This is the start of the stable review cycle for the 5.4.84 release.
There are 36 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 16 Dec 2020 17:25:32 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.84-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.84-rc1
Arvind Sankar <nivedita(a)alum.mit.edu>
compiler.h: fix barrier_data() on clang
Minchan Kim <minchan(a)kernel.org>
mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING
Thomas Gleixner <tglx(a)linutronix.de>
x86/apic/vector: Fix ordering in vector assignment
Andy Lutomirski <luto(a)kernel.org>
x86/membarrier: Get rid of a dubious optimization
Arvind Sankar <nivedita(a)alum.mit.edu>
x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP
Dan Carpenter <dan.carpenter(a)oracle.com>
scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
Miles Chen <miles.chen(a)mediatek.com>
proc: use untagged_addr() for pagemap_read addresses
Arnd Bergmann <arnd(a)arndb.de>
kbuild: avoid static_assert for genksyms
Manasi Navare <manasi.d.navare(a)intel.com>
drm/i915/display/dp: Compute the correct slice count for VDSC on DP
Bean Huo <beanhuo(a)micron.com>
mmc: block: Fixup condition for CMD13 polling for RPMB requests
Coiby Xu <coiby.xu(a)gmail.com>
pinctrl: amd: remove debounce filter setting in IRQ type setting
Chris Chiu <chiu(a)endlessos.org>
Input: i8042 - add Acer laptops to the i8042 reset list
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: cm109 - do not stomp on control URB
Libo Chen <libo.chen(a)oracle.com>
ktest.pl: Fix incorrect reboot for grub2bls
Pankaj Sharma <pankj.sharma(a)samsung.com>
can: m_can: m_can_dev_setup(): add support for bosch mcan version 3.3.0
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: touchscreen_dmi: Add info for the Irbis TW118 tablet
Max Verevkin <me(a)maxverevkin.tk>
platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
Timo Witte <timo.witte(a)gmail.com>
platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e
Jon Hunter <jonathanh(a)nvidia.com>
arm64: tegra: Disable the ACONNECT for Jetson TX2
Hao Si <si.hao(a)zte.com.cn>
soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
Ran Wang <ran.wang_1(a)nxp.com>
spi: spi-nxp-fspi: fix fspi panic by unexpected interrupts
Xu Qiang <xuqiang36(a)huawei.com>
irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend
Lijun Pan <ljp(a)linux.ibm.com>
ibmvnic: skip tx timeout reset while in resetting
Georgi Djakov <georgi.djakov(a)linaro.org>
interconnect: qcom: qcs404: Remove GPU and display RPM IDs
Can Guo <cang(a)codeaurora.org>
scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE
Vineet Gupta <vgupta(a)synopsys.com>
ARC: stack unwinding: don't assume non-current task is sleeping
Zhen Lei <thunder.leizhen(a)huawei.com>
arm64: dts: broadcom: clear the warnings caused by empty dma-ranges
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc: Drop -me200 addition to build flags
Sara Sharon <sara.sharon(a)intel.com>
iwlwifi: mvm: fix kernel panic in case of assert during CSA
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: pcie: set LTR to avoid completion timeout
Markus Reichl <m.reichl(a)fivetechno.de>
arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards.
