This is the start of the stable review cycle for the 5.3.2 release.
There are 25 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue 01 Oct 2019 01:47:47 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.3.2-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.3.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.3.2-rc1
Josh Poimboeuf <jpoimboe(a)redhat.com>
objtool: Clobber user CFLAGS variable
Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
platform/x86: i2c-multi-instantiate: Derive the device name from parent
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda - Apply AMD controller workaround for Raven platform
Shih-Yuan Lee (FourDollars) <fourdollars(a)debian.org>
ALSA: hda - Add laptop imic fixup for ASUS M9V laptop
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: dice: fix wrong packet parameter for Alesis iO26
Jussi Laako <jussi(a)sonarnerd.net>
ALSA: usb-audio: Add DSD support for EVGA NU Audio
Ilya Pshonkin <sudokamikaze(a)protonmail.com>
ALSA: usb-audio: Add Hiby device family to quirks for native DSD support
Vitaly Wool <vitalywool(a)gmail.com>
Revert "mm/z3fold.c: fix race between migration and destruction"
Peng Fan <peng.fan(a)nxp.com>
clk: imx: imx8mm: fix audio pll setting
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
crypto: talitos - fix missing break in switch statement
Tokunori Ikegami <ikegami.t(a)gmail.com>
mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword()
Sebastian Parschauer <s.parschauer(a)gmx.de>
HID: Add quirk for HP X500 PIXART OEM mouse
Alan Stern <stern(a)rowland.harvard.edu>
HID: hidraw: Fix invalid read in hidraw_ioctl
Hans de Goede <hdegoede(a)redhat.com>
HID: logitech-dj: Fix crash when initial logi_dj_recv_query_paired_devices fails
Alan Stern <stern(a)rowland.harvard.edu>
HID: logitech: Fix general protection fault caused by Logitech driver
Roderick Colenbrander <roderick.colenbrander(a)sony.com>
HID: sony: Fix memory corruption issue on cleanup.
Alan Stern <stern(a)rowland.harvard.edu>
HID: prodikeys: Fix general protection fault during probe
Greg Kurz <groug(a)kaod.org>
powerpc/xive: Fix bogus error code returned by OPAL
Nick Desaulniers <ndesaulniers(a)google.com>
drm/amd/display: readd -msse2 to prevent Clang from emitting libcalls to undefined SW FP routines
Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
drm/amd/display: Don't replace the dc_state for fast updates
Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
drm/amd/display: Skip determining update type for async updates
Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
drm/amd/display: Allow cursor async updates for framebuffer swaps
Jon Hunter <jonathanh(a)nvidia.com>
clocksource/drivers: Do not warn on probe defer
Jon Hunter <jonathanh(a)nvidia.com>
clocksource/drivers/timer-of: Do not warn on deferred probe
Jeremy Sowden <jeremy(a)azazel.net>
netfilter: add missing IS_ENABLED(CONFIG_NF_TABLES) check to header-file.
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/include/asm/opal.h | 2 +-
arch/powerpc/platforms/powernv/opal-call.c | 2 +-
arch/powerpc/sysdev/xive/native.c | 11 +++
drivers/clk/imx/clk-imx8mm.c | 4 +-
drivers/clocksource/timer-of.c | 6 +-
drivers/clocksource/timer-probe.c | 4 +-
drivers/crypto/talitos.c | 1 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 56 ++++++++++----
drivers/gpu/drm/amd/display/dc/calcs/Makefile | 4 +
drivers/gpu/drm/amd/display/dc/dcn20/Makefile | 4 +
drivers/gpu/drm/amd/display/dc/dml/Makefile | 4 +
drivers/gpu/drm/amd/display/dc/dsc/Makefile | 4 +
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-lg.c | 10 ++-
drivers/hid/hid-lg4ff.c | 1 -
drivers/hid/hid-logitech-dj.c | 10 +--
drivers/hid/hid-prodikeys.c | 12 ++-
drivers/hid/hid-quirks.c | 1 +
drivers/hid/hid-sony.c | 2 +-
drivers/hid/hidraw.c | 2 +-
drivers/mtd/chips/cfi_cmdset_0002.c | 18 +++--
drivers/platform/x86/i2c-multi-instantiate.c | 2 +-
include/net/netfilter/nf_tables.h | 4 +
mm/z3fold.c | 90 -----------------------
sound/firewire/dice/dice-alesis.c | 2 +-
sound/pci/hda/hda_intel.c | 3 +-
sound/pci/hda/patch_analog.c | 1 +
sound/usb/quirks.c | 2 +
tools/objtool/Makefile | 2 +-
30 files changed, 130 insertions(+), 139 deletions(-)
From: Sascha Hauer <s.hauer(a)pengutronix.de>
[ Upstream commit f5e1040196dbfe14c77ce3dfe3b7b08d2d961e88 ]
integrity_kernel_read() returns the number of bytes read. If this is
a short read then this positive value is returned from
ima_calc_file_hash_atfm(). Currently this is only indirectly called from
ima_calc_file_hash() and this function only tests for the return value
being zero or nonzero and also doesn't forward the return value.
