- Linux-stable-mirror - lists.linaro.org

[merged mm-hotfixes-stable] mm-enable-maple-tree-rcu-mode-by-default.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: enable maple tree RCU mode by default has been removed from the -mm tree. Its filename was mm-enable-maple-tree-rcu-mode-by-default.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com> Subject: mm: enable maple tree RCU mode by default Date: Mon, 27 Feb 2023 09:36:07 -0800 Use the maple tree in RCU mode for VMA tracking. The maple tree tracks the stack and is able to update the pivot (lower/upper boundary) in-place to allow the page fault handler to write to the tree while holding just the mmap read lock. This is safe as the writes to the stack have a guard VMA which ensures there will always be a NULL in the direction of the growth and thus will only update a pivot. It is possible, but not recommended, to have VMAs that grow up/down without guard VMAs. syzbot has constructed a testcase which sets up a VMA to grow and consume the empty space. Overwriting the entire NULL entry causes the tree to be altered in a way that is not safe for concurrent readers; the readers may see a node being rewritten or one that does not match the maple state they are using. Enabling RCU mode allows the concurrent readers to see a stable node and will return the expected result. [Liam.Howlett(a)Oracle.com: we don't need to free the nodes with RCU[ Link: https://lore.kernel.org/linux-mm/000000000000b0a65805f663ace6@google.com/ Link: https://lkml.kernel.org/r/20230227173632.3292573-9-surenb@google.com Fixes: d4af56c5c7c6 ("mm: start tracking VMAs with maple tree") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Reported-by: syzbot+8d95422d3537159ca390(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mm_types.h | 3 ++- kernel/fork.c | 3 +++ mm/mmap.c | 3 ++- 3 files changed, 7 insertions(+), 2 deletions(-) --- a/include/linux/mm_types.h~mm-enable-maple-tree-rcu-mode-by-default +++ a/include/linux/mm_types.h @@ -774,7 +774,8 @@ struct mm_struct { unsigned long cpu_bitmap[]; }; -#define MM_MT_FLAGS (MT_FLAGS_ALLOC_RANGE | MT_FLAGS_LOCK_EXTERN) +#define MM_MT_FLAGS (MT_FLAGS_ALLOC_RANGE | MT_FLAGS_LOCK_EXTERN | \ + MT_FLAGS_USE_RCU) extern struct mm_struct init_mm; /* Pointer magic because the dynamic array size confuses some compilers. */ --- a/kernel/fork.c~mm-enable-maple-tree-rcu-mode-by-default +++ a/kernel/fork.c @@ -617,6 +617,7 @@ static __latent_entropy int dup_mmap(str if (retval) goto out; + mt_clear_in_rcu(vmi.mas.tree); for_each_vma(old_vmi, mpnt) { struct file *file; @@ -700,6 +701,8 @@ static __latent_entropy int dup_mmap(str retval = arch_dup_mmap(oldmm, mm); loop_out: vma_iter_free(&vmi); + if (!retval) + mt_set_in_rcu(vmi.mas.tree); out: mmap_write_unlock(mm); flush_tlb_mm(oldmm); --- a/mm/mmap.c~mm-enable-maple-tree-rcu-mode-by-default +++ a/mm/mmap.c @@ -2277,7 +2277,7 @@ do_vmi_align_munmap(struct vma_iterator int count = 0; int error = -ENOMEM; MA_STATE(mas_detach, &mt_detach, 0, 0); - mt_init_flags(&mt_detach, MT_FLAGS_LOCK_EXTERN); + mt_init_flags(&mt_detach, vmi->mas.tree->ma_flags & MT_FLAGS_LOCK_MASK); mt_set_external_lock(&mt_detach, &mm->mmap_lock); /* @@ -3037,6 +3037,7 @@ void exit_mmap(struct mm_struct *mm) */ set_bit(MMF_OOM_SKIP, &mm->flags); mmap_write_lock(mm); + mt_clear_in_rcu(&mm->mm_mt); free_pgtables(&tlb, &mm->mm_mt, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb); _ Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are

2 years, 7 months

1
0
0 0

[merged mm-hotfixes-stable] maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: maple_tree: add RCU lock checking to rcu callback functions has been removed from the -mm tree. Its filename was maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com> Subject: maple_tree: add RCU lock checking to rcu callback functions Date: Mon, 27 Feb 2023 09:36:06 -0800 Dereferencing RCU objects within the RCU callback without the RCU check has caused lockdep to complain. Fix the RCU dereferencing by using the RCU callback lock to ensure the operation is safe. Also stop creating a new lock to use for dereferencing during destruction of the tree or subtree. Instead, pass through a pointer to the tree that has the lock that is held for RCU dereferencing checking. It also does not make sense to use the maple state in the freeing scenario as the tree walk is a special case where the tree no longer has the normal encodings and parent pointers. Link: https://lkml.kernel.org/r/20230227173632.3292573-8-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Reported-by: Suren Baghdasaryan <surenb(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/maple_tree.c | 188 ++++++++++++++++++++++----------------------- 1 file changed, 96 insertions(+), 92 deletions(-) --- a/lib/maple_tree.c~maple_tree-add-rcu-lock-checking-to-rcu-callback-functions +++ a/lib/maple_tree.c @@ -824,6 +824,11 @@ static inline void *mt_slot(const struct return rcu_dereference_check(slots[offset], mt_locked(mt)); } +static inline void *mt_slot_locked(struct maple_tree *mt, void __rcu **slots, + unsigned char offset) +{ + return rcu_dereference_protected(slots[offset], mt_locked(mt)); +} /* * mas_slot_locked() - Get the slot value when holding the maple tree lock. * @mas: The maple state @@ -835,7 +840,7 @@ static inline void *mt_slot(const struct static inline void *mas_slot_locked(struct ma_state *mas, void __rcu **slots, unsigned char offset) { - return rcu_dereference_protected(slots[offset], mt_locked(mas->tree)); + return mt_slot_locked(mas->tree, slots, offset); } /* @@ -907,34 +912,35 @@ static inline void ma_set_meta(struct ma } /* - * mas_clear_meta() - clear the metadata information of a node, if it exists - * @mas: The maple state + * mt_clear_meta() - clear the metadata information of a node, if it exists + * @mt: The maple tree * @mn: The maple node - * @mt: The maple node type + * @type: The maple node type * @offset: The offset of the highest sub-gap in this node. * @end: The end of the data in this node. */ -static inline void mas_clear_meta(struct ma_state *mas, struct maple_node *mn, - enum maple_type mt) +static inline void mt_clear_meta(struct maple_tree *mt, struct maple_node *mn, + enum maple_type type) { struct maple_metadata *meta; unsigned long *pivots; void __rcu **slots; void *next; - switch (mt) { + switch (type) { case maple_range_64: pivots = mn->mr64.pivot; if (unlikely(pivots[MAPLE_RANGE64_SLOTS - 2])) { slots = mn->mr64.slot; - next = mas_slot_locked(mas, slots, - MAPLE_RANGE64_SLOTS - 1); - if (unlikely((mte_to_node(next) && mte_node_type(next)))) - return; /* The last slot is a node, no metadata */ + next = mt_slot_locked(mt, slots, + MAPLE_RANGE64_SLOTS - 1); + if (unlikely((mte_to_node(next) && + mte_node_type(next)))) + return; /* no metadata, could be node */ } fallthrough; case maple_arange_64: - meta = ma_meta(mn, mt); + meta = ma_meta(mn, type); break; default: return; @@ -5483,7 +5489,7 @@ no_gap: } /* - * mas_dead_leaves() - Mark all leaves of a node as dead. + * mte_dead_leaves() - Mark all leaves of a node as dead. * @mas: The maple state * @slots: Pointer to the slot array * @type: The maple node type @@ -5493,16 +5499,16 @@ no_gap: * Return: The number of leaves marked as dead. */ static inline -unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots, - enum maple_type mt) +unsigned char mte_dead_leaves(struct maple_enode *enode, struct maple_tree *mt, + void __rcu **slots) { struct maple_node *node; enum maple_type type; void *entry; int offset; - for (offset = 0; offset < mt_slots[mt]; offset++) { - entry = mas_slot_locked(mas, slots, offset); + for (offset = 0; offset < mt_slot_count(enode); offset++) { + entry = mt_slot(mt, slots, offset); type = mte_node_type(entry); node = mte_to_node(entry); /* Use both node and type to catch LE & BE metadata */ @@ -5517,162 +5523,160 @@ unsigned char mas_dead_leaves(struct ma_ return offset; } -static void __rcu **mas_dead_walk(struct ma_state *mas, unsigned char offset) +/** + * mte_dead_walk() - Walk down a dead tree to just before the leaves + * @enode: The maple encoded node + * @offset: The starting offset + * + * Note: This can only be used from the RCU callback context. + */ +static void __rcu **mte_dead_walk(struct maple_enode **enode, unsigned char offset) { - struct maple_node *next; + struct maple_node *node, *next; void __rcu **slots = NULL; - next = mas_mn(mas); + next = mte_to_node(*enode); do { - mas->node = mt_mk_node(next, next->type); - slots = ma_slots(next, next->type); - next = mas_slot_locked(mas, slots, offset); + *enode = ma_enode_ptr(next); + node = mte_to_node(*enode); + slots = ma_slots(node, node->type); + next = rcu_dereference_protected(slots[offset], + lock_is_held(&rcu_callback_map)); offset = 0; } while (!ma_is_leaf(next->type)); return slots; } +/** + * mt_free_walk() - Walk & free a tree in the RCU callback context + * @head: The RCU head that's within the node. + * + * Note: This can only be used from the RCU callback context. + */ static void mt_free_walk(struct rcu_head *head) { void __rcu **slots; struct maple_node *node, *start; - struct maple_tree mt; + struct maple_enode *enode; unsigned char offset; enum maple_type type; - MA_STATE(mas, &mt, 0, 0); node = container_of(head, struct maple_node, rcu); if (ma_is_leaf(node->type)) goto free_leaf; - mt_init_flags(&mt, node->ma_flags); - mas_lock(&mas); start = node; - mas.node = mt_mk_node(node, node->type); - slots = mas_dead_walk(&mas, 0); - node = mas_mn(&mas); + enode = mt_mk_node(node, node->type); + slots = mte_dead_walk(&enode, 0); + node = mte_to_node(enode); do { mt_free_bulk(node->slot_len, slots); offset = node->parent_slot + 1; - mas.node = node->piv_parent; - if (mas_mn(&mas) == node) - goto start_slots_free; - - type = mte_node_type(mas.node); - slots = ma_slots(mte_to_node(mas.node), type); - if ((offset < mt_slots[type]) && (slots[offset])) - slots = mas_dead_walk(&mas, offset); - - node = mas_mn(&mas); + enode = node->piv_parent; + if (mte_to_node(enode) == node) + goto free_leaf; + + type = mte_node_type(enode); + slots = ma_slots(mte_to_node(enode), type); + if ((offset < mt_slots[type]) && + rcu_dereference_protected(slots[offset], + lock_is_held(&rcu_callback_map))) + slots = mte_dead_walk(&enode, offset); + node = mte_to_node(enode); } while ((node != start) || (node->slot_len < offset)); slots = ma_slots(node, node->type); mt_free_bulk(node->slot_len, slots); -start_slots_free: - mas_unlock(&mas); free_leaf: mt_free_rcu(&node->rcu); } -static inline void __rcu **mas_destroy_descend(struct ma_state *mas, - struct maple_enode *prev, unsigned char offset) +static inline void __rcu **mte_destroy_descend(struct maple_enode **enode, + struct maple_tree *mt, struct maple_enode *prev, unsigned char offset) { struct maple_node *node; - struct maple_enode *next = mas->node; + struct maple_enode *next = *enode; void __rcu **slots = NULL; + enum maple_type type; + unsigned char next_offset = 0; do { - mas->node = next; - node = mas_mn(mas); - slots = ma_slots(node, mte_node_type(mas->node)); - next = mas_slot_locked(mas, slots, 0); - if ((mte_dead_node(next))) { - mte_to_node(next)->type = mte_node_type(next); - next = mas_slot_locked(mas, slots, 1); - } + *enode = next; + node = mte_to_node(*enode); + type = mte_node_type(*enode); + slots = ma_slots(node, type); + next = mt_slot_locked(mt, slots, next_offset); + if ((mte_dead_node(next))) + next = mt_slot_locked(mt, slots, ++next_offset); - mte_set_node_dead(mas->node); - node->type = mte_node_type(mas->node); - mas_clear_meta(mas, node, node->type); + mte_set_node_dead(*enode); + node->type = type; node->piv_parent = prev; node->parent_slot = offset; - offset = 0; - prev = mas->node; + offset = next_offset; + next_offset = 0; + prev = *enode; } while (!mte_is_leaf(next)); return slots; } -static void mt_destroy_walk(struct maple_enode *enode, unsigned char ma_flags, +static void mt_destroy_walk(struct maple_enode *enode, struct maple_tree *mt, bool free) { void __rcu **slots; struct maple_node *node = mte_to_node(enode); struct maple_enode *start; - struct maple_tree mt; - MA_STATE(mas, &mt, 0, 0); - - mas.node = enode; if (mte_is_leaf(enode)) { node->type = mte_node_type(enode); goto free_leaf; } - ma_flags &= ~MT_FLAGS_LOCK_MASK; - mt_init_flags(&mt, ma_flags); - mas_lock(&mas); - - mte_to_node(enode)->ma_flags = ma_flags; start = enode; - slots = mas_destroy_descend(&mas, start, 0); - node = mas_mn(&mas); + slots = mte_destroy_descend(&enode, mt, start, 0); + node = mte_to_node(enode); // Updated in the above call. do { enum maple_type type; unsigned char offset; struct maple_enode *parent, *tmp; - node->type = mte_node_type(mas.node); - node->slot_len = mas_dead_leaves(&mas, slots, node->type); + node->slot_len = mte_dead_leaves(enode, mt, slots); if (free) mt_free_bulk(node->slot_len, slots); offset = node->parent_slot + 1; - mas.node = node->piv_parent; - if (mas_mn(&mas) == node) - goto start_slots_free; + enode = node->piv_parent; + if (mte_to_node(enode) == node) + goto free_leaf; - type = mte_node_type(mas.node); - slots = ma_slots(mte_to_node(mas.node), type); + type = mte_node_type(enode); + slots = ma_slots(mte_to_node(enode), type); if (offset >= mt_slots[type]) goto next; - tmp = mas_slot_locked(&mas, slots, offset); + tmp = mt_slot_locked(mt, slots, offset); if (mte_node_type(tmp) && mte_to_node(tmp)) { - parent = mas.node; - mas.node = tmp; - slots = mas_destroy_descend(&mas, parent, offset); + parent = enode; + enode = tmp; + slots = mte_destroy_descend(&enode, mt, parent, offset); } next: - node = mas_mn(&mas); - } while (start != mas.node); + node = mte_to_node(enode); + } while (start != enode); - node = mas_mn(&mas); - node->type = mte_node_type(mas.node); - node->slot_len = mas_dead_leaves(&mas, slots, node->type); + node = mte_to_node(enode); + node->slot_len = mte_dead_leaves(enode, mt, slots); if (free) mt_free_bulk(node->slot_len, slots); -start_slots_free: - mas_unlock(&mas); - free_leaf: if (free) mt_free_rcu(&node->rcu); else - mas_clear_meta(&mas, node, node->type); + mt_clear_meta(mt, node, node->type); } /* @@ -5688,10 +5692,10 @@ static inline void mte_destroy_walk(stru struct maple_node *node = mte_to_node(enode); if (mt_in_rcu(mt)) { - mt_destroy_walk(enode, mt->ma_flags, false); + mt_destroy_walk(enode, mt, false); call_rcu(&node->rcu, mt_free_walk); } else { - mt_destroy_walk(enode, mt->ma_flags, true); + mt_destroy_walk(enode, mt, true); } } _ Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are