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: pcie: limit memory read spin time
Fangrui Song <maskray(a)google.com>
x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S
Nick Desaulniers <ndesaulniers(a)google.com>
Kbuild: do not emit debug info for assembly with LLVM_IAS=1
-------------
Diffstat:
Makefile | 7 +++-
arch/arc/kernel/stacktrace.c | 23 +++++++----
.../boot/dts/broadcom/stingray/stingray-usb.dtsi | 20 +++++-----
arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts | 12 ------
arch/arm64/boot/dts/rockchip/rk3399.dtsi | 3 ++
arch/powerpc/Makefile | 1 -
arch/x86/include/asm/pgtable_types.h | 1 +
arch/x86/include/asm/sync_core.h | 9 +++--
arch/x86/kernel/apic/vector.c | 24 ++++++-----
arch/x86/lib/memcpy_64.S | 4 +-
arch/x86/lib/memmove_64.S | 4 +-
arch/x86/lib/memset_64.S | 4 +-
arch/x86/mm/mem_encrypt_identity.c | 4 +-
arch/x86/mm/tlb.c | 10 ++++-
drivers/gpu/drm/i915/display/intel_dp.c | 2 +-
drivers/input/misc/cm109.c | 7 +++-
drivers/input/serio/i8042-x86ia64io.h | 42 ++++++++++++++++++++
drivers/interconnect/qcom/qcs404.c | 4 +-
drivers/irqchip/irq-gic-v3-its.c | 16 ++------
drivers/mmc/core/block.c | 2 +-
drivers/net/can/m_can/m_can.c | 2 +
drivers/net/ethernet/ibm/ibmvnic.c | 6 +++
drivers/net/wireless/intel/iwlwifi/iwl-csr.h | 10 +++++
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
.../wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 20 ++++++++++
drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 36 ++++++++++++-----
drivers/pinctrl/pinctrl-amd.c | 7 ----
drivers/platform/x86/acer-wmi.c | 1 +
drivers/platform/x86/intel-vbtn.c | 6 +++
drivers/platform/x86/thinkpad_acpi.c | 10 ++++-
drivers/platform/x86/touchscreen_dmi.c | 23 +++++++++++
drivers/scsi/be2iscsi/be_main.c | 4 +-
drivers/scsi/ufs/ufshcd.c | 7 ++++
drivers/soc/fsl/dpio/dpio-driver.c | 5 +--
drivers/spi/spi-nxp-fspi.c | 7 ++++
fs/proc/task_mmu.c | 8 +++-
include/linux/build_bug.h | 5 +++
include/linux/compiler-clang.h | 6 ---
include/linux/compiler-gcc.h | 19 ---------
include/linux/compiler.h | 18 ++++++++-
include/linux/zsmalloc.h | 1 -
mm/Kconfig | 13 ------
mm/zsmalloc.c | 46 ----------------------
tools/testing/ktest/ktest.pl | 2 +-
44 files changed, 270 insertions(+), 193 deletions(-)
While running btrfs/011 in a loop I would often ASSERT() while trying to
add a new free space entry that already existed, or get an -EEXIST while
adding a new block to the extent tree, which is another indication of
double allocation.
This occurs because when we do the free space tree population, we create
the new root and then populate the tree and commit the transaction.
The problem is when you create a new root, the root node and commit root
node are the same. This means that caching a block group before the
transaction is committed can race with other operations modifying the
free space tree, and thus you can get double adds and other sort of
shenanigans. This is only a problem for the first transaction, once
we've committed the transaction we created the free space tree in we're
OK to use the free space tree to cache block groups.
Fix this by marking the fs_info as unsafe to load the free space tree,
and fall back on the old slow method. We could be smarter than this,
for example caching the block group while we're populating the free
space tree, but since this is a serious problem I've opted for the
simplest solution.
cc: stable(a)vger.kernel.org
Fixes: a5ed91828518 ("Btrfs: implement the free space B-tree")
Signed-off-by: Josef Bacik <josef(a)toxicpanda.com>
---
fs/btrfs/block-group.c | 11 ++++++++++-
fs/btrfs/ctree.h | 3 +++
fs/btrfs/free-space-tree.c | 10 +++++++++-
3 files changed, 22 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
index 52f2198d44c9..b8bbdd95743e 100644
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -673,7 +673,16 @@ static noinline void caching_thread(struct btrfs_work *work)
wake_up(&caching_ctl->wait);
}
- if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE))
+ /*
+ * If we are in the transaction that populated the free space tree we
+ * can't actually cache from the free space tree as our commit root and
+ * real root are the same, so we could change the contents of the blocks
+ * while caching. Instead do the slow caching in this case, and after
+ * the transaction has committed we will be safe.
