This bug is marked as fixed by commit:
net: core: netlink: add helper refcount dec and lock function
net: sched: add helper function to take reference to Qdisc
net: sched: extend Qdisc with rcu
net: sched: rename qdisc_destroy() to qdisc_put()
net: sched: use Qdisc rcu API instead of relying on rtnl lock
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux 4.19
Dashboard link: https://syzkaller.appspot.com/bug?extid=5f229e48cccc804062c0
---
[1] I expect the commit to be present in:
1. linux-4.19.y branch of
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
The fourth interrupt on SCI port is transmit end interrupt compared to
the break interrupt on other port types. So, shuffle the interrupts to fix
the transmit end interrupt handler.
Fixes: e1d0be616186 ("sh-sci: Add h8300 SCI")
Cc: stable(a)vger.kernel.org
Suggested-by: Geert Uytterhoeven <geert+renesas(a)glider.be>
Signed-off-by: Biju Das <biju.das.jz(a)bp.renesas.com>
---
v3->v4:
* No change.
v2->v3:
* Cced stable(a)vger.kernel.org
v1->v2:
* Replaced the wrong fixes tag
* Added a simpler check in sci_init_single() and added a check in
probe to catch invalid interrupt count.
Tested the SCI0 interface on RZ/G2UL by connecting to PMOD USBUART.
39: 0 GICv3 437 Level 1004d000.serial:rx err
40: 12 GICv3 438 Edge 1004d000.serial:rx full
41: 70 GICv3 439 Edge 1004d000.serial:tx empty
42: 18 GICv3 440 Level 1004d000.serial:tx end
---
drivers/tty/serial/sh-sci.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index af4a7a865764..616041faab55 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -31,6 +31,7 @@
#include <linux/ioport.h>
#include <linux/ktime.h>
#include <linux/major.h>
+#include <linux/minmax.h>
#include <linux/module.h>
#include <linux/mm.h>
#include <linux/of.h>
@@ -2864,6 +2865,13 @@ static int sci_init_single(struct platform_device *dev,
sci_port->irqs[i] = platform_get_irq(dev, i);
}
+ /*
+ * The fourth interrupt on SCI port is transmit end interrupt, so
+ * shuffle the interrupts.
+ */
+ if (p->type == PORT_SCI)
+ swap(sci_port->irqs[SCIx_BRI_IRQ], sci_port->irqs[SCIx_TEI_IRQ]);
+
/* The SCI generates several interrupts. They can be muxed together or
* connected to different interrupt lines. In the muxed case only one
* interrupt resource is specified as there is only one interrupt ID.
--
2.25.1
Good Day. I know this message might meet you in utmost surprise.
However, it's just my urgent need for a foreign partner that made me
to contact you for this mutually beneficial business when searching
for a good and reliable and trustworthy person. I need your urgent
assistance in transferring the sum of $27.5 million dollars currently
in my branch where I work. If you're interested please reply to me
immediately so I will let you know the next steps to follow.
Thanks.
Mr.Patrick Joseph.
Hello,
I am reaching out to provide awareness for a part-time career. We are currently sourcing for representatives in Europe to work from home to act as our company's regional business representative in that region. It will by no means interfere with your current job or business.
Kindly email me for detailed information.
Regards,
Bleiholder Novak
Currently, vmxnet3 uses GRO callback only if LRO is disabled. However,
on smartNic based setups where UPT is supported, LRO can be enabled
from guest VM but UPT devicve does not support LRO as of now. In such
cases, there can be performance degradation as GRO is not being done.
This patch fixes this issue by calling GRO API when UPT is enabled. We
use updateRxProd to determine if UPT mode is active or not.
To clarify few things discussed over the thread:
The patch is not neglecting any feature bits nor disabling GRO. It uses
GRO callback when UPT is active as LRO is not available in UPT.
GRO callback cannot be used as default for all cases as it degrades
performance for non-UPT cases or for cases when LRO is already done in
ESXi.
Cc: stable(a)vger.kernel.org
Fixes: 6f91f4ba046e ("vmxnet3: add support for capability registers")
Signed-off-by: Ronak Doshi <doshir(a)vmware.com>
Reviewed-by: Simon Horman <simon.horman(a)corigine.com>
--
v1->v2: split if check on multiple lines
---
drivers/net/vmxnet3/vmxnet3_drv.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 682987040ea8..da488cbb0542 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1688,7 +1688,9 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
if (unlikely(rcd->ts))
__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), rcd->tci);
- if (adapter->netdev->features & NETIF_F_LRO)
+ /* Use GRO callback if UPT is enabled */
+ if ((adapter->netdev->features & NETIF_F_LRO) &&
+ !rq->shared->updateRxProd)
netif_receive_skb(skb);
else
napi_gro_receive(&rq->napi, skb);
--
2.11.0
Hi There,
Greeting. Hope this email find you are well.
We are one of the biggest ones in south of China manufacturer specialized in Adapter products since 2001.
Now I'm writing for keeping in touch with you for further business.
As our factory is manufacturer, we can Customizes, OEM & ODM also acceptable.
If you need the catalogue, please feel free to contact me.
Andy
Hi,
This commit that landed in 6.3 was marked to got to stable, but it failed
to apply to both 6.2.y and 6.1.y.
cbd6c1b17d3b ("drm/amd/display: Fix DP MST sinks removal issue")
The code is needed for some timing issues with USB4 CM teardown.
It failed to apply because the code it fixed was moved to a new file in
6.3. The code is otherwise unchanged in the old file, so this has been
manually fixed up.
Please apply for both 6.2.y and 6.1.y.
Thanks!
Cruise Hung (1):
drm/amd/display: Fix DP MST sinks removal issue
drivers/gpu/drm/amd/display/dc/core/dc_link.c | 9 +++++++++
1 file changed, 9 insertions(+)
--
2.34.1
Hi Greg, Sasha,
Recently, 3 patches related to MPTCP have not been backported due to
conflicts:
- 3a236aef280e ("mptcp: refactor passive socket initialization")
- b6985b9b8295 ("mptcp: use the workqueue to destroy unaccepted sockets")
- 0a3f4f1f9c27 ("mptcp: fix UaF in listener shutdown")
Yesterday, Sasha has resolved the conflicts for the first one and he has
already added this one to v6.1.
In fact, this first patch is a requirement for the two others.
I then here resolved the conflicts for the two other patches, documented
that in each patch and ran our tests suite. Everything seems OK.
Do you mind adding these two patches to v6.1 queue as well if you don't
mind?
Signed-off-by: Matthieu Baerts <matthieu.baerts(a)tessares.net>
---
Paolo Abeni (2):
mptcp: use the workqueue to destroy unaccepted sockets
mptcp: fix UaF in listener shutdown
net/mptcp/protocol.c | 46 ++++++++++++++++++---------
net/mptcp/protocol.h | 6 ++--
net/mptcp/subflow.c | 89 +++++++---------------------------------------------
3 files changed, 47 insertions(+), 94 deletions(-)
---
base-commit: 0866b93e23cb1d66eb4b105d305cdb185ca17b7d
change-id: 20230323-upstream-stable-conflicts-6-1-e0baa081983d
Best regards,
--
Matthieu Baerts <matthieu.baerts(a)tessares.net>
The commit 49c47cc21b5b (net: tls: fix possible race condition between
do_tls_getsockopt_conf() and do_tls_setsockopt_conf()) fixes race
condition and use after free. This patch didn't apply cleanly in 5.15
kernel due to the added switch cases in do_tls_getsockopt_conf function.
Hangyu Hua (1):
net: tls: fix possible race condition between do_tls_getsockopt_conf()
and do_tls_setsockopt_conf()
net/tls/tls_main.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--
2.40.0.348.gf938b09366-goog
Hello,
I am reaching out to provide awareness for a part-time career. We are currently sourcing for representatives in Europe to work from home to act as our company's regional business representative in that region. It will by no means interfere with your current job or business.
Kindly email me for detailed information.
Regards,
Bleiholder Novak
The patch titled
Subject: mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v3
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v3.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Peter Xu <peterx(a)redhat.com>
Subject: mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v3
Date: Fri, 24 Mar 2023 10:26:20 -0400
Link: https://lkml.kernel.org/r/20230324142620.2344140-1-peterx@redhat.com
Reported-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com>
Cc: linux-stable <stable(a)vger.kernel.org>
Fixes: 166f3ecc0daf ("mm/hugetlb: hook page faults for uffd write protection")
Signed-off-by: Peter Xu <peterx(a)redhat.com>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/hugetlb.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/mm/hugetlb.c~mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v3
+++ a/mm/hugetlb.c
@@ -5491,11 +5491,11 @@ static vm_fault_t hugetlb_wp(struct mm_s
* Never handle CoW for uffd-wp protected pages. It should be only
* handled when the uffd-wp protection is removed.
*
- * Note that only the CoW optimization path can trigger this and
- * got skipped, because hugetlb_fault() will always resolve uffd-wp
- * bit first.
+ * Note that only the CoW optimization path (in hugetlb_no_page())
+ * can trigger this, because hugetlb_fault() will always resolve
+ * uffd-wp bit first.
*/
- if (huge_pte_uffd_wp(pte))
+ if (!unshare && huge_pte_uffd_wp(pte))
return 0;
/*
_
Patches currently in -mm which might be from peterx(a)redhat.com are
mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path.patch
mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v2.patch
mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v3.patch
mm-khugepaged-alloc_charge_hpage-take-care-of-mem-charge-errors.patch
mm-khugepaged-cleanup-memcg-uncharge-for-failure-path.patch
mm-uffd-uffd_feature_wp_unpopulated.patch
mm-uffd-uffd_feature_wp_unpopulated-fix.patch
selftests-mm-smoke-test-uffd_feature_wp_unpopulated.patch
mm-thp-rename-transparent_hugepage_never_dax-to-_unsupported.patch
mm-thp-rename-transparent_hugepage_never_dax-to-_unsupported-fix.patch
During a system boot, it can happen that the kernel receives a burst of
requests to insert the same module but loading it eventually fails
during its init call. For instance, udev can make a request to insert
a frequency module for each individual CPU when another frequency module
is already loaded which causes the init function of the new module to
return an error.
Since commit 6e6de3dee51a ("kernel/module.c: Only return -EEXIST for
modules that have finished loading"), the kernel waits for modules in
MODULE_STATE_GOING state to finish unloading before making another
attempt to load the same module.
This creates unnecessary work in the described scenario and delays the
boot. In the worst case, it can prevent udev from loading drivers for
other devices and might cause timeouts of services waiting on them and
subsequently a failed boot.
This patch attempts a different solution for the problem 6e6de3dee51a
was trying to solve. Rather than waiting for the unloading to complete,
it returns a different error code (-EBUSY) for modules in the GOING
state. This should avoid the error situation that was described in
6e6de3dee51a (user space attempting to load a dependent module because
the -EEXIST error code would suggest to user space that the first module
had been loaded successfully), while avoiding the delay situation too.
Fixes: 6e6de3dee51a ("kernel/module.c: Only return -EEXIST for modules that have finished loading")
Co-developed-by: Martin Wilck <mwilck(a)suse.com>
Signed-off-by: Martin Wilck <mwilck(a)suse.com>
Signed-off-by: Petr Pavlu <petr.pavlu(a)suse.com>
Cc: stable(a)vger.kernel.org
---
Changes since v1 [1]:
- Don't attempt a new module initialization when a same-name module
completely disappeared while waiting on it, which means it went
through the GOING state implicitly already.
[1] https://lore.kernel.org/linux-modules/20221123131226.24359-1-petr.pavlu@sus…
kernel/module/main.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/kernel/module/main.c b/kernel/module/main.c
index d02d39c7174e..7a627345d4fd 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -2386,7 +2386,8 @@ static bool finished_loading(const char *name)
sched_annotate_sleep();
mutex_lock(&module_mutex);
mod = find_module_all(name, strlen(name), true);
- ret = !mod || mod->state == MODULE_STATE_LIVE;
+ ret = !mod || mod->state == MODULE_STATE_LIVE
+ || mod->state == MODULE_STATE_GOING;
mutex_unlock(&module_mutex);
return ret;
@@ -2562,20 +2563,35 @@ static int add_unformed_module(struct module *mod)
mod->state = MODULE_STATE_UNFORMED;
-again:
mutex_lock(&module_mutex);
old = find_module_all(mod->name, strlen(mod->name), true);
if (old != NULL) {
- if (old->state != MODULE_STATE_LIVE) {
+ if (old->state == MODULE_STATE_COMING
+ || old->state == MODULE_STATE_UNFORMED) {
/* Wait in case it fails to load. */
mutex_unlock(&module_mutex);
err = wait_event_interruptible(module_wq,
finished_loading(mod->name));
if (err)
goto out_unlocked;
- goto again;
+
+ /* The module might have gone in the meantime. */
+ mutex_lock(&module_mutex);
+ old = find_module_all(mod->name, strlen(mod->name),
+ true);
}
- err = -EEXIST;
+
+ /*
+ * We are here only when the same module was being loaded. Do
+ * not try to load it again right now. It prevents long delays
+ * caused by serialized module load failures. It might happen
+ * when more devices of the same type trigger load of
+ * a particular module.
+ */
+ if (old && old->state == MODULE_STATE_LIVE)
+ err = -EEXIST;
+ else
+ err = -EBUSY;
goto out;
}
mod_update_bounds(mod);
--
2.35.3
This patch fixes an issue that a hugetlb uffd-wr-protected mapping can be
writable even with uffd-wp bit set. It only happens with all these
conditions met: (1) hugetlb memory (2) private mapping (3) original mapping
was missing, then (4) being wr-protected (IOW, pte marker installed). Then
write to the page to trigger.
Userfaultfd-wp trap for hugetlb was implemented in hugetlb_fault() before
even reaching hugetlb_wp() to avoid taking more locks that userfault won't
need. However there's one CoW optimization path for missing hugetlb page
that can trigger hugetlb_wp() inside hugetlb_no_page(), that can bypass the
userfaultfd-wp traps.
A few ways to resolve this:
(1) Skip the CoW optimization for hugetlb private mapping, considering
that private mappings for hugetlb should be very rare, so it may not
really be helpful to major workloads. The worst case is we only skip the
optimization if userfaultfd_wp(vma)==true, because uffd-wp needs another
fault anyway.
(2) Move the userfaultfd-wp handling for hugetlb from hugetlb_fault()
into hugetlb_wp(). The major cons is there're a bunch of locks taken
when calling hugetlb_wp(), and that will make the changeset unnecessarily
complicated due to the lock operations.
(3) Carry over uffd-wp bit in hugetlb_wp(), so it'll need to fault again
for uffd-wp privately mapped pages.
This patch chose option (3) which contains the minimum changeset (simplest
for backport) and also make sure hugetlb_wp() itself will start to be
always safe with uffd-wp ptes even if called elsewhere in the future.
This patch will be needed for v5.19+ hence copy stable.
Reported-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com>
Cc: linux-stable <stable(a)vger.kernel.org>
Fixes: 166f3ecc0daf ("mm/hugetlb: hook page faults for uffd write protection")
Signed-off-by: Peter Xu <peterx(a)redhat.com>
---
mm/hugetlb.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 8bfd07f4c143..22337b191eae 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -5478,7 +5478,7 @@ static vm_fault_t hugetlb_wp(struct mm_struct *mm, struct vm_area_struct *vma,
struct folio *pagecache_folio, spinlock_t *ptl)
{
const bool unshare = flags & FAULT_FLAG_UNSHARE;
- pte_t pte;
+ pte_t pte, newpte;
struct hstate *h = hstate_vma(vma);
struct page *old_page;
struct folio *new_folio;
@@ -5622,8 +5622,10 @@ static vm_fault_t hugetlb_wp(struct mm_struct *mm, struct vm_area_struct *vma,
mmu_notifier_invalidate_range(mm, range.start, range.end);
page_remove_rmap(old_page, vma, true);
hugepage_add_new_anon_rmap(new_folio, vma, haddr);
- set_huge_pte_at(mm, haddr, ptep,
- make_huge_pte(vma, &new_folio->page, !unshare));
+ newpte = make_huge_pte(vma, &new_folio->page, !unshare);
+ if (huge_pte_uffd_wp(pte))
+ newpte = huge_pte_mkuffd_wp(newpte);
+ set_huge_pte_at(mm, haddr, ptep, newpte);
folio_set_hugetlb_migratable(new_folio);
/* Make the old page be freed below */
new_folio = page_folio(old_page);
--
2.39.1
The Hyper-V "EnlightenedNptTlb" enlightenment is always enabled when KVM
is running on top of Hyper-V and Hyper-V exposes support for it (which
is always). On AMD CPUs this enlightenment results in ASID invalidations
not flushing TLB entries derived from the NPT. To force the underlying
(L0) hypervisor to rebuild its shadow page tables, an explicit hypercall
is needed.
The original KVM implementation of Hyper-V's "EnlightenedNptTlb" on SVM
only added remote TLB flush hooks. This worked out fine for a while, as
sufficient remote TLB flushes where being issued in KVM to mask the
problem. Since v5.17, changes in the TDP code reduced the number of
flushes and the out-of-sync TLB prevents guests from booting
successfully.
Split svm_flush_tlb_current() into separate callbacks for the 3 cases
(guest/all/current), and issue the required Hyper-V hypercall when a
Hyper-V TLB flush is needed. The most important case where the TLB flush
was missing is when loading a new PGD, which is followed by what is now
svm_flush_tlb_current(). Since the hypercall acts on all CPUs, cache the
last flushed root in kvm_arch->hv_root_tdp. This prevents the shadow
NPTs from being unnecessarily rebuilt for multiple vcpus and when the
same root is flushed multiple times in a row on a single vcpu.
Cc: stable(a)vger.kernel.org # v5.17+
Fixes: 1e0c7d40758b ("KVM: SVM: hyper-v: Remote TLB flush for SVM")
Link: https://lore.kernel.org/lkml/43980946-7bbf-dcef-7e40-af904c456250@linux.mic…
Suggested-by: Sean Christopherson <seanjc(a)google.com>
Signed-off-by: Jeremi Piotrowski <jpiotrowski(a)linux.microsoft.com>
---
arch/x86/kvm/kvm_onhyperv.c | 23 +++++++++++++++++++++++
arch/x86/kvm/kvm_onhyperv.h | 5 +++++
arch/x86/kvm/svm/svm.c | 18 +++++++++++++++---
3 files changed, 43 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kvm/kvm_onhyperv.c b/arch/x86/kvm/kvm_onhyperv.c
index 482d6639ef88..036e04c0a161 100644
--- a/arch/x86/kvm/kvm_onhyperv.c
+++ b/arch/x86/kvm/kvm_onhyperv.c
@@ -94,6 +94,29 @@ int hv_remote_flush_tlb(struct kvm *kvm)
}
EXPORT_SYMBOL_GPL(hv_remote_flush_tlb);
+void hv_flush_tlb_current(struct kvm_vcpu *vcpu)
+{
+ struct kvm_arch *kvm_arch = &vcpu->kvm->arch;
+ hpa_t root_tdp = vcpu->arch.mmu->root.hpa;
+
+ if (kvm_x86_ops.tlb_remote_flush == hv_remote_flush_tlb && VALID_PAGE(root_tdp)) {
+ spin_lock(&kvm_arch->hv_root_tdp_lock);
+ if (kvm_arch->hv_root_tdp != root_tdp) {
+ hyperv_flush_guest_mapping(root_tdp);
+ kvm_arch->hv_root_tdp = root_tdp;
+ }
+ spin_unlock(&kvm_arch->hv_root_tdp_lock);
+ }
+}
+EXPORT_SYMBOL_GPL(hv_flush_tlb_current);
+
+void hv_flush_tlb_all(struct kvm_vcpu *vcpu)
+{
+ if (WARN_ON_ONCE(kvm_x86_ops.tlb_remote_flush == hv_remote_flush_tlb))
+ hv_remote_flush_tlb(vcpu->kvm);
+}
+EXPORT_SYMBOL_GPL(hv_flush_tlb_all);
+
void hv_track_root_tdp(struct kvm_vcpu *vcpu, hpa_t root_tdp)
{
struct kvm_arch *kvm_arch = &vcpu->kvm->arch;
diff --git a/arch/x86/kvm/kvm_onhyperv.h b/arch/x86/kvm/kvm_onhyperv.h
index 287e98ef9df3..f24d0ca41d2b 100644
--- a/arch/x86/kvm/kvm_onhyperv.h
+++ b/arch/x86/kvm/kvm_onhyperv.h
@@ -10,11 +10,16 @@
int hv_remote_flush_tlb_with_range(struct kvm *kvm,
struct kvm_tlb_range *range);
int hv_remote_flush_tlb(struct kvm *kvm);
+void hv_flush_tlb_current(struct kvm_vcpu *vcpu);
+void hv_flush_tlb_all(struct kvm_vcpu *vcpu);
void hv_track_root_tdp(struct kvm_vcpu *vcpu, hpa_t root_tdp);
#else /* !CONFIG_HYPERV */
static inline void hv_track_root_tdp(struct kvm_vcpu *vcpu, hpa_t root_tdp)
{
}
+
+static inline void hv_flush_tlb_current(struct kvm_vcpu *vcpu) { }
+static inline void hv_flush_tlb_all(struct kvm_vcpu *vcpu) { }
#endif /* !CONFIG_HYPERV */
#endif
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 252e7f37e4e2..8da6740ef595 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3729,7 +3729,7 @@ static void svm_enable_nmi_window(struct kvm_vcpu *vcpu)
svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
}
-static void svm_flush_tlb_current(struct kvm_vcpu *vcpu)
+static void svm_flush_tlb_asid(struct kvm_vcpu *vcpu)
{
struct vcpu_svm *svm = to_svm(vcpu);
@@ -3753,6 +3753,18 @@ static void svm_flush_tlb_current(struct kvm_vcpu *vcpu)
svm->current_vmcb->asid_generation--;
}
+static void svm_flush_tlb_current(struct kvm_vcpu *vcpu)
+{
+ hv_flush_tlb_current(vcpu);
+ svm_flush_tlb_asid(vcpu);
+}
+
+static void svm_flush_tlb_all(struct kvm_vcpu *vcpu)
+{
+ hv_flush_tlb_all(vcpu);
+ svm_flush_tlb_asid(vcpu);
+}
+
static void svm_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t gva)
{
struct vcpu_svm *svm = to_svm(vcpu);
@@ -4745,10 +4757,10 @@ static struct kvm_x86_ops svm_x86_ops __initdata = {
.set_rflags = svm_set_rflags,
.get_if_flag = svm_get_if_flag,
- .flush_tlb_all = svm_flush_tlb_current,
+ .flush_tlb_all = svm_flush_tlb_all,
.flush_tlb_current = svm_flush_tlb_current,
.flush_tlb_gva = svm_flush_tlb_gva,
- .flush_tlb_guest = svm_flush_tlb_current,
+ .flush_tlb_guest = svm_flush_tlb_asid,
.vcpu_pre_run = svm_vcpu_pre_run,
.vcpu_run = svm_vcpu_run,
--
2.37.2
On some platforms there are some platform devices created with
invalid names. For example: "HID-SENSOR-INT-020b?.39.auto" instead
of "HID-SENSOR-INT-020b.39.auto"
This string include some invalid characters, hence it will fail to
properly load the driver which will handle this custom sensor. Also
it is a problem for some user space tools, which parses the device
names from ftrace and dmesg.
