January 2022 - Linux-stable-mirror

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.96 release. There are 100 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Feb 2022 10:51:59 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.96-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.96-rc1 OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp> block: Fix wrong offset in bio_truncate() Amir Goldstein <amir73il(a)gmail.com> fsnotify: invalidate dcache before IN_DELETE event Dmitry V. Levin <ldv(a)altlinux.org> usr/include/Makefile: add linux/nfc.h to the compile-test coverage Marc Kleine-Budde <mkl(a)pengutronix.de> dt-bindings: can: tcan4x5x: fix mram-cfg RX FIFO config Tim Yi <tim.yi(a)pica8.com> net: bridge: vlan: fix memory leak in __allowed_ingress Eric Dumazet <edumazet(a)google.com> ipv4: remove sparse error in ip_neigh_gw4() Eric Dumazet <edumazet(a)google.com> ipv4: tcp: send zero IPID in SYNACK messages Eric Dumazet <edumazet(a)google.com> ipv4: raw: lock the socket in raw_bind() Nikolay Aleksandrov <nikolay(a)nvidia.com> net: bridge: vlan: fix single net device option dumping Guillaume Nault <gnault(a)redhat.com> Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values" Yufeng Mo <moyufeng(a)huawei.com> net: hns3: handle empty unknown interrupt for VF Toke Høiland-Jørgensen <toke(a)redhat.com> net: cpsw: Properly initialise struct page_pool_params Hangyu Hua <hbh25y(a)gmail.com> yam: fix a memory leak in yam_siocdevprivate() José Expósito <jose.exposito89(a)gmail.com> drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc Miaoqian Lin <linmq006(a)gmail.com> drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy Michael Kelley <mikelley(a)microsoft.com> video: hyperv_fb: Fix validation of screen resolution Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: don't spin in tasklet Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: init ->running_cap_crqs early Jakub Kicinski <kuba(a)kernel.org> ipv4: fix ip option filtering for locally generated fragments Yajun Deng <yajun.deng(a)linux.dev> net: ipv4: Fix the warning for dereference Yajun Deng <yajun.deng(a)linux.dev> net: ipv4: Move ip_options_fragment() out of loop Athira Rajeev <atrajeev(a)linux.vnet.ibm.com> powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Mark alert as broken for MAX6654 Mihai Carabas <mihai.carabas(a)oracle.com> efi/libstub: arm64: Fix image check alignment at entry David Howells <dhowells(a)redhat.com> rxrpc: Adjust retransmission backoff Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2-pf: Forward error codes to VF Marek Behún <kabel(a)kernel.org> phylib: fix potential use-after-free Robert Hancock <robert.hancock(a)calian.com> net: phy: broadcom: hook up soft_reset for BCM54616S Vincent Guittot <vincent.guittot(a)linaro.org> sched/pelt: Relax the sync of util_sum with util_avg Peter Zijlstra <peterz(a)infradead.org> perf: Fix perf_event_read_local() time Randy Dunlap <rdunlap(a)infradead.org> kernel: delete repeated words in comments Florian Westphal <fw(a)strlen.de> netfilter: conntrack: don't increment invalid counter on NF_REPEAT Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06 Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Ensure the server has an up to date ctime before renaming Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Ensure the server has an up to date ctime before hardlinking Eric Dumazet <edumazet(a)google.com> ipv6: annotate accesses to fn->fn_sernum José Expósito <jose.exposito89(a)gmail.com> drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable Miaoqian Lin <linmq006(a)gmail.com> drm/msm/dsi: Fix missing put_device() call in dsi_get_phy Xianting Tian <xianting.tian(a)linux.alibaba.com> drm/msm: Fix wrong size calculation Jianguo Wu <wujianguo(a)chinatelecom.cn> net-procfs: show net devices bound packet types Trond Myklebust <trond.myklebust(a)hammerspace.com> NFSv4: nfs_atomic_open() can race when looking up a non-regular file Trond Myklebust <trond.myklebust(a)hammerspace.com> NFSv4: Handle case where the lookup of a directory fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Reduce maximum conversion rate for G781 Eric Dumazet <edumazet(a)google.com> ipv4: avoid using shared IP generator for connected sockets Xin Long <lucien.xin(a)gmail.com> ping: fix the sk_bound_dev_if match in ping_lookup Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Mark alert as broken for MAX6680 Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649 Congyu Liu <liu3101(a)purdue.edu> net: fix information leakage in /proc/net/ptype sparkhuang <huangshaobo6(a)huawei.com> ARM: 9170/1: fix panic when kasan and kprobe are enabled Ido Schimmel <idosch(a)nvidia.com> ipv6_tunnel: Rate limit warning messages John Meneghini <jmeneghi(a)redhat.com> scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() Matthias Kaehlcke <mka(a)chromium.org> rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev Sujit Kautkar <sujitka(a)chromium.org> rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev Linyu Yuan <quic_linyyuan(a)quicinc.com> usb: roles: fix include/linux/usb/role.h compile issue Joe Damato <jdamato(a)fastly.com> i40e: fix unsigned stat widths Karen Sornek <karen.sornek(a)intel.com> i40e: Fix for failed to init adminq while VF reset Sylwester Dziedziuch <sylwesterx.dziedziuch(a)intel.com> i40e: Fix queues reservation for XDP Jedrzej Jagielski <jedrzej.jagielski(a)intel.com> i40e: Fix issue when maximum queues is exceeded Jedrzej Jagielski <jedrzej.jagielski(a)intel.com> i40e: Increase delay to 1 s after global EMP reset Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/32: Fix boot failure with GCC latent entropy plugin Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/32s: Fix kasan_init_region() for KASAN Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/32s: Allocate one 256k IBAT instead of two consecutives 128k IBATs Yazen Ghannam <yazen.ghannam(a)amd.com> x86/MCE/AMD: Allow thresholding interface updates after init Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> sched/membarrier: Fix membarrier-rseq fence command missing from query bitmask Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix a deadlock when commit trans Joseph Qi <joseph.qi(a)linux.alibaba.com> jbd2: export jbd2_journal_[grab|put]_journal_head Sing-Han Chen <singhanc(a)nvidia.com> ucsi_ccg: Check DEV_INT bit only when starting CCG4 Badhri Jagan Sridharan <badhri(a)google.com> usb: typec: tcpm: Do not disconnect while receiving VBUS off Alan Stern <stern(a)rowland.harvard.edu> USB: core: Fix hang in usb_kill_urb by adding memory barriers Pavankumar Kondeti <quic_pkondeti(a)quicinc.com> usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS Jon Hunter <jonathanh(a)nvidia.com> usb: common: ulpi: Fix crash in ulpi_match() Frank Li <Frank.Li(a)nxp.com> usb: xhci-plat: fix crash when suspend if remote wake enable Alan Stern <stern(a)rowland.harvard.edu> usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge Cameron Williams <cang1(a)live.co.uk> tty: Add support for Brainboxes UC cards. daniel.starke(a)siemens.com <daniel.starke(a)siemens.com> tty: n_gsm: fix SW flow control encoding/handling Valentin Caron <valentin.caron(a)foss.st.com> serial: stm32: fix software flow control transfer Robert Hancock <robert.hancock(a)calian.com> serial: 8250: of: Fix mapped region size when using reg-offset property Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_payload: do not update layer 4 checksum when mangling fragments D Scott Phillips <scott(a)os.amperecomputing.com> arm64: errata: Fix exec handling in erratum 1418040 workaround Like Xu <likexu(a)tencent.com> KVM: x86: Update vCPU's runtime CPUID on write to MSR_IA32_XSS Lucas Stach <l.stach(a)pengutronix.de> drm/etnaviv: relax submit size limits Zhengjun Xing <zhengjun.xing(a)linux.intel.com> perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX Sean Christopherson <seanjc(a)google.com> Revert "KVM: SVM: avoid infinite loop on NPF from bad address" Amir Goldstein <amir73il(a)gmail.com> fsnotify: fix fsnotify hooks in pseudo filesystems Jeff Layton <jlayton(a)kernel.org> ceph: set pool_ns in new inode layout for async creates Jeff Layton <jlayton(a)kernel.org> ceph: properly put ceph_string reference after async create attempt Tom Zanussi <zanussi(a)kernel.org> tracing: Don't inc err_log entry count if entry allocation fails Xiaoke Wang <xkernel.wang(a)foxmail.com> tracing/histogram: Fix a potential memory leak for kstrdup() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> PM: wakeup: simplify the output logic of pm_show_wakelocks() Ard Biesheuvel <ardb(a)kernel.org> efi: runtime: avoid EFIv2 runtime services on Apple x86 machines Jan Kara <jack(a)suse.cz> udf: Fix NULL ptr deref when converting from inline format Jan Kara <jack(a)suse.cz> udf: Restore i_lenAlloc when inode expansion fails Steffen Maier <maier(a)linux.ibm.com> scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack() Vasily Gorbik <gor(a)linux.ibm.com> s390/hypfs: include z/VM guests with access control group set Ilya Leoshkevich <iii(a)linux.ibm.com> s390/module: fix loading modules with a lot of relocations Mohammad Athari Bin Ismail <mohammad.athari.ismail(a)intel.com> net: stmmac: skip only stmmac_ptp_register when resume from suspend Marek Behún <kabel(a)kernel.org> net: sfp: ignore disabled SFP node Stanimir Varbanov <stanimir.varbanov(a)linaro.org> media: venus: core: Drop second v4l2 device unregister Brian Gix <brian.gix(a)intel.com> Bluetooth: refactor malicious adv data check ------------- Diffstat: .../devicetree/bindings/net/can/tcan4x5x.txt | 2 +- Makefile | 4 +- arch/arm/probes/kprobes/Makefile | 3 + arch/arm64/kernel/process.c | 39 ++-- arch/powerpc/include/asm/book3s/32/mmu-hash.h | 2 + arch/powerpc/include/asm/ppc-opcode.h | 1 + arch/powerpc/kernel/Makefile | 1 + arch/powerpc/lib/Makefile | 3 + arch/powerpc/mm/book3s32/mmu.c | 15 +- arch/powerpc/mm/kasan/book3s_32.c | 59 ++--- arch/powerpc/net/bpf_jit_comp64.c | 22 +- arch/powerpc/perf/core-book3s.c | 17 +- arch/s390/hypfs/hypfs_vm.c | 6 +- arch/s390/kernel/module.c | 37 ++- arch/x86/events/intel/uncore_snbep.c | 2 +- arch/x86/kernel/cpu/mce/amd.c | 2 +- arch/x86/kvm/svm/svm.c | 7 - arch/x86/kvm/x86.c | 1 + block/bio.c | 3 +- drivers/firmware/efi/efi.c | 7 + drivers/firmware/efi/libstub/arm64-stub.c | 6 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 4 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c | 11 +- drivers/gpu/drm/msm/dsi/dsi.c | 7 +- drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +- drivers/gpu/drm/msm/hdmi/hdmi.c | 7 +- drivers/gpu/drm/msm/msm_drv.c | 2 +- drivers/hwmon/lm90.c | 7 +- drivers/media/platform/qcom/venus/core.c | 2 - .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +- drivers/net/ethernet/ibm/ibmvnic.c | 112 +++++---- drivers/net/ethernet/intel/i40e/i40e.h | 9 +- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 44 ++-- drivers/net/ethernet/intel/i40e/i40e_register.h | 3 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 103 ++++++++- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 20 +- drivers/net/ethernet/ti/cpsw_priv.c | 2 +- drivers/net/hamradio/yam.c | 4 +- drivers/net/phy/broadcom.c | 1 + drivers/net/phy/phy_device.c | 6 +- drivers/net/phy/sfp-bus.c | 5 + drivers/rpmsg/rpmsg_char.c | 22 +- drivers/s390/scsi/zfcp_fc.c | 13 +- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 20 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/serial/8250/8250_of.c | 11 +- drivers/tty/serial/8250/8250_pci.c | 100 +++++++- drivers/tty/serial/stm32-usart.c | 2 +- drivers/usb/common/ulpi.c | 7 +- drivers/usb/core/hcd.c | 14 ++ drivers/usb/core/urb.c | 12 + drivers/usb/gadget/function/f_sourcesink.c | 1 + drivers/usb/host/xhci-plat.c | 3 + drivers/usb/storage/unusual_devs.h | 10 + drivers/usb/typec/tcpm/tcpm.c | 3 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +- drivers/video/fbdev/hyperv_fb.c | 16 +- fs/btrfs/ioctl.c | 6 +- fs/ceph/file.c | 9 + fs/configfs/dir.c | 6 +- fs/devpts/inode.c | 2 +- fs/jbd2/journal.c | 2 + fs/namei.c | 10 +- fs/nfs/dir.c | 22 ++ fs/nfsd/nfsctl.c | 5 +- fs/ocfs2/suballoc.c | 25 +- fs/udf/inode.c | 9 +- include/linux/fsnotify.h | 48 +++- include/linux/netdevice.h | 1 + include/linux/perf_event.h | 15 +- include/linux/usb/role.h | 6 + include/net/addrconf.h | 2 + include/net/ip.h | 21 +- include/net/ip6_fib.h | 2 +- include/net/route.h | 2 +- kernel/bpf/stackmap.c | 5 +- kernel/events/core.c | 252 ++++++++++++--------- kernel/events/uprobes.c | 2 +- kernel/locking/rtmutex.c | 4 +- kernel/locking/rwsem.c | 2 +- kernel/locking/semaphore.c | 2 +- kernel/power/wakelock.c | 11 +- kernel/sched/fair.c | 18 +- kernel/sched/membarrier.c | 11 +- kernel/sched/pelt.h | 4 +- kernel/trace/trace.c | 3 +- kernel/trace/trace_events_hist.c | 1 + net/bluetooth/hci_event.c | 10 +- net/bridge/br_vlan.c | 9 +- net/core/net-procfs.c | 38 +++- net/ipv4/ip_output.c | 41 ++-- net/ipv4/ping.c | 3 +- net/ipv4/raw.c | 5 +- net/ipv6/addrconf.c | 27 ++- net/ipv6/ip6_fib.c | 23 +- net/ipv6/ip6_tunnel.c | 8 +- net/ipv6/route.c | 2 +- net/netfilter/nf_conntrack_core.c | 8 +- net/netfilter/nft_payload.c | 3 + net/packet/af_packet.c | 2 + net/rxrpc/call_event.c | 8 +- net/rxrpc/output.c | 2 +- net/sunrpc/rpc_pipe.c | 4 +- usr/include/Makefile | 1 - virt/kvm/kvm_main.c | 1 - 108 files changed, 1018 insertions(+), 530 deletions(-)

