December 2021 - Linux-stable-mirror

by Nick Desaulniers

Dear Stable Kernel Maintainers, Please consider applying the attached mbox file to v5.10.y. For Android's T release in 2022, I'd like to verify whether clang's integrated assembler was used. For the compiler and linker, they both embed a string in object file that can be read via: $ llvm-readelf -p .comment <object file> String dump of section '.comment': [ 0] Linker: LLD 14.0.0 [ 13] clang version 14.0.0 (git@github.com:llvm/llvm-project.git 2ff26d0e794ab7300d94051f91be7da274cc348e) Unfortunately, the assembler version is not also embedded. Instead, I'd like to check for the presence of AS_IS_LLVM in .config. This series helps move some toolchain version checking from build time to configure time, though that's only a modest improvement and I don't _have_ to check this config. The mbox contains the following 7 commits: 1. commit 052c805a1851 ("kbuild: LD_VERSION redenomination") 2. commit aec6c60a01d3 ("kbuild: check the minimum compiler version in Kconfig") 3. commit 02aff8592204 ("kbuild: check the minimum linker version in Kconfig") 4. commit 1f09af062556 ("kbuild: Fix ld-version.sh script if LLD was built with LLD_VENDOR") 5. commit bcbcf50f5218 ("kbuild: fix ld-version.sh to not be affected by locale") 6. commit e24b3ffcf421 ("kbuild: collect minimum tool versions into scripts/min-tool-version.sh") 7. commit ba64beb17493 ("kbuild: check the minimum assembler version in Kconfig") They landed respectively upstream in: 1. v5.12-rc1 2. v5.12-rc1 3. v5.12-rc1 4. v5.12-rc3 5. v5.12-rc3 6. v5.13-rc1 7. v5.13-rc1 I needed to manually resolve conflicts in the respective patches: 1. N/A 2. N/A 3. scripts/lld-version.sh due to df58fb431aa3 ("scripts/lld-version.sh: Rewrite based on upstream ld-version.sh") being 5.10 only. This file is removed regardless of what it looks like. 4. N/A 5. N/A 6. N/A 7. arch/Kconfig due to missing dc5723b02e523 ("kbuild: add support for Clang LTO") which landed in v5.12-rc1. These conflicts are also noted in the commit messages of the commits in the mbox. -- Thanks, ~Nick Desaulniers

2 years, 4 months

2
2
0 0

[PATCH 2/3] bfq: Avoid merging queues with different parents

by Jan Kara

It can happen that the parent of a bfqq changes between the moment we decide two queues are worth to merge (and set bic->stable_merge_bfqq) and the moment bfq_setup_merge() is called. This can happen e.g. because the process submitted IO for a different cgroup and thus bfqq got reparented. It can even happen that the bfqq we are merging with has parent cgroup that is already offline and going to be destroyed in which case the merge can lead to use-after-free issues such as: BUG: KASAN: use-after-free in __bfq_deactivate_entity+0x9cb/0xa50 Read of size 8 at addr ffff88800693c0c0 by task runc:[2:INIT]/10544 CPU: 0 PID: 10544 Comm: runc:[2:INIT] Tainted: G E 5.15.2-0.g5fb85fd-default #1 openSUSE Tumbleweed (unreleased) f1f3b891c72369aebecd2e43e4641a6358867c70 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.org 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x46/0x5a print_address_description.constprop.0+0x1f/0x140 ? __bfq_deactivate_entity+0x9cb/0xa50 kasan_report.cold+0x7f/0x11b ? __bfq_deactivate_entity+0x9cb/0xa50 __bfq_deactivate_entity+0x9cb/0xa50 ? update_curr+0x32f/0x5d0 bfq_deactivate_entity+0xa0/0x1d0 bfq_del_bfqq_busy+0x28a/0x420 ? resched_curr+0x116/0x1d0 ? bfq_requeue_bfqq+0x70/0x70 ? check_preempt_wakeup+0x52b/0xbc0 __bfq_bfqq_expire+0x1a2/0x270 bfq_bfqq_expire+0xd16/0x2160 ? try_to_wake_up+0x4ee/0x1260 ? bfq_end_wr_async_queues+0xe0/0xe0 ? _raw_write_unlock_bh+0x60/0x60 ? _raw_spin_lock_irq+0x81/0xe0 bfq_idle_slice_timer+0x109/0x280 ? bfq_dispatch_request+0x4870/0x4870 __hrtimer_run_queues+0x37d/0x700 ? enqueue_hrtimer+0x1b0/0x1b0 ? kvm_clock_get_cycles+0xd/0x10 ? ktime_get_update_offsets_now+0x6f/0x280 hrtimer_interrupt+0x2c8/0x740 Fix the problem by checking that the parent of the two bfqqs we are merging in bfq_setup_merge() is the same. Link: https://lore.kernel.org/linux-block/20211125172809.GC19572@quack2.suse.cz/ CC: stable(a)vger.kernel.org Fixes: 430a67f9d616 ("block, bfq: merge bursts of newly-created queues") Signed-off-by: Jan Kara <jack(a)suse.cz> --- block/bfq-iosched.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index 056399185c2f..0da47f2ca781 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -2638,6 +2638,14 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq) if (process_refs == 0 || new_process_refs == 0) return NULL; + /* + * Make sure merged queues belong to the same parent. Parents could + * have changed since the time we decided the two queues are suitable + * for merging. + */ + if (new_bfqq->entity.parent != bfqq->entity.parent) + return NULL; + bfq_log_bfqq(bfqq->bfqd, bfqq, "scheduling merge with queue %d", new_bfqq->pid); -- 2.26.2