Nevertheless there's no point in returning a positive value as an error,
so translate a short read into -EINVAL.
Signed-off-by: Sascha Hauer <s.hauer(a)pengutronix.de>
Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
security/integrity/ima/ima_crypto.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index a29209fa56746..5c87baaefafb6 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -298,8 +298,11 @@ static int ima_calc_file_hash_atfm(struct file *file,
rbuf_len = min_t(loff_t, i_size - offset, rbuf_size[active]);
rc = integrity_kernel_read(file, offset, rbuf[active],
rbuf_len);
- if (rc != rbuf_len)
+ if (rc != rbuf_len) {
+ if (rc >= 0)
+ rc = -EINVAL;
goto out3;
+ }
if (rbuf[1] && offset) {
/* Using two buffers, and it is not the first
--
2.20.1
From: Sascha Hauer <s.hauer(a)pengutronix.de>
[ Upstream commit f5e1040196dbfe14c77ce3dfe3b7b08d2d961e88 ]
integrity_kernel_read() returns the number of bytes read. If this is
a short read then this positive value is returned from
ima_calc_file_hash_atfm(). Currently this is only indirectly called from
ima_calc_file_hash() and this function only tests for the return value
being zero or nonzero and also doesn't forward the return value.
Nevertheless there's no point in returning a positive value as an error,
so translate a short read into -EINVAL.
Signed-off-by: Sascha Hauer <s.hauer(a)pengutronix.de>
Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
security/integrity/ima/ima_crypto.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 20e66291ca99a..5155c343406e0 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -298,8 +298,11 @@ static int ima_calc_file_hash_atfm(struct file *file,
rbuf_len = min_t(loff_t, i_size - offset, rbuf_size[active]);
rc = integrity_kernel_read(file, offset, rbuf[active],
rbuf_len);
- if (rc != rbuf_len)
+ if (rc != rbuf_len) {
+ if (rc >= 0)
+ rc = -EINVAL;
goto out3;
+ }
if (rbuf[1] && offset) {
/* Using two buffers, and it is not the first
--
2.20.1
From: Sascha Hauer <s.hauer(a)pengutronix.de>
[ Upstream commit f5e1040196dbfe14c77ce3dfe3b7b08d2d961e88 ]
integrity_kernel_read() returns the number of bytes read. If this is
a short read then this positive value is returned from
ima_calc_file_hash_atfm(). Currently this is only indirectly called from
ima_calc_file_hash() and this function only tests for the return value
being zero or nonzero and also doesn't forward the return value.
Nevertheless there's no point in returning a positive value as an error,
so translate a short read into -EINVAL.
Signed-off-by: Sascha Hauer <s.hauer(a)pengutronix.de>
Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
security/integrity/ima/ima_crypto.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index af680b5b678a4..06b0ee75f34fb 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -293,8 +293,11 @@ static int ima_calc_file_hash_atfm(struct file *file,
rbuf_len = min_t(loff_t, i_size - offset, rbuf_size[active]);
rc = integrity_kernel_read(file, offset, rbuf[active],
rbuf_len);
- if (rc != rbuf_len)
+ if (rc != rbuf_len) {
+ if (rc >= 0)
+ rc = -EINVAL;
goto out3;
+ }
if (rbuf[1] && offset) {
/* Using two buffers, and it is not the first
--
2.20.1
From: Sascha Hauer <s.hauer(a)pengutronix.de>
[ Upstream commit f5e1040196dbfe14c77ce3dfe3b7b08d2d961e88 ]
integrity_kernel_read() returns the number of bytes read. If this is
a short read then this positive value is returned from
ima_calc_file_hash_atfm(). Currently this is only indirectly called from
ima_calc_file_hash() and this function only tests for the return value
being zero or nonzero and also doesn't forward the return value.
Nevertheless there's no point in returning a positive value as an error,
so translate a short read into -EINVAL.
Signed-off-by: Sascha Hauer <s.hauer(a)pengutronix.de>
Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
security/integrity/ima/ima_crypto.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index d9e7728027c6c..b7822d2b79736 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -271,8 +271,11 @@ static int ima_calc_file_hash_atfm(struct file *file,
rbuf_len = min_t(loff_t, i_size - offset, rbuf_size[active]);
rc = integrity_kernel_read(file, offset, rbuf[active],
rbuf_len);
- if (rc != rbuf_len)
+ if (rc != rbuf_len) {
+ if (rc >= 0)
+ rc = -EINVAL;
goto out3;
+ }
if (rbuf[1] && offset) {
/* Using two buffers, and it is not the first
--
2.20.1
We've historically had reports of being unable to mount file systems
because the tree log root couldn't be read. Usually this is the "parent
transid failure", but could be any of the related errors, including
"fsid mismatch" or "bad tree block", depending on which block got
allocated.