2 years, 7 months

1
0
0 0

[merged mm-hotfixes-stable] maple_tree-add-smp_rmb-to-dead-node-detection.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: maple_tree: add smp_rmb() to dead node detection has been removed from the -mm tree. Its filename was maple_tree-add-smp_rmb-to-dead-node-detection.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com> Subject: maple_tree: add smp_rmb() to dead node detection Date: Mon, 27 Feb 2023 09:36:05 -0800 Add an smp_rmb() before reading the parent pointer to ensure that anything read from the node prior to the parent pointer hasn't been reordered ahead of this check. The is necessary for RCU mode. Link: https://lkml.kernel.org/r/20230227173632.3292573-7-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/maple_tree.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/lib/maple_tree.c~maple_tree-add-smp_rmb-to-dead-node-detection +++ a/lib/maple_tree.c @@ -539,9 +539,11 @@ static inline struct maple_node *mte_par */ static inline bool ma_dead_node(const struct maple_node *node) { - struct maple_node *parent = (void *)((unsigned long) - node->parent & ~MAPLE_NODE_MASK); + struct maple_node *parent; + /* Do not reorder reads from the node prior to the parent check */ + smp_rmb(); + parent = (void *)((unsigned long) node->parent & ~MAPLE_NODE_MASK); return (parent == node); } @@ -556,6 +558,8 @@ static inline bool mte_dead_node(const s struct maple_node *parent, *node; node = mte_to_node(enode); + /* Do not reorder reads from the node prior to the parent check */ + smp_rmb(); parent = mte_parent(enode); return (parent == node); } _ Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are

2 years, 7 months

1
0
0 0

[merged mm-hotfixes-stable] maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: maple_tree: fix write memory barrier of nodes once dead for RCU mode has been removed from the -mm tree. Its filename was maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com> Subject: maple_tree: fix write memory barrier of nodes once dead for RCU mode Date: Mon, 27 Feb 2023 09:36:04 -0800 During the development of the maple tree, the strategy of freeing multiple nodes changed and, in the process, the pivots were reused to store pointers to dead nodes. To ensure the readers see accurate pivots, the writers need to mark the nodes as dead and call smp_wmb() to ensure any readers can identify the node as dead before using the pivot values. There were two places where the old method of marking the node as dead without smp_wmb() were being used, which resulted in RCU readers seeing the wrong pivot value before seeing the node was dead. Fix this race condition by using mte_set_node_dead() which has the smp_wmb() call to ensure the race is closed. Add a WARN_ON() to the ma_free_rcu() call to ensure all nodes being freed are marked as dead to ensure there are no other call paths besides the two updated paths. This is necessary for the RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-6-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/maple_tree.c | 7 +++++-- tools/testing/radix-tree/maple.c | 16 ++++++++++++++++ 2 files changed, 21 insertions(+), 2 deletions(-) --- a/lib/maple_tree.c~maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode +++ a/lib/maple_tree.c @@ -185,7 +185,7 @@ static void mt_free_rcu(struct rcu_head */ static void ma_free_rcu(struct maple_node *node) { - node->parent = ma_parent_ptr(node); + WARN_ON(node->parent != ma_parent_ptr(node)); call_rcu(&node->rcu, mt_free_rcu); } @@ -1778,8 +1778,10 @@ static inline void mas_replace(struct ma rcu_assign_pointer(slots[offset], mas->node); } - if (!advanced) + if (!advanced) { + mte_set_node_dead(old_enode); mas_free(mas, old_enode); + } } /* @@ -4218,6 +4220,7 @@ static inline bool mas_wr_node_store(str done: mas_leaf_set_meta(mas, newnode, dst_pivots, maple_leaf_64, new_end); if (in_rcu) { + mte_set_node_dead(mas->node); mas->node = mt_mk_node(newnode, wr_mas->type); mas_replace(mas, false); } else { --- a/tools/testing/radix-tree/maple.c~maple_tree-fix-write-memory-barrier-of-nodes-once-dead-for-rcu-mode +++ a/tools/testing/radix-tree/maple.c @@ -108,6 +108,7 @@ static noinline void check_new_node(stru MT_BUG_ON(mt, mn->slot[1] != NULL); MT_BUG_ON(mt, mas_allocated(&mas) != 0); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); mas.node = MAS_START; mas_nomem(&mas, GFP_KERNEL); @@ -160,6 +161,7 @@ static noinline void check_new_node(stru MT_BUG_ON(mt, mas_allocated(&mas) != i); MT_BUG_ON(mt, !mn); MT_BUG_ON(mt, not_empty(mn)); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); } @@ -192,6 +194,7 @@ static noinline void check_new_node(stru MT_BUG_ON(mt, not_empty(mn)); MT_BUG_ON(mt, mas_allocated(&mas) != i - 1); MT_BUG_ON(mt, !mn); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); } @@ -210,6 +213,7 @@ static noinline void check_new_node(stru mn = mas_pop_node(&mas); MT_BUG_ON(mt, not_empty(mn)); MT_BUG_ON(mt, mas_allocated(&mas) != j - 1); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); } MT_BUG_ON(mt, mas_allocated(&mas) != 0); @@ -233,6 +237,7 @@ static noinline void check_new_node(stru MT_BUG_ON(mt, mas_allocated(&mas) != i - j); mn = mas_pop_node(&mas); MT_BUG_ON(mt, not_empty(mn)); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); MT_BUG_ON(mt, mas_allocated(&mas) != i - j - 1); } @@ -269,6 +274,7 @@ static noinline void check_new_node(stru mn = mas_pop_node(&mas); /* get the next node. */ MT_BUG_ON(mt, mn == NULL); MT_BUG_ON(mt, not_empty(mn)); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); } MT_BUG_ON(mt, mas_allocated(&mas) != 0); @@ -294,6 +300,7 @@ static noinline void check_new_node(stru mn = mas_pop_node(&mas2); /* get the next node. */ MT_BUG_ON(mt, mn == NULL); MT_BUG_ON(mt, not_empty(mn)); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); } MT_BUG_ON(mt, mas_allocated(&mas2) != 0); @@ -334,10 +341,12 @@ static noinline void check_new_node(stru MT_BUG_ON(mt, mas_allocated(&mas) != MAPLE_ALLOC_SLOTS + 2); mn = mas_pop_node(&mas); MT_BUG_ON(mt, not_empty(mn)); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); for (i = 1; i <= MAPLE_ALLOC_SLOTS + 1; i++) { mn = mas_pop_node(&mas); MT_BUG_ON(mt, not_empty(mn)); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); } MT_BUG_ON(mt, mas_allocated(&mas) != 0); @@ -375,6 +384,7 @@ static noinline void check_new_node(stru mas_node_count(&mas, i); /* Request */ mas_nomem(&mas, GFP_KERNEL); /* Fill request */ mn = mas_pop_node(&mas); /* get the next node. */ + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); mas_destroy(&mas); @@ -382,10 +392,13 @@ static noinline void check_new_node(stru mas_node_count(&mas, i); /* Request */ mas_nomem(&mas, GFP_KERNEL); /* Fill request */ mn = mas_pop_node(&mas); /* get the next node. */ + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); mn = mas_pop_node(&mas); /* get the next node. */ + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); mn = mas_pop_node(&mas); /* get the next node. */ + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); mas_destroy(&mas); } @@ -35369,6 +35382,7 @@ static noinline void check_prealloc(stru MT_BUG_ON(mt, allocated != 1 + height * 3); mn = mas_pop_node(&mas); MT_BUG_ON(mt, mas_allocated(&mas) != allocated - 1); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); MT_BUG_ON(mt, mas_preallocate(&mas, GFP_KERNEL) != 0); mas_destroy(&mas); @@ -35386,6 +35400,7 @@ static noinline void check_prealloc(stru mas_destroy(&mas); allocated = mas_allocated(&mas); MT_BUG_ON(mt, allocated != 0); + mn->parent = ma_parent_ptr(mn); ma_free_rcu(mn); MT_BUG_ON(mt, mas_preallocate(&mas, GFP_KERNEL) != 0); @@ -35756,6 +35771,7 @@ void farmer_tests(void) tree.ma_root = mt_mk_node(node, maple_leaf_64); mt_dump(&tree); + node->parent = ma_parent_ptr(node); ma_free_rcu(node); /* Check things that will make lockdep angry */ _ Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are