This is because the string, real_usage, is not NULL terminated and
printed with %s to form device name.
To address this, initialize the real_usage string with 0s.
Reported-and-tested-by: Todd Brandt <todd.e.brandt(a)linux.intel.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217169
Fixes: 98c062e82451 ("HID: hid-sensor-custom: Allow more custom iio sensors")
Cc: stable(a)vger.kernel.org
Suggested-by: Philipp Jungkamp <p.jungkamp(a)gmx.net>
Signed-off-by: Philipp Jungkamp <p.jungkamp(a)gmx.net>
Signed-off-by: Todd Brandt <todd.e.brandt(a)intel.com>
Reviewed-by: Andi Shyti <andi.shyti(a)kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
---
Changes in v4:
- add the Fixes line
- add patch version change list
Changes in v3:
- update the changelog
- add proper reviewed/signed/suggested links
Changes in v2:
- update the changelog
drivers/hid/hid-sensor-custom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index 3e3f89e01d81..d85398721659 100644
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -940,7 +940,7 @@ hid_sensor_register_platform_device(struct platform_device *pdev,
struct hid_sensor_hub_device *hsdev,
const struct hid_sensor_custom_match *match)
{
- char real_usage[HID_SENSOR_USAGE_LENGTH];
+ char real_usage[HID_SENSOR_USAGE_LENGTH] = { 0 };
struct platform_device *custom_pdev;
const char *dev_name;
char *c;
--
2.17.1
Read mmu_invalidate_seq before dropping the mmap_lock so that KVM can
detect if the results of vma_lookup() (e.g. vma_shift) become stale
before it acquires kvm->mmu_lock. This fixes a theoretical bug where a
VMA could be changed by userspace after vma_lookup() and before KVM
reads the mmu_invalidate_seq, causing KVM to install page table entries
based on a (possibly) no-longer-valid vma_shift.
Re-order the MMU cache top-up to earlier in user_mem_abort() so that it
is not done after KVM has read mmu_invalidate_seq (i.e. so as to avoid
inducing spurious fault retries).
It's unlikely that any sane userspace currently modifies VMAs in such a
way as to trigger this race. And even with directed testing I was unable
to reproduce it. But a sufficiently motivated host userspace might be
able to exploit this race.
Note KVM/ARM had the same bug and was fixed in a separate, near
identical patch (see Link).
Link: https://lore.kernel.org/kvm/20230313235454.2964067-1-dmatlack@google.com/
Fixes: 9955371cc014 ("RISC-V: KVM: Implement MMU notifiers")
Cc: stable(a)vger.kernel.org
Signed-off-by: David Matlack <dmatlack(a)google.com>
---
Note: Compile-tested only.
arch/riscv/kvm/mmu.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/arch/riscv/kvm/mmu.c b/arch/riscv/kvm/mmu.c
index 78211aed36fa..46d692995830 100644
--- a/arch/riscv/kvm/mmu.c
+++ b/arch/riscv/kvm/mmu.c
@@ -628,6 +628,13 @@ int kvm_riscv_gstage_map(struct kvm_vcpu *vcpu,
!(memslot->flags & KVM_MEM_READONLY)) ? true : false;
unsigned long vma_pagesize, mmu_seq;
+ /* We need minimum second+third level pages */
+ ret = kvm_mmu_topup_memory_cache(pcache, gstage_pgd_levels);
+ if (ret) {
+ kvm_err("Failed to topup G-stage cache\n");
+ return ret;
+ }
+
mmap_read_lock(current->mm);
vma = vma_lookup(current->mm, hva);
@@ -648,6 +655,15 @@ int kvm_riscv_gstage_map(struct kvm_vcpu *vcpu,
if (vma_pagesize == PMD_SIZE || vma_pagesize == PUD_SIZE)
gfn = (gpa & huge_page_mask(hstate_vma(vma))) >> PAGE_SHIFT;
+ /*
+ * Read mmu_invalidate_seq so that KVM can detect if the results of
+ * vma_lookup() or gfn_to_pfn_prot() become stale priort to acquiring
+ * kvm->mmu_lock.
+ *
+ * Rely on mmap_read_unlock() for an implicit smp_rmb(), which pairs
+ * with the smp_wmb() in kvm_mmu_invalidate_end().
+ */
+ mmu_seq = kvm->mmu_invalidate_seq;
mmap_read_unlock(current->mm);
if (vma_pagesize != PUD_SIZE &&
@@ -657,15 +673,6 @@ int kvm_riscv_gstage_map(struct kvm_vcpu *vcpu,
return -EFAULT;
}
- /* We need minimum second+third level pages */
- ret = kvm_mmu_topup_memory_cache(pcache, gstage_pgd_levels);
- if (ret) {
- kvm_err("Failed to topup G-stage cache\n");
- return ret;
- }
-
- mmu_seq = kvm->mmu_invalidate_seq;
-
hfn = gfn_to_pfn_prot(kvm, gfn, is_write, &writable);
if (hfn == KVM_PFN_ERR_HWPOISON) {
send_sig_mceerr(BUS_MCEERR_AR, (void __user *)hva,
base-commit: eeac8ede17557680855031c6f305ece2378af326
--
2.40.0.rc2.332.ga46443480c-goog
The crypto_unregister_alg() function expects callers to ensure that any
algorithm that is unregistered has a refcnt of exactly 1, and issues a
BUG_ON() if this is not the case. However, there are in fact drivers that
will call crypto_unregister_alg() without ensuring that the refcnt has been
lowered first, most notably on system shutdown. This causes the BUG_ON() to
trigger, which prevents a clean shutdown and hangs the system.
To avoid such hangs on shutdown, demote the BUG_ON() in
crypto_unregister_alg() to a WARN_ON() with early return. Cc stable because
this problem was observed on a 6.2 kernel, cf the link below.
Link: https://lore.kernel.org/r/87r0tyq8ph.fsf@toke.dk
Cc: stable(a)vger.kernel.org
Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com>
---
v2:
- Return early if the WARN_ON() triggers
crypto/algapi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/crypto/algapi.c b/crypto/algapi.c
index d08f864f08be..9de0677b3643 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -493,7 +493,9 @@ void crypto_unregister_alg(struct crypto_alg *alg)
if (WARN(ret, "Algorithm %s is not registered", alg->cra_driver_name))
return;
- BUG_ON(refcount_read(&alg->cra_refcnt) != 1);
+ if (WARN_ON(refcount_read(&alg->cra_refcnt) != 1))
+ return;
+
if (alg->cra_destroy)
alg->cra_destroy(alg);
--
2.39.2
Hi, Thorsten here, the Linux kernel's regression tracker.
I noticed a regression report in bugzilla.kernel.org. As many (most?)
kernel developers don't keep an eye on it, I decided to forward it by
mail (note, the reporter *is not* CCed to this mail, see[1]).
Note, it's a stable regression, so it's a bit unclear who's responsible.
I decided to forward it nevertheless, as some of you might want to be
aware of this or might even have an idea what's wrong.
Quoting from https://bugzilla.kernel.org/show_bug.cgi?id=217225 :
> runrin 2023-03-21 17:49:34 UTC
>
> I occasionally manage my fan speed manually by changing the `level' in
> `/proc/acpi/ibm/fan'. As of upgrading to 6.1.20, I am now getting the
> following error when attempting to change the fan speed:
>
> $ echo 'level auto' > /proc/acpi/ibm/fan
> echo: write error: invalid argument
>
> While troubleshooting, I tried double checking that fan_control had been
> set to 1 as noted in the documentation.
>
> I recently upgraded my kernel a few versions at once, so unfortunately i
> can't be sure when this bug originated. It was working with 6.1.15, and
> since upgrading to 6.1.20 it is no longer working.
See the ticket for more details. The reporter was already asked to
bisect. I'll ask to consider testing latest mainline.
[TLDR for the rest of this mail: I'm adding this report to the list of
tracked Linux kernel regressions; the text you find below is based on a
few templates paragraphs you might have encountered already in similar
form.]
BTW, let me use this mail to also add the report to the list of tracked
regressions to ensure it's doesn't fall through the cracks:
#regzbot introduced: v6.1.15..v6.1.20
https://bugzilla.kernel.org/show_bug.cgi?id=217225
#regzbot title: platform: thinkpad: can no longer alter /proc/acpi/ibm/fan
#regzbot ignore-activity
This isn't a regression? This issue or a fix for it are already
discussed somewhere else? It was fixed already? You want to clarify when
the regression started to happen? Or point out I got the title or
something else totally wrong? Then just reply and tell me -- ideally
while also telling regzbot about it, as explained by the page listed in
the footer of this mail.
Developers: When fixing the issue, remember to add 'Link:' tags pointing
to the report (e.g. the buzgzilla ticket and maybe this mail as well, if
this thread sees some discussion). See page linked in footer for details.
Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
--
Everything you wanna know about Linux kernel regression tracking:
https://linux-regtracking.leemhuis.info/about/#tldr
If I did something stupid, please tell me, as explained on that page.
[1] because bugzilla.kernel.org tells users upon registration their
"email address will never be displayed to logged out users"
From: Martin Leung <Martin.Leung(a)amd.com>
[Why & How]
when trying to fix a nullptr dereference on VMs,
accidentally doubly allocated memory for the non VM
case. removed the extra link_srv creation since
dc_construct_ctx is called in both VM and non VM cases
Also added a proper fail check for if kzalloc fails
Cc: stable(a)vger.kernel.org
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Reviewed-by: Leo Ma <Hanghong.Ma(a)amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo(a)amd.com>
Signed-off-by: Martin Leung <Martin.Leung(a)amd.com>
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 40f2e174c524..52564b93f7eb 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -887,7 +887,10 @@ static bool dc_construct_ctx(struct dc *dc,
}
dc->ctx = dc_ctx;
+
dc->link_srv = link_create_link_service();
+ if (!dc->link_srv)
+ return false;
return true;
}
@@ -986,8 +989,6 @@ static bool dc_construct(struct dc *dc,
goto fail;
}
- dc->link_srv = link_create_link_service();
-
dc->res_pool = dc_create_resource_pool(dc, init_params, dc_ctx->dce_version);
if (!dc->res_pool)
goto fail;
--
2.34.1
From: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
[Why]
While scanning the top_pipe connections we can run into a case where
the bottom pipe is still connected to a top_pipe but with a NULL
plane_state.
[How]
Treat a NULL plane_state the same as the plane being invisible for
pipe cursor disable logic.
Cc: stable(a)vger.kernel.org
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Reviewed-by: Charlene Liu <Charlene.Liu(a)amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo(a)amd.com>
Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
---
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 7f9cceb49f4e..46ca88741cb8 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3385,7 +3385,9 @@ static bool dcn10_can_pipe_disable_cursor(struct pipe_ctx *pipe_ctx)
for (test_pipe = pipe_ctx->top_pipe; test_pipe;
test_pipe = test_pipe->top_pipe) {
// Skip invisible layer and pipe-split plane on same layer
- if (!test_pipe->plane_state->visible || test_pipe->plane_state->layer_index == cur_layer)
+ if (!test_pipe->plane_state ||
+ !test_pipe->plane_state->visible ||
+ test_pipe->plane_state->layer_index == cur_layer)
continue;
r2 = test_pipe->plane_res.scl_data.recout;
--
2.34.1
It looks like HDMI audio stopped working in 5.17-rc1. I ran a bisect
which points to 636110411ca726f19ef8e87b0be51bb9a4cdef06. I built
5.17.14 with it reverted and it restored HDMI output, but it doesn't
revert cleanly from 5.18 onward.
From what I can tell it looks like -ENOTSUPP is returned from
snd_soc_dai_set_stream for hdmi1 and hdmi2 now. I'm not sure if that's
expected, but I made the following change and I have working HDMI
audio now. https://gist.github.com/jmontleon/4780154c309f956d97ca9a304a00da3f
Thank you,
Jason Montleon
Make num_cache_leaves a per-CPU variable. Otherwise, populate_cache_
leaves() fails on systems with asymmetric number of subleaves in CPUID
leaf 0x4. Intel Meteor Lake is an example of such a system.
Cc: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
Cc: Len Brown <len.brown(a)intel.com>
Cc: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com>
Cc: Zhang Rui <rui.zhang(a)intel.com>
Cc: Chen Yu <yu.c.chen(a)intel.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Len Brown <len.brown(a)intel.com>
Signed-off-by: Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com>
---
After this change, all CPUs will traverse CPUID leaf 0x4 when booted for
the first time. On systems with asymmetric cache topologies this is
useless work.
Creating a list of processor models that have asymmetric cache topologies
was considered. The burden of maintaining such list would outweigh the
performance benefit of skipping this extra step.
---
arch/x86/kernel/cpu/cacheinfo.c | 48 ++++++++++++++++++++-------------
1 file changed, 29 insertions(+), 19 deletions(-)
diff --git a/arch/x86/kernel/cpu/cacheinfo.c b/arch/x86/kernel/cpu/cacheinfo.c
index 4063e8991211..6ad51657c853 100644
--- a/arch/x86/kernel/cpu/cacheinfo.c
+++ b/arch/x86/kernel/cpu/cacheinfo.c
@@ -176,7 +176,18 @@ struct _cpuid4_info_regs {
struct amd_northbridge *nb;
};
-static unsigned short num_cache_leaves;
+static DEFINE_PER_CPU(unsigned short, num_cache_leaves);
+
+static inline unsigned short get_num_cache_leaves(unsigned int cpu)
+{
+ return per_cpu(num_cache_leaves, cpu);
+}
+
+static inline void
+set_num_cache_leaves(unsigned short nr_leaves, unsigned int cpu)
+{
+ per_cpu(num_cache_leaves, cpu) = nr_leaves;
+}
/* AMD doesn't have CPUID4. Emulate it here to report the same
information to the user. This makes some assumptions about the machine:
@@ -716,19 +727,21 @@ void cacheinfo_hygon_init_llc_id(struct cpuinfo_x86 *c, int cpu)
void init_amd_cacheinfo(struct cpuinfo_x86 *c)
{
+ unsigned int cpu = c->cpu_index;
+
if (boot_cpu_has(X86_FEATURE_TOPOEXT)) {
- num_cache_leaves = find_num_cache_leaves(c);
+ set_num_cache_leaves(find_num_cache_leaves(c), cpu);
} else if (c->extended_cpuid_level >= 0x80000006) {
if (cpuid_edx(0x80000006) & 0xf000)
- num_cache_leaves = 4;
+ set_num_cache_leaves(4, cpu);
else
- num_cache_leaves = 3;
+ set_num_cache_leaves(3, cpu);
}
}
void init_hygon_cacheinfo(struct cpuinfo_x86 *c)
{
- num_cache_leaves = find_num_cache_leaves(c);
+ set_num_cache_leaves(find_num_cache_leaves(c), c->cpu_index);
}
void init_intel_cacheinfo(struct cpuinfo_x86 *c)
@@ -738,24 +751,21 @@ void init_intel_cacheinfo(struct cpuinfo_x86 *c)
unsigned int new_l1d = 0, new_l1i = 0; /* Cache sizes from cpuid(4) */
unsigned int new_l2 = 0, new_l3 = 0, i; /* Cache sizes from cpuid(4) */
unsigned int l2_id = 0, l3_id = 0, num_threads_sharing, index_msb;
-#ifdef CONFIG_SMP
unsigned int cpu = c->cpu_index;
-#endif
if (c->cpuid_level > 3) {
- static int is_initialized;
-
- if (is_initialized == 0) {
- /* Init num_cache_leaves from boot CPU */
- num_cache_leaves = find_num_cache_leaves(c);
- is_initialized++;
- }
+ /*
+ * There should be at least one leaf. A non-zero value means
+ * that the number of leaves has been initialized.
+ */
+ if (!get_num_cache_leaves(cpu))
+ set_num_cache_leaves(find_num_cache_leaves(c), cpu);
/*
* Whenever possible use cpuid(4), deterministic cache
* parameters cpuid leaf to find the cache details
*/
- for (i = 0; i < num_cache_leaves; i++) {
+ for (i = 0; i < get_num_cache_leaves(cpu); i++) {
struct _cpuid4_info_regs this_leaf = {};
int retval;
@@ -791,14 +801,14 @@ void init_intel_cacheinfo(struct cpuinfo_x86 *c)
* Don't use cpuid2 if cpuid4 is supported. For P4, we use cpuid2 for
* trace cache
*/
- if ((num_cache_leaves == 0 || c->x86 == 15) && c->cpuid_level > 1) {
+ if ((!get_num_cache_leaves(cpu) || c->x86 == 15) && c->cpuid_level > 1) {
/* supports eax=2 call */
int j, n;
unsigned int regs[4];
unsigned char *dp = (unsigned char *)regs;
int only_trace = 0;
- if (num_cache_leaves != 0 && c->x86 == 15)
+ if (get_num_cache_leaves(cpu) && c->x86 == 15)
only_trace = 1;
/* Number of times to iterate */
@@ -1000,12 +1010,12 @@ int init_cache_level(unsigned int cpu)
{
struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
- if (!num_cache_leaves)
+ if (!get_num_cache_leaves(cpu))
return -ENOENT;
if (!this_cpu_ci)
return -EINVAL;
this_cpu_ci->num_levels = 3;
- this_cpu_ci->num_leaves = num_cache_leaves;
+ this_cpu_ci->num_leaves = get_num_cache_leaves(cpu);
return 0;
}
--
2.25.1
There are two related issues that appear in certain combinations with
clang and GNU binutils.