The modification of the individual log root items are serialized on the
per-log root root_mutex. This means that any modification to the
per-subvol log root_item is completely protected.
However we update the root item in the log root tree outside of the log
root tree log_mutex. We do this in order to allow multiple subvolumes
to be updated in each log transaction.
This is problematic however because when we are writing the log root
tree out we update the super block with the _current_ log root node
information. Since these two operations happen independently of each
other, you can end up updating the log root tree in between writing out
the dirty blocks and setting the super block to point at the current
root.
This means we'll point at the new root node that hasn't been written
out, instead of the one we should be pointing at. Thus whatever garbage
or old block we end up pointing at complains when we mount the file
system later and try to replay the log.
Fix this by copying the log's root item into a local root item copy.
Then once we're safely under the log_root_tree->log_mutex we update the
root item in the log_root_tree. This way we do not modify the
log_root_tree while we're committing it, fixing the problem.
cc: stable(a)vger.kernel.org
Signed-off-by: Josef Bacik <josef(a)toxicpanda.com>
Reviewed-by: Chris Mason <clm(a)fb.com>
---
fs/btrfs/tree-log.c | 36 +++++++++++++++++++++++++++---------
1 file changed, 27 insertions(+), 9 deletions(-)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 7cac09a6f007..1d7f22951ef2 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2908,7 +2908,8 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
* in the tree of log roots
*/
static int update_log_root(struct btrfs_trans_handle *trans,
- struct btrfs_root *log)
+ struct btrfs_root *log,
+ struct btrfs_root_item *root_item)
{
struct btrfs_fs_info *fs_info = log->fs_info;
int ret;
@@ -2916,10 +2917,10 @@ static int update_log_root(struct btrfs_trans_handle *trans,
if (log->log_transid == 1) {
/* insert root item on the first sync */
ret = btrfs_insert_root(trans, fs_info->log_root_tree,
- &log->root_key, &log->root_item);
+ &log->root_key, root_item);
} else {
ret = btrfs_update_root(trans, fs_info->log_root_tree,
- &log->root_key, &log->root_item);
+ &log->root_key, root_item);
}
return ret;
}
@@ -3017,6 +3018,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
struct btrfs_fs_info *fs_info = root->fs_info;
struct btrfs_root *log = root->log_root;
struct btrfs_root *log_root_tree = fs_info->log_root_tree;
+ struct btrfs_root_item new_root_item;
int log_transid = 0;
struct btrfs_log_ctx root_log_ctx;
struct blk_plug plug;
@@ -3080,17 +3082,25 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
goto out;
}
+ /*
+ * We _must_ update under the root->log_mutex in order to make sure we
+ * have a consistent view of the log root we are trying to commit at
+ * this moment.
+ *
+ * We _must_ copy this into a local copy, because we are not holding the
+ * log_root_tree->log_mutex yet. This is important because when we
+ * commit the log_root_tree we must have a consistent view of the
+ * log_root_tree when we update the super block to point at the
+ * log_root_tree bytenr. If we update the log_root_tree here we'll race
+ * with the commit and possibly point at the new block which we may not
+ * have written out.
+ */
btrfs_set_root_node(&log->root_item, log->node);
+ memcpy(&new_root_item, &log->root_item, sizeof(new_root_item));
root->log_transid++;
log->log_transid = root->log_transid;
root->log_start_pid = 0;
- /*
- * Update or create log root item under the root's log_mutex to prevent
- * races with concurrent log syncs that can lead to failure to update
- * log root item because it was not created yet.
- */
- ret = update_log_root(trans, log);
/*
* IO has been started, blocks of the log tree have WRITTEN flag set
* in their headers. new modifications of the log will be written to
@@ -3111,6 +3121,14 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
mutex_unlock(&log_root_tree->log_mutex);
mutex_lock(&log_root_tree->log_mutex);
+
+ /*
+ * Now we are safe to update the log_root_tree because we're under the
+ * log_mutex, and we're a current writer so we're holding the commit
+ * open until we drop the log_mutex.
+ */
+ ret = update_log_root(trans, log, &new_root_item);
+
if (atomic_dec_and_test(&log_root_tree->log_writers)) {
/* atomic_dec_and_test implies a barrier */
cond_wake_up_nomb(&log_root_tree->log_writer_wait);
--
2.21.0