2 years, 7 months

1
0
0 0

[merged mm-hotfixes-stable] maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: maple_tree: remove extra smp_wmb() from mas_dead_leaves() has been removed from the -mm tree. Its filename was maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Liam Howlett <Liam.Howlett(a)oracle.com> Subject: maple_tree: remove extra smp_wmb() from mas_dead_leaves() Date: Mon, 27 Feb 2023 09:36:03 -0800 The call to mte_set_dead_node() before the smp_wmb() already calls smp_wmb() so this is not needed. This is an optimization for the RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-5-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/maple_tree.c | 1 - 1 file changed, 1 deletion(-) --- a/lib/maple_tree.c~maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves +++ a/lib/maple_tree.c @@ -5503,7 +5503,6 @@ unsigned char mas_dead_leaves(struct ma_ break; mte_set_node_dead(entry); - smp_wmb(); /* Needed for RCU */ node->type = type; rcu_assign_pointer(slots[offset], node); } _ Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are

2 years, 7 months

1
0
0 0

[merged mm-hotfixes-stable] maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: maple_tree: fix freeing of nodes in rcu mode has been removed from the -mm tree. Its filename was maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Liam Howlett <Liam.Howlett(a)oracle.com> Subject: maple_tree: fix freeing of nodes in rcu mode Date: Mon, 27 Feb 2023 09:36:02 -0800 The walk to destroy the nodes was not always setting the node type and would result in a destroy method potentially using the values as nodes. Avoid this by setting the correct node types. This is necessary for the RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-4-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/maple_tree.c | 73 ++++++++++++++++++++++++++++++++++++++------- 1 file changed, 62 insertions(+), 11 deletions(-) --- a/lib/maple_tree.c~maple_tree-fix-freeing-of-nodes-in-rcu-mode +++ a/lib/maple_tree.c @@ -903,6 +903,44 @@ static inline void ma_set_meta(struct ma } /* + * mas_clear_meta() - clear the metadata information of a node, if it exists + * @mas: The maple state + * @mn: The maple node + * @mt: The maple node type + * @offset: The offset of the highest sub-gap in this node. + * @end: The end of the data in this node. + */ +static inline void mas_clear_meta(struct ma_state *mas, struct maple_node *mn, + enum maple_type mt) +{ + struct maple_metadata *meta; + unsigned long *pivots; + void __rcu **slots; + void *next; + + switch (mt) { + case maple_range_64: + pivots = mn->mr64.pivot; + if (unlikely(pivots[MAPLE_RANGE64_SLOTS - 2])) { + slots = mn->mr64.slot; + next = mas_slot_locked(mas, slots, + MAPLE_RANGE64_SLOTS - 1); + if (unlikely((mte_to_node(next) && mte_node_type(next)))) + return; /* The last slot is a node, no metadata */ + } + fallthrough; + case maple_arange_64: + meta = ma_meta(mn, mt); + break; + default: + return; + } + + meta->gap = 0; + meta->end = 0; +} + +/* * ma_meta_end() - Get the data end of a node from the metadata * @mn: The maple node * @mt: The maple node type @@ -5441,20 +5479,22 @@ no_gap: * mas_dead_leaves() - Mark all leaves of a node as dead. * @mas: The maple state * @slots: Pointer to the slot array + * @type: The maple node type * * Must hold the write lock. * * Return: The number of leaves marked as dead. */ static inline -unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots) +unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots, + enum maple_type mt) { struct maple_node *node; enum maple_type type; void *entry; int offset; - for (offset = 0; offset < mt_slot_count(mas->node); offset++) { + for (offset = 0; offset < mt_slots[mt]; offset++) { entry = mas_slot_locked(mas, slots, offset); type = mte_node_type(entry); node = mte_to_node(entry); @@ -5473,14 +5513,13 @@ unsigned char mas_dead_leaves(struct ma_ static void __rcu **mas_dead_walk(struct ma_state *mas, unsigned char offset) { - struct maple_node *node, *next; + struct maple_node *next; void __rcu **slots = NULL; next = mas_mn(mas); do { - mas->node = ma_enode_ptr(next); - node = mas_mn(mas); - slots = ma_slots(node, node->type); + mas->node = mt_mk_node(next, next->type); + slots = ma_slots(next, next->type); next = mas_slot_locked(mas, slots, offset); offset = 0; } while (!ma_is_leaf(next->type)); @@ -5544,11 +5583,14 @@ static inline void __rcu **mas_destroy_d node = mas_mn(mas); slots = ma_slots(node, mte_node_type(mas->node)); next = mas_slot_locked(mas, slots, 0); - if ((mte_dead_node(next))) + if ((mte_dead_node(next))) { + mte_to_node(next)->type = mte_node_type(next); next = mas_slot_locked(mas, slots, 1); + } mte_set_node_dead(mas->node); node->type = mte_node_type(mas->node); + mas_clear_meta(mas, node, node->type); node->piv_parent = prev; node->parent_slot = offset; offset = 0; @@ -5568,13 +5610,18 @@ static void mt_destroy_walk(struct maple MA_STATE(mas, &mt, 0, 0); - if (mte_is_leaf(enode)) + mas.node = enode; + if (mte_is_leaf(enode)) { + node->type = mte_node_type(enode); goto free_leaf; + } + ma_flags &= ~MT_FLAGS_LOCK_MASK; mt_init_flags(&mt, ma_flags); mas_lock(&mas); - mas.node = start = enode; + mte_to_node(enode)->ma_flags = ma_flags; + start = enode; slots = mas_destroy_descend(&mas, start, 0); node = mas_mn(&mas); do { @@ -5582,7 +5629,8 @@ static void mt_destroy_walk(struct maple unsigned char offset; struct maple_enode *parent, *tmp; - node->slot_len = mas_dead_leaves(&mas, slots); + node->type = mte_node_type(mas.node); + node->slot_len = mas_dead_leaves(&mas, slots, node->type); if (free) mt_free_bulk(node->slot_len, slots); offset = node->parent_slot + 1; @@ -5606,7 +5654,8 @@ next: } while (start != mas.node); node = mas_mn(&mas); - node->slot_len = mas_dead_leaves(&mas, slots); + node->type = mte_node_type(mas.node); + node->slot_len = mas_dead_leaves(&mas, slots, node->type); if (free) mt_free_bulk(node->slot_len, slots); @@ -5616,6 +5665,8 @@ start_slots_free: free_leaf: if (free) mt_free_rcu(&node->rcu); + else + mas_clear_meta(&mas, node, node->type); } /* _ Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are

2 years, 7 months

1
0
0 0

[merged mm-hotfixes-stable] maple_tree-detect-dead-nodes-in-mas_start.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: maple_tree: detect dead nodes in mas_start() has been removed from the -mm tree. Its filename was maple_tree-detect-dead-nodes-in-mas_start.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Liam Howlett <Liam.Howlett(a)oracle.com> Subject: maple_tree: detect dead nodes in mas_start() Date: Mon, 27 Feb 2023 09:36:01 -0800 When initially starting a search, the root node may already be in the process of being replaced in RCU mode. Detect and restart the walk if this is the case. This is necessary for RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-3-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/maple_tree.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/lib/maple_tree.c~maple_tree-detect-dead-nodes-in-mas_start +++ a/lib/maple_tree.c @@ -1360,12 +1360,16 @@ static inline struct maple_enode *mas_st mas->max = ULONG_MAX; mas->depth = 0; +retry: root = mas_root(mas); /* Tree with nodes */ if (likely(xa_is_node(root))) { mas->depth = 1; mas->node = mte_safe_root(root); mas->offset = 0; + if (mte_dead_node(mas->node)) + goto retry; + return NULL; } _ Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are