The first occurs when a version of clang that supports zicsr or zifencei
via '-march=' [1] (i.e, >= 17.x) is used in combination with a version
of GNU binutils that do not recognize zicsr and zifencei in the
'-march=' value (i.e., < 2.36):
riscv64-linux-gnu-ld: -march=rv64i2p0_m2p0_a2p0_c2p0_zicsr2p0_zifencei2p0: Invalid or unknown z ISA extension: 'zifencei'
riscv64-linux-gnu-ld: failed to merge target specific data of file fs/efivarfs/file.o
riscv64-linux-gnu-ld: -march=rv64i2p0_m2p0_a2p0_c2p0_zicsr2p0_zifencei2p0: Invalid or unknown z ISA extension: 'zifencei'
riscv64-linux-gnu-ld: failed to merge target specific data of file fs/efivarfs/super.o
The second occurs when a version of clang that does not support zicsr or
zifencei via '-march=' (i.e., <= 16.x) is used in combination with a
version of GNU as that defaults to a newer ISA base spec, which requires
specifying zicsr and zifencei in the '-march=' value explicitly (i.e, >=
2.38):
../arch/riscv/kernel/kexec_relocate.S: Assembler messages:
../arch/riscv/kernel/kexec_relocate.S:147: Error: unrecognized opcode `fence.i', extension `zifencei' required
clang-12: error: assembler command failed with exit code 1 (use -v to see invocation)
This is the same issue addressed by commit 6df2a016c0c8 ("riscv: fix
build with binutils 2.38") (see [2] for additional information) but
older versions of clang miss out on it because the cc-option check
fails:
clang-12: error: invalid arch name 'rv64imac_zicsr_zifencei', unsupported standard user-level extension 'zicsr'
clang-12: error: invalid arch name 'rv64imac_zicsr_zifencei', unsupported standard user-level extension 'zicsr'
To resolve the first issue, only attempt to add zicsr and zifencei to
the march string when using the GNU assembler 2.38 or newer, which is
when the default ISA spec was updated, requiring these extensions to be
specified explicitly. LLVM implements an older version of the base
specification for all currently released versions, so these instructions
are available as part of the 'i' extension. If LLVM's implementation is
updated in the future, a CONFIG_AS_IS_LLVM condition can be added to
CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI.
To resolve the second issue, use version 2.2 of the base ISA spec when
using an older version of clang that does not support zicsr or zifencei
via '-march=', as that is the spec version most compatible with the one
clang/LLVM implements and avoids the need to specify zicsr and zifencei
explicitly due to still being a part of 'i'.
[1]: https://github.com/llvm/llvm-project/commit/22e199e6afb1263c943c0c0d4498694…
[2]: https://lore.kernel.org/ZAxT7T9Xy1Fo3d5W@aurel32.net/
Cc: stable(a)vger.kernel.org
Link: https://github.com/ClangBuiltLinux/linux/issues/1808
Co-developed-by: Conor Dooley <conor.dooley(a)microchip.com>
Signed-off-by: Conor Dooley <conor.dooley(a)microchip.com>
Signed-off-by: Nathan Chancellor <nathan(a)kernel.org>
---
This is essentially a v3 of Conor's v1 and v2 but since I am sending the
patch after finding a separate but related issue, I left it at v1:
- v1: https://lore.kernel.org/20230223220546.52879-1-conor@kernel.org/
- v2: https://lore.kernel.org/20230308220842.1231003-1-conor@kernel.org/
I have built allmodconfig with the following toolchain combinations to
confirm this problem is resolved:
- clang 12/17 + GNU as and ld 2.35/2.39
- clang 12/17 with the integrated assembler + GNU ld 2.35/2.39
- clang 12/17 with the integrated assembler + ld.lld
There are a couple of other incompatibilities between clang-17 and GNU
binutils that I had to patch to get allmodconfig to build successfully
but those are less likely to be hit in practice because the full LLVM
stack can be used with LLVM versions 13.x and newer. I will follow up
with separate issues and patches.
---
arch/riscv/Kconfig | 22 ++++++++++++++++++++++
arch/riscv/Makefile | 10 ++++++----
2 files changed, 28 insertions(+), 4 deletions(-)
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index c5e42cc37604..5b182d1c196c 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -464,6 +464,28 @@ config TOOLCHAIN_HAS_ZIHINTPAUSE
depends on !32BIT || $(cc-option,-mabi=ilp32 -march=rv32ima_zihintpause)
depends on LLD_VERSION >= 150000 || LD_VERSION >= 23600
+config TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI
+ def_bool y
+ # https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=aed44286efa8ae871…
+ depends on AS_IS_GNU && AS_VERSION >= 23800
+ help
+ Newer binutils versions default to ISA spec version 20191213 which
+ moves some instructions from the I extension to the Zicsr and Zifencei
+ extensions.
+
+config TOOLCHAIN_NEEDS_OLD_ISA_SPEC
+ def_bool y
+ depends on TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI
+ # https://github.com/llvm/llvm-project/commit/22e199e6afb1263c943c0c0d4498694…
+ depends on CC_IS_CLANG && CLANG_VERSION < 170000
+ help
+ Certain versions of clang do not support zicsr and zifencei via -march
+ but newer versions of binutils require it for the reasons noted in the
+ help text of CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI. This
+ option causes an older ISA spec compatible with these older versions
+ of clang to be passed to GAS, which has the same result as passing zicsr
+ and zifencei to -march.
+
config FPU
bool "FPU support"
default y
diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
index 4de83b9b1772..b05e833a022d 100644
--- a/arch/riscv/Makefile
+++ b/arch/riscv/Makefile
@@ -57,10 +57,12 @@ riscv-march-$(CONFIG_ARCH_RV64I) := rv64ima
riscv-march-$(CONFIG_FPU) := $(riscv-march-y)fd
riscv-march-$(CONFIG_RISCV_ISA_C) := $(riscv-march-y)c
-# Newer binutils versions default to ISA spec version 20191213 which moves some
-# instructions from the I extension to the Zicsr and Zifencei extensions.
-toolchain-need-zicsr-zifencei := $(call cc-option-yn, -march=$(riscv-march-y)_zicsr_zifencei)
-riscv-march-$(toolchain-need-zicsr-zifencei) := $(riscv-march-y)_zicsr_zifencei
+ifdef CONFIG_TOOLCHAIN_NEEDS_OLD_ISA_SPEC
+KBUILD_CFLAGS += -Wa,-misa-spec=2.2
+KBUILD_AFLAGS += -Wa,-misa-spec=2.2
+else
+riscv-march-$(CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI) := $(riscv-march-y)_zicsr_zifencei
+endif
# Check if the toolchain supports Zihintpause extension
riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZIHINTPAUSE) := $(riscv-march-y)_zihintpause
---
base-commit: eeac8ede17557680855031c6f305ece2378af326
change-id: 20230313-riscv-zicsr-zifencei-fiasco-2941caebe7dc
Best regards,
--
Nathan Chancellor <nathan(a)kernel.org>
This is a note to let you know that I've just added the patch titled
usb: chipidea: core: fix possible concurrent when switch role
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
From 451b15ed138ec15bffbebb58a00ebdd884c3e659 Mon Sep 17 00:00:00 2001
From: Xu Yang <xu.yang_2(a)nxp.com>
Date: Fri, 17 Mar 2023 14:15:16 +0800
Subject: usb: chipidea: core: fix possible concurrent when switch role
The user may call role_store() when driver is handling
ci_handle_id_switch() which is triggerred by otg event or power lost
event. Unfortunately, the controller may go into chaos in this case.
Fix this by protecting it with mutex lock.
Fixes: a932a8041ff9 ("usb: chipidea: core: add sysfs group")
cc: <stable(a)vger.kernel.org>
Acked-by: Peter Chen <peter.chen(a)kernel.org>
Signed-off-by: Xu Yang <xu.yang_2(a)nxp.com>
Link: https://lore.kernel.org/r/20230317061516.2451728-2-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/chipidea/ci.h | 2 ++
drivers/usb/chipidea/core.c | 8 +++++++-
drivers/usb/chipidea/otg.c | 5 ++++-
3 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h
index 005c67cb3afb..f210b7489fd5 100644
--- a/drivers/usb/chipidea/ci.h
+++ b/drivers/usb/chipidea/ci.h
@@ -208,6 +208,7 @@ struct hw_bank {
* @in_lpm: if the core in low power mode
* @wakeup_int: if wakeup interrupt occur
* @rev: The revision number for controller
+ * @mutex: protect code from concorrent running when doing role switch
*/
struct ci_hdrc {
struct device *dev;
@@ -260,6 +261,7 @@ struct ci_hdrc {
bool in_lpm;
bool wakeup_int;
enum ci_revision rev;
+ struct mutex mutex;
};
static inline struct ci_role_driver *ci_role(struct ci_hdrc *ci)
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index b6f2a41de20e..281fc51720ce 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -987,8 +987,12 @@ static ssize_t role_store(struct device *dev,
if (role == CI_ROLE_END)
return -EINVAL;
- if (role == ci->role)
+ mutex_lock(&ci->mutex);
+
+ if (role == ci->role) {
+ mutex_unlock(&ci->mutex);
return n;
+ }
pm_runtime_get_sync(dev);
disable_irq(ci->irq);
@@ -998,6 +1002,7 @@ static ssize_t role_store(struct device *dev,
ci_handle_vbus_change(ci);
enable_irq(ci->irq);
pm_runtime_put_sync(dev);
+ mutex_unlock(&ci->mutex);
return (ret == 0) ? n : ret;
}
@@ -1033,6 +1038,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
return -ENOMEM;
spin_lock_init(&ci->lock);
+ mutex_init(&ci->mutex);
ci->dev = dev;
ci->platdata = dev_get_platdata(dev);
ci->imx28_write_fix = !!(ci->platdata->flags &
diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
index 622c3b68aa1e..f5490f2a5b6b 100644
--- a/drivers/usb/chipidea/otg.c
+++ b/drivers/usb/chipidea/otg.c
@@ -167,8 +167,10 @@ static int hw_wait_vbus_lower_bsv(struct ci_hdrc *ci)
void ci_handle_id_switch(struct ci_hdrc *ci)
{
- enum ci_role role = ci_otg_role(ci);
+ enum ci_role role;
+ mutex_lock(&ci->mutex);
+ role = ci_otg_role(ci);
if (role != ci->role) {
dev_dbg(ci->dev, "switching from %s to %s\n",
ci_role(ci)->name, ci->roles[role]->name);
@@ -198,6 +200,7 @@ void ci_handle_id_switch(struct ci_hdrc *ci)
if (role == CI_ROLE_GADGET)
ci_handle_vbus_change(ci);
}
+ mutex_unlock(&ci->mutex);
}
/**
* ci_otg_work - perform otg (vbus/id) event handle
--
2.40.0
This is a note to let you know that I've just added the patch titled
usb: chipdea: core: fix return -EINVAL if request role is the same
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
From 3670de80678961eda7fa2220883fc77c16868951 Mon Sep 17 00:00:00 2001
From: Xu Yang <xu.yang_2(a)nxp.com>
Date: Fri, 17 Mar 2023 14:15:15 +0800
Subject: usb: chipdea: core: fix return -EINVAL if request role is the same
with current role
It should not return -EINVAL if the request role is the same with current
role, return non-error and without do anything instead.
Fixes: a932a8041ff9 ("usb: chipidea: core: add sysfs group")
cc: <stable(a)vger.kernel.org>
Acked-by: Peter Chen <peter.chen(a)kernel.org>
Signed-off-by: Xu Yang <xu.yang_2(a)nxp.com>
Link: https://lore.kernel.org/r/20230317061516.2451728-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/chipidea/core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 27c601296130..b6f2a41de20e 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -984,9 +984,12 @@ static ssize_t role_store(struct device *dev,
strlen(ci->roles[role]->name)))
break;
- if (role == CI_ROLE_END || role == ci->role)
+ if (role == CI_ROLE_END)
return -EINVAL;
+ if (role == ci->role)
+ return n;
+
pm_runtime_get_sync(dev);
disable_irq(ci->irq);
ci_role_stop(ci);
--
2.40.0
Hello,
In order to resolve CVE-2023-23005 in kernel v6.1 stable tree, I would
like to request cherry-picking the below commit:
mm/demotion: fix NULL vs IS_ERR checking in memory_tier_init (4a625ce)
The above commit is needed only in v6.1 stable kernel tree since older
LTS versions don't have the implementation which introduced the
problem.
Thanks,
Vaibhav
Currently, vmxnet3 uses GRO callback only if LRO is disabled. However,
on smartNic based setups where UPT is supported, LRO can be enabled
from guest VM but UPT devicve does not support LRO as of now. In such
cases, there can be performance degradation as GRO is not being done.
This patch fixes this issue by calling GRO API when UPT is enabled. We
use updateRxProd to determine if UPT mode is active or not.
To clarify few things discussed over the thread:
The patch is not neglecting any feature bits nor disabling GRO. It uses
GRO callback when UPT is active as LRO is not available in UPT.
GRO callback cannot be used as default for all cases as it degrades
performance for non-UPT cases or for cases when LRO is already done in
ESXi.
Cc: stable(a)vger.kernel.org
Fixes: 6f91f4ba046e ("vmxnet3: add support for capability registers")
Signed-off-by: Ronak Doshi <doshir(a)vmware.com>
Acked-by: Guolin Yang <gyang(a)vmware.com>
---
drivers/net/vmxnet3/vmxnet3_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 682987040ea8..8f7ac7d85afc 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1688,7 +1688,8 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
if (unlikely(rcd->ts))
__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), rcd->tci);
- if (adapter->netdev->features & NETIF_F_LRO)
+ /* Use GRO callback if UPT is enabled */
+ if ((adapter->netdev->features & NETIF_F_LRO) && !rq->shared->updateRxProd)
netif_receive_skb(skb);
else
napi_gro_receive(&rq->napi, skb);
--
2.11.0
From: NeilBrown <neilb(a)suse.de>
[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
slot_store() uses kstrtouint() to get a slot number, but stores the
result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is
very large.
A negative number means that the slot is empty, but setting a negative
slot number this way will not remove the device from the array. I don't
think this is a serious problem, but it could cause confusion and it is
best to fix it.
Reported-by: Dan Carpenter <error27(a)gmail.com>
Signed-off-by: NeilBrown <neilb(a)suse.de>
Signed-off-by: Song Liu <song(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/md/md.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 89d4dcc5253e5..f8c111b369928 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2991,6 +2991,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
err = kstrtouint(buf, 10, (unsigned int *)&slot);
if (err < 0)
return err;
+ if (slot < 0)
+ /* overflow */
+ return -ENOSPC;
}
if (rdev->mddev->pers && slot == -1) {
/* Setting 'slot' on an active array requires also
--
2.39.2
From: Chris Wilson <chris.p.wilson(a)linux.intel.com>
i915_gem_object_create_lmem_from_data() lacks the flush of the data
written to lmem to ensure the object is marked as dirty and the writes
flushed to the backing store. Once created, we can immediately release
the obj->mm.mapping caching of the vmap.
Fixes: 7acbbc7cf485 ("drm/i915/guc: put all guc objects in lmem when available")
Cc: Matthew Auld <matthew.auld(a)intel.com>
Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com>
Cc: Andi Shyti <andi.shyti(a)linux.intel.com>
Cc: Matthew Brost <matthew.brost(a)intel.com>
Cc: John Harrison <John.C.Harrison(a)Intel.com>
Signed-off-by: Chris Wilson <chris.p.wilson(a)linux.intel.com>
Cc: <stable(a)vger.kernel.org> # v5.16+
Signed-off-by: Nirmoy Das <nirmoy.das(a)intel.com>
---
drivers/gpu/drm/i915/gem/i915_gem_lmem.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_lmem.c b/drivers/gpu/drm/i915/gem/i915_gem_lmem.c
index 8949fb0a944f..3198b64ad7db 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_lmem.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_lmem.c
@@ -127,7 +127,8 @@ i915_gem_object_create_lmem_from_data(struct drm_i915_private *i915,
memcpy(map, data, size);
- i915_gem_object_unpin_map(obj);
+ i915_gem_object_flush_map(obj);
+ __i915_gem_object_release_map(obj);
return obj;
}
--
2.39.0
modpost now reads CRCs from .*.cmd files, parsing them using strtol().
This is inconsistent with its parsing of Module.symvers and with their
definition as *unsigned* 32-bit values.
strtol() clamps values to [LONG_MIN, LONG_MAX], and when building on a
32-bit system this changes all CRCs >= 0x80000000 to be 0x7fffffff.
Change extract_crcs_for_object() to use strtoul() instead.
Cc: stable(a)vger.kernel.org
Fixes: f292d875d0dc ("modpost: extract symbol versions from *.cmd files")
Signed-off-by: Ben Hutchings <ben(a)decadent.org.uk>
---
scripts/mod/modpost.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index efff8078e395..9466b6a2abae 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1733,7 +1733,7 @@ static void extract_crcs_for_object(const char *object, struct module *mod)
if (!isdigit(*p))
continue; /* skip this line */
- crc = strtol(p, &p, 0);
+ crc = strtoul(p, &p, 0);
if (*p != '\n')
continue; /* skip this line */
The commit 49c47cc21b5b (net: tls: fix possible race condition between
do_tls_getsockopt_conf() and do_tls_setsockopt_conf()) fixes race
condition and use after free. This patch didn't apply cleanly in 5.10
kernel due to the added cipher_types in do_tls_getsockopt_conf function.
Hangyu Hua (1):
net: tls: fix possible race condition between do_tls_getsockopt_conf()
and do_tls_setsockopt_conf()
net/tls/tls_main.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--
2.40.0.348.gf938b09366-goog
The commit 49c47cc21b5b (net: tls: fix possible race condition between
do_tls_getsockopt_conf() and do_tls_setsockopt_conf()) fixes race
condition and use after free. This patch didn't apply cleanly in 5.10
kernel due to the added cipher_types in do_tls_getsockopt_conf function.
Hangyu Hua (1):
net: tls: fix possible race condition between do_tls_getsockopt_conf()
and do_tls_setsockopt_conf()
net/tls/tls_main.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--
2.40.0.348.gf938b09366-goog
The quilt patch titled
Subject: kcsan: avoid passing -g for test
has been removed from the -mm tree. Its filename was
kcsan-avoid-passing-g-for-test.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Marco Elver <elver(a)google.com>
Subject: kcsan: avoid passing -g for test
Date: Thu, 16 Mar 2023 23:47:05 +0100
Nathan reported that when building with GNU as and a version of clang that
defaults to DWARF5, the assembler will complain with:
Error: non-constant .uleb128 is not supported
This is because `-g` defaults to the compiler debug info default. If the
assembler does not support some of the directives used, the above errors
occur. To fix, remove the explicit passing of `-g`.
All the test wants is that stack traces print valid function names, and
debug info is not required for that. (I currently cannot recall why I
added the explicit `-g`.)
Link: https://lkml.kernel.org/r/20230316224705.709984-2-elver@google.com
Fixes: 1fe84fd4a402 ("kcsan: Add test suite")
Signed-off-by: Marco Elver <elver(a)google.com>
Reported-by: Nathan Chancellor <nathan(a)kernel.org>
Cc: Alexander Potapenko <glider(a)google.com>
Cc: Dmitry Vyukov <dvyukov(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/kernel/kcsan/Makefile~kcsan-avoid-passing-g-for-test
+++ a/kernel/kcsan/Makefile
@@ -16,6 +16,6 @@ obj-y := core.o debugfs.o report.o
KCSAN_INSTRUMENT_BARRIERS_selftest.o := y
obj-$(CONFIG_KCSAN_SELFTEST) += selftest.o
-CFLAGS_kcsan_test.o := $(CFLAGS_KCSAN) -g -fno-omit-frame-pointer
+CFLAGS_kcsan_test.o := $(CFLAGS_KCSAN) -fno-omit-frame-pointer
CFLAGS_kcsan_test.o += $(DISABLE_STRUCTLEAK_PLUGIN)
obj-$(CONFIG_KCSAN_KUNIT_TEST) += kcsan_test.o
_
Patches currently in -mm which might be from elver(a)google.com are
The quilt patch titled
Subject: kfence: avoid passing -g for test
has been removed from the -mm tree. Its filename was
kfence-avoid-passing-g-for-test.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Marco Elver <elver(a)google.com>
Subject: kfence: avoid passing -g for test
Date: Thu, 16 Mar 2023 23:47:04 +0100
Nathan reported that when building with GNU as and a version of clang that
defaults to DWARF5:
$ make -skj"$(nproc)" ARCH=riscv CROSS_COMPILE=riscv64-linux-gnu- \
LLVM=1 LLVM_IAS=0 O=build \
mrproper allmodconfig mm/kfence/kfence_test.o
/tmp/kfence_test-08a0a0.s: Assembler messages:
/tmp/kfence_test-08a0a0.s:14627: Error: non-constant .uleb128 is not supported
/tmp/kfence_test-08a0a0.s:14628: Error: non-constant .uleb128 is not supported
/tmp/kfence_test-08a0a0.s:14632: Error: non-constant .uleb128 is not supported
/tmp/kfence_test-08a0a0.s:14633: Error: non-constant .uleb128 is not supported
/tmp/kfence_test-08a0a0.s:14639: Error: non-constant .uleb128 is not supported
...
This is because `-g` defaults to the compiler debug info default. If the
assembler does not support some of the directives used, the above errors
occur. To fix, remove the explicit passing of `-g`.
All the test wants is that stack traces print valid function names, and
debug info is not required for that. (I currently cannot recall why I
added the explicit `-g`.)