2 years, 4 months

2
2
0 0

[PATCH 1/2] btrfs: don't start transaction for scrub if the fs is mounted read-only

by Qu Wenruo

[BUG] The following super simple script would crash btrfs at unmount time, if CONFIG_BTRFS_ASSERT() is set. mkfs.btrfs -f $dev mount $dev $mnt xfs_io -f -c "pwrite 0 4k" $mnt/file umount $mnt mount -r ro $dev $mnt btrfs scrub start -Br $mnt umount $mnt This will trigger the following ASSERT() introduced by commit 0a31daa4b602 ("btrfs: add assertion for empty list of transactions at late stage of umount"). That patch is deifnitely not the cause, it just makes enough noise for us developer. [CAUSE] We will start transaction for the following call chain during scrub: scrub_enumerate_chunks() |- btrfs_inc_block_group_ro() |- btrfs_join_transaction() However for RO mount, there is no running transaction at all, thus btrfs_join_transaction() will start a new transaction. Furthermore, since it's read-only mount, btrfs_sync_fs() will not call btrfs_commit_super() to commit the new but empty transaction. And lead to the ASSERT() being triggered. The bug should be there for a long time. Only the new ASSERT() makes it noisy enough to be noticed. [FIX] For read-only scrub on read-only mount, there is no need to start a transaction nor to allocate new chunks in btrfs_inc_block_group_ro(). Just do extra read-only mount check in btrfs_inc_block_group_ro(), and if it's read-only, skip all chunk allocation and go inc_block_group_ro() directly. Since we're here, also add extra debug message at unmount for btrfs_fs_info::trans_list. Sometimes just knowing that there is no dirty metadata bytes for a uncommitted transaction can tell us a lot of things. Cc: stable(a)vger.kernel.org # 5.4+ Signed-off-by: Qu Wenruo <wqu(a)suse.com> --- fs/btrfs/block-group.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c index 1db24e6d6d90..702219361b12 100644 --- a/fs/btrfs/block-group.c +++ b/fs/btrfs/block-group.c @@ -2544,6 +2544,19 @@ int btrfs_inc_block_group_ro(struct btrfs_block_group *cache, int ret; bool dirty_bg_running; + /* + * This can only happen when we are doing read-only scrub on read-only + * mount. + * In that case we should not start a new transaction on read-only fs. + * Thus here we skip all chunk allocation. + */ + if (sb_rdonly(fs_info->sb)) { + mutex_lock(&fs_info->ro_block_group_mutex); + ret = inc_block_group_ro(cache, 0); + mutex_unlock(&fs_info->ro_block_group_mutex); + return ret; + } + do { trans = btrfs_join_transaction(root); if (IS_ERR(trans)) -- 2.34.1