3 years

11
113
0 0

[PATCH] io_uring: prevent io_put_identity() from freeing a static identity

by Tadeusz Struk

Note: this applies to 5.10 stable only. It doesn't trigger on anything above 5.10 as the code there has been substantially reworked. This also doesn't apply to any stable kernel below 5.10 afaict. Syzbot found a bug: KASAN: invalid-free in io_dismantle_req https://syzkaller.appspot.com/bug?id=123d9a852fc88ba573ffcb2dbcf4f9576c3b05… The test submits bunch of io_uring writes and exits, which then triggers uring_task_cancel() and io_put_identity(), which in some corner cases, tries to free a static identity. This causes a panic as shown in the trace below: BUG: KASAN: double-free or invalid-free in kfree+0xd5/0x310 CPU: 0 PID: 4618 Comm: repro Not tainted 5.10.76-05281-g4944ec82ebb9-dirty #17 Call Trace: dump_stack_lvl+0x1b2/0x21b print_address_description+0x8d/0x3b0 kasan_report_invalid_free+0x58/0x130 ____kasan_slab_free+0x14b/0x170 __kasan_slab_free+0x11/0x20 slab_free_freelist_hook+0xcc/0x1a0 kfree+0xd5/0x310 io_dismantle_req+0x9b0/0xd90 io_do_iopoll+0x13a4/0x23e0 io_iopoll_try_reap_events+0x116/0x290 io_uring_cancel_task_requests+0x197d/0x1ee0 io_uring_flush+0x170/0x6d0 filp_close+0xb0/0x150 put_files_struct+0x1d4/0x350 exit_files+0x80/0xa0 do_exit+0x6d9/0x2390 do_group_exit+0x16a/0x2d0 get_signal+0x133e/0x1f80 arch_do_signal+0x7b/0x610 exit_to_user_mode_prepare+0xaa/0xe0 syscall_exit_to_user_mode+0x24/0x40 do_syscall_64+0x3d/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 4611: ____kasan_kmalloc+0xcd/0x100 __kasan_kmalloc+0x9/0x10 kmem_cache_alloc_trace+0x208/0x390 io_uring_alloc_task_context+0x57/0x550 io_uring_add_task_file+0x1f7/0x290 io_uring_create+0x2195/0x3490 __x64_sys_io_uring_setup+0x1bf/0x280 do_syscall_64+0x31/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff88810732b500 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 88 bytes inside of 192-byte region [ffff88810732b500, ffff88810732b5c0) Kernel panic - not syncing: panic_on_warn set ... This issue bisected to this commit: commit 186725a80c4e ("io_uring: fix skipping disabling sqo on exec") Simple reverting the offending commit doesn't work as it hits some other, related issues like: /* sqo_dead check is for when this happens after cancellation */ WARN_ON_ONCE(ctx->sqo_task == current && !ctx->sqo_dead && !xa_load(&tctx->xa, (unsigned long)file)); ------------[ cut here ]------------ WARNING: CPU: 1 PID: 5622 at fs/io_uring.c:8960 io_uring_flush+0x5bc/0x6d0 Modules linked in: CPU: 1 PID: 5622 Comm: repro Not tainted 5.10.76-05281-g4944ec82ebb9-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-6.fc35 04/01/2014 RIP: 0010:io_uring_flush+0x5bc/0x6d0 Call Trace: filp_close+0xb0/0x150 put_files_struct+0x1d4/0x350 reset_files_struct+0x88/0xa0 bprm_execve+0x7f2/0x9f0 do_execveat_common+0x46f/0x5d0 __x64_sys_execve+0x92/0xb0 do_syscall_64+0x31/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Changing __io_uring_task_cancel() to call io_disable_sqo_submit() directly, as the comment suggests, only if __io_uring_files_cancel() is not executed seems to fix the issue. Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Alexander Viro <viro(a)zeniv.linux.org.uk> Cc: <io-uring(a)vger.kernel.org> Cc: <linux-fsdevel(a)vger.kernel.org> Cc: <linux-kernel(a)vger.kernel.org> Cc: <stable(a)vger.kernel.org> Reported-by: syzbot+6055980d041c8ac23307(a)syzkaller.appspotmail.com Signed-off-by: Tadeusz Struk <tadeusz.struk(a)linaro.org> --- fs/io_uring.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 0736487165da..fcf9ffe9b209 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -8882,20 +8882,18 @@ void __io_uring_task_cancel(void) struct io_uring_task *tctx = current->io_uring; DEFINE_WAIT(wait); s64 inflight; + int canceled = 0; /* make sure overflow events are dropped */ atomic_inc(&tctx->in_idle); - /* trigger io_disable_sqo_submit() */ - if (tctx->sqpoll) - __io_uring_files_cancel(NULL); - do { /* read completions before cancelations */ inflight = tctx_inflight(tctx); if (!inflight) break; __io_uring_files_cancel(NULL); + canceled = 1; prepare_to_wait(&tctx->wait, &wait, TASK_UNINTERRUPTIBLE); @@ -8909,6 +8907,21 @@ void __io_uring_task_cancel(void) finish_wait(&tctx->wait, &wait); } while (1); + /* + * trigger io_disable_sqo_submit() + * if not already done by __io_uring_files_cancel() + */ + if (tctx->sqpoll && !canceled) { + struct file *file; + unsigned long index; + + xa_for_each(&tctx->xa, index, file) { + struct io_ring_ctx *ctx = file->private_data; + + io_disable_sqo_submit(ctx); + } + } + atomic_dec(&tctx->in_idle); io_uring_remove_task_files(tctx); -- 2.33.1