+ */
+ if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE) &&
+ !(test_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED,
+ &fs_info->flags)))
ret = load_free_space_tree(caching_ctl);
else
ret = load_extent_tree_free(caching_ctl);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 3935d297d198..4a60d81da5cb 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -562,6 +562,9 @@ enum {
/* Indicate that we need to cleanup space cache v1 */
BTRFS_FS_CLEANUP_SPACE_CACHE_V1,
+
+ /* Indicate that we can't trust the free space tree for caching yet. */
+ BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED,
};
/*
diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c
index e33a65bd9a0c..a33bca94d133 100644
--- a/fs/btrfs/free-space-tree.c
+++ b/fs/btrfs/free-space-tree.c
@@ -1150,6 +1150,7 @@ int btrfs_create_free_space_tree(struct btrfs_fs_info *fs_info)
return PTR_ERR(trans);
set_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags);
+ set_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags);
free_space_root = btrfs_create_tree(trans,
BTRFS_FREE_SPACE_TREE_OBJECTID);
if (IS_ERR(free_space_root)) {
@@ -1171,11 +1172,18 @@ int btrfs_create_free_space_tree(struct btrfs_fs_info *fs_info)
btrfs_set_fs_compat_ro(fs_info, FREE_SPACE_TREE);
btrfs_set_fs_compat_ro(fs_info, FREE_SPACE_TREE_VALID);
clear_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags);
+ ret = btrfs_commit_transaction(trans);
- return btrfs_commit_transaction(trans);
+ /*
+ * Now that we've committed the transaction any reading of our commit
+ * root will be safe, so we can cache from the free space tree now.
+ */
+ clear_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags);
+ return ret;
abort:
clear_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags);
+ clear_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags);
btrfs_abort_transaction(trans, ret);
btrfs_end_transaction(trans);
return ret;
--
2.26.2
Make sure to always cancel the control URB in write() so that it can be
reused after a timeout or spurious CMD_ACK.
Currently any further write requests after a timeout would fail after
triggering a WARN() in usb_submit_urb() when attempting to submit the
already active URB.
Reported-by: syzbot+e87ebe0f7913f71f2ea5(a)syzkaller.appspotmail.com
Fixes: 6bc235a2e24a ("USB: add driver for Meywa-Denki & Kayac YUREX")
Cc: stable <stable(a)vger.kernel.org> # 2.6.37
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
drivers/usb/misc/yurex.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 73ebfa6e9715..c640f98d20c5 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -496,6 +496,9 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
finish_wait(&dev->waitq, &wait);
+ /* make sure URB is idle after timeout or (spurious) CMD_ACK */
+ usb_kill_urb(dev->cntl_urb);
+
mutex_unlock(&dev->io_mutex);
if (retval < 0) {
--
2.26.2
From: Roberto Sassu <roberto.sassu(a)huawei.com>
commit 2d6c25215ab26bb009de3575faab7b685f138e92 upstream.
Commit c78719203fc6 ("KEYS: trusted: allow trusted.ko to initialize w/o a
TPM") allows the trusted module to be loaded even if a TPM is not found, to
avoid module dependency problems.
However, trusted module initialization can still fail if the TPM is
inactive or deactivated. tpm_get_random() returns an error.
This patch removes the call to tpm_get_random() and instead extends the PCR
specified by the user with zeros. The security of this alternative is
equivalent to the previous one, as either option prevents with a PCR update
unsealing and misuse of sealed data by a user space process.
Even if a PCR is extended with zeros, instead of random data, it is still
computationally infeasible to find a value as input for a new PCR extend
operation, to obtain again the PCR value that would allow unsealing.
Cc: stable(a)vger.kernel.org
Fixes: 240730437deb ("KEYS: trusted: explicitly use tpm_chip structure...")
Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com>
Reviewed-by: Tyler Hicks <tyhicks(a)canonical.com>
Suggested-by: Mimi Zohar <zohar(a)linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: mayuanchen <mayuanchen(a)hygon.cn>
Change-Id: Iada0e052c2ab4a0fbc2db4ac2690da3115d985c6
Signed-off-by: Shan <chenshan(a)hygon.cn>
---
security/keys/trusted.c | 13 -------------
1 file changed, 13 deletions(-)
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 5e983eb9a..b03525d0f 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1216,24 +1216,11 @@ static int __init trusted_shash_alloc(void)
static int __init init_digests(void)
{
- u8 digest[TPM_MAX_DIGEST_SIZE];
- int ret;
- int i;
-
- ret = tpm_get_random(chip, digest, TPM_MAX_DIGEST_SIZE);
- if (ret < 0)
- return ret;
- if (ret < TPM_MAX_DIGEST_SIZE)
- return -EFAULT;
-
digests = kcalloc(chip->nr_allocated_banks, sizeof(*digests),
GFP_KERNEL);
if (!digests)
return -ENOMEM;
- for (i = 0; i < chip->nr_allocated_banks; i++)
- memcpy(digests[i].digest, digest, TPM_MAX_DIGEST_SIZE);
-
return 0;
}
--
2.17.1
From: Roberto Sassu <roberto.sassu(a)huawei.com>
commit 9f75c82246313d4c2a6bc77e947b45655b3b5ad5 upstream.
Commit 0b6cf6b97b7e ("tpm: pass an array of tpm_extend_digest structures to
tpm_pcr_extend()") modifies tpm_pcr_extend() to accept a digest for each
PCR bank. After modification, tpm_pcr_extend() expects that digests are
passed in the same order as the algorithms set in chip->allocated_banks.
This patch fixes two issues introduced in the last iterations of the patch
set: missing initialization of the TPM algorithm ID in the tpm_digest
structures passed to tpm_pcr_extend() by the trusted key module, and
unreleased locks in the TPM driver due to returning from tpm_pcr_extend()
without calling tpm_put_ops().
Cc: stable(a)vger.kernel.org
Fixes: 0b6cf6b97b7e ("tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()")
Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com>
Suggested-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: mayuanchen <mayuanchen(a)hygon.cn>
Change-Id: If1f7d414bcf2d8189d07623fea04d0b5db7060d8
Signed-off-by: Shan <chenshan(a)hygon.cn>
---
drivers/char/tpm/tpm-interface.c | 14 +++++++++-----
security/keys/trusted.c | 5 +++++
2 files changed, 14 insertions(+), 5 deletions(-)
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 46e0882d6..d0303d298 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -1057,18 +1057,22 @@ int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
if (!chip)
return -ENODEV;
- for (i = 0; i < chip->nr_allocated_banks; i++)
- if (digests[i].alg_id != chip->allocated_banks[i].alg_id)
- return -EINVAL;
+ for (i = 0; i < chip->nr_allocated_banks; i++) {
+ if (digests[i].alg_id != chip->allocated_banks[i].alg_id) {
+ rc = EINVAL;
+ goto out;
+ }
+ }
if (chip->flags & TPM_CHIP_FLAG_TPM2) {
rc = tpm2_pcr_extend(chip, pcr_idx, digests);
- tpm_put_ops(chip);
- return rc;
+ goto out;
}
rc = tpm1_pcr_extend(chip, pcr_idx, digests[0].digest,
"attempting extend a PCR value");
+
+out:
tpm_put_ops(chip);
return rc;
}
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index b03525d0f..536970168 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1216,11 +1216,16 @@ static int __init trusted_shash_alloc(void)
static int __init init_digests(void)
{
+ int i;
+
digests = kcalloc(chip->nr_allocated_banks, sizeof(*digests),
GFP_KERNEL);
if (!digests)
return -ENOMEM;
+ for (i = 0; i < chip->nr_allocated_banks; i++)
+ digests[i].alg_id = chip->allocated_banks[i].alg_id;
+
return 0;
}
--
2.17.1