2 years, 4 months

3
5
0 0

[PATCH 01/24] pinctrl: samsung: drop pin banks references on error paths

by Krzysztof Kozlowski

The driver iterates over its devicetree children with for_each_child_of_node() and stores for later found node pointer. This has to be put in error paths to avoid leak during re-probing. Fixes: ab663789d697 ("pinctrl: samsung: Match pin banks with their device nodes") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> --- drivers/pinctrl/samsung/pinctrl-samsung.c | 29 +++++++++++++++++------ 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c index 8941f658e7f1..f2864a7869b3 100644 --- a/drivers/pinctrl/samsung/pinctrl-samsung.c +++ b/drivers/pinctrl/samsung/pinctrl-samsung.c @@ -1002,6 +1002,15 @@ samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev) return &(of_data->ctrl[id]); } +static void samsung_banks_of_node_put(struct samsung_pinctrl_drv_data *d) +{ + struct samsung_pin_bank *bank; + unsigned int i; + + for (i = 0; i < d->nr_banks; ++i, ++bank) + of_node_put(bank->of_node); +} + /* retrieve the soc specific data */ static const struct samsung_pin_ctrl * samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d, @@ -1116,19 +1125,19 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) if (ctrl->retention_data) { drvdata->retention_ctrl = ctrl->retention_data->init(drvdata, ctrl->retention_data); - if (IS_ERR(drvdata->retention_ctrl)) - return PTR_ERR(drvdata->retention_ctrl); + if (IS_ERR(drvdata->retention_ctrl)) { + ret = PTR_ERR(drvdata->retention_ctrl); + goto err_put_banks; + } } ret = samsung_pinctrl_register(pdev, drvdata); if (ret) - return ret; + goto err_put_banks; ret = samsung_gpiolib_register(pdev, drvdata); - if (ret) { - samsung_pinctrl_unregister(pdev, drvdata); - return ret; - } + if (ret) + goto err_unregister; if (ctrl->eint_gpio_init) ctrl->eint_gpio_init(drvdata); @@ -1138,6 +1147,12 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) platform_set_drvdata(pdev, drvdata); return 0; + +err_unregister: + samsung_pinctrl_unregister(pdev, drvdata); +err_put_banks: + samsung_banks_of_node_put(drvdata); + return ret; } /* -- 2.32.0

2 years, 4 months

2
2
0 0

[PATCH net 0/2] net: bridge: mcast: add and enforce query interval minimum

by Nikolay Aleksandrov

Hi, This set adds and enforces 1 second minimum value for bridge multicast query and startup query intervals in order to avoid rearming the timers too often which could lock and crash the host. I doubt anyone is using such low values or anything lower than 1 second, so it seems like a good minimum. In order to be compatible if the value is lower then it is overwritten and a log message is emitted, since we can't return an error at this point. Eric, I looked for the syzbot reports in its dashboard but couldn't find them so I've added you as the reporter. If you point me to the reports I can respin to give syzbot the credit. I've prepared a global bridge igmp rate limiting patch but wasn't sure if it's ok for -net. It adds a static limit of 32k packets per second, I plan to send it for net-next with added drop counters for each bridge so it can be easily debugged. Original report can be seen at: https://lore.kernel.org/netdev/e8b9ce41-57b9-b6e2-a46a-ff9c791cf0ba@gmail.c… Thanks, Nik Nikolay Aleksandrov (2): net: bridge: mcast: add and enforce query interval minimum net: bridge: mcast: add and enforce startup query interval minimum net/bridge/br_multicast.c | 32 ++++++++++++++++++++++++++++++++ net/bridge/br_netlink.c | 4 ++-- net/bridge/br_private.h | 6 ++++++ net/bridge/br_sysfs_br.c | 4 ++-- net/bridge/br_vlan_options.c | 4 ++-- 5 files changed, 44 insertions(+), 6 deletions(-) -- 2.33.1

