rsbs r7, r8, #(1 << 8) @ CP 0 or 1 only
- movscs r7, r5, lsr #(TIF_USING_IWMMXT + 1)
- bcs iwmmxt_task_enable
+ tst r8, #0xe << 8 @ CP 0 or 1?
+ ldreq r5, [r10, #TI_FLAGS] @ if so, load thread_info flags
+ andeq r5, r5, #1 << TIF_USING_IWMMXT @ isolate TIF_USING_IWMMXT flag
+ teqeq r5, #1 << TIF_USING_IWMMXT @ check whether it is set
+ beq iwmmxt_task_enable @ branch if set
#endif
ARM( add pc, pc, r8, lsr #6 )
THUMB( lsr r8, r8, #6 )
--
2.39.2