2 years, 7 months

1
0
0 0

[merged mm-hotfixes-stable] maple_tree-be-more-cautious-about-dead-nodes.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: maple_tree: be more cautious about dead nodes has been removed from the -mm tree. Its filename was maple_tree-be-more-cautious-about-dead-nodes.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Liam Howlett <Liam.Howlett(a)oracle.com> Subject: maple_tree: be more cautious about dead nodes Date: Mon, 27 Feb 2023 09:36:00 -0800 Patch series "Fix VMA tree modification under mmap read lock". Syzbot reported a BUG_ON in mm/mmap.c which was found to be caused by an inconsistency between threads walking the VMA maple tree. The inconsistency is caused by the page fault handler modifying the maple tree while holding the mmap_lock for read. This only happens for stack VMAs. We had thought this was safe as it only modifies a single pivot in the tree. Unfortunately, syzbot constructed a test case where the stack had no guard page and grew the stack to abut the next VMA. This causes us to delete the NULL entry between the two VMAs and rewrite the node. We considered several options for fixing this, including dropping the mmap_lock, then reacquiring it for write; and relaxing the definition of the tree to permit a zero-length NULL entry in the node. We decided the best option was to backport some of the RCU patches from -next, which solve the problem by allocating a new node and RCU-freeing the old node. Since the problem exists in 6.1, we preferred a solution which is similar to the one we intended to merge next merge window. These patches have been in -next since next-20230301, and have received intensive testing in Android as part of the RCU page fault patchset. They were also sent as part of the "Per-VMA locks" v4 patch series. Patches 1 to 7 are bug fixes for RCU mode of the tree and patch 8 enables RCU mode for the tree. Performance v6.3-rc3 vs patched v6.3-rc3: Running these changes through mmtests showed there was a 15-20% performance decrease in will-it-scale/brk1-processes. This tests creating and inserting a single VMA repeatedly through the brk interface and isn't representative of any real world applications. This patch (of 8): ma_pivots() and ma_data_end() may be called with a dead node. Ensure to that the node isn't dead before using the returned values. This is necessary for RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230327185532.2354250-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20230227173632.3292573-1-surenb@google.com Link: https://lkml.kernel.org/r/20230227173632.3292573-2-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Arjun Roy <arjunroy(a)google.com> Cc: Axel Rasmussen <axelrasmussen(a)google.com> Cc: Chris Li <chriscli(a)google.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: David Howells <dhowells(a)redhat.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: David Rientjes <rientjes(a)google.com> Cc: Eric Dumazet <edumazet(a)google.com> Cc: freak07 <michalechner92(a)googlemail.com> Cc: Greg Thelen <gthelen(a)google.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Jann Horn <jannh(a)google.com> Cc: Joel Fernandes <joelaf(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Laurent Dufour <ldufour(a)linux.ibm.com> Cc: Lorenzo Stoakes <lstoakes(a)gmail.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Minchan Kim <minchan(a)google.com> Cc: Paul E. McKenney <paulmck(a)kernel.org> Cc: Peter Oskolkov <posk(a)google.com> Cc: Peter Xu <peterx(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Punit Agrawal <punit.agrawal(a)bytedance.com> Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Soheil Hassas Yeganeh <soheil(a)google.com> Cc: Song Liu <songliubraving(a)fb.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Will Deacon <will(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/maple_tree.c | 52 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 43 insertions(+), 9 deletions(-) --- a/lib/maple_tree.c~maple_tree-be-more-cautious-about-dead-nodes +++ a/lib/maple_tree.c @@ -544,6 +544,7 @@ static inline bool ma_dead_node(const st return (parent == node); } + /* * mte_dead_node() - check if the @enode is dead. * @enode: The encoded maple node @@ -625,6 +626,8 @@ static inline unsigned int mas_alloc_req * @node - the maple node * @type - the node type * + * In the event of a dead node, this array may be %NULL + * * Return: A pointer to the maple node pivots */ static inline unsigned long *ma_pivots(struct maple_node *node, @@ -1096,8 +1099,11 @@ static int mas_ascend(struct ma_state *m a_type = mas_parent_enum(mas, p_enode); a_node = mte_parent(p_enode); a_slot = mte_parent_slot(p_enode); - pivots = ma_pivots(a_node, a_type); a_enode = mt_mk_node(a_node, a_type); + pivots = ma_pivots(a_node, a_type); + + if (unlikely(ma_dead_node(a_node))) + return 1; if (!set_min && a_slot) { set_min = true; @@ -1401,6 +1407,9 @@ static inline unsigned char ma_data_end( { unsigned char offset; + if (!pivots) + return 0; + if (type == maple_arange_64) return ma_meta_end(node, type); @@ -1436,6 +1445,9 @@ static inline unsigned char mas_data_end return ma_meta_end(node, type); pivots = ma_pivots(node, type); + if (unlikely(ma_dead_node(node))) + return 0; + offset = mt_pivots[type] - 1; if (likely(!pivots[offset])) return ma_meta_end(node, type); @@ -4505,6 +4517,9 @@ static inline int mas_prev_node(struct m node = mas_mn(mas); slots = ma_slots(node, mt); pivots = ma_pivots(node, mt); + if (unlikely(ma_dead_node(node))) + return 1; + mas->max = pivots[offset]; if (offset) mas->min = pivots[offset - 1] + 1; @@ -4526,6 +4541,9 @@ static inline int mas_prev_node(struct m slots = ma_slots(node, mt); pivots = ma_pivots(node, mt); offset = ma_data_end(node, mt, pivots, mas->max); + if (unlikely(ma_dead_node(node))) + return 1; + if (offset) mas->min = pivots[offset - 1] + 1; @@ -4574,6 +4592,7 @@ static inline int mas_next_node(struct m struct maple_enode *enode; int level = 0; unsigned char offset; + unsigned char node_end; enum maple_type mt; void __rcu **slots; @@ -4597,7 +4616,11 @@ static inline int mas_next_node(struct m node = mas_mn(mas); mt = mte_node_type(mas->node); pivots = ma_pivots(node, mt); - } while (unlikely(offset == ma_data_end(node, mt, pivots, mas->max))); + node_end = ma_data_end(node, mt, pivots, mas->max); + if (unlikely(ma_dead_node(node))) + return 1; + + } while (unlikely(offset == node_end)); slots = ma_slots(node, mt); pivot = mas_safe_pivot(mas, pivots, ++offset, mt); @@ -4613,6 +4636,9 @@ static inline int mas_next_node(struct m mt = mte_node_type(mas->node); slots = ma_slots(node, mt); pivots = ma_pivots(node, mt); + if (unlikely(ma_dead_node(node))) + return 1; + offset = 0; pivot = pivots[0]; } @@ -4659,11 +4685,14 @@ static inline void *mas_next_nentry(stru return NULL; } - pivots = ma_pivots(node, type); slots = ma_slots(node, type); - mas->index = mas_safe_min(mas, pivots, mas->offset); + pivots = ma_pivots(node, type); count = ma_data_end(node, type, pivots, mas->max); - if (ma_dead_node(node)) + if (unlikely(ma_dead_node(node))) + return NULL; + + mas->index = mas_safe_min(mas, pivots, mas->offset); + if (unlikely(ma_dead_node(node))) return NULL; if (mas->index > max) @@ -4817,6 +4846,11 @@ retry: slots = ma_slots(mn, mt); pivots = ma_pivots(mn, mt); + if (unlikely(ma_dead_node(mn))) { + mas_rewalk(mas, index); + goto retry; + } + if (offset == mt_pivots[mt]) pivot = mas->max; else @@ -6617,11 +6651,11 @@ static inline void *mas_first_entry(stru while (likely(!ma_is_leaf(mt))) { MT_BUG_ON(mas->tree, mte_dead_node(mas->node)); slots = ma_slots(mn, mt); - pivots = ma_pivots(mn, mt); - max = pivots[0]; entry = mas_slot(mas, slots, 0); + pivots = ma_pivots(mn, mt); if (unlikely(ma_dead_node(mn))) return NULL; + max = pivots[0]; mas->node = entry; mn = mas_mn(mas); mt = mte_node_type(mas->node); @@ -6641,13 +6675,13 @@ static inline void *mas_first_entry(stru if (likely(entry)) return entry; - pivots = ma_pivots(mn, mt); - mas->index = pivots[0] + 1; mas->offset = 1; entry = mas_slot(mas, slots, 1); + pivots = ma_pivots(mn, mt); if (unlikely(ma_dead_node(mn))) return NULL; + mas->index = pivots[0] + 1; if (mas->index > limit) goto none; _ Patches currently in -mm which might be from Liam.Howlett(a)oracle.com are

2 years, 7 months

1
0
0 0

[folded-merged] mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v3.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v3 has been removed from the -mm tree. Its filename was mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v3.patch This patch was dropped because it was folded into mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path.patch ------------------------------------------------------ From: Peter Xu <peterx(a)redhat.com> Subject: mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v3 Date: Fri, 24 Mar 2023 10:26:20 -0400 Link: https://lkml.kernel.org/r/20230324142620.2344140-1-peterx@redhat.com Reported-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com> Cc: linux-stable <stable(a)vger.kernel.org> Fixes: 166f3ecc0daf ("mm/hugetlb: hook page faults for uffd write protection") Signed-off-by: Peter Xu <peterx(a)redhat.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/hugetlb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/mm/hugetlb.c~mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path-v3 +++ a/mm/hugetlb.c @@ -5491,11 +5491,11 @@ static vm_fault_t hugetlb_wp(struct mm_s * Never handle CoW for uffd-wp protected pages. It should be only * handled when the uffd-wp protection is removed. * - * Note that only the CoW optimization path can trigger this and - * got skipped, because hugetlb_fault() will always resolve uffd-wp - * bit first. + * Note that only the CoW optimization path (in hugetlb_no_page()) + * can trigger this, because hugetlb_fault() will always resolve + * uffd-wp bit first. */ - if (huge_pte_uffd_wp(pte)) + if (!unshare && huge_pte_uffd_wp(pte)) return 0; /* _ Patches currently in -mm which might be from peterx(a)redhat.com are mm-hugetlb-fix-uffd-wr-protection-for-cow-optimization-path.patch mm-khugepaged-check-again-on-anon-uffd-wp-during-isolation.patch mm-uffd-uffd_feature_wp_unpopulated.patch mm-uffd-uffd_feature_wp_unpopulated-fix.patch selftests-mm-smoke-test-uffd_feature_wp_unpopulated.patch