3 years

1
3
0 0

[PATCH stable] drm/vc4: hdmi: Fix improper merge conflict with CEC

by Maxime Ripard

Commit 20b0dfa86bef0e80b41b0e5ac38b92f23b6f27f9 upstream. The original commit depended on a rework commit (724fc856c09e ("drm/vc4: hdmi: Split the CEC disable / enable functions in two")) that (rightfully) didn't reach stable. However, probably because the context changed, when the patch was applied to stable the pm_runtime_put called got moved to the end of the vc4_hdmi_cec_adap_enable function (that would have become vc4_hdmi_cec_disable with the rework) to vc4_hdmi_cec_init. This means that at probe time, we now drop our reference to the clocks and power domains and thus end up with a CPU hang when the CPU tries to access registers. The call to pm_runtime_resume_and_get() is also problematic since the .adap_enable CEC hook is called both to enable and to disable the controller. That means that we'll now call pm_runtime_resume_and_get() at disable time as well, messing with the reference counting. The behaviour we should have though would be to have pm_runtime_resume_and_get() called when the CEC controller is enabled, and pm_runtime_put when it's disabled. We need to move things around a bit to behave that way, but it aligns stable with upstream. Cc: <stable(a)vger.kernel.org> # 5.10.x Cc: <stable(a)vger.kernel.org> # 5.15.x Cc: <stable(a)vger.kernel.org> # 5.16.x Reported-by: Michael Stapelberg <michael+drm(a)stapelberg.ch> Signed-off-by: Maxime Ripard <maxime(a)cerno.tech> --- drivers/gpu/drm/vc4/vc4_hdmi.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c index 8465914892fa..e6aad838065b 100644 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -1739,18 +1739,18 @@ static int vc4_hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable) u32 val; int ret; - ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev); - if (ret) - return ret; - - val = HDMI_READ(HDMI_CEC_CNTRL_5); - val &= ~(VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET | - VC4_HDMI_CEC_CNT_TO_4700_US_MASK | - VC4_HDMI_CEC_CNT_TO_4500_US_MASK); - val |= ((4700 / usecs) << VC4_HDMI_CEC_CNT_TO_4700_US_SHIFT) | - ((4500 / usecs) << VC4_HDMI_CEC_CNT_TO_4500_US_SHIFT); - if (enable) { + ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev); + if (ret) + return ret; + + val = HDMI_READ(HDMI_CEC_CNTRL_5); + val &= ~(VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET | + VC4_HDMI_CEC_CNT_TO_4700_US_MASK | + VC4_HDMI_CEC_CNT_TO_4500_US_MASK); + val |= ((4700 / usecs) << VC4_HDMI_CEC_CNT_TO_4700_US_SHIFT) | + ((4500 / usecs) << VC4_HDMI_CEC_CNT_TO_4500_US_SHIFT); + HDMI_WRITE(HDMI_CEC_CNTRL_5, val | VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET); HDMI_WRITE(HDMI_CEC_CNTRL_5, val); @@ -1778,7 +1778,10 @@ static int vc4_hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable) HDMI_WRITE(HDMI_CEC_CPU_MASK_SET, VC4_HDMI_CPU_CEC); HDMI_WRITE(HDMI_CEC_CNTRL_5, val | VC4_HDMI_CEC_TX_SW_RESET | VC4_HDMI_CEC_RX_SW_RESET); + + pm_runtime_put(&vc4_hdmi->pdev->dev); } + return 0; } @@ -1889,8 +1892,6 @@ static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi) if (ret < 0) goto err_remove_handlers; - pm_runtime_put(&vc4_hdmi->pdev->dev); - return 0; err_remove_handlers: -- 2.34.1

3 years

2
1
0 0

FAILED: patch "[PATCH] x86/cpu: Add Xeon Icelake-D to list of CPUs that support PPIN" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From e464121f2d40eabc7d11823fb26db807ce945df4 Mon Sep 17 00:00:00 2001 From: Tony Luck <tony.luck(a)intel.com> Date: Fri, 21 Jan 2022 09:47:38 -0800 Subject: [PATCH] x86/cpu: Add Xeon Icelake-D to list of CPUs that support PPIN Missed adding the Icelake-D CPU to the list. It uses the same MSRs to control and read the inventory number as all the other models. Fixes: dc6b025de95b ("x86/mce: Add Xeon Icelake to list of CPUs that support PPIN") Reported-by: Ailin Xu <ailin.xu(a)intel.com> Signed-off-by: Tony Luck <tony.luck(a)intel.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220121174743.1875294-2-tony.luck@intel.com diff --git a/arch/x86/kernel/cpu/mce/intel.c b/arch/x86/kernel/cpu/mce/intel.c index bb9a46a804bf..baafbb37be67 100644 --- a/arch/x86/kernel/cpu/mce/intel.c +++ b/arch/x86/kernel/cpu/mce/intel.c @@ -486,6 +486,7 @@ static void intel_ppin_init(struct cpuinfo_x86 *c) case INTEL_FAM6_BROADWELL_X: case INTEL_FAM6_SKYLAKE_X: case INTEL_FAM6_ICELAKE_X: + case INTEL_FAM6_ICELAKE_D: case INTEL_FAM6_SAPPHIRERAPIDS_X: case INTEL_FAM6_XEON_PHI_KNL: case INTEL_FAM6_XEON_PHI_KNM:

3 years

5
5
0 0

FAILED: patch "[PATCH] perf/core: Fix cgroup event list management" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From c5de60cd622a2607c043ba65e25a6e9998a369f9 Mon Sep 17 00:00:00 2001 From: Namhyung Kim <namhyung(a)kernel.org> Date: Mon, 24 Jan 2022 11:58:08 -0800 Subject: [PATCH] perf/core: Fix cgroup event list management The active cgroup events are managed in the per-cpu cgrp_cpuctx_list. This list is only accessed from current cpu and not protected by any locks. But from the commit ef54c1a476ae ("perf: Rework perf_event_exit_event()"), it's possible to access (actually modify) the list from another cpu. In the perf_remove_from_context(), it can remove an event from the context without an IPI when the context is not active. This is not safe with cgroup events which can have some active events in the context even if ctx->is_active is 0 at the moment. The target cpu might be in the middle of list iteration at the same time. If the event is enabled when it's about to be closed, it might call perf_cgroup_event_disable() and list_del() with the cgrp_cpuctx_list on a different cpu. This resulted in a crash due to an invalid list pointer access during the cgroup list traversal on the cpu which the event belongs to. Let's fallback to IPI to access the cgrp_cpuctx_list from that cpu. Similarly, perf_install_in_context() should use IPI for the cgroup events too. Fixes: ef54c1a476ae ("perf: Rework perf_event_exit_event()") Signed-off-by: Namhyung Kim <namhyung(a)kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20220124195808.2252071-1-namhyung@kernel.org diff --git a/kernel/events/core.c b/kernel/events/core.c index b1c1928c0e7c..76c754e45d01 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -2462,7 +2462,11 @@ static void perf_remove_from_context(struct perf_event *event, unsigned long fla * event_function_call() user. */ raw_spin_lock_irq(&ctx->lock); - if (!ctx->is_active) { + /* + * Cgroup events are per-cpu events, and must IPI because of + * cgrp_cpuctx_list. + */ + if (!ctx->is_active && !is_cgroup_event(event)) { __perf_remove_from_context(event, __get_cpu_context(ctx), ctx, (void *)flags); raw_spin_unlock_irq(&ctx->lock); @@ -2895,11 +2899,14 @@ perf_install_in_context(struct perf_event_context *ctx, * perf_event_attr::disabled events will not run and can be initialized * without IPI. Except when this is the first event for the context, in * that case we need the magic of the IPI to set ctx->is_active. + * Similarly, cgroup events for the context also needs the IPI to + * manipulate the cgrp_cpuctx_list. * * The IOC_ENABLE that is sure to follow the creation of a disabled * event will issue the IPI and reprogram the hardware. */ - if (__perf_effective_state(event) == PERF_EVENT_STATE_OFF && ctx->nr_events) { + if (__perf_effective_state(event) == PERF_EVENT_STATE_OFF && + ctx->nr_events && !is_cgroup_event(event)) { raw_spin_lock_irq(&ctx->lock); if (ctx->task == TASK_TOMBSTONE) { raw_spin_unlock_irq(&ctx->lock);

3 years

3
2
0 0

[PATCH v2] PCI: imx6: Allow to probe when dw_pcie_wait_for_link() fails

by Fabio Estevam

The intention of commit 886a9c134755 ("PCI: dwc: Move link handling into common code") was to standardize the behavior of link down as explained in its commit log: "The behavior for a link down was inconsistent as some drivers would fail probe in that case while others succeed. Let's standardize this to succeed as there are usecases where devices (and the link) appear later even without hotplug. For example, a reconfigured FPGA device." The pci-imx6 still fails to probe when the link is not present, which causes the following warning: imx6q-pcie 8ffc000.pcie: Phy link never came up imx6q-pcie: probe of 8ffc000.pcie failed with error -110 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 30 at drivers/regulator/core.c:2257 _regulator_put.part.0+0x1b8/0x1dc Modules linked in: CPU: 0 PID: 30 Comm: kworker/u2:2 Not tainted 5.15.0-next-20211103 #1 Hardware name: Freescale i.MX6 SoloX (Device Tree) Workqueue: events_unbound async_run_entry_fn [<c0111730>] (unwind_backtrace) from [<c010bb74>] (show_stack+0x10/0x14) [<c010bb74>] (show_stack) from [<c0f90290>] (dump_stack_lvl+0x58/0x70) [<c0f90290>] (dump_stack_lvl) from [<c012631c>] (__warn+0xd4/0x154) [<c012631c>] (__warn) from [<c0f87b00>] (warn_slowpath_fmt+0x74/0xa8) [<c0f87b00>] (warn_slowpath_fmt) from [<c076b4bc>] (_regulator_put.part.0+0x1b8/0x1dc) [<c076b4bc>] (_regulator_put.part.0) from [<c076b574>] (regulator_put+0x2c/0x3c) [<c076b574>] (regulator_put) from [<c08c3740>] (release_nodes+0x50/0x178) Fix this problem by ignoring the dw_pcie_wait_for_link() error like it is done on the other dwc drivers. Tested on imx6sx-sdb and imx6q-sabresd boards. Cc: <stable(a)vger.kernel.org> Fixes: 886a9c134755 ("PCI: dwc: Move link handling into common code") Signed-off-by: Fabio Estevam <festevam(a)gmail.com> --- Changes since v1: - Remove the printk timestamp from the kernel warning log (Richard). drivers/pci/controller/dwc/pci-imx6.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c index 2ac081510632..5e8a03061b31 100644 --- a/drivers/pci/controller/dwc/pci-imx6.c +++ b/drivers/pci/controller/dwc/pci-imx6.c @@ -807,9 +807,7 @@ static int imx6_pcie_start_link(struct dw_pcie *pci) /* Start LTSSM. */ imx6_pcie_ltssm_enable(dev); - ret = dw_pcie_wait_for_link(pci); - if (ret) - goto err_reset_phy; + dw_pcie_wait_for_link(pci); if (pci->link_gen == 2) { /* Allow Gen2 mode after the link is up. */ @@ -845,11 +843,7 @@ static int imx6_pcie_start_link(struct dw_pcie *pci) } /* Make sure link training is finished as well! */ - ret = dw_pcie_wait_for_link(pci); - if (ret) { - dev_err(dev, "Failed to bring link up!\n"); - goto err_reset_phy; - } + dw_pcie_wait_for_link(pci); } else { dev_info(dev, "Link: Gen2 disabled\n"); } -- 2.25.1

3 years

4
5
0 0

[PATCH] ARM: davinci: da850-evm: Avoid NULL pointer dereference

by Nathan Chancellor

With newer versions of GCC, there is a panic in da850_evm_config_emac() when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine: Unable to handle kernel NULL pointer dereference at virtual address 00000020 pgd = (ptrval) [00000020] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1 Hardware name: Generic DT based system PC is at da850_evm_config_emac+0x1c/0x120 LR is at do_one_initcall+0x50/0x1e0 The emac_pdata pointer in soc_info is NULL because davinci_soc_info only gets populated on davinci machines but da850_evm_config_emac() is called on all machines via device_initcall(). Move the rmii_en assignment below the machine check so that it is only dereferenced when running on a supported SoC. Cc: stable(a)vger.kernel.org Fixes: bae105879f2f ("davinci: DA850/OMAP-L138 EVM: implement autodetect of RMII PHY") Link: https://lore.kernel.org/r/YcS4xVWs6bQlQSPC@archlinux-ax161/ Reviewed-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Nathan Chancellor <nathan(a)kernel.org> --- arch/arm/mach-davinci/board-da850-evm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c index 428012687a80..7f7f6bae21c2 100644 --- a/arch/arm/mach-davinci/board-da850-evm.c +++ b/arch/arm/mach-davinci/board-da850-evm.c @@ -1101,11 +1101,13 @@ static int __init da850_evm_config_emac(void) int ret; u32 val; struct davinci_soc_info *soc_info = &davinci_soc_info; - u8 rmii_en = soc_info->emac_pdata->rmii_en; + u8 rmii_en; if (!machine_is_davinci_da850_evm()) return 0; + rmii_en = soc_info->emac_pdata->rmii_en; + cfg_chip3_base = DA8XX_SYSCFG0_VIRT(DA8XX_CFGCHIP3_REG); val = __raw_readl(cfg_chip3_base); base-commit: a7904a538933c525096ca2ccde1e60d0ee62c08e -- 2.34.1

3 years

2
2
0 0

FAILED: patch "[PATCH] net: ipa: prevent concurrent replenish" failed to apply to 5.16-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.16-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 998c0bd2b3715244da7639cc4e6a2062cb79c3f4 Mon Sep 17 00:00:00 2001 From: Alex Elder <elder(a)linaro.org> Date: Wed, 12 Jan 2022 07:30:12 -0600 Subject: [PATCH] net: ipa: prevent concurrent replenish We have seen cases where an endpoint RX completion interrupt arrives while replenishing for the endpoint is underway. This causes another instance of replenishing to begin as part of completing the receive transaction. If this occurs it can lead to transaction corruption. Use a new flag to ensure only one replenish instance for an endpoint executes at a time. Fixes: 84f9bd12d46db ("soc: qcom: ipa: IPA endpoints") Signed-off-by: Alex Elder <elder(a)linaro.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c index cddddcedaf72..68291a3efd04 100644 --- a/drivers/net/ipa/ipa_endpoint.c +++ b/drivers/net/ipa/ipa_endpoint.c @@ -1088,15 +1088,27 @@ static void ipa_endpoint_replenish(struct ipa_endpoint *endpoint, bool add_one) return; } + /* If already active, just update the backlog */ + if (test_and_set_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags)) { + if (add_one) + atomic_inc(&endpoint->replenish_backlog); + return; + } + while (atomic_dec_not_zero(&endpoint->replenish_backlog)) if (ipa_endpoint_replenish_one(endpoint)) goto try_again_later; + + clear_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags); + if (add_one) atomic_inc(&endpoint->replenish_backlog); return; try_again_later: + clear_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags); + /* The last one didn't succeed, so fix the backlog */ delta = add_one ? 2 : 1; backlog = atomic_add_return(delta, &endpoint->replenish_backlog); @@ -1691,6 +1703,7 @@ static void ipa_endpoint_setup_one(struct ipa_endpoint *endpoint) * backlog is the same as the maximum outstanding TREs. */ clear_bit(IPA_REPLENISH_ENABLED, endpoint->replenish_flags); + clear_bit(IPA_REPLENISH_ACTIVE, endpoint->replenish_flags); atomic_set(&endpoint->replenish_saved, gsi_channel_tre_max(gsi, endpoint->channel_id)); atomic_set(&endpoint->replenish_backlog, 0); diff --git a/drivers/net/ipa/ipa_endpoint.h b/drivers/net/ipa/ipa_endpoint.h index 07d5c20e5f00..0313cdc607de 100644 --- a/drivers/net/ipa/ipa_endpoint.h +++ b/drivers/net/ipa/ipa_endpoint.h @@ -44,10 +44,12 @@ enum ipa_endpoint_name { * enum ipa_replenish_flag: RX buffer replenish flags * * @IPA_REPLENISH_ENABLED: Whether receive buffer replenishing is enabled + * @IPA_REPLENISH_ACTIVE: Whether replenishing is underway * @IPA_REPLENISH_COUNT: Number of defined replenish flags */ enum ipa_replenish_flag { IPA_REPLENISH_ENABLED, + IPA_REPLENISH_ACTIVE, IPA_REPLENISH_COUNT, /* Number of flags (must be last) */ };

3 years

3
2
0 0

[PATCH v3] sched/fair: Fix fault in reweight_entity

by Tadeusz Struk

Syzbot found a GPF in reweight_entity. This has been bisected to commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") There is a race between sched_post_fork() and setpriority(PRIO_PGRP) within a thread group that causes a null-ptr-deref in reweight_entity() in CFS. The scenario is that the main process spawns number of new threads, which then call setpriority(PRIO_PGRP, 0, -20), wait, and exit. For each of the new threads the copy_process() gets invoked, which adds the new task_struct and calls sched_post_fork() for it. In the above scenario there is a possibility that setpriority(PRIO_PGRP) and set_one_prio() will be called for a thread in the group that is just being created by copy_process(), and for which the sched_post_fork() has not been executed yet. This will trigger a null pointer dereference in reweight_entity(), as it will try to access the run queue pointer, which hasn't been set. This results it a crash as shown below: KASAN: null-ptr-deref in range [0x00000000000000a0-0x00000000000000a7] CPU: 0 PID: 2392 Comm: reduced_repro Not tainted 5.16.0-11201-gb42c5a161ea3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014 RIP: 0010:reweight_entity+0x15d/0x440 RSP: 0018:ffffc900035dfcf8 EFLAGS: 00010006 Call Trace: <TASK> reweight_task+0xde/0x1c0 set_load_weight+0x21c/0x2b0 set_user_nice.part.0+0x2d1/0x519 set_user_nice.cold+0x8/0xd set_one_prio+0x24f/0x263 __do_sys_setpriority+0x2d3/0x640 __x64_sys_setpriority+0x84/0x8b do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> ---[ end trace 9dc80a9d378ed00a ]--- Before the mentioned change the cfs_rq pointer for the task has been set in sched_fork(), which is called much earlier in copy_process(), before the new task is added to the thread_group. Now it is done in the sched_post_fork(), which is called after that. To fix the issue the update_load condition passed to set_load_weight() in set_user_nice() and __sched_setscheduler() has been changed from always true to true if the task->state != TASK_NEW. Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Juri Lelli <juri.lelli(a)redhat.com> Cc: Vincent Guittot <vincent.guittot(a)linaro.org> Cc: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: Ben Segall <bsegall(a)google.com> Cc: Mel Gorman <mgorman(a)suse.de> Cc: Daniel Bristot de Oliveira <bristot(a)redhat.com> Cc: Zhang Qiao <zhangqiao22(a)huawei.com> Cc: Daniel Jordan <daniel.m.jordan(a)oracle.com> Cc: stable(a)vger.kernel.org Cc: linux-kernel(a)vger.kernel.org Link: https://syzkaller.appspot.com/bug?id=9d9c27adc674e3a7932b22b61c79a02da82cbd… Fixes: 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") Reported-by: syzbot+af7a719bc92395ee41b3(a)syzkaller.appspotmail.com Signed-off-by: Tadeusz Struk <tadeusz.struk(a)linaro.org> --- Changes in v3: - Removed the new check and changed the update_load condition from always true to true if p->state != TASK_NEW Changes in v2: - Added a check in set_user_nice(), and return from there if the task is not fully setup instead of returning from reweight_entity() --- --- kernel/sched/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 848eaa0efe0e..3d7ede06b971 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -6921,7 +6921,7 @@ void set_user_nice(struct task_struct *p, long nice) put_prev_task(rq, p); p->static_prio = NICE_TO_PRIO(nice); - set_load_weight(p, true); + set_load_weight(p, !(READ_ONCE(p->__state) & TASK_NEW)); old_prio = p->prio; p->prio = effective_prio(p); @@ -7212,7 +7212,7 @@ static void __setscheduler_params(struct task_struct *p, */ p->rt_priority = attr->sched_priority; p->normal_prio = normal_prio(p); - set_load_weight(p, true); + set_load_weight(p, !(READ_ONCE(p->__state) & TASK_NEW)); } /* -- 2.34.1

3 years

2
5
0 0

[PATCH 4.19 000/239] 4.19.226-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.226 release. There are 239 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 26 Jan 2022 18:39:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.226-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.226-rc1 Amir Goldstein <amir73il(a)gmail.com> fuse: fix live lock in fuse_iget() Miklos Szeredi <mszeredi(a)redhat.com> fuse: fix bad inode Ben Hutchings <ben(a)decadent.org.uk> mips,s390,sh,sparc: gup: Work around the "COW can break either way" issue Doyle, Patrick <pdoyle(a)irobot.com> mtd: nand: bbt: Fix corner case in bad block table handling Miaoqian Lin <linmq006(a)gmail.com> lib82596: Fix IRQ check in sni_82596_probe Matthias Schiffer <matthias.schiffer(a)ew.tq-group.com> scripts/dtc: dtx_diff: remove broken example from help text Sergey Shtylyov <s.shtylyov(a)omp.ru> bcmgenet: add WOL IRQ check Kevin Bracey <kevin(a)bracey.fi> net_sched: restore "mpu xxx" handling Tudor Ambarus <tudor.ambarus(a)microchip.com> dmaengine: at_xdmac: Fix at_xdmac_lld struct definition Tudor Ambarus <tudor.ambarus(a)microchip.com> dmaengine: at_xdmac: Fix lld view setting Tudor Ambarus <tudor.ambarus(a)microchip.com> dmaengine: at_xdmac: Print debug message after realeasing the lock Tudor Ambarus <tudor.ambarus(a)microchip.com> dmaengine: at_xdmac: Don't start transactions at tx_submit level Guillaume Nault <gnault(a)redhat.com> libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() Eric Dumazet <edumazet(a)google.com> netns: add schedule point in ops_exit_list() Laurence de Bruxelles <lfdebrux(a)gmail.com> rtc: pxa: fix null pointer dereference Robert Hancock <robert.hancock(a)calian.com> net: axienet: fix number of TX ring slots for available check Robert Hancock <robert.hancock(a)calian.com> net: axienet: Wait for PhyRstCmplt after core reset Eric Dumazet <edumazet(a)google.com> af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress Miaoqian Lin <linmq006(a)gmail.com> parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries Tobias Waldekranz <tobias(a)waldekranz.com> net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module Tobias Waldekranz <tobias(a)waldekranz.com> powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses Anders Roxell <anders.roxell(a)linaro.org> powerpc/cell: Fix clang -Wimplicit-fallthrough warning Amelie Delaunay <amelie.delaunay(a)foss.st.com> dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK Chengguang Xu <cgxu519(a)mykernel.net> RDMA/rxe: Fix a typo in opcode name Yixing Liu <liuyixing1(a)huawei.com> RDMA/hns: Modify the mapping attribute of doorbell to device Lukas Bulwahn <lukas.bulwahn(a)gmail.com> Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization Suresh Udipi <sudipi(a)jp.adit-jv.com> media: rcar-csi2: Optimize the selection PHTW register Ben Hutchings <ben(a)decadent.org.uk> firmware: Update Kconfig help text for Google firmware Tony Lindgren <tony(a)atomide.com> ARM: dts: Fix vcsi regulator to be always-on for droid4 to prevent hangs Christian König <christian.koenig(a)amd.com> drm/radeon: fix error handling in radeon_driver_open_kms Pascal Paillet <p.paillet(a)st.com> regulator: core: Let boot-on regulators be powered off KaiChieh Chuang <kaichieh.chuang(a)mediatek.com> ASoC: dpcm: prevent snd_soc_dpcm use after free Marek Vasut <marex(a)denx.de> crypto: stm32/crc32 - Fix kernel BUG triggered in probe() Theodore Ts'o <tytso(a)mit.edu> ext4: don't use the orphan list when migrating an inode Ye Bin <yebin10(a)huawei.com> ext4: Fix BUG_ON in ext4_bread when write quota data Luís Henriques <lhenriques(a)suse.de> ext4: set csum seed in tmp inode while migrating to extents Jan Kara <jack(a)suse.cz> ext4: make sure quota gets properly shutdown on error Jan Kara <jack(a)suse.cz> ext4: make sure to reset inode lockdep class when quota enabling fails Lucas Stach <l.stach(a)pengutronix.de> drm/etnaviv: limit submit sizes Alexander Gordeev <agordeev(a)linux.ibm.com> s390/mm: fix 2KB pgtable release race Ilan Peer <ilan.peer(a)intel.com> iwlwifi: mvm: Increase the scan timeout guard to 30 seconds Andrey Ryabinin <arbn(a)yandex-team.com> cputime, cpuacct: Include guest time in user time in cpuacct.stat Lukas Wunner <lukas(a)wunner.de> serial: Fix incorrect rs485 polarity on uart open Petr Cvachoucek <cvachoucek(a)gmail.com> ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers Arnaud Pouliquen <arnaud.pouliquen(a)foss.st.com> rpmsg: core: Clean up resources on announce_create failure. Yauhen Kharuzhy <jekhor(a)gmail.com> power: bq25890: Enable continuous conversion for ADC at charging Tzung-Bi Shih <tzungbi(a)google.com> ASoC: mediatek: mt8173: fix device_node leak Christoph Hellwig <hch(a)lst.de> scsi: sr: Don't use GFP_DMA Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> MIPS: Octeon: Fix build errors using clang Lakshmi Sowjanya D <lakshmi.sowjanya.d(a)intel.com> i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters Ye Guojin <ye.guojin(a)zte.com.cn> MIPS: OCTEON: add put_device() after of_find_device_by_node() Hari Bathini <hbathini(a)linux.ibm.com> powerpc: handle kdump appropriately with crash_kexec_post_notifiers option Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Set upper limit of processed events Christophe Leroy <christophe.leroy(a)csgroup.eu> w1: Misuse of get_user()/put_user() reported by sparse Joakim Tjernlund <joakim.tjernlund(a)infinera.com> i2c: mpc: Correct I2C reset procedure Michael Ellerman <mpe(a)ellerman.id.au> powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING Heiner Kallweit <hkallweit1(a)gmail.com> i2c: i801: Don't silently correct invalid transfer size Nicholas Piggin <npiggin(a)gmail.com> powerpc/watchdog: Fix missed watchdog reset due to memory ordering race Julia Lawall <Julia.Lawall(a)lip6.fr> powerpc/btext: add missing of_node_put Julia Lawall <Julia.Lawall(a)lip6.fr> powerpc/cell: add missing of_node_put Julia Lawall <Julia.Lawall(a)lip6.fr> powerpc/powernv: add missing of_node_put Julia Lawall <Julia.Lawall(a)lip6.fr> powerpc/6xx: add missing of_node_put John David Anglin <dave.anglin(a)bell.net> parisc: Avoid calling faulthandler_disabled() twice Lukas Wunner <lukas(a)wunner.de> serial: core: Keep mctrl register state and cached copy in sync Lukas Wunner <lukas(a)wunner.de> serial: pl010: Drop CR register reset on set_termios Konrad Dybcio <konrad.dybcio(a)somainline.org> regulator: qcom_smd: Align probe function with rpmh-regulator Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: gemini: allow any RGMII interface mode Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: phy: marvell: configure RGMII delays for 88E1118 Joe Thornber <ejt(a)redhat.com> dm space map common: add bounds check to sm_ll_lookup_bitmap() Joe Thornber <ejt(a)redhat.com> dm btree: add a defensive bounds check to insert_at() Ping-Ke Shih <pkshih(a)realtek.com> mac80211: allow non-standard VHT MCS-10/11 Florian Fainelli <f.fainelli(a)gmail.com> net: mdio: Demote probed message to debug print Josef Bacik <josef(a)toxicpanda.com> btrfs: remove BUG_ON(!eie) in find_parent_nodes Josef Bacik <josef(a)toxicpanda.com> btrfs: remove BUG_ON() in find_parent_nodes() Thomas Weißschuh <linux(a)weissschuh.net> ACPI: battery: Add the ThinkPad "Not Charging" quirk Zongmin Zhou <zhouzongmin(a)kylinos.cn> drm/amdgpu: fixup bad vram size on gmc v8 Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPICA: Utilities: Avoid deleting the same object twice in a row Mark Langsdorf <mlangsdo(a)redhat.com> ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions Kyeong Yoo <kyeong.yoo(a)alliedtelesis.co.nz> jffs2: GC deadlock reading a page that is used in jffs2_write_begin() Randy Dunlap <rdunlap(a)infradead.org> um: registers: Rename function names to avoid conflicts and build problems Ilan Peer <ilan.peer(a)intel.com> iwlwifi: mvm: Fix calculation of frame length Johannes Berg <johannes.berg(a)intel.com> iwlwifi: remove module loading failure message Johannes Berg <johannes.berg(a)intel.com> iwlwifi: fix leaks/bad data after failed firmware load Zekun Shen <bruceshenzk(a)gmail.com> ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream Kai-Heng Feng <kai.heng.feng(a)canonical.com> usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 Thierry Reding <treding(a)nvidia.com> arm64: tegra: Adjust length of CCPLEX cluster MMIO region Paul Moore <paul(a)paul-moore.com> audit: ensure userspace is penalized the same as the kernel when under pressure Ulf Hansson <ulf.hansson(a)linaro.org> mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO Zhou Qingyang <zhou1615(a)umn.edu> media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() Sean Young <sean(a)mess.org> media: igorplugusb: receiver overflow should be reported Alistair Francis <alistair(a)alistair23.me> HID: quirks: Allow inverting the absolute X/Y values Paolo Abeni <pabeni(a)redhat.com> bpf: Do not WARN in bpf_warn_invalid_xdp_action() Suresh Kumar <surkumar(a)redhat.com> net: bonding: debug: avoid printing debug logs when bond is not notifying peers Borislav Petkov <bp(a)suse.de> x86/mce: Mark mce_read_aux() noinstr Borislav Petkov <bp(a)suse.de> x86/mce: Mark mce_end() noinstr Borislav Petkov <bp(a)suse.de> x86/mce: Mark mce_panic() noinstr Antoine Tenart <atenart(a)kernel.org> net-sysfs: update the queue counts in the unregistration path Sebastian Gottschall <s.gottschall(a)dd-wrt.com> ath10k: Fix tx hanging Johannes Berg <johannes.berg(a)intel.com> iwlwifi: mvm: synchronize with FW after multicast commands Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: m920x: don't use stack on USB reads Zhou Qingyang <zhou1615(a)umn.edu> media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() James Hilliard <james.hilliard1(a)gmail.com> media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. Xiongwei Song <sxwjean(a)gmail.com> floppy: Add max size check for user space request Neal Liu <neal_liu(a)aspeedtech.com> usb: uhci: add aspeed ast2600 uhci support Zekun Shen <bruceshenzk(a)gmail.com> rsi: Fix out-of-bounds read in rsi_read_pkt() Zekun Shen <bruceshenzk(a)gmail.com> mwifiex: Fix skb_over_panic in mwifiex_usb_recv() Chengfeng Ye <cyeaa(a)connect.ust.hk> HSI: core: Fix return freed object in hsi_new_client Hans de Goede <hdegoede(a)redhat.com> gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use Martyn Welch <martyn.welch(a)collabora.com> drm/bridge: megachips: Ensure both bridges are probed before registration Danielle Ratson <danieller(a)nvidia.com> mlxsw: pci: Add shutdown method in PCI driver Lukas Bulwahn <lukas.bulwahn(a)gmail.com> ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART Zheyu Ma <zheyuma97(a)gmail.com> media: b2c2: Add missing check in flexcop_pci_isr: José Expósito <jose.exposito89(a)gmail.com> HID: apple: Do not reset quirks when the Fn key is not found Pavankumar Kondeti <quic_pkondeti(a)quicinc.com> usb: gadget: f_fs: Use stream_open() for endpoint files Ben Skeggs <bskeggs(a)redhat.com> drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR Zekun Shen <bruceshenzk(a)gmail.com> ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply Alexander Aring <aahringo(a)redhat.com> fs: dlm: filter user dlm messages for kernel locks Wei Yongjun <weiyongjun1(a)huawei.com> Bluetooth: Fix debugfs entry leak in hci_register_dev() Kamal Heib <kamalheib1(a)gmail.com> RDMA/cxgb4: Set queue pair state when being queried Randy Dunlap <rdunlap(a)infradead.org> mips: bcm63xx: add support for clk_set_parent() Randy Dunlap <rdunlap(a)infradead.org> mips: lantiq: add support for clk_set_parent() Wei Yongjun <weiyongjun1(a)huawei.com> misc: lattice-ecp3-config: Fix task hung when firmware load failed Jiasheng Jiang <jiasheng(a)iscas.ac.cn> ASoC: samsung: idma: Check of ioremap return value Jiasheng Jiang <jiasheng(a)iscas.ac.cn> ASoC: mediatek: Check for error clk pointer Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/iova: Fix race between FQ timeout and teardown Arnd Bergmann <arnd(a)arndb.de> dmaengine: pxa/mmp: stop referencing config->slave_id Jiasheng Jiang <jiasheng(a)iscas.ac.cn> ASoC: rt5663: Handle device_property_read_u32_array error codes Avihai Horon <avihaih(a)nvidia.com> RDMA/core: Let ib_find_gid() continue search even after empty entry Bart Van Assche <bvanassche(a)acm.org> scsi: ufs: Fix race conditions related to driver data Hector Martin <marcan(a)marcan.st> iommu/io-pgtable-arm: Fix table descriptor paddr formatting Jiasheng Jiang <jiasheng(a)iscas.ac.cn> uio: uio_dmem_genirq: Catch the Exception Kees Cook <keescook(a)chromium.org> char/mwave: Adjust io port register size Bixuan Cui <cuibixuan(a)linux.alibaba.com> ALSA: oss: fix compile error when OSS_DEBUG is enabled Lukas Bulwahn <lukas.bulwahn(a)gmail.com> ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA Peiwei Hu <jlu.hpw(a)foxmail.com> powerpc/prom_init: Fix improper check of prom_getprop() Kamal Heib <kamalheib1(a)gmail.com> RDMA/hns: Validate the pkey index Takashi Iwai <tiwai(a)suse.de> ALSA: hda: Add missing rwsem around snd_ctl_remove() calls Takashi Iwai <tiwai(a)suse.de> ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls Takashi Iwai <tiwai(a)suse.de> ALSA: jack: Add missing rwsem around snd_ctl_remove() calls Jan Kara <jack(a)suse.cz> ext4: avoid trim error on fs with small groups Pavel Skripkin <paskripkin(a)gmail.com> net: mcs7830: handle usb read errors properly Dominik Brodowski <linux(a)dominikbrodowski.net> pcmcia: fix setting of kthread task states Jiasheng Jiang <jiasheng(a)iscas.ac.cn> can: xilinx_can: xcan_probe(): check for error irq Marc Kleine-Budde <mkl(a)pengutronix.de> can: softing: softing_startstop(): fix set but not used variable warning Chen Jun <chenjun102(a)huawei.com> tpm: add request_locality before write TPM_INT_ENABLE Miaoqian Lin <linmq006(a)gmail.com> spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Bluetooth: hci_bcm: Check for error irq Jiasheng Jiang <jiasheng(a)iscas.ac.cn> fsl/fman: Check for null pointer after calling devm_ioremap Jiasheng Jiang <jiasheng(a)iscas.ac.cn> staging: greybus: audio: Check null pointer Eric Dumazet <edumazet(a)google.com> ppp: ensure minimum packet size in ppp_write() Xin Xiong <xiongx18(a)fudan.edu.cn> netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() Zhou Qingyang <zhou1615(a)umn.edu> pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() Zhou Qingyang <zhou1615(a)umn.edu> pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() Zhang Zixun <zhang133010(a)icloud.com> x86/mce/inject: Avoid out-of-bounds write when setting flags Sergey Shtylyov <s.shtylyov(a)omp.ru> mmc: meson-mx-sdio: add IRQ check Marek Behún <kabel(a)kernel.org> ARM: dts: armada-38x: Add generic compatible to UART nodes Wei Yongjun <weiyongjun1(a)huawei.com> usb: ftdi-elan: fix memory leak on device disconnect Antony Antony <antony.antony(a)secunet.com> xfrm: state and policy should fail if XFRMA_IF_ID 0 Antony Antony <antony.antony(a)secunet.com> xfrm: interface with if_id 0 should return error Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: fix safe status debugfs file Jiasheng Jiang <jiasheng(a)iscas.ac.cn> media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes Wang Hai <wanghai38(a)huawei.com> media: msi001: fix possible null-ptr-deref in msi001_probe() Anton Vasilyev <vasilyev(a)ispras.ru> media: dw2102: Fix use after free Nicolas Toromanoff <nicolas.toromanoff(a)foss.st.com> crypto: stm32/cryp - fix double pm exit Eric Dumazet <edumazet(a)google.com> xfrm: fix a small bug in xfrm_sa_len() Li Hua <hucool.lihua(a)huawei.com> sched/rt: Try to restart rt period timer when rt runtime exceeded Robert Schlabbach <robert_s(a)gmx.net> media: si2157: Fix "warm" tuner state detection Zhou Qingyang <zhou1615(a)umn.edu> media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() Zhou Qingyang <zhou1615(a)umn.edu> media: dib8000: Fix a memleak in dib8000_init() Tasos Sahanidis <tasos(a)tasossah.com> floppy: Fix hang in watchdog when disk is ejected Lino Sanfilippo <LinoSanfilippo(a)gmx.de> serial: amba-pl011: do not request memory region twice Lizhi Hou <lizhi.hou(a)xilinx.com> tty: serial: uartlite: allow 64 bit address Zhou Qingyang <zhou1615(a)umn.edu> drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() Zhou Qingyang <zhou1615(a)umn.edu> drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> arm64: dts: qcom: msm8916: fix MMC controller aliases Florian Westphal <fw(a)strlen.de> netfilter: bridge: add support for pppoe filtering Dafna Hirschfeld <dafna.hirschfeld(a)collabora.com> media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released Yang Yingliang <yangyingliang(a)huawei.com> media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() Suresh Udipi <sudipi(a)jp.adit-jv.com> media: rcar-csi2: Correct the selection of hsfreqrange Tudor Ambarus <tudor.ambarus(a)microchip.com> tty: serial: atmel: Call dma_async_issue_pending() Tudor Ambarus <tudor.ambarus(a)microchip.com> tty: serial: atmel: Check return code of dmaengine_submit() Chengfeng Ye <cyeaa(a)connect.ust.hk> crypto: qce - fix uaf on qce_ahash_register_one Wang Hai <wanghai38(a)huawei.com> media: dmxdev: fix UAF when dvb_register_device() fails Jens Wiklander <jens.wiklander(a)linaro.org> tee: fix put order in teedev_close_context() Pavel Skripkin <paskripkin(a)gmail.com> Bluetooth: stop proccessing malicious adv data Christian Hewitt <christianshewitt(a)gmail.com> arm64: dts: meson-gxbb-wetek: fix missing GPIO binding Dongliang Mu <mudongliangabcd(a)gmail.com> media: em28xx: fix memory leak in em28xx_init_dev Dillon Min <dillon.minfei(a)gmail.com> media: videobuf2: Fix the size printk format Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> wcn36xx: Release DMA channel descriptor allocations Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND Maxime Ripard <maxime(a)cerno.tech> clk: bcm-2835: Remove rounding up the dividers Maxime Ripard <maxime(a)cerno.tech> clk: bcm-2835: Pick the closest clock rate Wang Hai <wanghai38(a)huawei.com> Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Brian Norris <briannorris(a)chromium.org> drm/panel: innolux-p079zca: Delete panel on attach() failure Gang Li <ligang.bdlg(a)bytedance.com> shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode Yifeng Li <tomli(a)tomli.me> PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller Christophe Leroy <christophe.leroy(a)csgroup.eu> lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() Johan Hovold <johan(a)kernel.org> can: softing_cs: softingcs_probe(): fix memleak on registration failure Johan Hovold <johan(a)kernel.org> media: stk1160: fix control-message timeouts Johan Hovold <johan(a)kernel.org> media: pvrusb2: fix control-message timeouts Johan Hovold <johan(a)kernel.org> media: redrat3: fix control-message timeouts Michael Kuron <michael.kuron(a)gmail.com> media: dib0700: fix undefined behavior in tuner shutdown Johan Hovold <johan(a)kernel.org> media: s2255: fix control-message timeouts Johan Hovold <johan(a)kernel.org> media: cpia2: fix control-message timeouts Johan Hovold <johan(a)kernel.org> media: em28xx: fix control-message timeouts Johan Hovold <johan(a)kernel.org> media: mceusb: fix control-message timeouts Johan Hovold <johan(a)kernel.org> media: flexcop-usb: fix control-message timeouts Mateusz Jończyk <mat.jonczyk(a)o2.pl> rtc: cmos: take rtc_lock while reading from CMOS Lucas De Marchi <lucas.demarchi(a)intel.com> x86/gpu: Reserve stolen memory for first integrated Intel GPU Stefan Riedmueller <s.riedmueller(a)phytec.de> mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check in is_alive() Jason Gerecke <killertofu(a)gmail.com> HID: wacom: Avoid using stale array indicies to read contact count Jason Gerecke <killertofu(a)gmail.com> HID: wacom: Ignore the confidence flag when a touch is removed Jason Gerecke <killertofu(a)gmail.com> HID: wacom: Reset expected and received contact counts at the same time Jann Horn <jannh(a)google.com> HID: uhid: Fix worker destroying device without any protection Christian Lachner <gladiac(a)gmail.com> ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows Johan Hovold <johan(a)kernel.org> firmware: qemu_fw_cfg: fix kobject leak in probe error path Johan Hovold <johan(a)kernel.org> firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries Johan Hovold <johan(a)kernel.org> firmware: qemu_fw_cfg: fix sysfs information leak Larry Finger <Larry.Finger(a)lwfinger.net> rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled Johan Hovold <johan(a)kernel.org> media: uvcvideo: fix division by zero at stream start Eric Farman <farman(a)linux.ibm.com> KVM: s390: Clarify SIGP orders versus STOP/RESTART Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() Nathan Chancellor <nathan(a)kernel.org> kbuild: Add $(KBUILD_HOSTLDFLAGS) to 'has_libelf' test Nathan Chancellor <nathan(a)kernel.org> drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() Nathan Chancellor <nathan(a)kernel.org> staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn() Eric Biggers <ebiggers(a)google.com> random: fix data race on crng init time Eric Biggers <ebiggers(a)google.com> random: fix data race on crng_node_pool Brian Silverman <brian.silverman(a)bluerivertech.com> can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() Daniel Borkmann <daniel(a)iogearbox.net> veth: Do not record rx queue hint in veth_xmit Thomas Gleixner <tglx(a)linutronix.de> can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet Alan Stern <stern(a)rowland.harvard.edu> USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status Alan Stern <stern(a)rowland.harvard.edu> USB: core: Fix bug in resuming hub's handling of wakeup requests Johan Hovold <johan(a)kernel.org> Bluetooth: bfusb: fix division by zero in send path ------------- Diffstat: Documentation/admin-guide/hw-vuln/spectre.rst | 2 +- Makefile | 6 +- arch/arm/Kconfig.debug | 14 +- arch/arm/boot/dts/armada-38x.dtsi | 4 +- arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi | 4 +- arch/arm/include/debug/imx-uart.h | 18 +- arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 1 + arch/arm64/boot/dts/nvidia/tegra186.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +- arch/mips/bcm63xx/clk.c | 6 + arch/mips/cavium-octeon/octeon-platform.c | 2 + arch/mips/cavium-octeon/octeon-usb.c | 1 + arch/mips/include/asm/octeon/cvmx-bootinfo.h | 4 +- arch/mips/lantiq/clk.c | 6 + arch/mips/mm/gup.c | 9 +- arch/parisc/kernel/traps.c | 2 +- arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi | 2 + arch/powerpc/kernel/btext.c | 4 +- arch/powerpc/kernel/prom_init.c | 2 +- arch/powerpc/kernel/smp.c | 32 ++ arch/powerpc/kernel/watchdog.c | 41 ++- arch/powerpc/platforms/cell/iommu.c | 1 + arch/powerpc/platforms/cell/pervasive.c | 1 + arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 1 + arch/powerpc/platforms/powernv/opal-lpc.c | 1 + arch/s390/kvm/interrupt.c | 7 + arch/s390/kvm/kvm-s390.c | 9 +- arch/s390/kvm/kvm-s390.h | 1 + arch/s390/kvm/sigp.c | 28 ++ arch/s390/mm/gup.c | 9 +- arch/s390/mm/pgalloc.c | 4 +- arch/sh/mm/gup.c | 9 +- arch/sparc/mm/gup.c | 9 +- arch/um/include/shared/registers.h | 4 +- arch/um/os-Linux/registers.c | 4 +- arch/um/os-Linux/start_up.c | 2 +- arch/x86/kernel/cpu/mcheck/mce-inject.c | 2 +- arch/x86/kernel/cpu/mcheck/mce.c | 31 +- arch/x86/kernel/early-quirks.c | 10 +- arch/x86/um/syscalls_64.c | 3 +- drivers/acpi/acpica/exoparg1.c | 3 +- drivers/acpi/acpica/hwesleep.c | 4 +- drivers/acpi/acpica/hwsleep.c | 4 +- drivers/acpi/acpica/hwxfsleep.c | 2 - drivers/acpi/acpica/utdelete.c | 1 + drivers/acpi/battery.c | 22 ++ drivers/block/floppy.c | 6 +- drivers/bluetooth/bfusb.c | 3 + drivers/bluetooth/hci_bcm.c | 7 +- drivers/char/mwave/3780i.h | 2 +- drivers/char/random.c | 61 ++-- drivers/char/tpm/tpm_tis_core.c | 8 + drivers/clk/bcm/clk-bcm2835.c | 13 +- drivers/crypto/qce/sha.c | 2 +- drivers/crypto/stm32/stm32-cryp.c | 2 - drivers/crypto/stm32/stm32_crc32.c | 4 +- drivers/dma/at_xdmac.c | 32 +- drivers/dma/mmp_pdma.c | 6 - drivers/dma/pxa_dma.c | 7 - drivers/dma/stm32-mdma.c | 2 +- drivers/firmware/google/Kconfig | 6 +- drivers/firmware/qemu_fw_cfg.c | 20 +- drivers/gpio/gpiolib-acpi.c | 15 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 6 + drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 13 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 40 ++- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 6 + drivers/gpu/drm/i915/intel_pm.c | 6 +- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 37 ++- drivers/gpu/drm/panel/panel-innolux-p079zca.c | 10 +- drivers/gpu/drm/radeon/radeon_kms.c | 42 +-- drivers/hid/hid-apple.c | 2 +- drivers/hid/hid-input.c | 6 + drivers/hid/uhid.c | 29 +- drivers/hid/wacom_wac.c | 39 ++- drivers/hsi/hsi_core.c | 1 + drivers/i2c/busses/i2c-designware-pcidrv.c | 8 +- drivers/i2c/busses/i2c-i801.c | 15 +- drivers/i2c/busses/i2c-mpc.c | 23 +- drivers/infiniband/core/device.c | 3 +- drivers/infiniband/hw/cxgb4/qp.c | 1 + drivers/infiniband/hw/hns/hns_roce_main.c | 5 +- drivers/infiniband/sw/rxe/rxe_opcode.c | 2 +- drivers/iommu/io-pgtable-arm.c | 9 +- drivers/iommu/iova.c | 3 +- drivers/md/persistent-data/dm-btree.c | 8 +- drivers/md/persistent-data/dm-space-map-common.c | 5 + drivers/media/common/saa7146/saa7146_fops.c | 2 +- .../media/common/videobuf2/videobuf2-dma-contig.c | 8 +- drivers/media/dvb-core/dmxdev.c | 18 +- drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/pci/b2c2/flexcop-pci.c | 3 + drivers/media/pci/saa7146/hexium_gemini.c | 7 +- drivers/media/pci/saa7146/hexium_orion.c | 8 +- drivers/media/pci/saa7146/mxb.c | 8 +- drivers/media/platform/coda/imx-vdoa.c | 6 +- .../media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 2 +- drivers/media/platform/rcar-vin/rcar-csi2.c | 18 +- drivers/media/radio/si470x/radio-si470x-i2c.c | 3 +- drivers/media/rc/igorplugusb.c | 4 +- drivers/media/rc/mceusb.c | 8 +- drivers/media/rc/redrat3.c | 22 +- drivers/media/tuners/msi001.c | 7 + drivers/media/tuners/si2157.c | 2 +- drivers/media/usb/b2c2/flexcop-usb.c | 10 +- drivers/media/usb/b2c2/flexcop-usb.h | 12 +- drivers/media/usb/cpia2/cpia2_usb.c | 4 +- drivers/media/usb/dvb-usb/dib0700_core.c | 2 - drivers/media/usb/dvb-usb/dw2102.c | 338 +++++++++++++-------- drivers/media/usb/dvb-usb/m920x.c | 12 +- drivers/media/usb/em28xx/em28xx-cards.c | 18 +- drivers/media/usb/em28xx/em28xx-core.c | 4 +- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 +- drivers/media/usb/s2255/s2255drv.c | 4 +- drivers/media/usb/stk1160/stk1160-core.c | 4 +- drivers/media/usb/uvc/uvc_video.c | 4 + drivers/media/usb/uvc/uvcvideo.h | 2 +- drivers/mfd/intel-lpss-acpi.c | 7 +- drivers/misc/lattice-ecp3-config.c | 12 +- drivers/misc/lkdtm/Makefile | 2 +- drivers/mmc/core/sdio.c | 4 +- drivers/mmc/host/meson-mx-sdio.c | 5 + drivers/mtd/nand/bbt.c | 2 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 9 - drivers/net/bonding/bond_main.c | 6 +- drivers/net/can/softing/softing_cs.c | 2 +- drivers/net/can/softing/softing_fw.c | 11 +- drivers/net/can/usb/gs_usb.c | 5 +- drivers/net/can/xilinx_can.c | 7 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 10 +- drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | 3 +- drivers/net/ethernet/cortina/gemini.c | 9 +- drivers/net/ethernet/freescale/fman/mac.c | 21 +- drivers/net/ethernet/freescale/xgmac_mdio.c | 3 +- drivers/net/ethernet/i825xx/sni_82596.c | 3 +- drivers/net/ethernet/mellanox/mlxsw/pci.c | 1 + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 14 +- drivers/net/phy/marvell.c | 6 + drivers/net/phy/mdio_bus.c | 2 +- drivers/net/ppp/ppp_generic.c | 7 +- drivers/net/usb/mcs7830.c | 12 +- drivers/net/veth.c | 1 - drivers/net/wireless/ath/ar5523/ar5523.c | 4 + drivers/net/wireless/ath/ath10k/htt_tx.c | 3 + drivers/net/wireless/ath/ath10k/txrx.c | 2 - drivers/net/wireless/ath/ath9k/hif_usb.c | 7 + drivers/net/wireless/ath/wcn36xx/dxe.c | 5 + drivers/net/wireless/ath/wcn36xx/smd.c | 4 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 17 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 17 ++ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 27 ++ drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- drivers/net/wireless/marvell/mwifiex/usb.c | 3 +- .../net/wireless/realtek/rtlwifi/rtl8192cu/hw.c | 1 + drivers/net/wireless/rsi/rsi_91x_main.c | 4 + drivers/net/wireless/rsi/rsi_91x_usb.c | 1 - drivers/net/wireless/rsi/rsi_usb.h | 2 + drivers/parisc/pdc_stable.c | 4 +- drivers/pci/quirks.c | 3 + drivers/pcmcia/cs.c | 8 +- drivers/pcmcia/rsrc_nonstatic.c | 6 + drivers/power/supply/bq25890_charger.c | 4 +- drivers/regulator/core.c | 4 +- drivers/regulator/qcom_smd-regulator.c | 100 ++++-- drivers/rpmsg/rpmsg_core.c | 20 +- drivers/rtc/rtc-cmos.c | 3 + drivers/rtc/rtc-pxa.c | 4 + drivers/scsi/sr.c | 2 +- drivers/scsi/sr_vendor.c | 4 +- drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 - drivers/scsi/ufs/ufshcd-pltfrm.c | 2 - drivers/scsi/ufs/ufshcd.c | 7 + drivers/soc/mediatek/mtk-scpsys.c | 15 +- drivers/spi/spi-meson-spifc.c | 1 + drivers/staging/greybus/audio_topology.c | 15 + drivers/staging/wlan-ng/hfa384x_usb.c | 22 +- drivers/tee/tee_core.c | 4 +- drivers/tty/serial/amba-pl010.c | 3 - drivers/tty/serial/amba-pl011.c | 27 +- drivers/tty/serial/atmel_serial.c | 14 + drivers/tty/serial/serial_core.c | 7 +- drivers/tty/serial/uartlite.c | 2 +- drivers/uio/uio_dmem_genirq.c | 6 +- drivers/usb/core/hcd.c | 9 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_fs.c | 4 +- drivers/usb/host/uhci-platform.c | 3 +- drivers/usb/misc/ftdi-elan.c | 1 + drivers/w1/slaves/w1_ds28e04.c | 26 +- fs/btrfs/backref.c | 21 +- fs/dlm/lock.c | 9 + fs/ext4/ioctl.c | 2 - fs/ext4/mballoc.c | 8 + fs/ext4/migrate.c | 23 +- fs/ext4/super.c | 25 +- fs/f2fs/gc.c | 3 + fs/fuse/acl.c | 6 + fs/fuse/dir.c | 40 ++- fs/fuse/file.c | 27 +- fs/fuse/fuse_i.h | 13 + fs/fuse/inode.c | 2 +- fs/fuse/xattr.c | 9 + fs/jffs2/file.c | 40 ++- fs/orangefs/orangefs-bufmap.c | 7 +- fs/ubifs/super.c | 1 - include/acpi/actypes.h | 10 +- include/linux/hid.h | 2 + include/net/sch_generic.h | 5 + include/sound/soc.h | 2 + kernel/audit.c | 18 +- kernel/sched/cputime.c | 4 +- kernel/sched/rt.c | 23 +- mm/shmem.c | 37 ++- net/bluetooth/cmtp/core.c | 4 +- net/bluetooth/hci_core.c | 1 + net/bluetooth/hci_event.c | 8 +- net/bridge/br_netfilter_hooks.c | 7 +- net/can/bcm.c | 156 ++++------ net/core/filter.c | 6 +- net/core/net-sysfs.c | 3 + net/core/net_namespace.c | 4 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +- net/mac80211/rx.c | 2 +- net/nfc/llcp_sock.c | 5 + net/sched/sch_generic.c | 1 + net/unix/garbage.c | 14 +- net/unix/scm.c | 6 +- net/xfrm/xfrm_interface.c | 14 +- net/xfrm/xfrm_user.c | 23 +- scripts/dtc/dtx_diff | 8 +- sound/core/jack.c | 3 + sound/core/oss/pcm_oss.c | 2 +- sound/core/pcm.c | 6 +- sound/core/seq/seq_queue.c | 14 +- sound/pci/hda/hda_codec.c | 3 + sound/pci/hda/patch_realtek.c | 30 +- sound/soc/codecs/rt5663.c | 12 +- sound/soc/mediatek/mt8173/mt8173-max98090.c | 3 + sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c | 2 + sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 2 + sound/soc/mediatek/mt8173/mt8173-rt5650.c | 2 + sound/soc/samsung/idma.c | 2 + sound/soc/soc-core.c | 1 + sound/soc/soc-pcm.c | 40 ++- sound/soc/uniphier/Kconfig | 2 - 246 files changed, 1866 insertions(+), 872 deletions(-)

3 years

9
253
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror January 2022