2 years, 4 months

4
6
0 0

[PATCH for-rc] IB/hfi1: Insure preempt is held across smp_processor_id

by Dennis Dalessandro

From: Mike Marciniszyn <mike.marciniszyn(a)cornelisnetworks.com> Despite the patch noted below, the warning still happens with certain kernel configs. It appears that either check_preemption_disabled() is inconsistent with with debug_rcu_read_lock() or the patch incorrectly assumes that an RCU critical section will prevent the current cpu from changing. A clarification has been solicited via: https://lore.kernel.org/linux-rdma/CH0PR01MB71536FB1BD5ECF16E65CB3BFF26F9@C… This patch will silence the warning for now by using get_cpu()/put_cpu(). Fixes: b6d57e24ce6c ("IB/hfi1: Insure use of smp_processor_id() is preempt disabled") Cc: stable(a)vger.kernel.org Reviewed-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Signed-off-by: Mike Marciniszyn <mike.marciniszyn(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> --- drivers/infiniband/hw/hfi1/sdma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c index f07d328..809096d 100644 --- a/drivers/infiniband/hw/hfi1/sdma.c +++ b/drivers/infiniband/hw/hfi1/sdma.c @@ -839,15 +839,15 @@ struct sdma_engine *sdma_select_user_engine(struct hfi1_devdata *dd, goto out; rcu_read_lock(); - cpu_id = smp_processor_id(); + cpu_id = get_cpu(); rht_node = rhashtable_lookup(dd->sdma_rht, &cpu_id, sdma_rht_params); - if (rht_node && rht_node->map[vl]) { struct sdma_rht_map_elem *map = rht_node->map[vl]; sde = map->sde[selector & map->mask]; } + put_cpu(); rcu_read_unlock(); if (sde)

2 years, 4 months

3
3
0 0

[PATCH v3 0/5] aio: fix use-after-free and missing wakeups

by Eric Biggers

This series fixes two bugs in aio poll, and one issue with POLLFREE more broadly. This is intended to replace "[PATCH v5] aio: Add support for the POLLFREE" (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com) which has some bugs. Careful review is appreciated; the aio poll code is very hard to work with, and it doesn't appear to have many tests. I've verified that it passes the libaio test suite, which provides some coverage of poll. Note, it looks like io_uring has the same bugs as aio poll. I haven't tried to fix io_uring. This series applies to v5.16-rc4. Changed v2 => v3: - Fixed a few commit messages and comments. - Mention that libaio test suite still passes. Changed v1 => v2: - Added wake_up_pollfree(). - Various fixes to the aio poll fixes. - Improved some comments in aio poll. Eric Biggers (5): wait: add wake_up_pollfree() binder: use wake_up_pollfree() signalfd: use wake_up_pollfree() aio: keep poll requests on waitqueue until completed aio: fix use-after-free due to missing POLLFREE handling drivers/android/binder.c | 21 ++-- fs/aio.c | 184 ++++++++++++++++++++++++++------ fs/signalfd.c | 12 +-- include/linux/wait.h | 26 +++++ include/uapi/asm-generic/poll.h | 2 +- kernel/sched/wait.c | 7 ++ 6 files changed, 195 insertions(+), 57 deletions(-) -- 2.34.1

2 years, 4 months

4
14
0 0

[PATCH 5.10 00/76] 5.10.89-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.89 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 29 Dec 2021 15:13:09 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.89-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.89-rc1 Rémi Denis-Courmont <remi(a)remlab.net> phonet/pep: refuse to enable an unbound pipe Lin Ma <linma(a)zju.edu.cn> hamradio: improve the incomplete fix to avoid NPD Lin Ma <linma(a)zju.edu.cn> hamradio: defer ax25 kfree after unregister_netdev Lin Ma <linma(a)zju.edu.cn> ax25: NPD bug when detaching AX25 device Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Do not report 'busy' status bit as alarm Guenter Roeck <linux(a)roeck-us.net> hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681 Guodong Liu <guodong.liu(a)mediatek.corp-partner.google.com> pinctrl: mediatek: fix global-out-of-bounds issue Derek Fang <derek.fang(a)realtek.com> ASoC: rt5682: fix the wrong jack type detected Martin Povišer <povik(a)protonmail.com> ASoC: tas2770: Fix setting of high sample rates Hans de Goede <hdegoede(a)redhat.com> Input: goodix - add id->model mapping for the "9111" model Samuel Čavoj <samuel(a)cavoj.net> Input: i8042 - enable deferred probe quirk for ASUS UM325UA Johnny Chuang <johnny.chuang.emc(a)gmail.com> Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312 Andrey Ryabinin <arbn(a)yandex-team.com> mm: mempolicy: fix THP allocations escaping mempolicy restrictions Sean Christopherson <seanjc(a)google.com> KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state Marian Postevca <posteuca(a)mutex.one> usb: gadget: u_ether: fix race in setting MAC address in setup phase Christian Brauner <christian.brauner(a)ubuntu.com> ceph: fix up non-directory creation in SGID directories Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() Sumit Garg <sumit.garg(a)linaro.org> tee: optee: Fix incorrect page free bug Liu Shixin <liushixin2(a)huawei.com> mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() Johannes Berg <johannes.berg(a)intel.com> mac80211: fix locking in ieee80211_start_ap error path Ard Biesheuvel <ardb(a)kernel.org> ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling Yann Gautier <yann.gautier(a)foss.st.com> mmc: mmci: stm32: clear DLYB_CR after sending tuning command Ulf Hansson <ulf.hansson(a)linaro.org> mmc: core: Disable card detect during shutdown Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commands Prathamesh Shete <pshete(a)nvidia.com> mmc: sdhci-tegra: Fix switch to HS400ES mode Noralf Trønnes <noralf(a)tronnes.org> gpio: dln2: Fix interrupts when replugging the device Fabien Dessenne <fabien.dessenne(a)foss.st.com> pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines Sean Christopherson <seanjc(a)google.com> KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU Johan Hovold <johan(a)kernel.org> platform/x86: intel_pmc_core: fix memleak on registration failure Andrew Cooper <andrew.cooper3(a)citrix.com> x86/pkey: Fix undefined behaviour with PKRU_WD_BIT Jens Wiklander <jens.wiklander(a)linaro.org> tee: handle lookup of shm with reference count 0 John David Anglin <dave.anglin(a)bell.net> parisc: Fix mask used to select futex spinlock John David Anglin <dave.anglin(a)bell.net> parisc: Correct completer in lws start Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> ipmi: fix initialization when workqueue allocation fails Mian Yousaf Kaukab <ykaukab(a)suse.de> ipmi: ssif: initialize ssif_info->client early Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> ipmi: bail out if init_srcu_struct fails José Expósito <jose.exposito89(a)gmail.com> Input: atmel_mxt_ts - fix double free in mxt_read_info_block Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to aiu-fifo-i2s Werner Sembach <wse(a)tuxedocomputers.com> ALSA: hda/realtek: Fix quirk for Clevo NJ51CU Bradley Scott <bscott(a)teksavvy.com> ALSA: hda/realtek: Add new alc285-hp-amp-init model Bradley Scott <Bradley.Scott(a)zebra.com> ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 Colin Ian King <colin.i.king(a)gmail.com> ALSA: drivers: opl3: Fix incorrect use of vp->state Xiaoke Wang <xkernel.wang(a)foxmail.com> ALSA: jack: Check the return value of kstrdup() Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Drop critical attribute support for MAX6654 Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Introduce flag indicating extended temperature support Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Add basic support for TI TMP461 Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Fix usage of CONFIG2 register in detect function Phil Elwell <phil(a)raspberrypi.com> pinctrl: bcm2835: Change init order for gpio hogs Andrea Righi <andrea.righi(a)canonical.com> Input: elantech - fix stack out of bound access in elantech_change_report_id() Jiasheng Jiang <jiasheng(a)iscas.ac.cn> sfc: falcon: Check null pointer of rx_queue->page_ring Jiasheng Jiang <jiasheng(a)iscas.ac.cn> sfc: Check null pointer of rx_queue->page_ring Jiasheng Jiang <jiasheng(a)iscas.ac.cn> net: ks8851: Check for error irq Jiasheng Jiang <jiasheng(a)iscas.ac.cn> drivers: net: smc911x: Check for error irq Jiasheng Jiang <jiasheng(a)iscas.ac.cn> fjes: Check for error irq Fernando Fernandez Mancera <ffmancera(a)riseup.net> bonding: fix ad_actor_system option setting to default Wu Bo <wubo40(a)huawei.com> ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module Heiner Kallweit <hkallweit1(a)gmail.com> igb: fix deadlock caused by taking RTNL in RPM resume path Willem de Bruijn <willemb(a)google.com> net: skip virtio_net_hdr_set_proto if protocol already set Willem de Bruijn <willemb(a)google.com> net: accept UFOv6 packages in virtio_net_hdr_to_skb Jiasheng Jiang <jiasheng(a)iscas.ac.cn> qlcnic: potential dereference null pointer of rx_queue->page_ring Yevhen Orlov <yevhen.orlov(a)plvision.eu> net: marvell: prestera: fix incorrect return of port_find Martin Haaß <vvvrrooomm(a)gmail.com> ARM: dts: imx6qdl-wandboard: Fix Ethernet support Ignacy Gawędzki <ignacy.gawedzki(a)green-communications.fr> netfilter: fix regression in looped (broad|multi)cast's MAC handling Jiacheng Shi <billsjc(a)sjtu.edu.cn> RDMA/hns: Replace kfree() with kvfree() José Expósito <jose.exposito89(a)gmail.com> IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> ASoC: meson: aiu: fifo: Add missing dma_coerce_mask_and_coherent() Dongliang Mu <mudongliangabcd(a)gmail.com> spi: change clk_disable_unprepare to clk_unprepare Robert Marko <robert.marko(a)sartura.hr> arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode Jiasheng Jiang <jiasheng(a)iscas.ac.cn> HID: potential dereference of null pointer Benjamin Tissoires <benjamin.tissoires(a)redhat.com> HID: holtek: fix mouse probing Zhang Yi <yi.zhang(a)huawei.com> ext4: check for inconsistent extents between index and leaf block Zhang Yi <yi.zhang(a)huawei.com> ext4: check for out-of-order index extents in ext4_valid_extent_entries() Zhang Yi <yi.zhang(a)huawei.com> ext4: prevent partial update of the extent blocks Greg Jesionowski <jesionowskigreg(a)gmail.com> net: usb: lan78xx: add Allied Telesis AT29M2-AF Nick Desaulniers <ndesaulniers(a)google.com> arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd Nick Desaulniers <ndesaulniers(a)google.com> arm64: vdso32: drop -no-integrated-as flag ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 8 +- Documentation/hwmon/lm90.rst | 10 ++ Documentation/networking/bonding.rst | 11 +- Documentation/sound/hd-audio/models.rst | 2 + Makefile | 4 +- arch/arm/boot/dts/imx6qdl-wandboard.dtsi | 1 + arch/arm/kernel/entry-armv.S | 8 +- arch/arm64/Kconfig | 3 +- .../dts/allwinner/sun50i-h5-orangepi-zero-plus.dts | 2 +- arch/arm64/kernel/vdso32/Makefile | 25 +-- arch/parisc/include/asm/futex.h | 4 +- arch/parisc/kernel/syscall.S | 2 +- arch/x86/include/asm/pgtable.h | 4 +- arch/x86/kvm/vmx/vmx.c | 3 +- drivers/char/ipmi/ipmi_msghandler.c | 21 ++- drivers/char/ipmi/ipmi_ssif.c | 7 +- drivers/gpio/gpio-dln2.c | 19 ++- drivers/hid/hid-holtek-mouse.c | 15 ++ drivers/hid/hid-vivaldi.c | 3 + drivers/hwmon/Kconfig | 2 +- drivers/hwmon/lm90.c | 171 +++++++++++++-------- drivers/infiniband/hw/hns/hns_roce_srq.c | 2 +- drivers/infiniband/hw/qib/qib_user_sdma.c | 2 +- drivers/input/mouse/elantech.c | 8 +- drivers/input/serio/i8042-x86ia64io.h | 7 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/elants_i2c.c | 46 +++++- drivers/input/touchscreen/goodix.c | 1 + drivers/mmc/core/core.c | 7 +- drivers/mmc/core/core.h | 1 + drivers/mmc/core/host.c | 9 ++ drivers/mmc/host/meson-mx-sdhc-mmc.c | 16 ++ drivers/mmc/host/mmci_stm32_sdmmc.c | 2 + drivers/mmc/host/sdhci-tegra.c | 43 ++++-- drivers/net/bonding/bond_options.c | 2 +- drivers/net/ethernet/intel/igb/igb_main.c | 19 ++- .../net/ethernet/marvell/prestera/prestera_main.c | 16 +- drivers/net/ethernet/micrel/ks8851_par.c | 2 + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h | 2 +- .../ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 12 +- .../net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c | 4 +- drivers/net/ethernet/sfc/falcon/rx.c | 5 +- drivers/net/ethernet/sfc/rx_common.c | 5 +- drivers/net/ethernet/smsc/smc911x.c | 5 + drivers/net/fjes/fjes_main.c | 5 + drivers/net/hamradio/mkiss.c | 5 +- drivers/net/usb/lan78xx.c | 6 + drivers/pinctrl/bcm/pinctrl-bcm2835.c | 29 ++-- drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 8 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 8 +- drivers/platform/x86/intel_pmc_core_pltdrv.c | 2 +- drivers/spi/spi-armada-3700.c | 2 +- drivers/tee/optee/shm_pool.c | 6 +- drivers/tee/tee_shm.c | 171 ++++++++------------- drivers/usb/gadget/function/u_ether.c | 15 +- fs/ceph/file.c | 18 ++- fs/ext4/extents.c | 93 +++++++---- fs/f2fs/xattr.c | 11 +- include/linux/tee_drv.h | 4 +- include/linux/virtio_net.h | 25 ++- mm/memory-failure.c | 1 + mm/mempolicy.c | 4 +- net/ax25/af_ax25.c | 4 +- net/mac80211/cfg.c | 3 + net/netfilter/nfnetlink_log.c | 3 +- net/netfilter/nfnetlink_queue.c | 3 +- net/phonet/pep.c | 2 + sound/core/jack.c | 4 + sound/drivers/opl3/opl3_midi.c | 2 +- sound/pci/hda/patch_realtek.c | 28 +++- sound/soc/codecs/rt5682.c | 4 + sound/soc/codecs/tas2770.c | 4 +- sound/soc/meson/aiu-encoder-i2s.c | 33 ---- sound/soc/meson/aiu-fifo-i2s.c | 19 +++ sound/soc/meson/aiu-fifo.c | 6 + 75 files changed, 677 insertions(+), 394 deletions(-)

2 years, 4 months

12
93
0 0

[PATCH v2] ipc/sem: do not sleep with a spin lock held

by cgel.zte＠gmail.com

From: Minghao Chi <chi.minghao(a)zte.com.cn> We can't call kvfree() with a spin lock held, so defer it. Fixes: fc37a3b8b438 ("[PATCH] ipc sem: use kvmalloc for sem_undo allocation") Reported-by: Zeal Robot <zealci(a)zte.com.cn> Signed-off-by: Minghao Chi <chi.minghao(a)zte.com.cn> --- changelog since v2: + Fixes: fc37a3b8b438 ("[PATCH] ipc sem: use kvmalloc for sem_undo + allocation") ipc/sem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ipc/sem.c b/ipc/sem.c index 6693daf4fe11..0dbdb98fdf2d 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -1964,6 +1964,7 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid) */ un = lookup_undo(ulp, semid); if (un) { + spin_unlock(&ulp->lock); kvfree(new); goto success; } @@ -1976,9 +1977,8 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid) ipc_assert_locked_object(&sma->sem_perm); list_add(&new->list_id, &sma->list_id); un = new; - -success: spin_unlock(&ulp->lock); +success: sem_unlock(sma, -1); out: return un; -- 2.25.1

2 years, 4 months

4
5
0 0

[PATCH 3/4] media: davinci: vpif: fix use-after-free on driver unbind

by Johan Hovold

The driver allocates and registers two platform device structures during probe, but the devices were never deregistered on driver unbind. This results in a use-after-free on driver unbind as the device structures were allocated using devres and would be freed by driver core when remove() returns. Fix this by adding the missing deregistration calls to the remove() callback and failing probe on registration errors. Note that the platform device structures must be freed using a proper release callback to avoid leaking associated resources like device names. Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support") Cc: stable(a)vger.kernel.org # 4.12 Cc: Kevin Hilman <khilman(a)baylibre.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/media/platform/davinci/vpif.c | 97 ++++++++++++++++++++------- 1 file changed, 71 insertions(+), 26 deletions(-) diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c index 1f5eacf48580..4a260f4ed236 100644 --- a/drivers/media/platform/davinci/vpif.c +++ b/drivers/media/platform/davinci/vpif.c @@ -41,6 +41,11 @@ MODULE_ALIAS("platform:" VPIF_DRIVER_NAME); #define VPIF_CH2_MAX_MODES 15 #define VPIF_CH3_MAX_MODES 2 +struct vpif_data { + struct platform_device *capture; + struct platform_device *display; +}; + DEFINE_SPINLOCK(vpif_lock); EXPORT_SYMBOL_GPL(vpif_lock); @@ -423,17 +428,31 @@ int vpif_channel_getfid(u8 channel_id) } EXPORT_SYMBOL(vpif_channel_getfid); +static void vpif_pdev_release(struct device *dev) +{ + struct platform_device *pdev = to_platform_device(dev); + + kfree(pdev); +} + static int vpif_probe(struct platform_device *pdev) { static struct resource *res_irq; struct platform_device *pdev_capture, *pdev_display; struct device_node *endpoint = NULL; + struct vpif_data *data; int ret; vpif_base = devm_platform_ioremap_resource(pdev, 0); if (IS_ERR(vpif_base)) return PTR_ERR(vpif_base); + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + platform_set_drvdata(pdev, data); + pm_runtime_enable(&pdev->dev); pm_runtime_get(&pdev->dev); @@ -461,49 +480,75 @@ static int vpif_probe(struct platform_device *pdev) goto err_put_rpm; } - pdev_capture = devm_kzalloc(&pdev->dev, sizeof(*pdev_capture), - GFP_KERNEL); - if (pdev_capture) { - pdev_capture->name = "vpif_capture"; - pdev_capture->id = -1; - pdev_capture->resource = res_irq; - pdev_capture->num_resources = 1; - pdev_capture->dev.dma_mask = pdev->dev.dma_mask; - pdev_capture->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; - pdev_capture->dev.parent = &pdev->dev; - platform_device_register(pdev_capture); - } else { - dev_warn(&pdev->dev, "Unable to allocate memory for pdev_capture.\n"); + pdev_capture = kzalloc(sizeof(*pdev_capture), GFP_KERNEL); + if (!pdev_capture) { + ret = -ENOMEM; + goto err_put_rpm; } - pdev_display = devm_kzalloc(&pdev->dev, sizeof(*pdev_display), - GFP_KERNEL); - if (pdev_display) { - pdev_display->name = "vpif_display"; - pdev_display->id = -1; - pdev_display->resource = res_irq; - pdev_display->num_resources = 1; - pdev_display->dev.dma_mask = pdev->dev.dma_mask; - pdev_display->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; - pdev_display->dev.parent = &pdev->dev; - platform_device_register(pdev_display); - } else { - dev_warn(&pdev->dev, "Unable to allocate memory for pdev_display.\n"); + pdev_capture->name = "vpif_capture"; + pdev_capture->id = -1; + pdev_capture->resource = res_irq; + pdev_capture->num_resources = 1; + pdev_capture->dev.dma_mask = pdev->dev.dma_mask; + pdev_capture->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; + pdev_capture->dev.parent = &pdev->dev; + pdev_capture->dev.release = vpif_pdev_release; + + ret = platform_device_register(pdev_capture); + if (ret) + goto err_put_pdev_capture; + + pdev_display = kzalloc(sizeof(*pdev_display), GFP_KERNEL); + if (!pdev_display) { + ret = -ENOMEM; + goto err_put_pdev_capture; } + pdev_display->name = "vpif_display"; + pdev_display->id = -1; + pdev_display->resource = res_irq; + pdev_display->num_resources = 1; + pdev_display->dev.dma_mask = pdev->dev.dma_mask; + pdev_display->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; + pdev_display->dev.parent = &pdev->dev; + pdev_display->dev.release = vpif_pdev_release; + + ret = platform_device_register(pdev_display); + if (ret) + goto err_put_pdev_display; + + data->capture = pdev_capture; + data->display = pdev_display; + return 0; +err_put_pdev_display: + platform_device_put(pdev_display); +err_put_pdev_capture: + platform_device_put(pdev_capture); err_put_rpm: pm_runtime_put(&pdev->dev); pm_runtime_disable(&pdev->dev); + kfree(data); return ret; } static int vpif_remove(struct platform_device *pdev) { + struct vpif_data *data = platform_get_drvdata(pdev); + + if (data->capture) + platform_device_unregister(data->capture); + if (data->display) + platform_device_unregister(data->display); + pm_runtime_put(&pdev->dev); pm_runtime_disable(&pdev->dev); + + kfree(data); + return 0; } -- 2.32.0

2 years, 4 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2021