2 years, 7 months

1
0
0 0

[PATCH 5.4 000/357] 5.4.235-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.4.235 release. There are 357 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 12 Mar 2023 13:36:38 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.235-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.4.235-rc1 Maxime Ripard <maxime(a)cerno.tech> dt-bindings: rtc: sun6i-a31-rtc: Loosen the requirements on the clocks Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: add missing discipline function Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Fix race condition with usb_kill_urb Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Provide sync and async uvc_ctrl_status_event Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Fix listen() regression in 5.4.229. Nguyen Dinh Phi <phind.uet(a)gmail.com> Bluetooth: hci_sock: purge socket queues in the destruct() callback Linus Torvalds <torvalds(a)linux-foundation.org> x86/resctl: fix scheduler confusion with 'current' Valentin Schneider <valentin.schneider(a)arm.com> x86/resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid} Jakub Kicinski <kuba(a)kernel.org> net: tls: avoid hanging tasks on the tx_lock Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com> phy: rockchip-typec: Fix unsigned comparison with less than zero Mengyuan Lou <mengyuanlou(a)net-swift.com> PCI: Add ACS quirk for Wangxun NICs Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> kernel/fail_function: fix memory leak with using debugfs_lookup() Daniel Scally <dan.scally(a)ideasonboard.com> usb: uvc: Enumerate valid values for color matching Kees Cook <keescook(a)chromium.org> USB: ene_usb6250: Allocate enough memory for full object Kees Cook <keescook(a)chromium.org> usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() Yulong Zhang <yulong.zhang(a)metoak.net> tools/iio/iio_utils:fix memory leak Alexander Usyskin <alexander.usyskin(a)intel.com> mei: bus-fixup:upon error print return values of send and receive Sherry Sun <sherry.sun(a)nxp.com> tty: serial: fsl_lpuart: disable the CTS when send break signal Sven Schnelle <svens(a)linux.ibm.com> tty: fix out-of-bounds access in tty_driver_lookup_tty() Yuan Can <yuancan(a)huawei.com> staging: emxx_udc: Add checks for dma_alloc_coherent() Kees Cook <keescook(a)chromium.org> media: uvcvideo: Silence memcpy() run-time false positive warnings Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 Guenter Roeck <linux(a)roeck-us.net> media: uvcvideo: Handle errors from calls to usb_string Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Handle cameras with invalid descriptors Liang He <windhl(a)126.com> mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak Darrell Kavanagh <darrell.kavanagh(a)gmail.com> firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 Jia-Ju Bai <baijiaju1990(a)gmail.com> tracing: Add NULL checks for buffer in ring_buffer_free_read_page() Randy Dunlap <rdunlap(a)infradead.org> thermal: intel: BXT_PMIC: select REGMAP instead of depending on it Dan Carpenter <error27(a)gmail.com> thermal: intel: quark_dts: fix error pointer dereference Arnd Bergmann <arnd(a)arndb.de> scsi: ipr: Work around fortify-string warning Samuel Holland <samuel(a)sholland.org> rtc: sun6i: Always export the internal oscillator Jernej Skrabec <jernej.skrabec(a)siol.net> rtc: sun6i: Make external 32k oscillator optional George Kennedy <george.kennedy(a)oracle.com> vc_screen: modify vcs_size() handling in vcs_read() Eric Dumazet <edumazet(a)google.com> tcp: tcp_check_req() can be called from process context Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ARM: dts: spear320-hmi: correct STMPE GPIO compatible Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_sample: fix action bind logic Fedor Pchelkin <pchelkin(a)ispras.ru> nfc: fix memory leak of se_io context in nfc_genl_se_io Maor Dickman <maord(a)nvidia.com> net/mlx5: Geneve, Fix handling of Geneve object id as error code Zhengchao Shao <shaozhengchao(a)huawei.com> 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() Juergen Gross <jgross(a)suse.com> 9p/xen: fix connection sequence Juergen Gross <jgross(a)suse.com> 9p/xen: fix version parsing Eric Dumazet <edumazet(a)google.com> net: fix __dev_kfree_skb_any() vs drop monitor Xin Long <lucien.xin(a)gmail.com> sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop Lu Wei <luwei32(a)huawei.com> ipv6: Add lwtunnel encap size of all siblings in nexthop calculation Hangyu Hua <hbh25y(a)gmail.com> netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() Li Hua <hucool.lihua(a)huawei.com> watchdog: pcwd_usb: Fix attempting to access uninitialized memory Chen Jun <chenjun102(a)huawei.com> watchdog: Fix kmemleak in watchdog_cdev_register ruanjinjie <ruanjinjie(a)huawei.com> watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path Ammar Faizi <ammarfaizi2(a)gnuweeb.org> x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Zhihao Cheng <chengzhihao1(a)huawei.com> ubifs: ubifs_writepage: Mark page dirty after writing inode failed Zhihao Cheng <chengzhihao1(a)huawei.com> ubifs: dirty_cow_znode: Fix memleak in error handling path Zhihao Cheng <chengzhihao1(a)huawei.com> ubifs: Re-statistic cleaned znode count if commit failed Yang Yingliang <yangyingliang(a)huawei.com> ubi: Fix possible null-ptr-deref in ubi_free_volume() Li Zetao <lizetao1(a)huawei.com> ubifs: Fix memory leak in alloc_wbufs() Li Zetao <lizetao1(a)huawei.com> ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() Li Zetao <lizetao1(a)huawei.com> ubi: Fix use-after-free when volume resizing failed Zhihao Cheng <chengzhihao1(a)huawei.com> ubifs: Reserve one leb for each journal head while doing budget Zhihao Cheng <chengzhihao1(a)huawei.com> ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 Zhihao Cheng <chengzhihao1(a)huawei.com> ubifs: Fix wrong dirty space budget for dirty inode Zhihao Cheng <chengzhihao1(a)huawei.com> ubifs: Rectify space budget for ubifs_xrename() Zhihao Cheng <chengzhihao1(a)huawei.com> ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted Li Hua <hucool.lihua(a)huawei.com> ubifs: Fix build errors as symbol undefined George Kennedy <george.kennedy(a)oracle.com> ubi: ensure that VID header offset + VID header size <= alloc, size Xiang Yang <xiangyang3(a)huawei.com> um: vector: Fix memory leak in vector_config Alexander Potapenko <glider(a)google.com> fs: f2fs: initialize fsdata in pagecache_write() Eric Biggers <ebiggers(a)google.com> f2fs: use memcpy_{to,from}_page() where possible Fabrice Gasnier <fabrice.gasnier(a)foss.st.com> pwm: stm32-lp: fix the check on arr and cmp registers update Emil Renner Berthing <emil.renner.berthing(a)canonical.com> pwm: sifive: Always let the first pwm_apply_state succeed Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> pwm: sifive: Reduce time the controller lock is held Liu Shixin via Jfs-discussion <jfs-discussion(a)lists.sourceforge.net> fs/jfs: fix shift exponent db_agl2size negative Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: Retire tcindex classifier Dmitry Goncharov <dgoncharov(a)users.sf.net> kbuild: Port silent mode detection to future gnu make. Arnd Bergmann <arnd(a)arndb.de> wifi: ath9k: use proper statements in conditionals Mark Hawrylak <mark.hawrylak(a)gmail.com> drm/radeon: Fix eDP for single-display iMac11,2 Mavroudis Chatzilaridis <mavchatz(a)protonmail.com> drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv Damien Le Moal <damien.lemoal(a)opensource.wdc.com> PCI: Avoid FLR for AMD FCH AHCI adapters Lukas Wunner <lukas(a)wunner.de> PCI: hotplug: Allow marking devices as disconnected during bind/unbind Lukas Wunner <lukas(a)wunner.de> PCI/PM: Observe reset delay irrespective of bridge_d3 Tomas Henzl <thenzl(a)redhat.com> scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() Tomas Henzl <thenzl(a)redhat.com> scsi: ses: Fix possible desc_ptr out-of-bounds accesses Tomas Henzl <thenzl(a)redhat.com> scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses Tomas Henzl <thenzl(a)redhat.com> scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() James Bottomley <jejb(a)linux.ibm.com> scsi: ses: Don't attach if enclosure has no components Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix erroneous link down Arun Easi <aeasi(a)marvell.com> scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix link failure in NPIV environment Steven Rostedt <rostedt(a)goodmis.org> ktest.pl: Add RUN_TIMEOUT option with default unlimited Steven Rostedt <rostedt(a)goodmis.org> ktest.pl: Fix missing "end_monitor" when machine check fails Steven Rostedt <rostedt(a)goodmis.org> ktest.pl: Give back console on Ctrt^C on monitor Yin Fengwei <fengwei.yin(a)intel.com> mm/thp: check and bail out if page in deferred queue already Johannes Weiner <hannes(a)cmpxchg.org> mm: memcontrol: deprecate charge moving Sakari Ailus <sakari.ailus(a)linux.intel.com> media: ipu3-cio2: Fix PM runtime usage_count in driver unbind Elvira Khabirova <lineprinter0(a)gmail.com> mips: fix syscall_get_nr Al Viro <viro(a)zeniv.linux.org.uk> alpha: fix FEN fault handling Ilya Dryomov <idryomov(a)gmail.com> rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ARM: dts: exynos: correct TMU phandle in Odroid XU Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ARM: dts: exynos: correct TMU phandle in Exynos4 Mikulas Patocka <mpatocka(a)redhat.com> dm flakey: don't corrupt the zero page Mikulas Patocka <mpatocka(a)redhat.com> dm flakey: fix logic when corrupting a bio Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> thermal: intel: powerclamp: Fix cur_state for multi package system Alexander Wetzel <alexander(a)wetzel-home.de> wifi: cfg80211: Fix use after free for wext Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: Use a longer retry limit of 48 Jun Nie <jun.nie(a)linaro.org> ext4: refuse to create ea block when umounted Jun Nie <jun.nie(a)linaro.org> ext4: optimize ea_inode block expansion Łukasz Stelmach <l.stelmach(a)samsung.com> ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC Dmitry Fomin <fomindmitriyfoma(a)mail.ru> ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() Johan Hovold <johan+linaro(a)kernel.org> irqdomain: Drop bogus fwspec-mapping error handling Johan Hovold <johan+linaro(a)kernel.org> irqdomain: Fix disassociation race Johan Hovold <johan+linaro(a)kernel.org> irqdomain: Fix association race Roberto Sassu <roberto.sassu(a)huawei.com> ima: Align ima_file_mmap() parameters with mmap_file LSM hook KP Singh <kpsingh(a)kernel.org> Documentation/hw-vuln: Document the interaction between IBRS and STIBP KP Singh <kpsingh(a)kernel.org> x86/speculation: Allow enabling STIBP with legacy IBRS Borislav Petkov (AMD) <bp(a)alien8.de> x86/microcode/AMD: Fix mixed steppings support Borislav Petkov (AMD) <bp(a)alien8.de> x86/microcode/AMD: Add a @cpu parameter to the reloading functions Borislav Petkov (AMD) <bp(a)alien8.de> x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter Yang Jihong <yangjihong1(a)huawei.com> x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range Yang Jihong <yangjihong1(a)huawei.com> x86/kprobes: Fix __recover_optprobed_insn check optimizing logic Sean Christopherson <seanjc(a)google.com> x86/reboot: Disable SVM, not just VMX, when stopping CPUs Sean Christopherson <seanjc(a)google.com> x86/reboot: Disable virtualization in an emergency if SVM is supported Sean Christopherson <seanjc(a)google.com> x86/crash: Disable virt in core NMI crash handler to avoid double shootdown Sean Christopherson <seanjc(a)google.com> x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) Nico Boehr <nrb(a)linux.ibm.com> KVM: s390: disable migration mode when dirty tracking is disabled Sean Christopherson <seanjc(a)google.com> KVM: Destroy target device if coalesced MMIO unregistration fails Jan Kara <jack(a)suse.cz> udf: Fix file corruption when appending just after end of preallocated extent Jan Kara <jack(a)suse.cz> udf: Detect system inodes linked into directory hierarchy Jan Kara <jack(a)suse.cz> udf: Preserve link count of system files Jan Kara <jack(a)suse.cz> udf: Do not update file length for failed writes to inline files Jan Kara <jack(a)suse.cz> udf: Do not bother merging very long extents Jan Kara <jack(a)suse.cz> udf: Truncate added extents on failed expansion Heming Zhao via Ocfs2-devel <ocfs2-devel(a)oss.oracle.com> ocfs2: fix non-auto defrag path not working issue Heming Zhao via Ocfs2-devel <ocfs2-devel(a)oss.oracle.com> ocfs2: fix defrag path triggering jbd2 ASSERT Eric Biggers <ebiggers(a)google.com> f2fs: fix cgroup writeback accounting with fs-layer encryption Eric Biggers <ebiggers(a)google.com> f2fs: fix information leak in f2fs_move_inline_dirents() Dongliang Mu <mudongliangabcd(a)gmail.com> fs: hfsplus: fix UAF issue in hfsplus_put_super Liu Shixin <liushixin2(a)huawei.com> hfs: fix missing hfs_bnode_get() in __hfs_bnode_create Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ARM: dts: exynos: correct HDMI phy compatible in Exynos4 Vasily Gorbik <gor(a)linux.ibm.com> s390/kprobes: fix current_kprobe never cleared after kprobes reenter Vasily Gorbik <gor(a)linux.ibm.com> s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler Ilya Leoshkevich <iii(a)linux.ibm.com> s390: discard .interp section Corey Minyard <cminyard(a)mvista.com> ipmi_ssif: Rename idle state and check Johan Hovold <johan+linaro(a)kernel.org> rtc: pm8xxx: fix set-alarm race Alper Nebi Yasak <alpernebiyasak(a)gmail.com> firmware: coreboot: framebuffer: Ignore reserved pixel color bits Jun ASAKA <JunASAKA(a)zzy040330.moe> wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu Jeff Layton <jlayton(a)kernel.org> nfsd: zero out pointers after putting nfsd_files on COPY setup error Mike Snitzer <snitzer(a)kernel.org> dm cache: add cond_resched() to various workqueue loops Mike Snitzer <snitzer(a)kernel.org> dm thin: add cond_resched() to various workqueue loops Darrell Kavanagh <darrell.kavanagh(a)gmail.com> drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 Claudiu Beznea <claudiu.beznea(a)microchip.com> pinctrl: at91: use devm_kasprintf() to avoid potential leaks Robin Murphy <robin.murphy(a)arm.com> hwmon: (coretemp) Simplify platform device handling Kees Cook <keescook(a)chromium.org> regulator: s5m8767: Bounds check id indexing into arrays Kees Cook <keescook(a)chromium.org> regulator: max77802: Bounds check regulator id against opmode Kees Cook <keescook(a)chromium.org> ASoC: kirkwood: Iterate over array indexes instead of using pointer math Jakob Koschel <jkl820.git(a)gmail.com> docs/scripts/gdb: add necessary make scripts_gdb step Jiasheng Jiang <jiasheng(a)iscas.ac.cn> drm/msm/dsi: Add missing check for alloc_ordered_workqueue Liwei Song <liwei.song(a)windriver.com> drm/radeon: free iio for atombios when driver shutdown Jingyuan Liang <jingyliang(a)chromium.org> HID: Add Mapping for System Microphone Mute Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> drm/omap: dsi: Fix excessive stack usage Roman Li <roman.li(a)amd.com> drm/amd/display: Fix potential null-deref in dm_resume Kees Cook <keescook(a)chromium.org> uaccess: Add minimum bounds check on kernel buffer size Kees Cook <keescook(a)chromium.org> coda: Avoid partial allocation of sig_inputArgs Shay Drory <shayd(a)nvidia.com> net/mlx5: fw_tracer: Fix debug print Hans de Goede <hdegoede(a)redhat.com> ACPI: video: Fix Lenovo Ideapad Z570 DMI match Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup Michael Schmitz <schmitzmic(a)gmail.com> m68k: Check syscall_trace_enter() return code Florian Fainelli <f.fainelli(a)gmail.com> net: bcmgenet: Add a check for oversized packets Mark Rutland <mark.rutland(a)arm.com> ACPI: Don't build ACPICA with '-Os' Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: add missing checks for PF vsi type Pietro Borrello <borrello(a)diag.uniroma1.it> inet: fix fast path in __inet_hash_connect() Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> wifi: mt7601u: fix an integer underflow Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds Breno Leitao <leitao(a)debian.org> x86/bugs: Reset speculation control settings on init Jann Horn <jannh(a)google.com> timers: Prevent union confusion from unexpected restart_syscall() Yang Li <yang.lee(a)linux.alibaba.com> thermal: intel: Fix unsigned comparison with less than zero Paul E. McKenney <paulmck(a)kernel.org> rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() Li Nan <linan122(a)huawei.com> blk-iocost: fix divide by 0 error in calc_lcoefs() Markuss Broks <markuss.broks(a)gmail.com> ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy Jan Kara <jack(a)suse.cz> udf: Define EFSCORRUPTED error code Bjorn Andersson <quic_bjorande(a)quicinc.com> rpmsg: glink: Avoid infinite loop on intent for missing channel Duoming Zhou <duoming(a)zju.edu.cn> media: usb: siano: Fix use after free bugs caused by do_submit_urb Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: i2c: ov7670: 0 instead of -EINVAL was returned Duoming Zhou <duoming(a)zju.edu.cn> media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() Yuan Can <yuancan(a)huawei.com> media: i2c: ov772x: Fix memleak in ov772x_probe() Shang XiaoJing <shangxiaojing(a)huawei.com> media: ov5675: Fix memleak in ov5675_init_controls() Nathan Chancellor <nathan(a)kernel.org> powerpc: Remove linker flag from KBUILD_AFLAGS Jiasheng Jiang <jiasheng(a)iscas.ac.cn> media: platform: ti: Add missing check for devm_regulator_get Sibi Sankar <quic_sibis(a)quicinc.com> remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers Randy Dunlap <rdunlap(a)infradead.org> MIPS: vpe-mt: drop physical_memsize Randy Dunlap <rdunlap(a)infradead.org> MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set Ganesh Goudar <ganeshgr(a)linux.ibm.com> powerpc/eeh: Set channel state after notifying the drivers Daniel Axtens <dja(a)axtens.net> powerpc/eeh: Small refactor of eeh_handle_normal_event() Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/rtas: ensure 4KB alignment for rtas_data_buf Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/rtas: make all exports GPL Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/pseries/lparcfg: add missing RTAS retry status handling Nathan Lynch <nathanl(a)linux.ibm.com> powerpc/pseries/lpar: add missing RTAS retry status handling Chen-Yu Tsai <wenst(a)chromium.org> clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() Frederic Barrat <fbarrat(a)linux.ibm.com> powerpc/powernv/ioda: Skip unallocated resources when mapping to PE Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC Luca Ellero <l.ellero(a)asem.it> Input: ads7846 - don't check penirq immediately for 7845 Luca Ellero <l.ellero(a)asem.it> Input: ads7846 - don't report pressure for ads7845 Geert Uytterhoeven <geert+renesas(a)glider.be> clk: renesas: cpg-mssr: Remove superfluous check in resume code Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> clk: renesas: cpg-mssr: Use enum clk_reg_layout instead of a boolean flag Alexey Khoroshilov <khoroshilov(a)ispras.ru> clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed Samuel Holland <samuel(a)sholland.org> mtd: rawnand: sunxi: Fix the size of the last OOB region Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents Qiheng Lin <linqiheng(a)huawei.com> mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() Masami Hiramatsu (Google) <mhiramat(a)kernel.org> selftests/ftrace: Fix bash specific "==" operator Randy Dunlap <rdunlap(a)infradead.org> sparc: allow PM configs for sparc32 COMPILE_TEST Yicong Yang <yangyicong(a)hisilicon.com> perf tools: Fix auto-complete on aarch64 Ian Rogers <irogers(a)google.com> perf llvm: Fix inadvertent file creation Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: jdata writepage fix Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> cifs: Fix warning and UAF when destroy the MR list Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> cifs: Fix lost destroy smbd connection when MR allocate failed Benjamin Coddington <bcodding(a)redhat.com> nfsd: fix race to check ls_layouts Pietro Borrello <borrello(a)diag.uniroma1.it> hid: bigben_probe(): validate report count Hans de Goede <hdegoede(a)redhat.com> HID: asus: Fix mute and touchpad-toggle keys on Medion Akoya E1239T Hans de Goede <hdegoede(a)redhat.com> HID: asus: Add support for multi-touch touchpad on Medion Akoya E1239T Hans de Goede <hdegoede(a)redhat.com> HID: asus: Add report_size to struct asus_touchpad_info Hans de Goede <hdegoede(a)redhat.com> HID: asus: Only set EV_REP if we are adding a mapping Pietro Borrello <borrello(a)diag.uniroma1.it> HID: bigben: use spinlock to safely schedule workers Pietro Borrello <borrello(a)diag.uniroma1.it> HID: bigben_worker() remove unneeded check on report_field Pietro Borrello <borrello(a)diag.uniroma1.it> HID: bigben: use spinlock to protect concurrent accesses Lucas Tanure <lucas.tanure(a)collabora.com> ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared Tzung-Bi Shih <tzungbi(a)google.com> ASoC: dapm: declare missing structure prototypes Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() Mike Snitzer <snitzer(a)kernel.org> dm: remove flush_scheduled_work() during local_exit() Vadim Pasternak <vadimp(a)nvidia.com> hwmon: (mlxreg-fan) Return zero speed for broken fan William Zhang <william.zhang(a)broadcom.com> spi: bcm63xx-hsspi: Fix multi-bit mode setting Álvaro Fernández Rojas <noltari(a)gmail.com> spi: bcm63xx-hsspi: fix pm_runtime Jiasheng Jiang <jiasheng(a)iscas.ac.cn> scsi: aic94xx: Add missing check for dma_map_single() Jonathan Cormier <jcormier(a)criticallink.com> hwmon: (ltc2945) Handle error case in ltc2945_value_store Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: connect GPIO label to dev name Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() Nícolas F. R. A. Prado <nfraprado(a)collabora.com> drm/mediatek: Clean dangling pointer on bind error path Rob Clark <robdclark(a)chromium.org> drm/mediatek: Drop unbalanced obj unref Miles Chen <miles.chen(a)mediatek.com> drm/mediatek: Use NULL instead of 0 for NULL pointer Wambui Karuga <wambui.karugax(a)gmail.com> drm/mediatek: remove cast to pointers passed to kfree Mikko Perttunen <mperttunen(a)nvidia.com> gpu: host1x: Don't skip assigning syncpoints to channels Jiasheng Jiang <jiasheng(a)iscas.ac.cn> drm/msm/mdp5: Add check for kzalloc Thomas Zimmermann <tzimmermann(a)suse.de> drm: Initialize struct drm_crtc_state.no_vblank from device settings Boris Brezillon <boris.brezillon(a)collabora.com> drm/bridge: Introduce drm_bridge_get_next_bridge() Boris Brezillon <boris.brezillon(a)collabora.com> drm/bridge: Rename bridge helpers targeting a bridge chain Boris Brezillon <boris.brezillon(a)collabora.com> drm/exynos: Don't reset bridge->next Jiasheng Jiang <jiasheng(a)iscas.ac.cn> drm/msm/dpu: Add check for pstates Jiasheng Jiang <jiasheng(a)iscas.ac.cn> drm/msm/dpu: Add check for cstate Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm: use strscpy instead of strncpy Daniel Mentz <danielmentz(a)google.com> drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness Alexey V. Vissarionov <gremlin(a)altlinux.org> ALSA: hda/ca0132: minor fix for allocation size Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: fsl_sai: initialize is_dsp_mode flag Miaoqian Lin <linmq006(a)gmail.com> pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain Jiasheng Jiang <jiasheng(a)iscas.ac.cn> drm/msm/hdmi: Add missing check for alloc_ordered_workqueue Liang He <windhl(a)126.com> gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: dpi: Fix format mapping for RGB565 Dave Stevenson <dave.stevenson(a)raspberrypi.com> drm/vc4: dpi: Add option for inverting pixel clock and output enable Yuan Can <yuancan(a)huawei.com> drm/bridge: megachips: Fix error handling in i2c_register_driver() Geert Uytterhoeven <geert+renesas(a)glider.be> drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC Geert Uytterhoeven <geert(a)linux-m68k.org> drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats Roxana Nicolescu <roxana.nicolescu(a)canonical.com> selftest: fib_tests: Always cleanup before exit Jakub Sitnicki <jakub(a)cloudflare.com> selftests/net: Interpret UDP_GRO cmsg data as an int value Florian Fainelli <f.fainelli(a)gmail.com> irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts Florian Fainelli <f.fainelli(a)gmail.com> irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts Frank Jungclaus <frank.jungclaus(a)esd.eu> can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error Yongqin Liu <yongqin.liu(a)linaro.org> thermal/drivers/hisi: Drop second sensor hi3660 Shayne Chen <shayne.chen(a)mediatek.com> wifi: mac80211: make rate u32 in sta_set_rate_info_rx() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: crypto4xx - Call dma_unmap_page when done Dan Carpenter <error27(a)gmail.com> wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() Jiasheng Jiang <jiasheng(a)iscas.ac.cn> wifi: iwl4965: Add missing check for create_singlethread_workqueue() Jiasheng Jiang <jiasheng(a)iscas.ac.cn> wifi: iwl3945: Add missing check for create_singlethread_workqueue Kees Cook <keescook(a)chromium.org> treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() Kees Cook <keescook(a)chromium.org> usb: gadget: udc: Avoid tasklet passing a global Conor Dooley <conor.dooley(a)microchip.com> RISC-V: time: initialize hrtimer based broadcast clock event device Randy Dunlap <rdunlap(a)infradead.org> m68k: /proc/hardware should depend on PROC_FS Herbert Xu <herbert(a)gondor.apana.org.au> crypto: rsa-pkcs1pad - Use akcipher_request_complete Pietro Borrello <borrello(a)diag.uniroma1.it> rds: rds_rm_zerocopy_callback() correct order for list_add_tail() Ilya Leoshkevich <iii(a)linux.ibm.com> libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix potential user-after-free Qi Zheng <zhengqi.arch(a)bytedance.com> OPP: fix error checking in opp_migrate_dentry() Pietro Borrello <borrello(a)diag.uniroma1.it> tap: tap_open(): correctly initialize socket uid Pietro Borrello <borrello(a)diag.uniroma1.it> tun: tun_chr_open(): correctly initialize socket uid Pietro Borrello <borrello(a)diag.uniroma1.it> net: add sock_init_data_uid() Geliang Tang <geliangtang(a)gmail.com> mptcp: add sk_stop_timer_sync helper Miaoqian Lin <linmq006(a)gmail.com> irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe Miaoqian Lin <linmq006(a)gmail.com> irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe Miaoqian Lin <linmq006(a)gmail.com> irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains Jack Morgenstein <jackm(a)nvidia.com> net/mlx5: Enhance debug print in page allocation failure Yang Yingliang <yangyingliang(a)huawei.com> powercap: fix possible name leak in powercap_register_zone() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: seqiv - Handle EBUSY correctly Herbert Xu <herbert(a)gondor.apana.org.au> crypto: essiv - Handle EBUSY correctly Chen Wandun <chenwandun(a)huawei.com> crypto: essiv - remove redundant null pointer check before kfree Koba Ko <koba.taiwan(a)gmail.com> crypto: ccp - Failure on re-initialization due to duplicate sysfs filename Armin Wolf <W_Armin(a)gmx.de> ACPI: battery: Fix missing NUL-termination with large strings Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Pavel Skripkin <paskripkin(a)gmail.com> ath9k: htc: clean up statistics macros Wan Jiabing <wanjiabing(a)vivo.com> ath9k: hif_usb: simplify if-if to if-else Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> wifi: orinoco: check return value of hermes_write_wordrec() Daniil Tatianin <d-tatianin(a)yandex-team.ru> ACPICA: nsrepair: handle cases without a return value correctly Herbert Xu <herbert(a)gondor.apana.org.au> lib/mpi: Fix buffer overrun when SG is too long Zhen Lei <thunder.leizhen(a)huawei.com> genirq: Fix the return type of kstat_cpu_irqs_sum() Mario Limonciello <mario.limonciello(a)amd.com> ACPICA: Drop port I/O validation for some regions Eric Biggers <ebiggers(a)google.com> crypto: x86/ghash - fix unaligned access in ghash_setkey() Yang Yingliang <yangyingliang(a)huawei.com> wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() Yang Yingliang <yangyingliang(a)huawei.com> wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() Yang Yingliang <yangyingliang(a)huawei.com> wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() Yang Yingliang <yangyingliang(a)huawei.com> wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() Yang Yingliang <yangyingliang(a)huawei.com> wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() Zhengchao Shao <shaozhengchao(a)huawei.com> wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() Zhang Changzhong <zhangchangzhong(a)huawei.com> wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() Zhang Changzhong <zhangchangzhong(a)huawei.com> wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com> wilc1000: let wilc_mac_xmit() return NETDEV_TX_OK Zhengchao Shao <shaozhengchao(a)huawei.com> wifi: ipw2200: fix memory leak in ipw_wdev_init() Yang Yingliang <yangyingliang(a)huawei.com> wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> ipw2x00: switch from 'pci_' to 'dma_' API Li Zetao <lizetao1(a)huawei.com> wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() Arnd Bergmann <arnd(a)arndb.de> rtlwifi: fix -Wpointer-sign warning Yang Yingliang <yangyingliang(a)huawei.com> wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() Zhengchao Shao <shaozhengchao(a)huawei.com> wifi: libertas: fix memory leak in lbs_init_adapter() Yang Yingliang <yangyingliang(a)huawei.com> wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() Markus Elfring <elfring(a)users.sourceforge.net> net/wireless: Delete unnecessary checks before the macro call “dev_kfree_skb” Yuan Can <yuancan(a)huawei.com> wifi: rsi: Fix memory leak in rsi_coex_attach() Martin K. Petersen <martin.petersen(a)oracle.com> block: bio-integrity: Copy flags when bio_integrity_payload is cloned Pietro Borrello <borrello(a)diag.uniroma1.it> sched/rt: pick_next_rt_entity(): check list_entry Dietmar Eggemann <dietmar.eggemann(a)arm.com> sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() Qiheng Lin <linqiheng(a)huawei.com> s390/dasd: Fix potential memleak in dasd_eckd_init() Jan Höppner <hoeppner(a)linux.ibm.com> s390/dasd: Prepare for additional path event handling Kemeng Shi <shikemeng(a)huaweicloud.com> blk-mq: correct stale comment of .get_budget Kemeng Shi <shikemeng(a)huaweicloud.com> blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait Kemeng Shi <shikemeng(a)huaweicloud.com> blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx Salman Qazi <sqazi(a)google.com> block: Limit number of items taken from the I/O scheduler in one go Douglas Anderson <dianders(a)chromium.org> Revert "scsi: core: run queue if SCSI device queue isn't ready and queue is idle" AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node Peng Fan <peng.fan(a)nxp.com> ARM: dts: imx7s: correct iomuxc gpr mux controller cells Neil Armstrong <neil.armstrong(a)linaro.org> arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name Neil Armstrong <neil.armstrong(a)linaro.org> arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name Neil Armstrong <neil.armstrong(a)linaro.org> arm64: dts: amlogic: meson-gx: add missing unit address to rng node name Neil Armstrong <neil.armstrong(a)linaro.org> arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible Neil Armstrong <neil.armstrong(a)linaro.org> arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name Neil Armstrong <neil.armstrong(a)linaro.org> arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name Angus Chen <angus.chen(a)jaguarmicro.com> ARM: imx: Call ida_simple_remove() for ida_simple_get Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato Yang Yingliang <yangyingliang(a)huawei.com> ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() Christian Hewitt <christianshewitt(a)gmail.com> arm64: dts: meson: remove CPU opps below 1GHz for G12A boards Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> arm64: dts: meson-gx: Fix Ethernet MAC address unit name Qiheng Lin <linqiheng(a)huawei.com> ARM: zynq: Fix refcount leak in zynq_early_slcr_init Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> arm64: dts: qcom: qcs404: use symbol names for PCIe resets Chen Hui <judy.chenhui(a)huawei.com> ARM: OMAP2+: Fix memory leak in realtime_counter_init() Pietro Borrello <borrello(a)diag.uniroma1.it> HID: asus: use spinlock to safely schedule workers Pietro Borrello <borrello(a)diag.uniroma1.it> HID: asus: use spinlock to protect concurrent accesses Luke D. Jones <luke(a)ljones.dev> HID: asus: Remove check for same LED brightness on set ------------- Diffstat: Documentation/admin-guide/cgroup-v1/memory.rst | 13 +- Documentation/admin-guide/hw-vuln/spectre.rst | 21 +- Documentation/dev-tools/gdb-kernel-debugging.rst | 4 + .../bindings/rtc/allwinner,sun6i-a31-rtc.yaml | 1 - Documentation/virt/kvm/api.txt | 18 +- Documentation/virt/kvm/devices/vm.txt | 4 + Makefile | 15 +- arch/alpha/kernel/traps.c | 30 +- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- arch/arm/boot/dts/exynos4-cpu-thermal.dtsi | 2 +- arch/arm/boot/dts/exynos4.dtsi | 2 +- arch/arm/boot/dts/exynos5410-odroidxu.dts | 1 - arch/arm/boot/dts/exynos5420.dtsi | 2 +- arch/arm/boot/dts/imx7s.dtsi | 2 +- arch/arm/boot/dts/spear320-hmi.dts | 2 +- arch/arm/mach-imx/mmdc.c | 24 +- arch/arm/mach-omap1/timer.c | 2 +- arch/arm/mach-omap2/timer.c | 1 + arch/arm/mach-zynq/slcr.c | 1 + arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 4 +- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 - arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +- .../dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 +- arch/m68k/68000/entry.S | 2 + arch/m68k/Kconfig.devices | 1 + arch/m68k/coldfire/entry.S | 2 + arch/m68k/kernel/entry.S | 3 + arch/mips/include/asm/syscall.h | 2 +- arch/mips/include/asm/vpe.h | 1 - arch/mips/kernel/smp-cps.c | 8 +- arch/mips/kernel/vpe-mt.c | 7 +- arch/mips/lantiq/prom.c | 6 - arch/powerpc/Makefile | 2 +- arch/powerpc/kernel/eeh_driver.c | 71 +- arch/powerpc/kernel/rtas.c | 24 +- arch/powerpc/platforms/powernv/pci-ioda.c | 3 +- arch/powerpc/platforms/pseries/lpar.c | 20 +- arch/powerpc/platforms/pseries/lparcfg.c | 20 +- arch/riscv/kernel/time.c | 3 + arch/s390/kernel/kprobes.c | 4 +- arch/s390/kernel/vmlinux.lds.S | 1 + arch/s390/kvm/kvm-s390.c | 16 + arch/sparc/Kconfig | 2 +- arch/um/drivers/vector_kern.c | 1 + arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +- arch/x86/include/asm/microcode.h | 4 +- arch/x86/include/asm/microcode_amd.h | 4 +- arch/x86/include/asm/msr-index.h | 4 + arch/x86/include/asm/reboot.h | 2 + arch/x86/include/asm/resctrl_sched.h | 19 +- arch/x86/include/asm/virtext.h | 16 +- arch/x86/kernel/cpu/bugs.c | 35 +- arch/x86/kernel/cpu/microcode/amd.c | 53 +- arch/x86/kernel/cpu/microcode/core.c | 6 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 14 +- arch/x86/kernel/crash.c | 17 +- arch/x86/kernel/kprobes/opt.c | 6 +- arch/x86/kernel/process_32.c | 2 +- arch/x86/kernel/process_64.c | 2 +- arch/x86/kernel/reboot.c | 88 ++- arch/x86/kernel/smp.c | 6 +- arch/x86/kernel/sysfb_efi.c | 8 + arch/x86/um/vdso/um_vdso.c | 12 +- block/bio-integrity.c | 1 + block/blk-iocost.c | 11 +- block/blk-mq-sched.c | 71 +- block/blk-mq.c | 6 +- crypto/essiv.c | 10 +- crypto/rsa-pkcs1pad.c | 34 +- crypto/seqiv.c | 2 +- drivers/acpi/acpica/Makefile | 2 +- drivers/acpi/acpica/hwvalid.c | 7 +- drivers/acpi/acpica/nsrepair.c | 12 +- drivers/acpi/battery.c | 2 +- drivers/acpi/video_detect.c | 2 +- drivers/block/rbd.c | 20 +- drivers/char/ipmi/ipmi_ssif.c | 46 +- drivers/clk/clk.c | 11 + drivers/clk/qcom/gcc-qcs404.c | 24 +- drivers/clk/qcom/gpucc-sdm845.c | 7 +- drivers/clk/renesas/r7s9210-cpg-mssr.c | 2 +- drivers/clk/renesas/renesas-cpg-mssr.c | 29 +- drivers/clk/renesas/renesas-cpg-mssr.h | 12 +- drivers/crypto/amcc/crypto4xx_core.c | 10 +- drivers/crypto/ccp/ccp-dmaengine.c | 21 +- drivers/firmware/google/framebuffer-coreboot.c | 4 +- drivers/gpio/gpio-vf610.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +- drivers/gpu/drm/drm_atomic_helper.c | 29 +- drivers/gpu/drm/drm_bridge.c | 125 ++-- drivers/gpu/drm/drm_encoder.c | 2 +- drivers/gpu/drm/drm_fourcc.c | 4 + drivers/gpu/drm/drm_mipi_dsi.c | 52 ++ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/drm_probe_helper.c | 2 +- drivers/gpu/drm/drm_vblank.c | 28 + drivers/gpu/drm/exynos/exynos_dp.c | 1 - drivers/gpu/drm/exynos/exynos_drm_dsi.c | 8 +- drivers/gpu/drm/i915/display/intel_quirks.c | 2 + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 8 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 +- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 7 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 3 + drivers/gpu/drm/msm/hdmi/hdmi.c | 4 + drivers/gpu/drm/msm/msm_fence.c | 2 +- drivers/gpu/drm/mxsfb/Kconfig | 1 + drivers/gpu/drm/omapdrm/dss/dsi.c | 26 +- drivers/gpu/drm/omapdrm/omap_drv.c | 4 +- drivers/gpu/drm/omapdrm/omap_encoder.c | 3 +- drivers/gpu/drm/radeon/atombios_encoders.c | 5 +- drivers/gpu/drm/radeon/radeon_device.c | 1 + drivers/gpu/drm/vc4/vc4_dpi.c | 66 +- drivers/gpu/drm/vc4/vc4_dsi.c | 8 +- drivers/gpu/host1x/hw/syncpt_hw.c | 3 - drivers/gpu/ipu-v3/ipu-common.c | 1 + drivers/hid/hid-asus.c | 136 +++- drivers/hid/hid-bigbenff.c | 75 ++- drivers/hid/hid-debug.c | 1 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 8 + drivers/hwmon/coretemp.c | 128 ++-- drivers/hwmon/ltc2945.c | 2 + drivers/hwmon/mlxreg-fan.c | 6 + drivers/iio/accel/mma9551_core.c | 10 +- drivers/input/keyboard/omap-keypad.c | 2 +- drivers/input/serio/hil_mlc.c | 2 +- drivers/input/touchscreen/ads7846.c | 13 +- drivers/irqchip/irq-alpine-msi.c | 1 + drivers/irqchip/irq-bcm7120-l2.c | 3 +- drivers/irqchip/irq-brcmstb-l2.c | 6 +- drivers/irqchip/irq-mvebu-gicp.c | 1 + drivers/irqchip/irq-ti-sci-intr.c | 1 + drivers/md/dm-cache-target.c | 4 + drivers/md/dm-flakey.c | 30 +- drivers/md/dm-thin.c | 2 + drivers/md/dm.c | 1 - drivers/media/i2c/ov5675.c | 4 +- drivers/media/i2c/ov7670.c | 2 +- drivers/media/i2c/ov772x.c | 3 +- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 3 + drivers/media/platform/omap3isp/isp.c | 9 + drivers/media/rc/ene_ir.c | 3 +- drivers/media/usb/siano/smsusb.c | 1 + drivers/media/usb/uvc/uvc_ctrl.c | 30 +- drivers/media/usb/uvc/uvc_driver.c | 66 +- drivers/media/usb/uvc/uvc_entity.c | 2 +- drivers/media/usb/uvc/uvc_status.c | 40 +- drivers/media/usb/uvc/uvc_video.c | 15 +- drivers/media/usb/uvc/uvcvideo.h | 6 +- drivers/mfd/arizona-core.c | 2 +- drivers/mfd/pcf50633-adc.c | 7 +- drivers/misc/mei/bus-fixup.c | 8 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- drivers/mtd/ubi/build.c | 7 + drivers/mtd/ubi/vmt.c | 18 +- drivers/mtd/ubi/wl.c | 25 +- drivers/net/can/usb/esd_usb2.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 + drivers/net/ethernet/intel/ice/ice_main.c | 17 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../net/ethernet/mellanox/mlx5/core/lib/geneve.c | 1 + .../net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 +- drivers/net/tap.c | 2 +- drivers/net/tun.c | 2 +- drivers/net/wan/farsync.c | 4 +- drivers/net/wireless/ath/ath10k/wmi.c | 4 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 60 +- drivers/net/wireless/ath/ath9k/htc.h | 32 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +- drivers/net/wireless/ath/ath9k/wmi.c | 1 + .../wireless/broadcom/brcm80211/brcmfmac/common.c | 7 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 121 ++-- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 67 +- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 24 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 +- drivers/net/wireless/intel/iwlegacy/common.c | 8 +- drivers/net/wireless/intersil/orinoco/hw.c | 2 + drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- drivers/net/wireless/marvell/libertas/main.c | 3 +- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- drivers/net/wireless/marvell/mwifiex/11n.c | 6 +- drivers/net/wireless/mediatek/mt76/dma.c | 13 +- .../net/wireless/mediatek/mt76/mt76x02_beacon.c | 5 +- drivers/net/wireless/mediatek/mt7601u/dma.c | 3 +- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 11 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 91 ++- .../net/wireless/realtek/rtlwifi/rtl8821ae/table.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/table.h | 4 +- drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + drivers/net/wireless/st/cw1200/scan.c | 3 +- drivers/net/wireless/wl3501_cs.c | 2 +- drivers/nfc/st-nci/se.c | 6 + drivers/nfc/st21nfca/se.c | 6 + drivers/opp/debugfs.c | 2 +- drivers/pci/pci.c | 2 +- drivers/pci/pci.h | 43 +- drivers/pci/quirks.c | 23 + drivers/phy/rockchip/phy-rockchip-typec.c | 3 +- drivers/pinctrl/pinctrl-at91-pio4.c | 4 +- drivers/pinctrl/pinctrl-at91.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + drivers/powercap/powercap_sys.c | 14 +- drivers/pwm/pwm-sifive.c | 16 +- drivers/pwm/pwm-stm32-lp.c | 2 +- drivers/regulator/max77802-regulator.c | 34 +- drivers/regulator/s5m8767.c | 6 +- drivers/remoteproc/qcom_q6v5_mss.c | 59 +- drivers/rpmsg/qcom_glink_native.c | 1 + drivers/rtc/rtc-pm8xxx.c | 24 +- drivers/rtc/rtc-sun6i.c | 32 +- drivers/s390/block/dasd.c | 4 +- drivers/s390/block/dasd_diag.c | 8 +- drivers/s390/block/dasd_eckd.c | 82 ++- drivers/s390/block/dasd_fba.c | 8 +- drivers/s390/block/dasd_int.h | 2 +- drivers/s390/crypto/ap_bus.c | 2 +- drivers/scsi/aic94xx/aic94xx_task.c | 3 + drivers/scsi/ipr.c | 41 +- drivers/scsi/qla2xxx/qla_nvme.c | 19 +- drivers/scsi/qla2xxx/qla_os.c | 9 +- drivers/scsi/scsi_lib.c | 7 +- drivers/scsi/ses.c | 64 +- drivers/spi/spi-bcm63xx-hsspi.c | 20 +- drivers/spi/spi-synquacer.c | 7 +- drivers/staging/emxx_udc/emxx_udc.c | 7 +- drivers/staging/most/dim2/dim2.c | 2 +- drivers/staging/octeon/ethernet-tx.c | 2 +- drivers/staging/wilc1000/wilc_netdev.c | 7 +- drivers/thermal/hisi_thermal.c | 4 - drivers/thermal/intel/Kconfig | 3 +- drivers/thermal/intel/intel_powerclamp.c | 20 +- drivers/thermal/intel/intel_quark_dts_thermal.c | 12 +- drivers/thermal/intel/intel_soc_dts_iosf.c | 2 +- drivers/tty/serial/fsl_lpuart.c | 24 +- drivers/tty/tty_io.c | 8 +- drivers/tty/vt/keyboard.c | 2 +- drivers/tty/vt/vc_screen.c | 4 +- drivers/usb/gadget/udc/snps_udc_core.c | 6 +- drivers/usb/host/fhci-sched.c | 2 +- drivers/usb/host/xhci-mvebu.c | 2 +- drivers/usb/storage/ene_ub6250.c | 2 +- drivers/watchdog/at91sam9_wdt.c | 7 +- drivers/watchdog/pcwd_usb.c | 6 +- drivers/watchdog/watchdog_dev.c | 2 +- fs/cifs/smbdirect.c | 4 +- fs/coda/upcall.c | 2 +- fs/ext4/xattr.c | 35 +- fs/f2fs/data.c | 6 +- fs/f2fs/inline.c | 28 +- fs/f2fs/super.c | 11 +- fs/f2fs/verity.c | 12 +- fs/gfs2/aops.c | 3 +- fs/hfs/bnode.c | 1 + fs/hfsplus/super.c | 4 +- fs/jfs/jfs_dmap.c | 3 +- fs/nfsd/nfs4layouts.c | 4 +- fs/nfsd/nfs4proc.c | 2 + fs/ocfs2/move_extents.c | 34 +- fs/ubifs/budget.c | 9 +- fs/ubifs/dir.c | 9 +- fs/ubifs/file.c | 12 +- fs/ubifs/super.c | 17 +- fs/ubifs/tnc.c | 24 +- fs/ubifs/ubifs.h | 5 + fs/udf/file.c | 26 +- fs/udf/inode.c | 74 +-- fs/udf/super.c | 1 + fs/udf/udf_i.h | 3 +- fs/udf/udf_sb.h | 2 + include/drm/drm_bridge.h | 77 ++- include/drm/drm_crtc.h | 34 +- include/drm/drm_mipi_dsi.h | 4 + include/drm/drm_simple_kms_helper.h | 7 +- include/drm/drm_vblank.h | 1 + include/linux/ima.h | 6 +- include/linux/interrupt.h | 15 +- include/linux/kernel_stat.h | 2 +- include/linux/kprobes.h | 2 + include/linux/pci_ids.h | 2 + include/linux/uaccess.h | 4 + include/net/sctp/structs.h | 1 + include/net/sock.h | 9 +- include/sound/soc-dapm.h | 3 + include/uapi/linux/usb/video.h | 30 + include/uapi/linux/uvcvideo.h | 2 +- kernel/backtracetest.c | 2 +- kernel/debug/debug_core.c | 2 +- kernel/fail_function.c | 5 +- kernel/irq/irqdomain.c | 31 +- kernel/irq/resend.c | 2 +- kernel/kprobes.c | 6 +- kernel/rcu/tree_exp.h | 2 + kernel/sched/deadline.c | 5 +- kernel/sched/rt.c | 10 +- kernel/time/hrtimer.c | 2 + kernel/time/posix-stubs.c | 2 + kernel/time/posix-timers.c | 2 + kernel/trace/ring_buffer.c | 7 +- lib/mpi/mpicoder.c | 3 +- mm/huge_memory.c | 3 + mm/memcontrol.c | 4 + net/9p/trans_rdma.c | 15 +- net/9p/trans_xen.c | 48 +- net/atm/pppoatm.c | 2 +- net/bluetooth/hci_sock.c | 11 +- net/bluetooth/l2cap_core.c | 24 - net/bluetooth/l2cap_sock.c | 8 + net/core/dev.c | 4 +- net/core/sock.c | 22 +- net/ipv4/inet_connection_sock.c | 1 + net/ipv4/inet_hashtables.c | 12 +- net/ipv4/tcp_minisocks.c | 7 +- net/ipv6/route.c | 11 +- net/iucv/iucv.c | 2 +- net/mac80211/sta_info.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 5 +- net/nfc/netlink.c | 4 + net/rds/message.c | 2 +- net/sched/Kconfig | 11 - net/sched/Makefile | 1 - net/sched/act_sample.c | 11 +- net/sched/cls_tcindex.c | 730 --------------------- net/sctp/stream_sched_prio.c | 52 +- net/tls/tls_sw.c | 26 +- net/wireless/sme.c | 31 +- security/integrity/ima/ima_main.c | 7 +- security/security.c | 7 +- sound/drivers/pcsp/pcsp_lib.c | 2 +- sound/pci/hda/patch_ca0132.c | 2 +- sound/pci/hda/patch_realtek.c | 1 + sound/pci/ice1712/aureon.c | 2 +- sound/soc/fsl/fsl_sai.c | 1 + sound/soc/kirkwood/kirkwood-dma.c | 2 +- sound/soc/soc-compress.c | 2 +- tools/iio/iio_utils.c | 23 +- tools/lib/bpf/nlattr.c | 2 +- tools/perf/perf-completion.sh | 11 +- tools/perf/util/llvm-utils.c | 25 +- tools/testing/ktest/ktest.pl | 26 +- tools/testing/ktest/sample.conf | 5 + .../ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- tools/testing/selftests/net/fib_tests.sh | 2 + tools/testing/selftests/net/udpgso_bench_rx.c | 6 +- virt/kvm/coalesced_mmio.c | 8 +- 356 files changed, 2777 insertions(+), 2417 deletions(-)

2 years, 7 months

8
368
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror