I'm announcing the release of the 4.9.282 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/arc/kernel/vmlinux.lds.S | 2 ++
arch/x86/kvm/mmu.c | 11 ++++++++++-
drivers/block/floppy.c | 27 +++++++++++++--------------
drivers/infiniband/hw/hfi1/sdma.c | 9 ++++-----
drivers/net/can/usb/esd_usb2.c | 4 ++--
drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++-
drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++
drivers/net/ethernet/marvell/mvneta.c | 2 +-
drivers/tty/vt/vt_ioctl.c | 11 +++++++----
drivers/usb/dwc3/gadget.c | 16 ++++++++--------
drivers/usb/serial/ch341.c | 1 -
drivers/usb/serial/option.c | 2 ++
drivers/vhost/vringh.c | 2 +-
drivers/video/fbdev/core/fbmem.c | 4 ++++
drivers/virtio/virtio_ring.c | 6 ++++--
net/ipv4/ip_gre.c | 2 ++
net/rds/ib_frmr.c | 4 ++--
18 files changed, 79 insertions(+), 43 deletions(-)
Denis Efremov (1):
Revert "floppy: reintroduce O_NDELAY fix"
George Kennedy (1):
fbmem: add margin check to fb_check_caps()
Gerd Rausch (1):
net/rds: dma_map_sg is entitled to merge entries
Greg Kroah-Hartman (1):
Linux 4.9.282
Guenter Roeck (1):
ARC: Fix CONFIG_STACKDEPOT
Johan Hovold (1):
Revert "USB: serial: ch341: fix character loss at high transfer rates"
Linus Torvalds (1):
vt_kdsetmode: extend console locking
Maxim Kiselev (1):
net: marvell: fix MVNETA_TX_IN_PRGRS bit number
Neeraj Upadhyay (1):
vringh: Use wiov->used to check for read/write desc order
Parav Pandit (1):
virtio: Improve vq->broken access to avoid any compiler optimization
Sasha Neftin (1):
e1000e: Fix the max snoop/no-snoop latency for 10M
Sean Christopherson (1):
KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
Shreyansh Chouhan (1):
ip_gre: add validation for csum_start
Stefan Mätje (1):
can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
Thinh Nguyen (1):
usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
Tuo Li (1):
IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
Zhengjun Zhang (1):
USB: serial: option: add new VID/PID to support Fibocom FG150
I'm announcing the release of the 4.4.283 kernel.
All users of the 4.4 kernel series must upgrade.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/block/floppy.c | 27 +++++++++++++--------------
drivers/net/can/usb/esd_usb2.c | 4 ++--
drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++-
drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++
drivers/net/ethernet/marvell/mvneta.c | 2 +-
drivers/tty/vt/vt_ioctl.c | 11 +++++++----
drivers/usb/serial/ch341.c | 1 -
drivers/usb/serial/option.c | 2 ++
drivers/vhost/vringh.c | 2 +-
drivers/video/fbdev/core/fbmem.c | 4 ++++
drivers/virtio/virtio_ring.c | 6 ++++--
12 files changed, 51 insertions(+), 27 deletions(-)
Denis Efremov (1):
Revert "floppy: reintroduce O_NDELAY fix"
George Kennedy (1):
fbmem: add margin check to fb_check_caps()
Greg Kroah-Hartman (1):
Linux 4.4.283
Johan Hovold (1):
Revert "USB: serial: ch341: fix character loss at high transfer rates"
Linus Torvalds (1):
vt_kdsetmode: extend console locking
Maxim Kiselev (1):
net: marvell: fix MVNETA_TX_IN_PRGRS bit number
Neeraj Upadhyay (1):
vringh: Use wiov->used to check for read/write desc order
Parav Pandit (1):
virtio: Improve vq->broken access to avoid any compiler optimization
Sasha Neftin (1):
e1000e: Fix the max snoop/no-snoop latency for 10M
Stefan Mätje (1):
can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
Zhengjun Zhang (1):
USB: serial: option: add new VID/PID to support Fibocom FG150
ocfs2_data_convert_worker() is currently dropping any cached acl info
for FILE before down-converting meta lock. It should also drop for DIRECTORY.
Otherwise the second acl lookup returns the cached one (from VFS layer) which
could be already stale.
The problem we are seeing is that the acl changes on one node doesn't get
refreshed on other nodes in the following case:
Node 1 Node 2
-------------- ----------------
getfacl dir1
getfacl dir1 <-- this is OK
setfacl -m u:user1:rwX dir1
getfacl dir1 <-- see the change for user1
getfacl dir1 <-- can't see change for user1
Signed-off-by: Wengang Wang <wen.gang.wang(a)oracle.com>
---
fs/ocfs2/dlmglue.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 50a863fc1779..207ec61569ea 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -3933,7 +3933,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres,
oi = OCFS2_I(inode);
oi->ip_dir_lock_gen++;
mlog(0, "generation: %u\n", oi->ip_dir_lock_gen);
- goto out;
+ goto out_forget;
}
if (!S_ISREG(inode->i_mode))
@@ -3964,6 +3964,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres,
filemap_fdatawait(mapping);
}
+out_forget:
forget_all_cached_acls(inode);
out:
--
2.21.0 (Apple Git-122.2)
sd and parent devices must not be removed as sd_open checks for events
sd_need_revalidate and sd_revalidate_disk traverse the device path
to check for event changes. If during this, e.g. the scsi host is being
removed and its resources freed, this traversal crashes.
Locking with scan_mutex for just a scsi disk open may seem blunt, but there
does not seem to be a more granular option. Also opening /dev/sdX directly
happens rarely enough that this shouldn't cause any issues.
The issue occurred on an older kernel with the following trace:
stack segment: 0000 [#1] PREEMPT SMP PTI
CPU: 1 PID: 121457 Comm: python3 Not tainted 4.14.238hyLinux #1
Hardware name: ASUS All Series/H81M-D, BIOS 0601 02/20/2014
task: ffff888213dbb700 task.stack: ffffc90008c14000
RIP: 0010:kobject_get_path+0x2a/0xe0
...
Call Trace:
kobject_uevent_env+0xe6/0x550
disk_check_events+0x101/0x160
disk_clear_events+0x75/0x100
check_disk_change+0x22/0x60
sd_open+0x70/0x170 [sd_mod]
__blkdev_get+0x3fd/0x4b0
? get_empty_filp+0x57/0x1b0
blkdev_get+0x11b/0x330
? bd_acquire+0xc0/0xc0
do_dentry_open+0x1ef/0x320
? __inode_permission+0x85/0xc0
path_openat+0x5cb/0x1500
? terminate_walk+0xeb/0x100
do_filp_open+0x9b/0x110
? __check_object_size+0xb4/0x190
? do_sys_open+0x1bd/0x250
do_sys_open+0x1bd/0x250
do_syscall_64+0x67/0x120
entry_SYSCALL_64_after_hwframe+0x41/0xa6
and this commit fixed that issue, as there has been no other such
synchronization in place since then, the issue should still be present in
recent kernels.
Signed-off-by: Christian Loehle <cloehle(a)hyperstone.com>
---
drivers/scsi/sd.c | 20 +++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 610ebba0d66e..ad4da985a473 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1436,6 +1436,16 @@ static int sd_open(struct block_device *bdev, fmode_t mode)
if (!scsi_block_when_processing_errors(sdev))
goto error_out;
+ /*
+ * Checking for changes to the device must not race with the device
+ * or its parent host being removed, so lock until sd_open returns.
+ */
+ mutex_lock(&sdev->host->scan_mutex);
+ if (sdev->sdev_state != SDEV_RUNNING) {
+ retval = -ERESTARTSYS;
+ goto unlock_scan_error_out;
+ }
+
if (sd_need_revalidate(bdev, sdkp))
sd_revalidate_disk(bdev->bd_disk);
@@ -1444,7 +1454,7 @@ static int sd_open(struct block_device *bdev, fmode_t mode)
*/
retval = -ENOMEDIUM;
if (sdev->removable && !sdkp->media_present && !(mode & FMODE_NDELAY))
- goto error_out;
+ goto unlock_scan_error_out;
/*
* If the device has the write protect tab set, have the open fail
@@ -1452,7 +1462,7 @@ static int sd_open(struct block_device *bdev, fmode_t mode)
*/
retval = -EROFS;
if (sdkp->write_prot && (mode & FMODE_WRITE))
- goto error_out;
+ goto unlock_scan_error_out;
/*
* It is possible that the disk changing stuff resulted in
@@ -1462,15 +1472,19 @@ static int sd_open(struct block_device *bdev, fmode_t mode)
*/
retval = -ENXIO;
if (!scsi_device_online(sdev))
- goto error_out;
+ goto unlock_scan_error_out;
if ((atomic_inc_return(&sdkp->openers) == 1) && sdev->removable) {
if (scsi_block_when_processing_errors(sdev))
scsi_set_medium_removal(sdev, SCSI_REMOVAL_PREVENT);
}
+ mutex_unlock(&sdev->host->scan_mutex);
return 0;
+unlock_scan_error_out:
+ mutex_unlock(&sdev->host->scan_mutex);
+
error_out:
scsi_disk_put(sdkp);
return retval;
--
2.32.0=
Hyperstone GmbH | Line-Eid-Strasse 3 | 78467 Konstanz
Managing Directors: Dr. Jan Peter Berns.
Commercial register of local courts: Freiburg HRB381782
This is the start of the stable review cycle for the 5.14.1 release.
There are 11 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Sep 2021 12:22:41 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.1-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.14.1-rc1
Richard Guy Briggs <rgb(a)redhat.com>
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
Peter Collingbourne <pcc(a)google.com>
net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
Eric Biggers <ebiggers(a)google.com>
ubifs: report correct st_size for encrypted symlinks
Eric Biggers <ebiggers(a)google.com>
f2fs: report correct st_size for encrypted symlinks
Eric Biggers <ebiggers(a)google.com>
ext4: report correct st_size for encrypted symlinks
Eric Biggers <ebiggers(a)google.com>
fscrypt: add fscrypt_symlink_getattr() for computing st_size
Denis Efremov <efremov(a)linux.com>
Revert "floppy: reintroduce O_NDELAY fix"
Qu Wenruo <wqu(a)suse.com>
btrfs: fix NULL pointer dereference when deleting device by invalid id
DENG Qingfang <dqfext(a)gmail.com>
net: dsa: mt7530: fix VLAN traffic leaks again
Pauli Virtanen <pav(a)iki.fi>
Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
Linus Torvalds <torvalds(a)linux-foundation.org>
vt_kdsetmode: extend console locking
-------------
Diffstat:
Makefile | 4 ++--
drivers/block/floppy.c | 30 +++++++++++++++---------------
drivers/bluetooth/btusb.c | 22 ++++++++++++++--------
drivers/net/dsa/mt7530.c | 5 +----
drivers/tty/vt/vt_ioctl.c | 10 ++++++----
fs/btrfs/volumes.c | 2 +-
fs/crypto/hooks.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
fs/ext4/symlink.c | 12 +++++++++++-
fs/f2fs/namei.c | 12 +++++++++++-
fs/ubifs/file.c | 13 ++++++++++++-
include/linux/fscrypt.h | 7 +++++++
include/linux/netdevice.h | 4 ++++
kernel/audit_tree.c | 2 +-
net/socket.c | 6 +++++-
14 files changed, 134 insertions(+), 39 deletions(-)
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Subject: hugetlb: fix hugetlb cgroup refcounting during vma split
Guillaume Morin reported hitting the following WARNING followed by GPF or
NULL pointer deference either in cgroups_destroy or in the kill_css path.:
percpu ref (css_release) <= 0 (-1) after switching to atomic
WARNING: CPU: 23 PID: 130 at lib/percpu-refcount.c:196 percpu_ref_switch_to_atomic_rcu+0x127/0x130
CPU: 23 PID: 130 Comm: ksoftirqd/23 Kdump: loaded Tainted: G O 5.10.60 #1
RIP: 0010:percpu_ref_switch_to_atomic_rcu+0x127/0x130
Call Trace:
rcu_core+0x30f/0x530
rcu_core_si+0xe/0x10
__do_softirq+0x103/0x2a2
? sort_range+0x30/0x30
run_ksoftirqd+0x2b/0x40
smpboot_thread_fn+0x11a/0x170
kthread+0x10a/0x140
? kthread_create_worker_on_cpu+0x70/0x70
ret_from_fork+0x22/0x30
Upon further examination, it was discovered that the css structure was
associated with hugetlb reservations.
For private hugetlb mappings the vma points to a reserve map that contains
a pointer to the css. At mmap time, reservations are set up and a
reference to the css is taken. This reference is dropped in the vma close
operation; hugetlb_vm_op_close. However, if a vma is split no additional
reference to the css is taken yet hugetlb_vm_op_close will be called twice
for the split vma resulting in an underflow.
Fix by taking another reference in hugetlb_vm_op_open. Note that the
reference is only taken for the owner of the reserve map. In the more
common fork case, the pointer to the reserve map is cleared for non-owning
vmas.
Link: https://lkml.kernel.org/r/20210830215015.155224-1-mike.kravetz@oracle.com
Fixes: e9fe92ae0cd2 ("hugetlb_cgroup: add reservation accounting for
private mappings")
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Reported-by: Guillaume Morin <guillaume(a)morinfr.org>
Suggested-by: Guillaume Morin <guillaume(a)morinfr.org>
Tested-by: Guillaume Morin <guillaume(a)morinfr.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/hugetlb_cgroup.h | 12 ++++++++++++
mm/hugetlb.c | 4 +++-
2 files changed, 15 insertions(+), 1 deletion(-)
--- a/include/linux/hugetlb_cgroup.h~hugetlb-fix-hugetlb-cgroup-refcounting-during-vma-split
+++ a/include/linux/hugetlb_cgroup.h
@@ -121,6 +121,13 @@ static inline void hugetlb_cgroup_put_rs
css_put(&h_cg->css);
}
+static inline void resv_map_dup_hugetlb_cgroup_uncharge_info(
+ struct resv_map *resv_map)
+{
+ if (resv_map->css)
+ css_get(resv_map->css);
+}
+
extern int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
struct hugetlb_cgroup **ptr);
extern int hugetlb_cgroup_charge_cgroup_rsvd(int idx, unsigned long nr_pages,
@@ -199,6 +206,11 @@ static inline void hugetlb_cgroup_put_rs
{
}
+static inline void resv_map_dup_hugetlb_cgroup_uncharge_info(
+ struct resv_map *resv_map)
+{
+}
+
static inline int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
struct hugetlb_cgroup **ptr)
{
--- a/mm/hugetlb.c~hugetlb-fix-hugetlb-cgroup-refcounting-during-vma-split
+++ a/mm/hugetlb.c
@@ -4106,8 +4106,10 @@ static void hugetlb_vm_op_open(struct vm
* after this open call completes. It is therefore safe to take a
* new reference here without additional locking.
*/
- if (resv && is_vma_resv_set(vma, HPAGE_RESV_OWNER))
+ if (resv && is_vma_resv_set(vma, HPAGE_RESV_OWNER)) {
+ resv_map_dup_hugetlb_cgroup_uncharge_info(resv);
kref_get(&resv->refs);
+ }
}
static void hugetlb_vm_op_close(struct vm_area_struct *vma)
_
From: Michael Wang <yun.wang(a)linux.alibaba.com>
Subject: mm: fix panic caused by __page_handle_poison()
In commit 510d25c92ec4 ("mm/hwpoison: disable pcp for
page_handle_poison()"), __page_handle_poison() was introduced, and if we
mark:
RET_A = dissolve_free_huge_page();
RET_B = take_page_off_buddy();
then __page_handle_poison was supposed to return TRUE When RET_A == 0 &&
RET_B == TRUE
But since it failed to take care the case when RET_A is -EBUSY or -ENOMEM,
and just return the ret as a bool which actually become TRUE, it break the
original logic.
The following result is a huge page in freelist but was
referenced as poisoned, and lead into the final panic:
kernel BUG at mm/internal.h:95!
invalid opcode: 0000 [#1] SMP PTI
skip...
RIP: 0010:set_page_refcounted mm/internal.h:95 [inline]
RIP: 0010:remove_hugetlb_page+0x23c/0x240 mm/hugetlb.c:1371
skip...
Call Trace:
remove_pool_huge_page+0xe4/0x110 mm/hugetlb.c:1892
return_unused_surplus_pages+0x8d/0x150 mm/hugetlb.c:2272
hugetlb_acct_memory.part.91+0x524/0x690 mm/hugetlb.c:4017
This patch replaces 'bool' with 'int' to handle RET_A correctly.
Link: https://lkml.kernel.org/r/61782ac6-1e8a-4f6f-35e6-e94fce3b37f5@linux.alibab…
Fixes: 510d25c92ec4 ("mm/hwpoison: disable pcp for page_handle_poison()")
Signed-off-by: Michael Wang <yun.wang(a)linux.alibaba.com>
Acked-by: Naoya Horiguchi <naoya.horiguchi(a)nec.com>
Reported-by: Abaci <abaci(a)linux.alibaba.com>
Cc: <stable(a)vger.kernel.org> [5.14+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/memory-failure.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/mm/memory-failure.c~mm-fix-panic-caused-by-__page_handle_poison
+++ a/mm/memory-failure.c
@@ -68,7 +68,7 @@ atomic_long_t num_poisoned_pages __read_
static bool __page_handle_poison(struct page *page)
{
- bool ret;
+ int ret;
zone_pcp_disable(page_zone(page));
ret = dissolve_free_huge_page(page);
@@ -76,7 +76,7 @@ static bool __page_handle_poison(struct
ret = take_page_off_buddy(page);
zone_pcp_enable(page_zone(page));
- return ret;
+ return ret > 0;
}
static bool page_handle_poison(struct page *page, bool hugepage_or_freepage, bool release)
_
This is the start of the stable review cycle for the 4.19.206 release.
There are 33 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Sep 2021 12:22:41 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.206-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.206-rc1
Peter Collingbourne <pcc(a)google.com>
net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
Denis Efremov <efremov(a)linux.com>
Revert "floppy: reintroduce O_NDELAY fix"
Sean Christopherson <seanjc(a)google.com>
KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
George Kennedy <george.kennedy(a)oracle.com>
fbmem: add margin check to fb_check_caps()
Linus Torvalds <torvalds(a)linux-foundation.org>
vt_kdsetmode: extend console locking
Gerd Rausch <gerd.rausch(a)oracle.com>
net/rds: dma_map_sg is entitled to merge entries
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/disp: power down unused DP links during init
Mark Yacoub <markyacoub(a)google.com>
drm: Copy drm_wait_vblank to user before returning
Shai Malin <smalin(a)marvell.com>
qed: Fix null-pointer dereference in qed_rdma_create_qp()
Shai Malin <smalin(a)marvell.com>
qed: qed ll2 race condition fixes
Neeraj Upadhyay <neeraju(a)codeaurora.org>
vringh: Use wiov->used to check for read/write desc order
Parav Pandit <parav(a)nvidia.com>
virtio_pci: Support surprise removal of virtio pci device
Parav Pandit <parav(a)nvidia.com>
virtio: Improve vq->broken access to avoid any compiler optimization
Michał Mirosław <mirq-linux(a)rere.qmqm.pl>
opp: remove WARN when no valid OPPs remain
Jerome Brunet <jbrunet(a)baylibre.com>
usb: gadget: u_audio: fix race condition on endpoint stop
Guangbin Huang <huangguangbin2(a)huawei.com>
net: hns3: fix get wrong pfc_en when query PFC configuration
Maxim Kiselev <bigunclemax(a)gmail.com>
net: marvell: fix MVNETA_TX_IN_PRGRS bit number
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
Shreyansh Chouhan <chouhan.shreyansh630(a)gmail.com>
ip_gre: add validation for csum_start
Sasha Neftin <sasha.neftin(a)intel.com>
e1000e: Fix the max snoop/no-snoop latency for 10M
Tuo Li <islituo(a)gmail.com>
IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
Wesley Cheng <wcheng(a)codeaurora.org>
usb: dwc3: gadget: Stop EP0 transfers during pullup disable
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
Zhengjun Zhang <zhangzhengjun(a)aicrobo.com>
USB: serial: option: add new VID/PID to support Fibocom FG150
Johan Hovold <johan(a)kernel.org>
Revert "USB: serial: ch341: fix character loss at high transfer rates"
Stefan Mätje <stefan.maetje(a)esd.eu>
can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
Kefeng Wang <wangkefeng.wang(a)huawei.com>
once: Fix panic when module unload
Florian Westphal <fw(a)strlen.de>
netfilter: conntrack: collect all entries in one cycle
Guenter Roeck <linux(a)roeck-us.net>
ARC: Fix CONFIG_STACKDEPOT
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix truncation handling for mod32 dst reg wrt zero
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix 32 bit src register truncation on div/mod
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Do not use ax register in interpreter on div/mod
Xiaolong Huang <butterflyhuangxx(a)gmail.com>
net: qrtr: fix another OOB Read in qrtr_endpoint_post
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/vmlinux.lds.S | 2 +
arch/x86/kvm/mmu.c | 11 +++-
drivers/block/floppy.c | 27 ++++----
drivers/gpu/drm/drm_ioc32.c | 4 +-
drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c | 9 +++
drivers/infiniband/hw/hfi1/sdma.c | 9 ++-
drivers/net/can/usb/esd_usb2.c | 4 +-
drivers/net/ethernet/apm/xgene-v2/main.c | 4 +-
.../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 13 +---
drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 ++++-
drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +
drivers/net/ethernet/marvell/mvneta.c | 2 +-
drivers/net/ethernet/qlogic/qed/qed_ll2.c | 20 ++++++
drivers/net/ethernet/qlogic/qed/qed_rdma.c | 3 +-
drivers/opp/of.c | 5 +-
drivers/tty/vt/vt_ioctl.c | 11 ++--
drivers/usb/dwc3/gadget.c | 23 ++++---
drivers/usb/gadget/function/u_audio.c | 5 +-
drivers/usb/serial/ch341.c | 1 -
drivers/usb/serial/option.c | 2 +
drivers/vhost/vringh.c | 2 +-
drivers/video/fbdev/core/fbmem.c | 4 ++
drivers/virtio/virtio_pci_common.c | 7 +++
drivers/virtio/virtio_ring.c | 6 +-
include/linux/filter.h | 24 ++++++++
include/linux/netdevice.h | 4 ++
include/linux/once.h | 4 +-
kernel/bpf/core.c | 32 +++++-----
kernel/bpf/verifier.c | 27 ++++----
lib/once.c | 11 +++-
net/ipv4/ip_gre.c | 2 +
net/netfilter/nf_conntrack_core.c | 71 +++++++---------------
net/qrtr/qrtr.c | 2 +-
net/rds/ib_frmr.c | 4 +-
net/socket.c | 6 +-
38 files changed, 228 insertions(+), 157 deletions(-)
This is the start of the stable review cycle for the 4.14.246 release.
There are 23 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Sep 2021 12:22:41 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.246-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.246-rc1
Denis Efremov <efremov(a)linux.com>
Revert "floppy: reintroduce O_NDELAY fix"
Lai Jiangshan <laijs(a)linux.alibaba.com>
KVM: X86: MMU: Use the correct inherited permissions to get shadow page
Sean Christopherson <seanjc(a)google.com>
KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
George Kennedy <george.kennedy(a)oracle.com>
fbmem: add margin check to fb_check_caps()
Linus Torvalds <torvalds(a)linux-foundation.org>
vt_kdsetmode: extend console locking
Gerd Rausch <gerd.rausch(a)oracle.com>
net/rds: dma_map_sg is entitled to merge entries
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/disp: power down unused DP links during init
Mark Yacoub <markyacoub(a)google.com>
drm: Copy drm_wait_vblank to user before returning
Neeraj Upadhyay <neeraju(a)codeaurora.org>
vringh: Use wiov->used to check for read/write desc order
Parav Pandit <parav(a)nvidia.com>
virtio: Improve vq->broken access to avoid any compiler optimization
Michał Mirosław <mirq-linux(a)rere.qmqm.pl>
opp: remove WARN when no valid OPPs remain
Jerome Brunet <jbrunet(a)baylibre.com>
usb: gadget: u_audio: fix race condition on endpoint stop
Maxim Kiselev <bigunclemax(a)gmail.com>
net: marvell: fix MVNETA_TX_IN_PRGRS bit number
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
Shreyansh Chouhan <chouhan.shreyansh630(a)gmail.com>
ip_gre: add validation for csum_start
Sasha Neftin <sasha.neftin(a)intel.com>
e1000e: Fix the max snoop/no-snoop latency for 10M
Tuo Li <islituo(a)gmail.com>
IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
Wesley Cheng <wcheng(a)codeaurora.org>
usb: dwc3: gadget: Stop EP0 transfers during pullup disable
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
Zhengjun Zhang <zhangzhengjun(a)aicrobo.com>
USB: serial: option: add new VID/PID to support Fibocom FG150
Johan Hovold <johan(a)kernel.org>
Revert "USB: serial: ch341: fix character loss at high transfer rates"
Stefan Mätje <stefan.maetje(a)esd.eu>
can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
Guenter Roeck <linux(a)roeck-us.net>
ARC: Fix CONFIG_STACKDEPOT
-------------
Diffstat:
Documentation/virtual/kvm/mmu.txt | 4 ++--
Makefile | 4 ++--
arch/arc/kernel/vmlinux.lds.S | 2 ++
arch/x86/kvm/mmu.c | 11 +++++++++-
arch/x86/kvm/paging_tmpl.h | 14 ++++++++-----
drivers/base/power/opp/of.c | 5 +++--
drivers/block/floppy.c | 27 ++++++++++++-------------
drivers/gpu/drm/drm_ioc32.c | 4 +---
drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h | 1 +
drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c | 9 +++++++++
drivers/infiniband/hw/hfi1/sdma.c | 9 ++++-----
drivers/net/can/usb/esd_usb2.c | 4 ++--
drivers/net/ethernet/apm/xgene-v2/main.c | 4 +++-
drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 ++++++++++++-
drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++
drivers/net/ethernet/marvell/mvneta.c | 2 +-
drivers/tty/vt/vt_ioctl.c | 11 ++++++----
drivers/usb/dwc3/gadget.c | 23 ++++++++++-----------
drivers/usb/gadget/function/u_audio.c | 5 ++---
drivers/usb/serial/ch341.c | 1 -
drivers/usb/serial/option.c | 2 ++
drivers/vhost/vringh.c | 2 +-
drivers/video/fbdev/core/fbmem.c | 4 ++++
drivers/virtio/virtio_ring.c | 6 ++++--
net/ipv4/ip_gre.c | 2 ++
net/rds/ib_frmr.c | 4 ++--
27 files changed, 114 insertions(+), 65 deletions(-)
This is the start of the stable review cycle for the 4.4.283 release.
There are 10 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Sep 2021 12:22:41 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.283-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.283-rc1
Denis Efremov <efremov(a)linux.com>
Revert "floppy: reintroduce O_NDELAY fix"
George Kennedy <george.kennedy(a)oracle.com>
fbmem: add margin check to fb_check_caps()
Linus Torvalds <torvalds(a)linux-foundation.org>
vt_kdsetmode: extend console locking
Neeraj Upadhyay <neeraju(a)codeaurora.org>
vringh: Use wiov->used to check for read/write desc order
Parav Pandit <parav(a)nvidia.com>
virtio: Improve vq->broken access to avoid any compiler optimization
Maxim Kiselev <bigunclemax(a)gmail.com>
net: marvell: fix MVNETA_TX_IN_PRGRS bit number
Sasha Neftin <sasha.neftin(a)intel.com>
e1000e: Fix the max snoop/no-snoop latency for 10M
Zhengjun Zhang <zhangzhengjun(a)aicrobo.com>
USB: serial: option: add new VID/PID to support Fibocom FG150
Johan Hovold <johan(a)kernel.org>
Revert "USB: serial: ch341: fix character loss at high transfer rates"
Stefan Mätje <stefan.maetje(a)esd.eu>
can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
-------------
Diffstat:
Makefile | 4 ++--
drivers/block/floppy.c | 27 +++++++++++++--------------
drivers/net/can/usb/esd_usb2.c | 4 ++--
drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++-
drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++
drivers/net/ethernet/marvell/mvneta.c | 2 +-
drivers/tty/vt/vt_ioctl.c | 11 +++++++----
drivers/usb/serial/ch341.c | 1 -
drivers/usb/serial/option.c | 2 ++
drivers/vhost/vringh.c | 2 +-
drivers/video/fbdev/core/fbmem.c | 4 ++++
drivers/virtio/virtio_ring.c | 6 ++++--
12 files changed, 52 insertions(+), 28 deletions(-)
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: aeef8b5089b76852bd84889f2809e69a7cfb414e
Gitweb: https://git.kernel.org/tip/aeef8b5089b76852bd84889f2809e69a7cfb414e
Author: Jeff Moyer <jmoyer(a)redhat.com>
AuthorDate: Wed, 11 Aug 2021 17:07:37 -04:00
Committer: Thomas Gleixner <tglx(a)linutronix.de>
CommitterDate: Thu, 02 Sep 2021 21:53:18 +02:00
x86/pat: Pass valid address to sanitize_phys()
The end address passed to memtype_reserve() is handed directly to
sanitize_phys(). However, end is exclusive and sanitize_phys() expects
an inclusive address. If end falls at the end of the physical address
space, sanitize_phys() will return 0. This can result in drivers
failing to load, and the following warning:
WARNING: CPU: 26 PID: 749 at arch/x86/mm/pat.c:354 reserve_memtype+0x262/0x450
reserve_memtype failed: [mem 0x3ffffff00000-0xffffffffffffffff], req uncached-minus
Call Trace:
[<ffffffffa427b1f2>] reserve_memtype+0x262/0x450
[<ffffffffa42764aa>] ioremap_nocache+0x1a/0x20
[<ffffffffc04620a1>] mpt3sas_base_map_resources+0x151/0xa60 [mpt3sas]
[<ffffffffc0465555>] mpt3sas_base_attach+0xf5/0xa50 [mpt3sas]
---[ end trace 6d6eea4438db89ef ]---
ioremap reserve_memtype failed -22
mpt3sas_cm0: unable to map adapter memory! or resource not found
mpt3sas_cm0: failure at drivers/scsi/mpt3sas/mpt3sas_scsih.c:10597/_scsih_probe()!
Fix this by passing the inclusive end address to sanitize_phys().
Fixes: 510ee090abc3 ("x86/mm/pat: Prepare {reserve, free}_memtype() for "decoy" addresses")
Signed-off-by: Jeff Moyer <jmoyer(a)redhat.com>
Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de>
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Reviewed-by: Dan Williams <dan.j.williams(a)intel.com>
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/r/x49o8a3pu5i.fsf@segfault.boston.devel.redhat.com
---
arch/x86/mm/pat/memtype.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/x86/mm/pat/memtype.c b/arch/x86/mm/pat/memtype.c
index 3112ca7..4ba2a3e 100644
--- a/arch/x86/mm/pat/memtype.c
+++ b/arch/x86/mm/pat/memtype.c
@@ -583,7 +583,12 @@ int memtype_reserve(u64 start, u64 end, enum page_cache_mode req_type,
int err = 0;
start = sanitize_phys(start);
- end = sanitize_phys(end);
+
+ /*
+ * The end address passed into this function is exclusive, but
+ * sanitize_phys() expects an inclusive address.
+ */
+ end = sanitize_phys(end - 1) + 1;
if (start >= end) {
WARN(1, "%s failed: [mem %#010Lx-%#010Lx], req %s\n", __func__,
start, end - 1, cattr_name(req_type));
The patch titled
Subject: mm/page_alloc.c: avoid accessing uninitialized pcp page migratetype
has been added to the -mm tree. Its filename is
mm-page_allocc-avoid-accessing-uninitialized-pcp-page-migratetype.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/mm-page_allocc-avoid-accessing-un…
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/mm-page_allocc-avoid-accessing-un…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Miaohe Lin <linmiaohe(a)huawei.com>
Subject: mm/page_alloc.c: avoid accessing uninitialized pcp page migratetype
If it's not prepared to free unref page, the pcp page migratetype is
unset. Thus We will get rubbish from get_pcppage_migratetype() and might
list_del &page->lru again after it's already deleted from the list leading
to grumble about data corruption.
Link: https://lkml.kernel.org/r/20210902115447.57050-1-linmiaohe@huawei.com
Fixes: df1acc856923 ("mm/page_alloc: avoid conflating IRQs disabled with zone->lock")
Signed-off-by: Miaohe Lin <linmiaohe(a)huawei.com>
Acked-by: Mel Gorman <mgorman(a)techsingularity.net>
Acked-by: Vlastimil Babka <vbabka(a)suse.cz>
Reviewed-by: David Hildenbrand <david(a)redhat.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/page_alloc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/page_alloc.c~mm-page_allocc-avoid-accessing-uninitialized-pcp-page-migratetype
+++ a/mm/page_alloc.c
@@ -3445,8 +3445,10 @@ void free_unref_page_list(struct list_he
/* Prepare pages for freeing */
list_for_each_entry_safe(page, next, list, lru) {
pfn = page_to_pfn(page);
- if (!free_unref_page_prepare(page, pfn, 0))
+ if (!free_unref_page_prepare(page, pfn, 0)) {
list_del(&page->lru);
+ continue;
+ }
/*
* Free isolated pages directly to the allocator, see
_
Patches currently in -mm which might be from linmiaohe(a)huawei.com are
mm-page_allocc-avoid-accessing-uninitialized-pcp-page-migratetype.patch
mm-gup-remove-set-but-unused-local-variable-major.patch
mm-gup-remove-unneed-local-variable-orig_refs.patch
mm-gup-remove-useless-bug_on-in-__get_user_pages.patch
mm-gup-fix-potential-pgmap-refcnt-leak-in-__gup_device_huge.patch
mm-gup-use-helper-page_aligned-in-populate_vma_page_range.patch
shmem-remove-unneeded-variable-ret.patch
shmem-remove-unneeded-header-file.patch
shmem-remove-unneeded-function-forward-declaration.patch
shmem-include-header-file-to-declare-swap_info.patch
mm-memcg-remove-unused-functions.patch
mm-memcg-save-some-atomic-ops-when-flush-is-already-true.patch
mm-hwpoison-remove-unneeded-variable-unmap_success.patch
mm-hwpoison-fix-potential-pte_unmap_unlock-pte-error.patch
mm-hwpoison-change-argument-struct-page-hpagep-to-hpage.patch
mm-hwpoison-fix-some-obsolete-comments.patch
mm-vmscan-remove-the-pagedirty-check-after-madv_free-pages-are-page_ref_freezed.patch
mm-vmscan-remove-misleading-setting-to-sc-priority.patch
mm-vmscan-remove-unneeded-return-value-of-kswapd_run.patch
mm-vmscan-add-else-to-remove-check_pending-label.patch
mm-vmstat-correct-some-wrong-comments.patch
mm-vmstat-simplify-the-array-size-calculation.patch
mm-vmstat-remove-unneeded-return-value.patch
mm-memory_hotplug-use-helper-zone_is_zone_device-to-simplify-the-code.patch
mm-memory_hotplug-make-hwpoisoned-dirty-swapcache-pages-unmovable.patch
mm-zsmallocc-close-race-window-between-zs_pool_dec_isolated-and-zs_unregister_migration.patch
mm-zsmallocc-combine-two-atomic-ops-in-zs_pool_dec_isolated.patch