Link: https://lkml.kernel.org/r/20230316224705.709984-1-elver@google.com
Fixes: bc8fbc5f305a ("kfence: add test suite")
Signed-off-by: Marco Elver <elver(a)google.com>
Reported-by: Nathan Chancellor <nathan(a)kernel.org>
Cc: Alexander Potapenko <glider(a)google.com>
Cc: Dmitry Vyukov <dvyukov(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/kfence/Makefile~kfence-avoid-passing-g-for-test
+++ a/mm/kfence/Makefile
@@ -2,5 +2,5 @@
obj-y := core.o report.o
-CFLAGS_kfence_test.o := -g -fno-omit-frame-pointer -fno-optimize-sibling-calls
+CFLAGS_kfence_test.o := -fno-omit-frame-pointer -fno-optimize-sibling-calls
obj-$(CONFIG_KFENCE_KUNIT_TEST) += kfence_test.o
_
Patches currently in -mm which might be from elver(a)google.com are
The quilt patch titled
Subject: mm: kfence: fix using kfence_metadata without initialization in show_object()
has been removed from the -mm tree. Its filename was
mm-kfence-fix-using-kfence_metadata-without-initialization-in-show_object.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Muchun Song <songmuchun(a)bytedance.com>
Subject: mm: kfence: fix using kfence_metadata without initialization in show_object()
Date: Wed, 15 Mar 2023 11:44:41 +0800
The variable kfence_metadata is initialized in kfence_init_pool(), then,
it is not initialized if kfence is disabled after booting. In this case,
kfence_metadata will be used (e.g. ->lock and ->state fields) without
initialization when reading /sys/kernel/debug/kfence/objects. There will
be a warning if you enable CONFIG_DEBUG_SPINLOCK. Fix it by creating
debugfs files when necessary.
Link: https://lkml.kernel.org/r/20230315034441.44321-1-songmuchun@bytedance.com
Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")
Signed-off-by: Muchun Song <songmuchun(a)bytedance.com>
Tested-by: Marco Elver <elver(a)google.com>
Reviewed-by: Marco Elver <elver(a)google.com>
Cc: Alexander Potapenko <glider(a)google.com>
Cc: Dmitry Vyukov <dvyukov(a)google.com>
Cc: Jann Horn <jannh(a)google.com>
Cc: SeongJae Park <sjpark(a)amazon.de>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/kfence/core.c~mm-kfence-fix-using-kfence_metadata-without-initialization-in-show_object
+++ a/mm/kfence/core.c
@@ -726,10 +726,14 @@ static const struct seq_operations objec
};
DEFINE_SEQ_ATTRIBUTE(objects);
-static int __init kfence_debugfs_init(void)
+static int kfence_debugfs_init(void)
{
- struct dentry *kfence_dir = debugfs_create_dir("kfence", NULL);
+ struct dentry *kfence_dir;
+ if (!READ_ONCE(kfence_enabled))
+ return 0;
+
+ kfence_dir = debugfs_create_dir("kfence", NULL);
debugfs_create_file("stats", 0444, kfence_dir, NULL, &stats_fops);
debugfs_create_file("objects", 0400, kfence_dir, NULL, &objects_fops);
return 0;
@@ -883,6 +887,8 @@ static int kfence_init_late(void)
}
kfence_init_enable();
+ kfence_debugfs_init();
+
return 0;
}
_
Patches currently in -mm which might be from songmuchun(a)bytedance.com are
mm-kfence-fix-pg_slab-and-memcg_data-clearing.patch
mm-hugetlb_vmemmap-simplify-hugetlb_vmemmap_init-a-bit.patch
The quilt patch titled
Subject: Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare"
has been removed from the -mm tree. Its filename was
revert-kasan-drop-skip_kasan_poison-variable-in-free_pages_prepare.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Peter Collingbourne <pcc(a)google.com>
Subject: Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare"
Date: Thu, 9 Mar 2023 20:29:13 -0800
This reverts commit 487a32ec24be819e747af8c2ab0d5c515508086a.
should_skip_kasan_poison() reads the PG_skip_kasan_poison flag from
page->flags. However, this line of code in free_pages_prepare():
page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP;
clears most of page->flags, including PG_skip_kasan_poison, before calling
should_skip_kasan_poison(), which meant that it would never return true as
a result of the page flag being set. Therefore, fix the code to call
should_skip_kasan_poison() before clearing the flags, as we were doing
before the reverted patch.
This fixes a measurable performance regression introduced in the reverted
commit, where munmap() takes longer than intended if HW tags KASAN is
supported and enabled at runtime. Without this patch, we see a
single-digit percentage performance regression in a particular
mmap()-heavy benchmark when enabling HW tags KASAN, and with the patch,
there is no statistically significant performance impact when enabling HW
tags KASAN.
Link: https://lkml.kernel.org/r/20230310042914.3805818-2-pcc@google.com
Fixes: 487a32ec24be ("kasan: drop skip_kasan_poison variable in free_pages_prepare")
Link: https://linux-review.googlesource.com/id/Ic4f13affeebd20548758438bb9ed9ca40…
Signed-off-by: Peter Collingbourne <pcc(a)google.com>
Reviewed-by: Andrey Konovalov <andreyknvl(a)gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a(a)gmail.com>
Cc: Catalin Marinas <catalin.marinas(a)arm.com> [arm64]
Cc: Evgenii Stepanov <eugenis(a)google.com>
Cc: Vincenzo Frascino <vincenzo.frascino(a)arm.com>
Cc: Will Deacon <will(a)kernel.org>
Cc: <stable(a)vger.kernel.org> [6.1]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/page_alloc.c~revert-kasan-drop-skip_kasan_poison-variable-in-free_pages_prepare
+++ a/mm/page_alloc.c
@@ -1398,6 +1398,7 @@ static __always_inline bool free_pages_p
unsigned int order, bool check_free, fpi_t fpi_flags)
{
int bad = 0;
+ bool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags);
bool init = want_init_on_free();
VM_BUG_ON_PAGE(PageTail(page), page);
@@ -1470,7 +1471,7 @@ static __always_inline bool free_pages_p
* With hardware tag-based KASAN, memory tags must be set before the
* page becomes unavailable via debug_pagealloc or arch_free_page.
*/
- if (!should_skip_kasan_poison(page, fpi_flags)) {
+ if (!skip_kasan_poison) {
kasan_poison_pages(page, order, init);
/* Memory is already initialized if KASAN did it internally. */
_
Patches currently in -mm which might be from pcc(a)google.com are
kasan-call-clear_page-with-a-match-all-tag-instead-of-changing-page-tag.patch
kasan-remove-pg_skip_kasan_poison-flag.patch
The quilt patch titled
Subject: mm/ksm: fix race with VMA iteration and mm_struct teardown
has been removed from the -mm tree. Its filename was
mm-ksm-fix-race-with-vma-iteration-and-mm_struct-teardown.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com>
Subject: mm/ksm: fix race with VMA iteration and mm_struct teardown
Date: Wed, 8 Mar 2023 17:03:10 -0500
exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held
in write mode. Ensure that the maple tree is still valid by checking
ksm_test_exit() after taking the mmap_lock in read mode, but before the
for_each_vma() iterator dereferences a destroyed maple tree.
Since the maple tree is destroyed, the flags telling lockdep to check an
external lock has been cleared. Skip the for_each_vma() iterator to avoid
dereferencing a maple tree without the external lock flag, which would
create a lockdep warning.
Link: https://lkml.kernel.org/r/20230308220310.3119196-1-Liam.Howlett@oracle.com
Fixes: a5f18ba07276 ("mm/ksm: use vma iterators instead of vma linked list")
Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com>
Reported-by: Pengfei Xu <pengfei.xu(a)intel.com>
Link: https://lore.kernel.org/lkml/ZAdUUhSbaa6fHS36@xpf.sh.intel.com/
Reported-by: syzbot+2ee18845e89ae76342c5(a)syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=64a3e95957cd3deab99df7cd7b5a9475af92c9…
Acked-by: David Hildenbrand <david(a)redhat.com>
Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: <heng.su(a)intel.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/ksm.c~mm-ksm-fix-race-with-vma-iteration-and-mm_struct-teardown
+++ a/mm/ksm.c
@@ -988,9 +988,15 @@ static int unmerge_and_remove_all_rmap_i
mm = mm_slot->slot.mm;
mmap_read_lock(mm);
+
+ /*
+ * Exit right away if mm is exiting to avoid lockdep issue in
+ * the maple tree
+ */
+ if (ksm_test_exit(mm))
+ goto mm_exiting;
+
for_each_vma(vmi, vma) {
- if (ksm_test_exit(mm))
- break;
if (!(vma->vm_flags & VM_MERGEABLE) || !vma->anon_vma)
continue;
err = unmerge_ksm_pages(vma,
@@ -999,6 +1005,7 @@ static int unmerge_and_remove_all_rmap_i
goto error;
}
+mm_exiting:
remove_trailing_rmap_items(&mm_slot->rmap_list);
mmap_read_unlock(mm);
_
Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are
maple_tree-be-more-cautious-about-dead-nodes.patch
maple_tree-detect-dead-nodes-in-mas_start.patch
maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch
maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch
maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode.patch
maple_tree-add-smp_rmb-to-dead-node-detection.patch
maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch
mm-enable-maple-tree-rcu-mode-by-default.patch
The quilt patch titled
Subject: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
has been removed from the -mm tree. Its filename was
nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Subject: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
Date: Tue, 7 Mar 2023 17:55:48 +0900
The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a
metadata array to/from user space, may copy uninitialized buffer regions
to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO
and NILFS_IOCTL_GET_CPINFO.
This can occur when the element size of the user space metadata given by
the v_size member of the argument nilfs_argv structure is larger than the
size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo
structure) on the file system side.
KMSAN-enabled kernels detect this issue as follows:
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
include/linux/instrumented.h:121 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33
instrument_copy_to_user include/linux/instrumented.h:121 [inline]
_copy_to_user+0xc0/0x100 lib/usercopy.c:33
copy_to_user include/linux/uaccess.h:169 [inline]
nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99
nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]
nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290
nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343
__do_compat_sys_ioctl fs/ioctl.c:968 [inline]
__se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910
__ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at:
__alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572
alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287
__get_free_pages+0x34/0xc0 mm/page_alloc.c:5599
nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74
nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]
nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290
nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343
__do_compat_sys_ioctl fs/ioctl.c:968 [inline]
__se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910
__ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Bytes 16-127 of 3968 are uninitialized
...
This eliminates the leak issue by initializing the page allocated as
buffer using get_zeroed_page().
Link: https://lkml.kernel.org/r/20230307085548.6290-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Reported-by: syzbot+132fdd2f1e1805fdc591(a)syzkaller.appspotmail.com
Link: https://lkml.kernel.org/r/000000000000a5bd2d05f63f04ae@google.com
Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/fs/nilfs2/ioctl.c~nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy
+++ a/fs/nilfs2/ioctl.c
@@ -71,7 +71,7 @@ static int nilfs_ioctl_wrap_copy(struct
if (argv->v_index > ~(__u64)0 - argv->v_nmembs)
return -EINVAL;
- buf = (void *)__get_free_pages(GFP_NOFS, 0);
+ buf = (void *)get_zeroed_page(GFP_NOFS);
if (unlikely(!buf))
return -ENOMEM;
maxmembs = PAGE_SIZE / argv->v_size;
_
Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are
The quilt patch titled
Subject: test_maple_tree: add more testing for mas_empty_area()
has been removed from the -mm tree. Its filename was
test_maple_tree-add-more-testing-for-mas_empty_area.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com>
Subject: test_maple_tree: add more testing for mas_empty_area()
Date: Tue, 7 Mar 2023 13:02:47 -0500
Test robust filling of an entire area of the tree, then test one beyond.
This is to test the walking back up the tree at the end of nodes and error
condition. Test inspired by the reproducer code provided by Snild Dolkow.
The last test in the function tests for the case of a corrupted maple
state caused by the incorrect limits set during mas_skip_node(). There
needs to be a gap in the second last child and last child, but the search
must rule out the second last child's gap. This would avoid correcting
the maple state to the correct max limit and return an error.
Link: https://lkml.kernel.org/r/20230307180247.2220303-3-Liam.Howlett@oracle.com
Cc: Snild Dolkow <snild(a)sony.com>
Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.…
Fixes: e15e06a83923 ("lib/test_maple_tree: add testing for maple tree")
Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com>
Cc: Peng Zhang <zhangpeng.00(a)bytedance.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/lib/test_maple_tree.c~test_maple_tree-add-more-testing-for-mas_empty_area
+++ a/lib/test_maple_tree.c
@@ -2670,6 +2670,49 @@ static noinline void check_empty_area_wi
rcu_read_unlock();
}
+static noinline void check_empty_area_fill(struct maple_tree *mt)
+{
+ const unsigned long max = 0x25D78000;
+ unsigned long size;
+ int loop, shift;
+ MA_STATE(mas, mt, 0, 0);
+
+ mt_set_non_kernel(99999);
+ for (shift = 12; shift <= 16; shift++) {
+ loop = 5000;
+ size = 1 << shift;
+ while (loop--) {
+ mas_set(&mas, 0);
+ mas_lock(&mas);
+ MT_BUG_ON(mt, mas_empty_area(&mas, 0, max, size) != 0);
+ MT_BUG_ON(mt, mas.last != mas.index + size - 1);
+ mas_store_gfp(&mas, (void *)size, GFP_KERNEL);
+ mas_unlock(&mas);
+ mas_reset(&mas);
+ }
+ }
+
+ /* No space left. */
+ size = 0x1000;
+ rcu_read_lock();
+ MT_BUG_ON(mt, mas_empty_area(&mas, 0, max, size) != -EBUSY);
+ rcu_read_unlock();
+
+ /* Fill a depth 3 node to the maximum */
+ for (unsigned long i = 629440511; i <= 629440800; i += 6)
+ mtree_store_range(mt, i, i + 5, (void *)i, GFP_KERNEL);
+ /* Make space in the second-last depth 4 node */
+ mtree_erase(mt, 631668735);
+ /* Make space in the last depth 4 node */
+ mtree_erase(mt, 629506047);
+ mas_reset(&mas);
+ /* Search from just after the gap in the second-last depth 4 */
+ rcu_read_lock();
+ MT_BUG_ON(mt, mas_empty_area(&mas, 629506048, 690000000, 0x5000) != 0);
+ rcu_read_unlock();
+ mt_set_non_kernel(0);
+}
+
static DEFINE_MTREE(tree);
static int maple_tree_seed(void)
{
@@ -2926,6 +2969,11 @@ static int maple_tree_seed(void)
check_empty_area_window(&tree);
mtree_destroy(&tree);
+ mt_init_flags(&tree, MT_FLAGS_ALLOC_RANGE);
+ check_empty_area_fill(&tree);
+ mtree_destroy(&tree);
+
+
#if defined(BENCH)
skip:
#endif
_
Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are
maple_tree-be-more-cautious-about-dead-nodes.patch
maple_tree-detect-dead-nodes-in-mas_start.patch
maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch
maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch
maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode.patch
maple_tree-add-smp_rmb-to-dead-node-detection.patch
maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch
mm-enable-maple-tree-rcu-mode-by-default.patch
The quilt patch titled
Subject: maple_tree: fix mas_skip_node() end slot detection
has been removed from the -mm tree. Its filename was
maple_tree-fix-mas_skip_node-end-slot-detection.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com>
Subject: maple_tree: fix mas_skip_node() end slot detection
Date: Tue, 7 Mar 2023 13:02:46 -0500
Patch series "Fix mas_skip_node() for mas_empty_area()", v2.
mas_empty_area() was incorrectly returning an error when there was room.
The issue was tracked down to mas_skip_node() using the incorrect
end-of-slot count. Instead of using the nodes hard limit, the limit of
data should be used.
mas_skip_node() was also setting the min and max to that of the child
node, which was unnecessary. Within these limits being set, there was
also a bug that corrupted the maple state's max if the offset was set to
the maximum node pivot. The bug was without consequence unless there was
a sufficient gap in the next child node which would cause an error to be
returned.
This patch set fixes these errors by removing the limit setting from
mas_skip_node() and uses the mas_data_end() for slot limits, and adds
tests for all failures discovered.
This patch (of 2):
mas_skip_node() is used to move the maple state to the node with a higher
limit. It does this by walking up the tree and increasing the slot count.
Since slot count may not be able to be increased, it may need to walk up
multiple times to find room to walk right to a higher limit node. The
limit of slots that was being used was the node limit and not the last
location of data in the node. This would cause the maple state to be
shifted outside actual data and enter an error state, thus returning
-EBUSY.
The result of the incorrect error state means that mas_awalk() would
return an error instead of finding the allocation space.
The fix is to use mas_data_end() in mas_skip_node() to detect the nodes
data end point and continue walking the tree up until it is safe to move
to a node with a higher limit.
The walk up the tree also sets the maple state limits so remove the buggy
code from mas_skip_node(). Setting the limits had the unfortunate side
effect of triggering another bug if the parent node was full and the there
was no suitable gap in the second last child, but room in the next child.
mas_skip_node() may also be passed a maple state in an error state from
mas_anode_descend() when no allocations are available. Return on such an
error state immediately.
Link: https://lkml.kernel.org/r/20230307180247.2220303-1-Liam.Howlett@oracle.com
Link: https://lkml.kernel.org/r/20230307180247.2220303-2-Liam.Howlett@oracle.com
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com>
Reported-by: Snild Dolkow <snild(a)sony.com>
Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.…
Tested-by: Snild Dolkow <snild(a)sony.com>
Cc: Peng Zhang <zhangpeng.00(a)bytedance.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/lib/maple_tree.c~maple_tree-fix-mas_skip_node-end-slot-detection
+++ a/lib/maple_tree.c
@@ -5099,35 +5099,21 @@ static inline bool mas_rewind_node(struc
*/
static inline bool mas_skip_node(struct ma_state *mas)
{
- unsigned char slot, slot_count;
- unsigned long *pivots;
- enum maple_type mt;
+ if (mas_is_err(mas))
+ return false;
- mt = mte_node_type(mas->node);
- slot_count = mt_slots[mt] - 1;
do {
if (mte_is_root(mas->node)) {
- slot = mas->offset;
- if (slot > slot_count) {
+ if (mas->offset >= mas_data_end(mas)) {
mas_set_err(mas, -EBUSY);
return false;
}
} else {
mas_ascend(mas);
- slot = mas->offset;
- mt = mte_node_type(mas->node);
- slot_count = mt_slots[mt] - 1;
}
- } while (slot > slot_count);
-
- mas->offset = ++slot;
- pivots = ma_pivots(mas_mn(mas), mt);
- if (slot > 0)
- mas->min = pivots[slot - 1] + 1;
-
- if (slot <= slot_count)
- mas->max = pivots[slot];
+ } while (mas->offset >= mas_data_end(mas));
+ mas->offset++;
return true;
}
_
Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are
maple_tree-be-more-cautious-about-dead-nodes.patch
maple_tree-detect-dead-nodes-in-mas_start.patch
maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch
maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch
maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode.patch
maple_tree-add-smp_rmb-to-dead-node-detection.patch
maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch
mm-enable-maple-tree-rcu-mode-by-default.patch
On Tue, Mar 21, 2023 at 10:25 PM Guenter Roeck <linux(a)roeck-us.net> wrote:
>
> On Tue, Mar 21, 2023 at 08:35:34PM +0800, Xi Ruoyao wrote:
> > On Tue, 2023-03-21 at 14:29 +0800, Tiezhu Yang wrote:
> > > We can see the following messages with CONFIG_PROVE_LOCKING=y on
> > > LoongArch:
> > >
> > > BUG: MAX_STACK_TRACE_ENTRIES too low!
> > > turning off the locking correctness validator.
> > >
> > > This is because stack_trace_save() returns a big value after call
> > > arch_stack_walk(), here is the call trace:
> > >
> > > save_trace()
> > > stack_trace_save()
> > > arch_stack_walk()
> > > stack_trace_consume_entry()
> > >
> > > arch_stack_walk() should return immediately if unwind_next_frame()
> > > failed, no need to do the useless loops to increase the value of
> > > c->len in stack_trace_consume_entry(), then we can fix the above
> > > problem.
> > >
> > > Reported-by: Guenter Roeck <linux(a)roeck-us.net>
> > > Link: https://lore.kernel.org/all/8a44ad71-68d2-4926-892f-72bfc7a67e2a@roeck-us.n…
> > > Signed-off-by: Tiezhu Yang <yangtiezhu(a)loongson.cn>
> >
> > The fix makes sense, but I'm asking the same question again (sorry if
> > it's noisy): should we Cc stable(a)vger.kernel.org and/or make a PR for
> > 6.3?
> >
> > To me a bug fixes should be backported into all stable branches affected
> > by the bug, unless there is some serious difficulty. As 6.3 release
> > will work on launched 3A5000 boards out-of-box, people may want to stop
> > staying on the leading edge and use a LTS/stable release series. We
> > can't just say (or behave like) "we don't backport, please use latest
> > mainline" IMO :).
>
> It is a bug fix, isn't it ? It should be backported to v6.1+. Otherwise,
> if your policy is to not backport bug fixes, I might as well stop testing
> loongarch on all but the most recent kernel branch. Let me know if this is
> what you want. If so, I think you should let all other regression testers
> know that they should only test loongarch on mainline and possibly on
> linux-next.
This is of course a bug fix, but should Tiezhu resend this patch? Or
just replying to this message with CC stable(a)vger.kernel.org is
enough?
Huacai
>
> Thanks,
> Guenter
From: Dean Luick <dean.luick(a)cornelisnetworks.com>
[ Upstream commit 892ede5a77f337831609fb9c248ac60948061894 ]
Fix possible RMT overflow: Use the correct netdev size.
Don't allow adjusted user contexts to go negative.
Fix QOS calculation: Send kernel context count as an argument since
dd->n_krcv_queues is not yet set up in earliest call. Do not include
the control context in the QOS calculation. Use the same sized
variable to find the max of krcvq[] entries.
Update the RMT count explanation to make more sense.
Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com>
Link: https://lore.kernel.org/r/167329106946.1472990.18385495251650939054.stgit@a…
Signed-off-by: Leon Romanovsky <leon(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/infiniband/hw/hfi1/chip.c | 59 +++++++++++++++++--------------
1 file changed, 32 insertions(+), 27 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index ebe970f76232d..90b672feed83d 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -1056,7 +1056,7 @@ static void read_link_down_reason(struct hfi1_devdata *dd, u8 *ldr);
static void handle_temp_err(struct hfi1_devdata *dd);
static void dc_shutdown(struct hfi1_devdata *dd);
static void dc_start(struct hfi1_devdata *dd);
-static int qos_rmt_entries(struct hfi1_devdata *dd, unsigned int *mp,
+static int qos_rmt_entries(unsigned int n_krcv_queues, unsigned int *mp,
unsigned int *np);
static void clear_full_mgmt_pkey(struct hfi1_pportdata *ppd);
static int wait_link_transfer_active(struct hfi1_devdata *dd, int wait_ms);
@@ -13362,7 +13362,6 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
int ret;
unsigned ngroups;
int rmt_count;
- int user_rmt_reduced;
u32 n_usr_ctxts;
u32 send_contexts = chip_send_contexts(dd);
u32 rcv_contexts = chip_rcv_contexts(dd);
@@ -13421,28 +13420,34 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
(num_kernel_contexts + n_usr_ctxts),
&node_affinity.real_cpu_mask);
/*
- * The RMT entries are currently allocated as shown below:
- * 1. QOS (0 to 128 entries);
- * 2. FECN (num_kernel_context - 1 + num_user_contexts +
- * num_netdev_contexts);
- * 3. netdev (num_netdev_contexts).
- * It should be noted that FECN oversubscribe num_netdev_contexts
- * entries of RMT because both netdev and PSM could allocate any receive
- * context between dd->first_dyn_alloc_text and dd->num_rcv_contexts,
- * and PSM FECN must reserve an RMT entry for each possible PSM receive
- * context.
+ * RMT entries are allocated as follows:
+ * 1. QOS (0 to 128 entries)
+ * 2. FECN (num_kernel_context - 1 [a] + num_user_contexts +
+ * num_netdev_contexts [b])
+ * 3. netdev (NUM_NETDEV_MAP_ENTRIES)
+ *
+ * Notes:
+ * [a] Kernel contexts (except control) are included in FECN if kernel
+ * TID_RDMA is active.
+ * [b] Netdev and user contexts are randomly allocated from the same
+ * context pool, so FECN must cover all contexts in the pool.
*/
- rmt_count = qos_rmt_entries(dd, NULL, NULL) + (num_netdev_contexts * 2);
- if (HFI1_CAP_IS_KSET(TID_RDMA))
- rmt_count += num_kernel_contexts - 1;
- if (rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) {
- user_rmt_reduced = NUM_MAP_ENTRIES - rmt_count;
- dd_dev_err(dd,
- "RMT size is reducing the number of user receive contexts from %u to %d\n",
- n_usr_ctxts,
- user_rmt_reduced);
- /* recalculate */
- n_usr_ctxts = user_rmt_reduced;
+ rmt_count = qos_rmt_entries(num_kernel_contexts - 1, NULL, NULL)
+ + (HFI1_CAP_IS_KSET(TID_RDMA) ? num_kernel_contexts - 1
+ : 0)
+ + n_usr_ctxts
+ + num_netdev_contexts
+ + NUM_NETDEV_MAP_ENTRIES;
+ if (rmt_count > NUM_MAP_ENTRIES) {
+ int over = rmt_count - NUM_MAP_ENTRIES;
+ /* try to squish user contexts, minimum of 1 */
+ if (over >= n_usr_ctxts) {
+ dd_dev_err(dd, "RMT overflow: reduce the requested number of contexts\n");
+ return -EINVAL;
+ }
+ dd_dev_err(dd, "RMT overflow: reducing # user contexts from %u to %u\n",
+ n_usr_ctxts, n_usr_ctxts - over);
+ n_usr_ctxts -= over;
}
/* the first N are kernel contexts, the rest are user/netdev contexts */
@@ -14299,15 +14304,15 @@ static void clear_rsm_rule(struct hfi1_devdata *dd, u8 rule_index)
}
/* return the number of RSM map table entries that will be used for QOS */
-static int qos_rmt_entries(struct hfi1_devdata *dd, unsigned int *mp,
+static int qos_rmt_entries(unsigned int n_krcv_queues, unsigned int *mp,
unsigned int *np)
{
int i;
unsigned int m, n;
- u8 max_by_vl = 0;
+ uint max_by_vl = 0;
/* is QOS active at all? */
- if (dd->n_krcv_queues <= MIN_KERNEL_KCTXTS ||
+ if (n_krcv_queues < MIN_KERNEL_KCTXTS ||
num_vls == 1 ||
krcvqsset <= 1)
goto no_qos;
@@ -14365,7 +14370,7 @@ static void init_qos(struct hfi1_devdata *dd, struct rsm_map_table *rmt)
if (!rmt)
goto bail;
- rmt_entries = qos_rmt_entries(dd, &m, &n);
+ rmt_entries = qos_rmt_entries(dd->n_krcv_queues - 1, &m, &n);
if (rmt_entries == 0)
goto bail;
qpns_per_vl = 1 << m;
--
2.39.2
[Public]
Hi,
The commit "Remove OTG DIV register write for Virtual" was CC to stable but failed to apply 6.2.y and 6.1.y due to some small missing dependencies.
Here is the series of commits for 6.2.y needed:
3b214bb7185d ("drm/amd/display: fix k1 k2 divider programming for phantom streams")
709671ffb15d ("drm/amd/display: Remove OTG DIV register write for Virtual signals.")
Here is the series of commits for 6.1.y needed:
368307cef69c ("drm/amd/display: Include virtual signal to set k1 and k2 values")
3b214bb7185d ("drm/amd/display: fix k1 k2 divider programming for phantom streams")
709671ffb15d ("drm/amd/display: Remove OTG DIV register write for Virtual signals.")
Can you please apply for a future stable release?
Thanks!
From: NeilBrown <neilb(a)suse.de>
[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
slot_store() uses kstrtouint() to get a slot number, but stores the
result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is
very large.
A negative number means that the slot is empty, but setting a negative
slot number this way will not remove the device from the array. I don't
think this is a serious problem, but it could cause confusion and it is
best to fix it.
Reported-by: Dan Carpenter <error27(a)gmail.com>
Signed-off-by: NeilBrown <neilb(a)suse.de>
Signed-off-by: Song Liu <song(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/md/md.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 880a0ebca8660..69d1501d9160e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2967,6 +2967,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
err = kstrtouint(buf, 10, (unsigned int *)&slot);
if (err < 0)
return err;
+ if (slot < 0)
+ /* overflow */
+ return -ENOSPC;
}
if (rdev->mddev->pers && slot == -1) {
/* Setting 'slot' on an active array requires also
--
2.39.2
From: NeilBrown <neilb(a)suse.de>
[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
slot_store() uses kstrtouint() to get a slot number, but stores the
result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is
very large.
A negative number means that the slot is empty, but setting a negative
slot number this way will not remove the device from the array. I don't
think this is a serious problem, but it could cause confusion and it is
best to fix it.
Reported-by: Dan Carpenter <error27(a)gmail.com>
Signed-off-by: NeilBrown <neilb(a)suse.de>
Signed-off-by: Song Liu <song(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/md/md.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index aa2993d5d5d38..64558991ce0a0 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3082,6 +3082,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
err = kstrtouint(buf, 10, (unsigned int *)&slot);
if (err < 0)
return err;
+ if (slot < 0)
+ /* overflow */
+ return -ENOSPC;
}
if (rdev->mddev->pers && slot == -1) {
/* Setting 'slot' on an active array requires also
--
2.39.2
From: NeilBrown <neilb(a)suse.de>
[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
slot_store() uses kstrtouint() to get a slot number, but stores the
result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is
very large.
A negative number means that the slot is empty, but setting a negative
slot number this way will not remove the device from the array. I don't
think this is a serious problem, but it could cause confusion and it is
best to fix it.
Reported-by: Dan Carpenter <error27(a)gmail.com>
Signed-off-by: NeilBrown <neilb(a)suse.de>
Signed-off-by: Song Liu <song(a)kernel.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/md/md.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c0b34637bd667..1553c2495841b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3207,6 +3207,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
err = kstrtouint(buf, 10, (unsigned int *)&slot);
if (err < 0)
return err;
+ if (slot < 0)
+ /* overflow */
+ return -ENOSPC;
}
if (rdev->mddev->pers && slot == -1) {
/* Setting 'slot' on an active array requires also
--
2.39.2
Could we please get:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
'net: retrieve netns cookie via getsocketopt'
included in 5.10 LTS.
This is technically a feature, but it's absolutely trivial - it just
adds a new getsockopt to fetch a u64.
Using netns cookies from bpf without it is pretty annoying.
It doesn't cherrypick to 5.10 cleanly, due to trivial conflicts in
header files (previous constants haven't yet been defined),
and because of a post 5.10 change from atomic64_t to u64 - which
requires adding in an atomic_read(&).
I've uploaded a compiling version to:
https://android-review.googlesource.com/c/kernel/common/+/2503056
I think you should be able to cherrypick it via:
git fetch https://android.googlesource.com/kernel/common
refs/changes/56/2503056/2 && git cherry-pick FETCH_HEAD
Thanks!
Maciej Żenczykowski, Kernel Networking Developer @ Google
I'm announcing the release of the 5.4.238 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/filesystems/vfs.rst | 2 -
Makefile | 2 -
arch/s390/boot/ipl_report.c | 8 ++++
arch/x86/kvm/vmx/nested.c | 10 ++++-
arch/x86/mm/mem_encrypt_identity.c | 3 +
drivers/block/sunvdc.c | 2 +
drivers/clk/Kconfig | 2 -
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +---
drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 5 +-
drivers/gpu/drm/meson/meson_vpp.c | 2 +
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 -
drivers/hid/hid-core.c | 18 ++++++---
drivers/hid/uhid.c | 1
drivers/hwmon/adt7475.c | 8 ++--
drivers/hwmon/ina3221.c | 2 -
drivers/hwmon/xgene-hwmon.c | 1
drivers/interconnect/core.c | 4 ++
drivers/media/i2c/m5mols/m5mols_core.c | 2 -
drivers/mmc/host/atmel-mci.c | 3 -
drivers/net/ethernet/intel/i40e/i40e_main.c | 1
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 ++
drivers/net/ethernet/sun/ldmvsw.c | 3 +
drivers/net/ethernet/sun/sunvnet.c | 3 +
drivers/net/ipvlan/ipvlan_l3s.c | 1
drivers/net/phy/smsc.c | 5 ++
drivers/net/usb/smsc75xx.c | 7 +++
drivers/nfc/pn533/usb.c | 1
drivers/nfc/st-nci/ndlc.c | 6 ++-
drivers/nvme/target/core.c | 4 +-
drivers/pci/pci-driver.c | 4 +-
drivers/pci/pci.c | 54 ++++++++++++----------------
drivers/pci/pci.h | 10 ++++-
drivers/scsi/hosts.c | 5 --
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++-
drivers/tty/serial/8250/8250_em.c | 4 +-
drivers/tty/serial/fsl_lpuart.c | 12 ++++--
drivers/video/fbdev/stifb.c | 27 ++++++++++++++
fs/cifs/transport.c | 21 ++++------
fs/ext4/inode.c | 18 ++++-----
fs/ext4/namei.c | 4 --
fs/ext4/page-io.c | 10 +++--
fs/ext4/xattr.c | 11 +++++
fs/jffs2/file.c | 15 +++----
include/linux/hid.h | 3 +
include/linux/netdevice.h | 6 ++-
include/linux/sh_intc.h | 5 ++
include/linux/tracepoint.h | 15 +++----
kernel/trace/ftrace.c | 3 +
kernel/trace/trace_events_hist.c | 3 +
net/ipv4/fib_frontend.c | 3 +
net/ipv4/ip_tunnel.c | 12 +++---
net/ipv4/tcp_output.c | 2 -
net/ipv6/ip6_tunnel.c | 4 +-
net/iucv/iucv.c | 2 -
net/netfilter/nft_redir.c | 2 -
net/xfrm/xfrm_state.c | 3 -
sound/pci/hda/hda_intel.c | 22 ++++++++++-
sound/pci/hda/patch_hdmi.c | 3 +
58 files changed, 276 insertions(+), 143 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Bart Van Assche (1):
scsi: core: Fix a procfs host directory removal regression
Biju Das (1):
serial: 8250_em: Fix UART port type
Bjorn Helgaas (1):
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Christian Hewitt (1):
drm/meson: fix 1px pink line on GXM when scaling video overlay
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Dmitry Osipenko (1):
drm/panfrost: Don't sync rpm suspension after mmu flushing
Eric Biggers (1):
ext4: fix cgroup writeback accounting with fs-layer encryption
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Glenn Washburn (1):
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Greg Kroah-Hartman (1):
Linux 5.4.238
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Herbert Xu (1):
xfrm: Allow transport-mode states with AF_UNSPEC selector
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
Ivan Vecera (1):
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jeremy Sowden (1):
netfilter: nft_redir: correct value of inet type `.maxattrs`
Jianguo Wu (1):
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Johan Hovold (1):
interconnect: fix mem leak when freeing nodes
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Kai Vehmanen (4):
ALSA: hda - add Intel DG1 PCI and HDMI ids
ALSA: hda - controller is in GPU on the DG1
ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Lukas Wunner (1):
PCI: Unify delay handling for reset and resume
Marcus Folkesson (1):
hwmon: (ina3221) return prober error code
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Nikita Zhandarovich (1):
x86/mm: Fix use of uninitialized buffer in sme_enable()
Paolo Bonzini (1):
KVM: nVMX: add missing consistency checks for CR0 and CR4
Qu Huang (1):
drm/amdkfd: Fix an illegal memory access
Randy Dunlap (1):
clk: HI655X: select REGMAP instead of depending on it
Sherry Sun (1):
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Steven Rostedt (Google) (2):
tracing: Check field value in hist_field_name()
tracing: Make tracepoint lockdep check actually test something
Sven Schnelle (1):
s390/ipl: add missing intersection check to ipl_report handling
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Theodore Ts'o (1):
ext4: fix possible double unlock when moving a directory
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Wenchao Hao (1):
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Xiang Chen (1):
scsi: core: Fix a comment in function scsi_host_dev_release()
Yifei Liu (1):
jffs2: correct logic when creating a hole in jffs2_write_begin
Zhang Xiaoxu (1):
cifs: Move the in_send statistic to __smb_send_rqst()
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
I'm announcing the release of the 4.19.279 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/x86/mm/mem_encrypt_identity.c | 3 ++-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +++------
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/jffs2/file.c | 15 +++++++--------
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
include/linux/tracepoint.h | 15 ++++++---------
kernel/trace/ftrace.c | 3 ++-
kernel/trace/trace_events_hist.c | 3 +++
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
38 files changed, 159 insertions(+), 77 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Biju Das (1):
serial: 8250_em: Fix UART port type
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Eric Biggers (2):
ext4: fix cgroup writeback accounting with fs-layer encryption
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Greg Kroah-Hartman (1):
Linux 4.19.279
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Nikita Zhandarovich (1):
x86/mm: Fix use of uninitialized buffer in sme_enable()
Qu Huang (1):
drm/amdkfd: Fix an illegal memory access
Randy Dunlap (1):
clk: HI655X: select REGMAP instead of depending on it
Steven Rostedt (Google) (2):
tracing: Check field value in hist_field_name()
tracing: Make tracepoint lockdep check actually test something
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Yifei Liu (1):
jffs2: correct logic when creating a hole in jffs2_write_begin
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
I'm announcing the release of the 4.14.311 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/block/sunvdc.c | 2 ++
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
kernel/trace/ftrace.c | 3 ++-
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
32 files changed, 137 insertions(+), 52 deletions(-)
Alexandra Winter (1):
net/iucv: Fix size of interrupt data
Baokun Li (2):
ext4: fail ext4_iget if special inode unallocated
ext4: fix task hung in ext4_xattr_delete_inode
Biju Das (1):
serial: 8250_em: Fix UART port type
Breno Leitao (1):
tcp: tcp_make_synack() can be called from process context
Chen Zhongjin (1):
ftrace: Fix invalid address access in lookup_rec() when index is 0
Damien Le Moal (1):
nvmet: avoid potential UAF in nvmet_req_complete()
Daniil Tatianin (1):
qed/qed_dev: guard against a possible division by zero
Eric Biggers (2):
ext4: fix cgroup writeback accounting with fs-layer encryption
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Dumazet (1):
net: tunnels: annotate lockless accesses to dev->needed_headroom
Fedor Pchelkin (1):
nfc: pn533: initialize struct pn533_out_arg properly
Greg Kroah-Hartman (1):
Linux 4.14.311
Heiner Kallweit (1):
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Helge Deller (1):
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Ido Schimmel (1):
ipv4: Fix incorrect table ID in IOCTL path
John Harrison (1):
drm/i915: Don't use stolen memory for ring buffers with LLC
Lee Jones (2):
HID: core: Provide new max_buffer_size attribute to over-ride the default
HID: uhid: Over-ride the default maximum data buffer value with our own
Liang He (2):
block: sunvdc: add check for mdesc_grab() returning NULL
ethernet: sun: add check for the mdesc_grab()
Linus Torvalds (1):
media: m5mols: fix off-by-one loop termination error
Michael Karcher (1):
sh: intc: Avoid spurious sizeof-pointer-div warning
Szymon Heidrich (2):
net: usb: smsc75xx: Limit packet length to skb->len
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Tobias Schramm (1):
mmc: atmel-mci: fix race between stop command and start of next command
Tony O'Brien (2):
hwmon: (adt7475) Display smoothing attributes in correct order
hwmon: (adt7475) Fix masking of hysteresis registers
Zheng Wang (2):
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: b15888840207c2bfe678dd1f68a32db54315e71f
Gitweb: https://git.kernel.org/tip/b15888840207c2bfe678dd1f68a32db54315e71f
Author: Chang S. Bae <chang.seok.bae(a)intel.com>
AuthorDate: Mon, 27 Feb 2023 13:05:03 -08:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Wed, 22 Mar 2023 10:59:13 -07:00
x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf()
__copy_xstate_to_uabi_buf() copies either from the tasks XSAVE buffer
or from init_fpstate into the ptrace buffer. Dynamic features, like
XTILEDATA, have an all zeroes init state and are not saved in
init_fpstate, which means the corresponding bit is not set in the
xfeatures bitmap of the init_fpstate header.
But __copy_xstate_to_uabi_buf() retrieves addresses for both the tasks
xstate and init_fpstate unconditionally via __raw_xsave_addr().
So if the tasks XSAVE buffer has a dynamic feature set, then the
address retrieval for init_fpstate triggers the warning in
__raw_xsave_addr() which checks the feature bit in the init_fpstate
header.
Remove the address retrieval from init_fpstate for extended features.
They have an all zeroes init state so init_fpstate has zeros for them.
Then zeroing the user buffer for the init state is the same as copying
them from init_fpstate.
Fixes: 2308ee57d93d ("x86/fpu/amx: Enable the AMX feature in 64-bit mode")
Reported-by: Mingwei Zhang <mizhang(a)google.com>
Link: https://lore.kernel.org/kvm/20230221163655.920289-2-mizhang@google.com/
Signed-off-by: Chang S. Bae <chang.seok.bae(a)intel.com>
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Tested-by: Mingwei Zhang <mizhang(a)google.com>
Link: https://lore.kernel.org/all/20230227210504.18520-2-chang.seok.bae%40intel.c…
Cc: stable(a)vger.kernel.org
---
arch/x86/kernel/fpu/xstate.c | 30 ++++++++++++++----------------
1 file changed, 14 insertions(+), 16 deletions(-)
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 714166c..0bab497 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1118,21 +1118,20 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
zerofrom = offsetof(struct xregs_state, extended_state_area);
/*
- * The ptrace buffer is in non-compacted XSAVE format. In
- * non-compacted format disabled features still occupy state space,
- * but there is no state to copy from in the compacted
- * init_fpstate. The gap tracking will zero these states.
- */
- mask = fpstate->user_xfeatures;
-
- /*
- * Dynamic features are not present in init_fpstate. When they are
- * in an all zeros init state, remove those from 'mask' to zero
- * those features in the user buffer instead of retrieving them
- * from init_fpstate.
+ * This 'mask' indicates which states to copy from fpstate.
+ * Those extended states that are not present in fpstate are
+ * either disabled or initialized:
+ *
+ * In non-compacted format, disabled features still occupy
+ * state space but there is no state to copy from in the
+ * compacted init_fpstate. The gap tracking will zero these
+ * states.
+ *
+ * The extended features have an all zeroes init state. Thus,
+ * remove them from 'mask' to zero those features in the user
+ * buffer instead of retrieving them from init_fpstate.
*/
- if (fpu_state_size_dynamic())
- mask &= (header.xfeatures | xinit->header.xcomp_bv);
+ mask = header.xfeatures;
for_each_extended_xfeature(i, mask) {
/*
@@ -1151,9 +1150,8 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
pkru.pkru = pkru_val;
membuf_write(&to, &pkru, sizeof(pkru));
} else {
- copy_feature(header.xfeatures & BIT_ULL(i), &to,
+ membuf_write(&to,
__raw_xsave_addr(xsave, i),
- __raw_xsave_addr(xinit, i),
xstate_sizes[i]);
}
/*
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: a3f547addcaa10df5a226526bc9e2d9a94542344
Gitweb: https://git.kernel.org/tip/a3f547addcaa10df5a226526bc9e2d9a94542344
Author: Michal Koutný <mkoutny(a)suse.com>
AuthorDate: Mon, 06 Mar 2023 20:31:44 +01:00
Committer: Dave Hansen <dave.hansen(a)linux.intel.com>
CommitterDate: Wed, 22 Mar 2023 10:42:47 -07:00
x86/mm: Do not shuffle CPU entry areas without KASLR
The commit 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area") fixed
an omission of KASLR on CPU entry areas. It doesn't take into account
KASLR switches though, which may result in unintended non-determinism
when a user wants to avoid it (e.g. debugging, benchmarking).
Generate only a single combination of CPU entry areas offsets -- the
linear array that existed prior randomization when KASLR is turned off.
Since we have 3f148f331814 ("x86/kasan: Map shadow for percpu pages on
demand") and followups, we can use the more relaxed guard
kasrl_enabled() (in contrast to kaslr_memory_enabled()).
Fixes: 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area")
Signed-off-by: Michal Koutný <mkoutny(a)suse.com>
Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/all/20230306193144.24605-1-mkoutny%40suse.com
---
arch/x86/mm/cpu_entry_area.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c
index 7316a82..e91500a 100644
--- a/arch/x86/mm/cpu_entry_area.c
+++ b/arch/x86/mm/cpu_entry_area.c
@@ -10,6 +10,7 @@
#include <asm/fixmap.h>
#include <asm/desc.h>
#include <asm/kasan.h>
+#include <asm/setup.h>
static DEFINE_PER_CPU_PAGE_ALIGNED(struct entry_stack_page, entry_stack_storage);
@@ -29,6 +30,12 @@ static __init void init_cea_offsets(void)
unsigned int max_cea;
unsigned int i, j;
+ if (!kaslr_enabled()) {
+ for_each_possible_cpu(i)
+ per_cpu(_cea_offset, i) = i;
+ return;
+ }
+
max_cea = (CPU_ENTRY_AREA_MAP_SIZE - PAGE_SIZE) / CPU_ENTRY_AREA_SIZE;
/* O(sodding terrible) */
From: Matheus Castello <matheus.castello(a)toradex.com>
Returns EPROBE_DEFER when of_drm_find_bridge() fails, this is consistent
with what all the other DRM bridge drivers are doing and this is
required since the bridge might not be there when the driver is probed
and this should not be a fatal failure.
Cc: <stable(a)vger.kernel.org>
Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
Signed-off-by: Matheus Castello <matheus.castello(a)toradex.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini(a)toradex.com>
---
v2: use dev_err_probe() instead of dev_dbg() (Laurent)
---
drivers/gpu/drm/bridge/lontium-lt8912b.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
index 2019a8167d69..b40baced1331 100644
--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
+++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
@@ -676,8 +676,8 @@ static int lt8912_parse_dt(struct lt8912 *lt)
lt->hdmi_port = of_drm_find_bridge(port_node);
if (!lt->hdmi_port) {
- dev_err(lt->dev, "%s: Failed to get hdmi port\n", __func__);
- ret = -ENODEV;
+ ret = -EPROBE_DEFER;
+ dev_err_probe(lt->dev, ret, "%s: Failed to get hdmi port\n", __func__);
goto err_free_host_node;
}
--
2.25.1
From: Matheus Castello <matheus.castello(a)toradex.com>
Returns EPROBE_DEFER when of_drm_find_bridge() fails, this is consistent
with what all the other DRM bridge drivers are doing and this is
required since the bridge might not be there when the driver is probed
and this should not be a fatal failure.
Cc: <stable(a)vger.kernel.org>
Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
Signed-off-by: Matheus Castello <matheus.castello(a)toradex.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini(a)toradex.com>
---
drivers/gpu/drm/bridge/lontium-lt8912b.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
index 2019a8167d69..fec02e47cfdb 100644
--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
+++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
@@ -676,8 +676,8 @@ static int lt8912_parse_dt(struct lt8912 *lt)
lt->hdmi_port = of_drm_find_bridge(port_node);
if (!lt->hdmi_port) {
- dev_err(lt->dev, "%s: Failed to get hdmi port\n", __func__);
- ret = -ENODEV;
+ dev_dbg(lt->dev, "%s: Failed to get hdmi port\n", __func__);
+ ret = -EPROBE_DEFER;
goto err_free_host_node;
}
--
2.25.1
This is the start of the stable review cycle for the 4.19.278 release.
There are 27 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 18 Mar 2023 09:41:20 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.278-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.278-rc3
Eric Dumazet <edumazet(a)google.com>
ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
Kang Chen <void0red(a)gmail.com>
nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
Shigeru Yoshida <syoshida(a)redhat.com>
net: caif: Fix use-after-free in cfusbl_device_notify()
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use BAR mappings for ring buffers with LLC
Tung Nguyen <tung.q.nguyen(a)dektech.com.au>
tipc: improve function tipc_wait_for_cond()
Paul Elder <paul.elder(a)ideasonboard.com>
media: ov5640: Fix analogue gain control
Alvaro Karsz <alvaro.karsz(a)solid-run.com>
PCI: Add SolidRun vendor ID
Nathan Chancellor <nathan(a)kernel.org>
macintosh: windfarm: Use unsigned type for 1-bit bitfields
Edward Humes <aurxenon(a)lunos.org>
alpha: fix R_ALPHA_LITERAL reloc for large modules
xurui <xurui(a)kylinos.cn>
MIPS: Fix a compilation issue
Nobuhiro Iwamatsu <nobuhiro1.iwamatsu(a)toshiba.co.jp>
Revert "spi: mt7621: Fix an error message in mt7621_spi_probe()"
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: generate modules.order only in directories visited by obj-y/m
Masahiro Yamada <yamada.masahiro(a)socionext.com>
kbuild: fix false-positive need-builtin calculation
Jan Kara <jack(a)suse.cz>
udf: Detect system inodes linked into directory hierarchy
Jan Kara <jack(a)suse.cz>
udf: Preserve link count of system files
Jan Kara <jack(a)suse.cz>
udf: Remove pointless union in udf_inode_info
Steven J. Magnani <steve.magnani(a)digidescorp.com>
udf: reduce leakage of blocks related to named streams
Jan Kara <jack(a)suse.cz>
udf: Explain handling of load_nls() failure
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: change order inside nfc_se_io error path
Zhihao Cheng <chengzhihao1(a)huawei.com>
ext4: zero i_disksize when initializing the bootloader inode
Ye Bin <yebin10(a)huawei.com>
ext4: fix WARNING in ext4_update_inline_data
Ye Bin <yebin10(a)huawei.com>
ext4: move where set the MAY_INLINE_DATA flag is set
Darrick J. Wong <djwong(a)kernel.org>
ext4: fix another off-by-one fsmap error on 1k block filesystems
Eric Whitney <enwlinux(a)gmail.com>
ext4: fix RENAME_WHITEOUT handling for inline directories
Andrew Cooper <andrew.cooper3(a)citrix.com>
x86/CPU/AMD: Disable XSAVES on AMD family 0x17
Theodore Ts'o <tytso(a)mit.edu>
fs: prevent out-of-bounds array speculation when closing a file descriptor
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/kernel/module.c | 4 +-
arch/mips/include/asm/mach-rc32434/pci.h | 2 +-
arch/x86/kernel/cpu/amd.c | 9 ++++
drivers/gpu/drm/i915/intel_ringbuffer.c | 4 +-
drivers/macintosh/windfarm_lm75_sensor.c | 4 +-
drivers/macintosh/windfarm_smu_sensors.c | 4 +-
drivers/media/i2c/ov5640.c | 2 +-
drivers/nfc/fdp/i2c.c | 4 ++
drivers/scsi/hosts.c | 2 +
drivers/staging/mt7621-spi/spi-mt7621.c | 8 ++--
fs/ext4/fsmap.c | 2 +
fs/ext4/inline.c | 1 -
fs/ext4/inode.c | 7 ++-
fs/ext4/ioctl.c | 1 +
fs/ext4/namei.c | 13 +++---
fs/ext4/xattr.c | 3 ++
fs/file.c | 1 +
fs/udf/directory.c | 2 +-
fs/udf/file.c | 7 ++-
fs/udf/ialloc.c | 14 +++---
fs/udf/inode.c | 76 ++++++++++++++++++++++----------
fs/udf/misc.c | 6 +--
fs/udf/namei.c | 7 ++-
fs/udf/partition.c | 2 +-
fs/udf/super.c | 12 ++++-
fs/udf/symlink.c | 2 +-
fs/udf/udf_i.h | 12 ++---
include/linux/pci_ids.h | 2 +
net/caif/caif_usb.c | 3 ++
net/ipv6/ila/ila_xlat.c | 1 +
net/nfc/netlink.c | 2 +-
net/tipc/socket.c | 2 +-
scripts/Makefile.build | 4 +-
34 files changed, 150 insertions(+), 79 deletions(-)
The s11b supply is used by the wlan module (as well as some of the
pmics) which are not yet fully described in the devicetree.
Mark the regulator as always-on for now.
Fixes: 123b30a75623 ("arm64: dts: qcom: sc8280xp-x13s: enable WiFi controller")
Cc: stable(a)vger.kernel.org # 6.2
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
index 26dbba9f51fb..c79559e4b22e 100644
--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
+++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
@@ -386,6 +386,7 @@ vreg_s11b: smps11 {
regulator-min-microvolt = <1272000>;
regulator-max-microvolt = <1272000>;
regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ regulator-always-on;
};
vreg_s12b: smps12 {
--
2.39.2
This is the start of the stable review cycle for the 5.4.238 release.
There are 57 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 23 Mar 2023 08:06:33 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.238-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.238-rc2
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Xiang Chen <chenxiang66(a)hisilicon.com>
scsi: core: Fix a comment in function scsi_host_dev_release()
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda - controller is in GPU on the DG1
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda - add Intel DG1 PCI and HDMI ids
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Makefile | 4 +--
arch/s390/boot/ipl_report.c | 8 +++++
arch/x86/kvm/vmx/nested.c | 10 ++++--
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 ++---
drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 5 +--
drivers/gpu/drm/meson/meson_vpp.c | 2 ++
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/hid/hid-core.c | 18 +++++++---
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++---
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 +++
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 --
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++
drivers/net/ethernet/sun/ldmvsw.c | 3 ++
drivers/net/ethernet/sun/sunvnet.c | 3 ++
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/smsc.c | 5 ++-
drivers/net/usb/smsc75xx.c | 7 ++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++--
drivers/nvme/target/core.c | 4 ++-
drivers/pci/pci-driver.c | 4 +--
drivers/pci/pci.c | 54 +++++++++++++----------------
drivers/pci/pci.h | 10 +++++-
drivers/scsi/hosts.c | 5 +--
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++--
drivers/tty/serial/8250/8250_em.c | 4 +--
drivers/tty/serial/fsl_lpuart.c | 12 +++++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++
fs/cifs/transport.c | 21 +++++------
fs/ext4/inode.c | 18 +++++-----
fs/ext4/namei.c | 4 +--
fs/ext4/page-io.c | 10 +++---
fs/ext4/xattr.c | 11 ++++++
fs/jffs2/file.c | 15 ++++----
include/linux/hid.h | 3 ++
include/linux/netdevice.h | 6 ++--
include/linux/sh_intc.h | 5 ++-
include/linux/tracepoint.h | 15 ++++----
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace_events_hist.c | 3 ++
net/ipv4/fib_frontend.c | 3 ++
net/ipv4/ip_tunnel.c | 12 +++----
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +--
net/iucv/iucv.c | 2 +-
net/netfilter/nft_redir.c | 2 +-
net/xfrm/xfrm_state.c | 3 --
sound/pci/hda/hda_intel.c | 22 ++++++++++--
sound/pci/hda/patch_hdmi.c | 3 ++
58 files changed, 277 insertions(+), 144 deletions(-)
The bug was obswerved while reading code. There are not many users of
addr_mode_nbytes. Anyway, we should update the flash's current address
mode when changing the address mode, fix it. We don't care for now about
the set_4byte_addr_mode(nor, false) from spi_nor_restore(), as it is
used at driver remove and shutdown.
Cc: stable(a)vger.kernel.org
Fixes: d7931a215063 ("mtd: spi-nor: core: Track flash's internal address mode")
Signed-off-by: Tudor Ambarus <tudor.ambarus(a)linaro.org>
---
drivers/mtd/spi-nor/core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index 1cf566fed9c6..868414017399 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -2769,6 +2769,7 @@ static int spi_nor_quad_enable(struct spi_nor *nor)
static int spi_nor_init(struct spi_nor *nor)
{
+ struct spi_nor_flash_parameter *params = nor->params;
int err;
err = spi_nor_octal_dtr_enable(nor, true);
@@ -2810,9 +2811,10 @@ static int spi_nor_init(struct spi_nor *nor)
*/
WARN_ONCE(nor->flags & SNOR_F_BROKEN_RESET,
"enabling reset hack; may not recover from unexpected reboots\n");
- err = nor->params->set_4byte_addr_mode(nor, true);
+ err = params->set_4byte_addr_mode(nor, true);
if (err && err != -ENOTSUPP)
return err;
+ params->addr_mode_nbytes = 4;
}
return 0;
--
2.40.0.rc1.284.g88254d51c5-goog
This is the start of the stable review cycle for the 5.15.104 release.
There are 115 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:26 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.104-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.104-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Lukas Wunner <lukas(a)wunner.de>
PCI/DPC: Await readiness of secondary bus after reset
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Fedor Pchelkin <pchelkin(a)ispras.ru>
io_uring: avoid null-ptr-deref in io_arm_poll_handler
Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com>
drm/i915/active: Fix misuse of non-idle barriers as fence trackers
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Shawn Wang <shawnwang(a)linux.alibaba.com>
x86/resctrl: Clear staged_config[] before and after it is used
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Yazen Ghannam <yazen.ghannam(a)amd.com>
x86/mce: Make sure logged MCEs are processed after sysfs update
Shawn Guo <shawn.guo(a)linaro.org>
cpuidle: psci: Iterate backwards over list in psci_pd_remove()
Radu Pirea (OSS) <radu-nicolae.pirea(a)oss.nxp.com>
net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit
Tero Kristo <tero.kristo(a)linux.intel.com>
trace/hwlat: Do not wipe the contents of per-cpu thread data
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Francesco Dolcini <francesco.dolcini(a)toradex.com>
mmc: sdhci_am654: lower power-on failed message severity
David Hildenbrand <david(a)redhat.com>
mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
Dave Ertman <david.m.ertman(a)intel.com>
ice: avoid bonding causing auxiliary plug/unplug under RTNL lock
Elmer Miroslav Mosher Golovin <miroslav(a)mishamosher.com>
nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Paolo Abeni <pabeni(a)redhat.com>
mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket()
Matthieu Baerts <matthieu.baerts(a)tessares.net>
mptcp: avoid setting TCP_CLOSE state twice
Geliang Tang <geliang.tang(a)suse.com>
mptcp: add ro_after_init for tcp{,v6}_prot_override
Paolo Abeni <pabeni(a)redhat.com>
mptcp: fix possible deadlock in subflow_error_report
Błażej Szczygieł <mumei6102(a)gmail.com>
drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume
Johan Hovold <johan+linaro(a)kernel.org>
drm/sun4i: fix missing component unbind on bind errors
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/shmem-helper: Remove another errant put in error path
Guo Ren <guoren(a)linux.alibaba.com>
riscv: asid: Fixup stale TLB entry cause application crash
Sergey Matyukevich <sergey.matyukevich(a)syntacore.com>
Revert "riscv: mm: notify remote harts about mmu cache updates"
Hamidreza H. Fard <nitocris(a)posteo.net>
ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
Bard Liao <yung-chuan.liao(a)linux.intel.com>
ALSA: hda: intel-dsp-config: add MTL PCI id
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Volker Lendecke <vl(a)samba.org>
cifs: Fix smb2_set_path_size()
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Sung-hun Kim <sfoon.kim(a)samsung.com>
tracing: Make splice_read available again
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: exynos: fix node leak in probe PM QoS error path
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Roman Gushchin <roman.gushchin(a)linux.dev>
firmware: xilinx: don't make a sleepable memory allocation from an atomic context
Johan Hovold <johan(a)kernel.org>
serial: 8250_fsl: fix handle_irq locking
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Alex Hung <alex.hung(a)amd.com>
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Eric Van Hensbergen <ericvh(a)kernel.org>
net/9p: fix bug in client create for .L
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: update s_journal_inum if it changes after journal replay
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
Jurica Vukadin <jura(a)vukad.in>
kconfig: Update config changed flag before calling callback
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
hwmon: tmp512: drop of_match_ptr for ID table
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (ucd90320) Add minimum delay between bus accesses
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Nikolay Aleksandrov <razor(a)blackwall.org>
bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
Nikolay Aleksandrov <razor(a)blackwall.org>
bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
Po-Hsu Lin <po-hsu.lin(a)canonical.com>
selftests: net: devlink_port_split.py: skip test if no suitable device available
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
sh_eth: avoid PHY being resumed when interface is not up
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
ravb: avoid PHY being resumed when interface is not up
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
Maciej Fijalkowski <maciej.fijalkowski(a)intel.com>
ice: xsk: disable txq irq before flushing hw
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Ming Lei <ming.lei(a)redhat.com>
nvme: fix handling single range discard request
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
block: null_blk: Fix handling of fake timeout request
Liu Ying <victor.liu(a)nxp.com>
drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Wenjia Zhang <wenjia(a)linux.ibm.com>
net/smc: fix deadlock triggered by cancel_delayed_work_syn()
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Bart Van Assche <bvanassche(a)acm.org>
loop: Fix use-after-free issues
Arınç ÜNAL <arinc.unal(a)arinc9.com>
net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used
Arınç ÜNAL <arinc.unal(a)arinc9.com>
net: dsa: mt7530: remove now incorrect comment regarding port 5
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
D. Wythe <alibuda(a)linux.alibaba.com>
net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
Jouni Högander <jouni.hogander(a)intel.com>
drm/i915/psr: Use calculated io and fast wake lines
Tom Rix <trix(a)redhat.com>
drm/i915/display: clean up comments
José Roberto de Souza <jose.souza(a)intel.com>
drm/i915/display/psr: Handle plane and pipe restrictions at every page flip
José Roberto de Souza <jose.souza(a)intel.com>
drm/i915/display/psr: Use drm damage helpers to calculate plane damaged area
José Roberto de Souza <jose.souza(a)intel.com>
drm/i915/display: Workaround cursor left overs with PSR2 selective fetch enabled
Niklas Schnelle <schnelle(a)linux.ibm.com>
PCI: s390: Fix use-after-free of PCI resources with per-function hotplug
Eugenio Pérez <eperezma(a)redhat.com>
vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready
Eugenio Pérez <eperezma(a)redhat.com>
vdpa_sim: not reset state in vdpasim_queue_ready
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_masq: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_nat: correct length for loading protocol registers
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Makefile | 4 +-
arch/riscv/include/asm/mmu.h | 2 -
arch/riscv/include/asm/tlbflush.h | 18 --
arch/riscv/mm/context.c | 40 ++--
arch/riscv/mm/tlbflush.c | 28 +--
arch/s390/boot/ipl_report.c | 8 +
arch/s390/pci/pci.c | 16 +-
arch/s390/pci/pci_bus.c | 12 +-
arch/s390/pci/pci_bus.h | 3 +-
arch/x86/Makefile.um | 6 +
arch/x86/kernel/cpu/mce/core.c | 1 +
arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 7 +-
arch/x86/kernel/cpu/resctrl/internal.h | 1 +
arch/x86/kernel/cpu/resctrl/rdtgroup.c | 25 ++-
arch/x86/kvm/vmx/nested.c | 10 +-
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/loop.c | 25 ++-
drivers/block/null_blk/main.c | 6 +-
drivers/block/sunvdc.c | 2 +
drivers/clk/Kconfig | 2 +-
drivers/cpuidle/cpuidle-psci-domain.c | 3 +-
drivers/firmware/xilinx/zynqmp.c | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +-
.../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 5 +-
.../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 43 ++++-
drivers/gpu/drm/drm_gem_shmem_helper.c | 9 +-
drivers/gpu/drm/i915/display/intel_display_types.h | 2 +
drivers/gpu/drm/i915/display/intel_psr.c | 207 +++++++++++++++------
drivers/gpu/drm/i915/gt/intel_ring.c | 2 +-
drivers/gpu/drm/i915/i915_active.c | 24 +--
drivers/gpu/drm/meson/meson_vpp.c | 2 +
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/gpu/drm/sun4i/sun4i_drv.c | 6 +-
drivers/hid/hid-core.c | 18 +-
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 +-
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/ltc2992.c | 1 +
drivers/hwmon/pmbus/adm1266.c | 1 +
drivers/hwmon/pmbus/ucd9000.c | 75 ++++++++
drivers/hwmon/tmp513.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 +
drivers/interconnect/samsung/exynos.c | 6 +-
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 -
drivers/mmc/host/sdhci_am654.c | 2 +-
drivers/net/bonding/bond_main.c | 23 ++-
drivers/net/dsa/mt7530.c | 64 +++----
drivers/net/dsa/mv88e6xxx/chip.c | 16 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/intel/ice/ice.h | 14 +-
drivers/net/ethernet/intel/ice/ice_main.c | 19 +-
drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +-
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +
drivers/net/ethernet/qlogic/qed/qed_mng_tlv.c | 2 +-
drivers/net/ethernet/renesas/ravb_main.c | 12 +-
drivers/net/ethernet/renesas/sh_eth.c | 12 +-
drivers/net/ethernet/sun/ldmvsw.c | 3 +
drivers/net/ethernet/sun/sunvnet.c | 3 +
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/nxp-c45-tja11xx.c | 2 +-
drivers/net/phy/smsc.c | 5 +-
drivers/net/usb/smsc75xx.c | 7 +
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 +-
drivers/nvme/host/core.c | 28 ++-
drivers/nvme/host/pci.c | 2 +
drivers/nvme/target/core.c | 4 +-
drivers/pci/bus.c | 21 +++
drivers/pci/pci-driver.c | 4 +-
drivers/pci/pci.c | 57 +++---
drivers/pci/pci.h | 16 +-
drivers/pci/pcie/dpc.c | 4 +-
drivers/scsi/hosts.c | 3 -
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 +-
drivers/tty/serial/8250/8250_em.c | 4 +-
drivers/tty/serial/8250/8250_fsl.c | 4 +-
drivers/tty/serial/fsl_lpuart.c | 12 +-
drivers/vdpa/vdpa_sim/vdpa_sim.c | 13 ++
drivers/video/fbdev/stifb.c | 27 +++
fs/cifs/smb2inode.c | 31 ++-
fs/cifs/transport.c | 21 +--
fs/ext4/inode.c | 18 +-
fs/ext4/namei.c | 4 +-
fs/ext4/super.c | 7 +-
fs/ext4/xattr.c | 11 ++
fs/jffs2/file.c | 15 +-
include/drm/drm_bridge.h | 4 +-
include/linux/hid.h | 3 +
include/linux/netdevice.h | 6 +-
include/linux/pci.h | 1 +
include/linux/sh_intc.h | 5 +-
include/linux/tracepoint.h | 15 +-
io_uring/io_uring.c | 4 +-
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace.c | 2 +
kernel/trace/trace_events_hist.c | 3 +
kernel/trace/trace_hwlat.c | 3 -
mm/huge_memory.c | 6 +-
net/9p/client.c | 2 +-
net/ipv4/fib_frontend.c | 3 +
net/ipv4/ip_tunnel.c | 12 +-
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +-
net/iucv/iucv.c | 2 +-
net/mptcp/pm_netlink.c | 16 ++
net/mptcp/subflow.c | 12 +-
net/netfilter/nft_masq.c | 2 +-
net/netfilter/nft_nat.c | 2 +-
net/netfilter/nft_redir.c | 4 +-
net/smc/smc_cdc.c | 3 +
net/smc/smc_core.c | 2 +-
net/xfrm/xfrm_state.c | 3 -
scripts/kconfig/confdata.c | 6 +-
sound/hda/intel-dsp-config.c | 9 +
sound/pci/hda/hda_intel.c | 5 +-
sound/pci/hda/patch_realtek.c | 1 +
tools/testing/selftests/net/devlink_port_split.py | 36 +++-
120 files changed, 925 insertions(+), 439 deletions(-)
This is the start of the stable review cycle for the 5.10.176 release.
There are 99 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.176-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.176-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Gaosheng Cui <cuigaosheng1(a)huawei.com>
xfs: remove xfs_setattr_time() declaration
Christian Brauner <brauner(a)kernel.org>
fs: use consistent setgid checks in is_sxid()
Amir Goldstein <amir73il(a)gmail.com>
attr: use consistent sgid stripping checks
Amir Goldstein <amir73il(a)gmail.com>
attr: add setattr_should_drop_sgid()
Amir Goldstein <amir73il(a)gmail.com>
fs: move should_remove_suid()
Amir Goldstein <amir73il(a)gmail.com>
attr: add in_group_or_capable()
Yang Xu <xuyang2018.jy(a)fujitsu.com>
fs: move S_ISGID stripping into the vfs_*() helpers
Yang Xu <xuyang2018.jy(a)fujitsu.com>
fs: add mode_strip_sgid() helper
Darrick J. Wong <djwong(a)kernel.org>
xfs: use setattr_copy to set vfs inode attributes
Dave Chinner <dchinner(a)redhat.com>
xfs: set prealloc flag in xfs_alloc_file_space()
Dave Chinner <dchinner(a)redhat.com>
xfs: fallocate() should call file_modified()
Dave Chinner <dchinner(a)redhat.com>
xfs: remove XFS_PREALLOC_SYNC
Darrick J. Wong <djwong(a)kernel.org>
xfs: don't leak btree cursor when insrec fails after a split
Darrick J. Wong <djwong(a)kernel.org>
xfs: purge dquots after inode walk fails during quotacheck
Dave Chinner <dchinner(a)redhat.com>
xfs: don't assert fail on perag references on teardown
Lukas Wunner <lukas(a)wunner.de>
PCI/DPC: Await readiness of secondary bus after reset
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Fedor Pchelkin <pchelkin(a)ispras.ru>
io_uring: avoid null-ptr-deref in io_arm_poll_handler
Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com>
drm/i915/active: Fix misuse of non-idle barriers as fence trackers
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Yazen Ghannam <yazen.ghannam(a)amd.com>
x86/mce: Make sure logged MCEs are processed after sysfs update
Shawn Guo <shawn.guo(a)linaro.org>
cpuidle: psci: Iterate backwards over list in psci_pd_remove()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Francesco Dolcini <francesco.dolcini(a)toradex.com>
mmc: sdhci_am654: lower power-on failed message severity
David Hildenbrand <david(a)redhat.com>
mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Matthieu Baerts <matthieu.baerts(a)tessares.net>
mptcp: avoid setting TCP_CLOSE state twice
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/shmem-helper: Remove another errant put in error path
Hamidreza H. Fard <nitocris(a)posteo.net>
ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
Bard Liao <yung-chuan.liao(a)linux.intel.com>
ALSA: hda: intel-dsp-config: add MTL PCI id
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Volker Lendecke <vl(a)samba.org>
cifs: Fix smb2_set_path_size()
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Sung-hun Kim <sfoon.kim(a)samsung.com>
tracing: Make splice_read available again
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Roman Gushchin <roman.gushchin(a)linux.dev>
firmware: xilinx: don't make a sleepable memory allocation from an atomic context
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Alex Hung <alex.hung(a)amd.com>
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
hwmon: tmp512: drop of_match_ptr for ID table
Lars-Peter Clausen <lars(a)metafoo.de>
hwmon: (ucd90320) Add minimum delay between bus accesses
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
Po-Hsu Lin <po-hsu.lin(a)canonical.com>
selftests: net: devlink_port_split.py: skip test if no suitable device available
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
Maciej Fijalkowski <maciej.fijalkowski(a)intel.com>
ice: xsk: disable txq irq before flushing hw
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Ming Lei <ming.lei(a)redhat.com>
nvme: fix handling single range discard request
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
block: null_blk: Fix handling of fake timeout request
Damien Le Moal <damien.lemoal(a)wdc.com>
null_blk: Move driver into its own directory
Liu Ying <victor.liu(a)nxp.com>
drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Wenjia Zhang <wenjia(a)linux.ibm.com>
net/smc: fix deadlock triggered by cancel_delayed_work_syn()
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
D. Wythe <alibuda(a)linux.alibaba.com>
net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Xiang Chen <chenxiang66(a)hisilicon.com>
scsi: core: Fix a comment in function scsi_host_dev_release()
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_masq: correct length for loading protocol registers
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_nat: correct length for loading protocol registers
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Documentation/trace/ftrace.rst | 2 +-
Makefile | 4 +-
arch/s390/boot/ipl_report.c | 8 +++
arch/x86/Makefile.um | 6 ++
arch/x86/kernel/cpu/mce/core.c | 1 +
arch/x86/kvm/vmx/nested.c | 10 ++-
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/Kconfig | 8 +--
drivers/block/Makefile | 7 +-
drivers/block/null_blk/Kconfig | 12 ++++
drivers/block/null_blk/Makefile | 11 +++
drivers/block/{null_blk_main.c => null_blk/main.c} | 6 +-
drivers/block/{ => null_blk}/null_blk.h | 0
.../block/{null_blk_trace.c => null_blk/trace.c} | 2 +-
.../block/{null_blk_trace.h => null_blk/trace.h} | 2 +-
.../block/{null_blk_zoned.c => null_blk/zoned.c} | 2 +-
drivers/block/sunvdc.c | 2 +
drivers/clk/Kconfig | 2 +-
drivers/cpuidle/cpuidle-psci-domain.c | 3 +-
drivers/firmware/xilinx/zynqmp.c | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +--
.../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 5 +-
drivers/gpu/drm/drm_gem_shmem_helper.c | 9 ++-
drivers/gpu/drm/i915/gt/intel_ring.c | 2 +-
drivers/gpu/drm/i915/i915_active.c | 24 ++++---
drivers/gpu/drm/meson/meson_vpp.c | 2 +
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/hid/hid-core.c | 18 +++--
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 +--
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/pmbus/adm1266.c | 1 +
drivers/hwmon/pmbus/ucd9000.c | 75 ++++++++++++++++++++
drivers/hwmon/tmp513.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 ++
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 -
drivers/mmc/host/sdhci_am654.c | 2 +-
drivers/net/dsa/mv88e6xxx/chip.c | 16 +++--
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +-
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 ++
drivers/net/ethernet/qlogic/qed/qed_mng_tlv.c | 2 +-
drivers/net/ethernet/sun/ldmvsw.c | 3 +
drivers/net/ethernet/sun/sunvnet.c | 3 +
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/smsc.c | 5 +-
drivers/net/usb/smsc75xx.c | 7 ++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 +-
drivers/nvme/host/core.c | 28 +++++---
drivers/nvme/target/core.c | 4 +-
drivers/pci/pci-driver.c | 4 +-
drivers/pci/pci.c | 57 +++++++--------
drivers/pci/pci.h | 16 ++++-
drivers/pci/pcie/dpc.c | 4 +-
drivers/scsi/hosts.c | 5 +-
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 +++-
drivers/tty/serial/8250/8250_em.c | 4 +-
drivers/tty/serial/fsl_lpuart.c | 12 +++-
drivers/video/fbdev/stifb.c | 27 ++++++++
fs/attr.c | 70 +++++++++++++++++--
fs/cifs/smb2inode.c | 31 +++++++--
fs/cifs/transport.c | 21 +++---
fs/ext4/inode.c | 18 +++--
fs/ext4/namei.c | 4 +-
fs/ext4/xattr.c | 11 +++
fs/inode.c | 80 +++++++++++++---------
fs/internal.h | 6 ++
fs/jffs2/file.c | 15 ++--
fs/namei.c | 80 ++++++++++++++++++----
fs/ocfs2/file.c | 4 +-
fs/ocfs2/namei.c | 1 +
fs/open.c | 6 +-
fs/xfs/libxfs/xfs_btree.c | 8 ++-
fs/xfs/xfs_bmap_util.c | 9 +--
fs/xfs/xfs_file.c | 24 +++----
fs/xfs/xfs_iops.c | 56 +--------------
fs/xfs/xfs_iops.h | 1 -
fs/xfs/xfs_mount.c | 3 +-
fs/xfs/xfs_pnfs.c | 9 ++-
fs/xfs/xfs_qm.c | 9 ++-
include/drm/drm_bridge.h | 4 +-
include/linux/fs.h | 5 +-
include/linux/hid.h | 3 +
include/linux/netdevice.h | 6 +-
include/linux/sh_intc.h | 5 +-
include/linux/tracepoint.h | 15 ++--
io_uring/io_uring.c | 4 +-
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace.c | 2 +
kernel/trace/trace_events_hist.c | 3 +
mm/huge_memory.c | 6 +-
net/ipv4/fib_frontend.c | 3 +
net/ipv4/ip_tunnel.c | 12 ++--
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +-
net/iucv/iucv.c | 2 +-
net/mptcp/subflow.c | 1 -
net/netfilter/nft_masq.c | 2 +-
net/netfilter/nft_nat.c | 2 +-
net/netfilter/nft_redir.c | 4 +-
net/smc/smc_cdc.c | 3 +
net/smc/smc_core.c | 2 +-
net/xfrm/xfrm_state.c | 3 -
sound/hda/intel-dsp-config.c | 9 +++
sound/pci/hda/hda_intel.c | 5 +-
sound/pci/hda/patch_realtek.c | 1 +
tools/testing/selftests/net/devlink_port_split.py | 30 ++++++++
111 files changed, 743 insertions(+), 360 deletions(-)
This is the start of the stable review cycle for the 4.19.279 release.
There are 36 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:13 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.279-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.279-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Eric Biggers <ebiggers(a)kernel.org>
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Makefile | 4 ++--
arch/x86/Makefile.um | 6 ++++++
arch/x86/mm/mem_encrypt_identity.c | 3 ++-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +++------
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/jffs2/file.c | 15 +++++++--------
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
include/linux/tracepoint.h | 15 ++++++---------
kernel/trace/ftrace.c | 3 ++-
kernel/trace/trace_events_hist.c | 3 +++
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
39 files changed, 166 insertions(+), 78 deletions(-)
This is the start of the stable review cycle for the 4.14.311 release.
There are 30 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.311-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.311-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Eric Biggers <ebiggers(a)kernel.org>
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Makefile | 4 ++--
arch/x86/Makefile.um | 6 ++++++
drivers/block/sunvdc.c | 2 ++
drivers/gpu/drm/i915/intel_ringbuffer.c | 5 +++--
drivers/hid/hid-core.c | 18 +++++++++++++-----
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++++----
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 ---
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++
drivers/net/ethernet/sun/ldmvsw.c | 3 +++
drivers/net/ethernet/sun/sunvnet.c | 3 +++
drivers/net/phy/smsc.c | 5 ++++-
drivers/net/usb/smsc75xx.c | 7 +++++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++++--
drivers/nvme/target/core.c | 4 +++-
drivers/tty/serial/8250/8250_em.c | 4 ++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++++++++++++++
fs/ext4/inode.c | 18 ++++++++----------
fs/ext4/page-io.c | 11 ++++++-----
fs/ext4/xattr.c | 11 +++++++++++
fs/sysfs/file.c | 2 +-
include/linux/hid.h | 3 +++
include/linux/netdevice.h | 6 ++++--
include/linux/sh_intc.h | 5 ++++-
kernel/trace/ftrace.c | 3 ++-
net/ipv4/fib_frontend.c | 3 +++
net/ipv4/ip_tunnel.c | 12 ++++++------
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 ++--
net/iucv/iucv.c | 2 +-
33 files changed, 144 insertions(+), 53 deletions(-)
The patch titled
Subject: mm/hugetlb: fix uffd wr-protection for CoW optimization path
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Peter Xu <peterx(a)redhat.com>
Subject: mm/hugetlb: fix uffd wr-protection for CoW optimization path
Date: Tue, 21 Mar 2023 15:18:40 -0400
This patch fixes an issue that a hugetlb uffd-wr-protected mapping can be
writable even with uffd-wp bit set. It only happens with all these
conditions met: (1) hugetlb memory (2) private mapping (3) original
mapping was missing, then (4) being wr-protected (IOW, pte marker
installed). Then write to the page to trigger.
Userfaultfd-wp trap for hugetlb was implemented in hugetlb_fault() before
even reaching hugetlb_wp() to avoid taking more locks that userfault won't
need. However there's one CoW optimization path for missing hugetlb page
that can trigger hugetlb_wp() inside hugetlb_no_page(), that can bypass
the userfaultfd-wp traps.
A few ways to resolve this:
(1) Skip the CoW optimization for hugetlb private mapping, considering
that private mappings for hugetlb should be very rare, so it may not
really be helpful to major workloads. The worst case is we only skip the
optimization if userfaultfd_wp(vma)==true, because uffd-wp needs another
fault anyway.
(2) Move the userfaultfd-wp handling for hugetlb from hugetlb_fault()
into hugetlb_wp(). The major cons is there're a bunch of locks taken
when calling hugetlb_wp(), and that will make the changeset unnecessarily
complicated due to the lock operations.
(3) Carry over uffd-wp bit in hugetlb_wp(), so it'll need to fault again
for uffd-wp privately mapped pages.
This patch chose option (3) which contains the minimum changeset (simplest
for backport) and also make sure hugetlb_wp() itself will start to be
always safe with uffd-wp ptes even if called elsewhere in the future.
This patch will be needed for v5.19+ hence copy stable.
Link: https://lkml.kernel.org/r/20230321191840.1897940-1-peterx@redhat.com
Fixes: 166f3ecc0daf ("mm/hugetlb: hook page faults for uffd write protection")
Signed-off-by: Peter Xu <peterx(a)redhat.com>
Reported-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com>
Acked-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Axel Rasmussen <axelrasmussen(a)google.com>
Cc: Mike Rapoport <rppt(a)linux.vnet.ibm.com>
Cc: Nadav Amit <nadav.amit(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/hugetlb.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/mm/hugetlb.c~mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path
+++ a/mm/hugetlb.c
@@ -5478,7 +5478,7 @@ static vm_fault_t hugetlb_wp(struct mm_s
struct folio *pagecache_folio, spinlock_t *ptl)
{
const bool unshare = flags & FAULT_FLAG_UNSHARE;
- pte_t pte;
+ pte_t pte, newpte;
struct hstate *h = hstate_vma(vma);
struct page *old_page;
struct folio *new_folio;
@@ -5622,8 +5622,10 @@ retry_avoidcopy:
mmu_notifier_invalidate_range(mm, range.start, range.end);
page_remove_rmap(old_page, vma, true);
hugepage_add_new_anon_rmap(new_folio, vma, haddr);
- set_huge_pte_at(mm, haddr, ptep,
- make_huge_pte(vma, &new_folio->page, !unshare));
+ newpte = make_huge_pte(vma, &new_folio->page, !unshare);
+ if (huge_pte_uffd_wp(pte))
+ newpte = huge_pte_mkuffd_wp(newpte);
+ set_huge_pte_at(mm, haddr, ptep, newpte);
folio_set_hugetlb_migratable(new_folio);
/* Make the old page be freed below */
new_folio = page_folio(old_page);
_
Patches currently in -mm which might be from peterx(a)redhat.com are
kselftest-vm-fix-unused-variable-warning.patch
tools-headers-uapi-sync-linux-prctlh-with-the-kernel-sources.patch
mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path.patch
mm-khugepaged-alloc_charge_hpage-take-care-of-mem-charge-errors.patch
mm-khugepaged-cleanup-memcg-uncharge-for-failure-path.patch
mm-uffd-uffd_feature_wp_unpopulated.patch
selftests-mm-smoke-test-uffd_feature_wp_unpopulated.patch
mm-thp-rename-transparent_hugepage_never_dax-to-_unsupported.patch
mm-thp-rename-transparent_hugepage_never_dax-to-_unsupported-fix.patch
The conditional MOVS instruction that appears to have been added to test
for the TIF_USING_IWMMXT thread_info flag only sets the N and Z
condition flags and register R7, none of which are referenced in the
subsequent code. This means that the instruction does nothing, which
means that we might misidentify faulting FPE instructions as iWMMXT
instructions on kernels that were built to support both.
This seems to have been part of the original submission of the code, and
so this has never worked as intended, and nobody ever noticed, and so we
might decide to just leave this as-is. However, with the ongoing move
towards multiplatform kernels, the issue becomes more likely to
manifest, and so it is better to fix it.
So check whether we are dealing with an undef exception regarding
coprocessor index #0 or #1, and if so, load the thread_info flag and
only dispatch it as a iWMMXT trap if the flag is set.
Cc: <stable(a)vger.kernel.org> # v2.6.9+
Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org>
---
arch/arm/kernel/entry-armv.S | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index c39303e5c23470e6..c5d2f07994fb0d87 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -606,10 +606,11 @@ call_fpe:
strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[]
#ifdef CONFIG_IWMMXT
@ Test if we need to give access to iWMMXt coprocessors
- ldr r5, [r10, #TI_FLAGS]
- rsbs r7, r8, #(1 << 8) @ CP 0 or 1 only
- movscs r7, r5, lsr #(TIF_USING_IWMMXT + 1)
- bcs iwmmxt_task_enable
+ tst r8, #0xe << 8 @ CP 0 or 1?
+ ldreq r5, [r10, #TI_FLAGS] @ if so, load thread_info flags
+ andeq r5, r5, #1 << TIF_USING_IWMMXT @ isolate TIF_USING_IWMMXT flag
+ teqeq r5, #1 << TIF_USING_IWMMXT @ check whether it is set
+ beq iwmmxt_task_enable @ branch if set
#endif
ARM( add pc, pc, r8, lsr #6 )
THUMB( lsr r8, r8, #6 )
--
2.39.2
In case of early initialisation errors and on platforms that do not use
the DPU controller, the deinitilisation code can be called with the kms
pointer set to NULL.
Fixes: f026e431cf86 ("drm/msm: Convert to Linux IRQ interfaces")
Cc: stable(a)vger.kernel.org # 5.14
Cc: Thomas Zimmermann <tzimmermann(a)suse.de>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
drivers/gpu/drm/msm/msm_drv.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 17a59d73fe01..2f2bcdb671d2 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -251,9 +251,11 @@ static int msm_drm_uninit(struct device *dev)
drm_bridge_remove(priv->bridges[i]);
priv->num_bridges = 0;
- pm_runtime_get_sync(dev);
- msm_irq_uninstall(ddev);
- pm_runtime_put_sync(dev);
+ if (kms) {
+ pm_runtime_get_sync(dev);
+ msm_irq_uninstall(ddev);
+ pm_runtime_put_sync(dev);
+ }
if (kms && kms->funcs)
kms->funcs->destroy(kms);
--
2.39.2
Fix SUPERH builds that select SYS_SUPPORTS_NUMA but do not select
SYS_SUPPORTS_SMP and SMP.
kernel/sched/topology.c is only built for CONFIG_SMP and then the NUMA
code + data inside topology.c is only built when CONFIG_NUMA is
set/enabled, so these arch/sh/ configs need to select SMP and
SYS_SUPPORTS_SMP to build the NUMA support.
Fixes this build error in multiple SUPERH configs:
mm/page_alloc.o: In function `get_page_from_freelist':
page_alloc.c:(.text+0x2ca8): undefined reference to `node_reclaim_distance'
Fixes: 357d59469c11 ("sh: Tidy up dependencies for SH-2 build.")
Fixes: 9109a30e5a54 ("sh: add support for sh7366 processor")
Fixes: 55ba99eb211a ("sh: Add support for SH7786 CPU subtype.")
Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org>
Reported-by: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: Rich Felker <dalias(a)libc.org>
Cc: Kuninori Morimoto <morimoto.kuninori(a)renesas.com>
Cc: linux-sh(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
---
v2: skipped
v3: skipped
v4: refresh & resend
v5: include CPU_SUBTYPE_SH7785 in this patch (Adrian)
arch/sh/Kconfig | 6 ++++++
1 file changed, 6 insertions(+)
diff -- a/arch/sh/Kconfig b/arch/sh/Kconfig
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -442,6 +442,8 @@ config CPU_SUBTYPE_SH7785
select CPU_SHX2
select ARCH_SPARSEMEM_ENABLE
select SYS_SUPPORTS_NUMA
+ select SYS_SUPPORTS_SMP
+ select SMP
select PINCTRL
config CPU_SUBTYPE_SH7786
@@ -476,6 +478,8 @@ config CPU_SUBTYPE_SH7722
select CPU_SHX2
select ARCH_SHMOBILE
select ARCH_SPARSEMEM_ENABLE
+ select SYS_SUPPORTS_SMP
+ select SMP
select SYS_SUPPORTS_NUMA
select SYS_SUPPORTS_SH_CMT
select PINCTRL
@@ -486,6 +490,8 @@ config CPU_SUBTYPE_SH7366
select CPU_SHX2
select ARCH_SHMOBILE
select ARCH_SPARSEMEM_ENABLE
+ select SYS_SUPPORTS_SMP
+ select SMP
select SYS_SUPPORTS_NUMA
select SYS_SUPPORTS_SH_CMT
In case of early initialisation errors and on platforms that do not use
the DPU controller, the deinitilisation code can be called with the kms
pointer set to NULL.
Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot")
Cc: stable(a)vger.kernel.org # 5.14
Cc: Abhinav Kumar <quic_abhinavk(a)quicinc.com>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
drivers/gpu/drm/msm/msm_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 9ded384acba4..17a59d73fe01 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -242,7 +242,8 @@ static int msm_drm_uninit(struct device *dev)
msm_fbdev_free(ddev);
#endif
- msm_disp_snapshot_destroy(ddev);
+ if (kms)
+ msm_disp_snapshot_destroy(ddev);
drm_mode_config_cleanup(ddev);
--
2.39.2
On Tue, Mar 21, 2023 at 05:18:03AM -0700, KernelCI bot wrote:
The KernelCI bisection bot found a boot bisection on one of the HP
ChromeBooks in v5.10.175 triggered by b5005605013d ("drm/i915: Don't use
BAR mappings for ring buffers with LLC"). The system appears to die
very early in boot with no output.
I've left the full report from the bot below, including links to full
boot logs such as they are and a tag for the bot, and the full web
dashboard for the test case fail is at:
https://linux.kernelci.org/test/plan/id/64147346939869e04b8c8694/
including details of the successful test on v5.10.174.
> * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
> * This automated bisection report was sent to you on the basis *
> * that you may be involved with the breaking commit it has *
> * found. No manual investigation has been done to verify it, *
> * and the root cause of the problem may be somewhere else. *
> * *
> * If you do send a fix, please include this trailer: *
> * Reported-by: "kernelci.org bot" <bot(a)kernelci.org> *
> * *
> * Hope this helps! *
> * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
>
> stable-rc/linux-5.10.y bisection: baseline.login on hp-x360-14-G1-sona
>
> Summary:
> Start: de26e1b2103b Linux 5.10.175
> Plain log: https://storage.kernelci.org/stable-rc/linux-5.10.y/v5.10.175/x86_64/x86_64…
> HTML log: https://storage.kernelci.org/stable-rc/linux-5.10.y/v5.10.175/x86_64/x86_64…
> Result: b5005605013d drm/i915: Don't use BAR mappings for ring buffers with LLC
>
> Checks:
> revert: PASS
> verify: PASS
>
> Parameters:
> Tree: stable-rc
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
> Branch: linux-5.10.y
> Target: hp-x360-14-G1-sona
> CPU arch: x86_64
> Lab: lab-collabora
> Compiler: gcc-10
> Config: x86_64_defconfig+x86-chromebook
> Test case: baseline.login
>
> Breaking commit found:
>
> -------------------------------------------------------------------------------
> commit b5005605013d30ab27c303cbaeff60b7872234a3
> Author: John Harrison <John.C.Harrison(a)Intel.com>
> Date: Wed Feb 15 17:11:01 2023 -0800
>
> drm/i915: Don't use BAR mappings for ring buffers with LLC
>
> commit 85636167e3206c3fbd52254fc432991cc4e90194 upstream.
>
> Direction from hardware is that ring buffers should never be mapped
> via the BAR on systems with LLC. There are too many caching pitfalls
> due to the way BAR accesses are routed. So it is safest to just not
> use it.
>
> Signed-off-by: John Harrison <John.C.Harrison(a)Intel.com>
> Fixes: 9d80841ea4c9 ("drm/i915: Allow ringbuffers to be bound anywhere")
> Cc: Chris Wilson <chris(a)chris-wilson.co.uk>
> Cc: Joonas Lahtinen <joonas.lahtinen(a)linux.intel.com>
> Cc: Jani Nikula <jani.nikula(a)linux.intel.com>
> Cc: Rodrigo Vivi <rodrigo.vivi(a)intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin(a)linux.intel.com>
> Cc: intel-gfx(a)lists.freedesktop.org
> Cc: <stable(a)vger.kernel.org> # v4.9+
> Tested-by: Jouni Högander <jouni.hogander(a)intel.com>
> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com>
> Link: https://patchwork.freedesktop.org/patch/msgid/20230216011101.1909009-3-John…
> (cherry picked from commit 65c08339db1ada87afd6cfe7db8e60bb4851d919)
> Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
> Signed-off-by: John Harrison <John.C.Harrison(a)Intel.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_ring.c b/drivers/gpu/drm/i915/gt/intel_ring.c
> index 4034a4bac7f0..69b2e5509d67 100644
> --- a/drivers/gpu/drm/i915/gt/intel_ring.c
> +++ b/drivers/gpu/drm/i915/gt/intel_ring.c
> @@ -49,7 +49,7 @@ int intel_ring_pin(struct intel_ring *ring, struct i915_gem_ww_ctx *ww)
> if (unlikely(ret))
> goto err_unpin;
>
> - if (i915_vma_is_map_and_fenceable(vma))
> + if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915))
> addr = (void __force *)i915_vma_pin_iomap(vma);
> else
> addr = i915_gem_object_pin_map(vma->obj,
> @@ -91,7 +91,7 @@ void intel_ring_unpin(struct intel_ring *ring)
> return;
>
> i915_vma_unset_ggtt_write(vma);
> - if (i915_vma_is_map_and_fenceable(vma))
> + if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915))
> i915_vma_unpin_iomap(vma);
> else
> i915_gem_object_unpin_map(vma->obj);
> -------------------------------------------------------------------------------
>
>
> Git bisection log:
>
> -------------------------------------------------------------------------------
> git bisect start
> # good: [955623617f2f505ac08d0efda2bb50c1a52e2c96] Linux 5.10.174
> git bisect good 955623617f2f505ac08d0efda2bb50c1a52e2c96
> # bad: [de26e1b2103b1f56451f6ad77f0190c9066c87dc] Linux 5.10.175
> git bisect bad de26e1b2103b1f56451f6ad77f0190c9066c87dc
> # good: [d16701a385b54f44bf41ff1d7485e7a11080deb3] bnxt_en: Avoid order-5 memory allocation for TPA data
> git bisect good d16701a385b54f44bf41ff1d7485e7a11080deb3
> # good: [d47d364f6671d8794a89e4972b1fd3284d213c96] macintosh: windfarm: Use unsigned type for 1-bit bitfields
> git bisect good d47d364f6671d8794a89e4972b1fd3284d213c96
> # bad: [c3fd717b58f0a3e2461c16e2360ee6a949b47940] ext4: add strict range checks while freeing blocks
> git bisect bad c3fd717b58f0a3e2461c16e2360ee6a949b47940
> # good: [7aa5a495cbf8a33cd9fec892c180dedf14292b76] ipmi/watchdog: replace atomic_add() and atomic_sub()
> git bisect good 7aa5a495cbf8a33cd9fec892c180dedf14292b76
> # bad: [b5005605013d30ab27c303cbaeff60b7872234a3] drm/i915: Don't use BAR mappings for ring buffers with LLC
> git bisect bad b5005605013d30ab27c303cbaeff60b7872234a3
> # good: [c53d50d8081a49ba21f866a51277a012b9efad8e] skbuff: Fix nfct leak on napi stolen
> git bisect good c53d50d8081a49ba21f866a51277a012b9efad8e
> # first bad commit: [b5005605013d30ab27c303cbaeff60b7872234a3] drm/i915: Don't use BAR mappings for ring buffers with LLC
> -------------------------------------------------------------------------------
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Groups.io Links: You receive all messages sent to this group.
> View/Reply Online (#39748): https://groups.io/g/kernelci-results/message/39748
> Mute This Topic: https://groups.io/mt/97753328/1131744
> Group Owner: kernelci-results+owner(a)groups.io
> Unsubscribe: https://groups.io/g/kernelci-results/unsub [broonie(a)kernel.org]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
This is the start of the stable review cycle for the 5.4.238 release.
There are 60 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:16 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.238-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.238-rc1
Lee Jones <lee(a)kernel.org>
HID: uhid: Over-ride the default maximum data buffer value with our own
Lee Jones <lee(a)kernel.org>
HID: core: Provide new max_buffer_size attribute to over-ride the default
Lukas Wunner <lukas(a)wunner.de>
PCI: Unify delay handling for reset and resume
Sven Schnelle <svens(a)linux.ibm.com>
s390/ipl: add missing intersection check to ipl_report handling
Biju Das <biju.das.jz(a)bp.renesas.com>
serial: 8250_em: Fix UART port type
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use stolen memory for ring buffers with LLC
Kees Cook <keescook(a)chromium.org>
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
Tom Saeger <tom.saeger(a)oracle.com>
Revert "treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()"
Nikita Zhandarovich <n.zhandarovich(a)fintech.ru>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Helge Deller <deller(a)gmx.de>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Chen Zhongjin <chenzhongjin(a)huawei.com>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <rostedt(a)goodmis.org>
tracing: Check field value in hist_field_name()
Johan Hovold <johan+linaro(a)kernel.org>
interconnect: fix mem leak when freeing nodes
Sherry Sun <sherry.sun(a)nxp.com>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix possible double unlock when moving a directory
Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de>
sh: intc: Avoid spurious sizeof-pointer-div warning
Qu Huang <qu.huang(a)linux.dev>
drm/amdkfd: Fix an illegal memory access
Baokun Li <libaokun1(a)huawei.com>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <libaokun1(a)huawei.com>
ext4: fail ext4_iget if special inode unallocated
David Gow <davidgow(a)google.com>
rust: arch/um: Disable FP/SIMD instruction to match x86
Yifei Liu <yifeliu(a)cs.stonybrook.edu>
jffs2: correct logic when creating a hole in jffs2_write_begin
Tobias Schramm <t.schramm(a)manjaro.org>
mmc: atmel-mci: fix race between stop command and start of next command
Linus Torvalds <torvalds(a)linux-foundation.org>
media: m5mols: fix off-by-one loop termination error
Marcus Folkesson <marcus.folkesson(a)gmail.com>
hwmon: (ina3221) return prober error code
Zheng Wang <zyytlz.wz(a)163.com>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <tony.obrien(a)alliedtelesis.co.nz>
hwmon: (adt7475) Display smoothing attributes in correct order
Liang He <windhl(a)126.com>
ethernet: sun: add check for the mdesc_grab()
Alexandra Winter <wintera(a)linux.ibm.com>
net/iucv: Fix size of interrupt data
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <idosch(a)nvidia.com>
ipv4: Fix incorrect table ID in IOCTL path
Liang He <windhl(a)126.com>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <damien.lemoal(a)opensource.wdc.com>
nvmet: avoid potential UAF in nvmet_req_complete()
Szymon Heidrich <szymon.heidrich(a)gmail.com>
net: usb: smsc75xx: Limit packet length to skb->len
Zheng Wang <zyytlz.wz(a)163.com>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <edumazet(a)google.com>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Daniil Tatianin <d-tatianin(a)yandex-team.ru>
qed/qed_dev: guard against a possible division by zero
Ivan Vecera <ivecera(a)redhat.com>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <wujianguo(a)chinatelecom.cn>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: pn533: initialize struct pn533_out_arg properly
Breno Leitao <leitao(a)debian.org>
tcp: tcp_make_synack() can be called from process context
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Fix a procfs host directory removal regression
Xiang Chen <chenxiang66(a)hisilicon.com>
scsi: core: Fix a comment in function scsi_host_dev_release()
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: nft_redir: correct value of inet type `.maxattrs`
Bjorn Helgaas <bhelgaas(a)google.com>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda - controller is in GPU on the DG1
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda - add Intel DG1 PCI and HDMI ids
Wenchao Hao <haowenchao2(a)huawei.com>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <development(a)efficientek.com>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Randy Dunlap <rdunlap(a)infradead.org>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <christianshewitt(a)gmail.com>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com>
cifs: Move the in_send statistic to __smb_send_rqst()
Dmitry Osipenko <dmitry.osipenko(a)collabora.com>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Herbert Xu <herbert(a)gondor.apana.org.au>
xfrm: Allow transport-mode states with AF_UNSPEC selector
Eric Biggers <ebiggers(a)google.com>
ext4: fix cgroup writeback accounting with fs-layer encryption
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +-
Makefile | 4 +--
arch/mips/lasat/picvue_proc.c | 2 +-
arch/s390/boot/ipl_report.c | 8 +++++
arch/x86/Makefile.um | 6 ++++
arch/x86/kvm/vmx/nested.c | 10 ++++--
arch/x86/mm/mem_encrypt_identity.c | 3 +-
drivers/block/sunvdc.c | 2 ++
drivers/clk/Kconfig | 2 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 ++---
drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 5 +--
drivers/gpu/drm/meson/meson_vpp.c | 2 ++
drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +-
drivers/hid/hid-core.c | 18 +++++++---
drivers/hid/uhid.c | 1 +
drivers/hwmon/adt7475.c | 8 ++---
drivers/hwmon/ina3221.c | 2 +-
drivers/hwmon/xgene-hwmon.c | 1 +
drivers/interconnect/core.c | 4 +++
drivers/media/i2c/m5mols/m5mols_core.c | 2 +-
drivers/mmc/host/atmel-mci.c | 3 --
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++
drivers/net/ethernet/sun/ldmvsw.c | 3 ++
drivers/net/ethernet/sun/sunvnet.c | 3 ++
drivers/net/ipvlan/ipvlan_l3s.c | 1 +
drivers/net/phy/smsc.c | 5 ++-
drivers/net/usb/smsc75xx.c | 7 ++++
drivers/nfc/pn533/usb.c | 1 +
drivers/nfc/st-nci/ndlc.c | 6 ++--
drivers/nvme/target/core.c | 4 ++-
drivers/pci/pci-driver.c | 4 +--
drivers/pci/pci.c | 54 +++++++++++++----------------
drivers/pci/pci.h | 10 +++++-
drivers/scsi/hosts.c | 5 +--
drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++--
drivers/tty/serial/8250/8250_em.c | 4 +--
drivers/tty/serial/fsl_lpuart.c | 12 +++++--
drivers/video/fbdev/stifb.c | 27 +++++++++++++++
fs/cifs/transport.c | 21 +++++------
fs/ext4/inode.c | 18 +++++-----
fs/ext4/namei.c | 4 +--
fs/ext4/page-io.c | 10 +++---
fs/ext4/xattr.c | 11 ++++++
fs/jffs2/file.c | 15 ++++----
include/linux/hid.h | 3 ++
include/linux/netdevice.h | 6 ++--
include/linux/sh_intc.h | 5 ++-
include/linux/tracepoint.h | 15 ++++----
kernel/trace/ftrace.c | 3 +-
kernel/trace/trace_events_hist.c | 3 ++
net/ipv4/fib_frontend.c | 3 ++
net/ipv4/ip_tunnel.c | 12 +++----
net/ipv4/tcp_output.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +--
net/iucv/iucv.c | 2 +-
net/netfilter/nft_redir.c | 2 +-
net/xfrm/xfrm_state.c | 3 --
sound/pci/hda/hda_intel.c | 22 ++++++++++--
sound/pci/hda/patch_hdmi.c | 3 ++
60 files changed, 284 insertions(+), 145 deletions(-)