October 2023 - Linux-stable-mirror

[PATCH 4.14] net/sched: sch_hfsc: Ensure inner classes have fsc curve

by Shaoying Xu

From: Budimir Markovic <markovicbudimir(a)gmail.com> [ Upstream commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f ] HFSC assumes that inner classes have an fsc curve, but it is currently possible for classes without an fsc curve to become parents. This leads to bugs including a use-after-free. Don't allow non-root classes without HFSC_FSC to become parents. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Budimir Markovic <markovicbudimir(a)gmail.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://lore.kernel.org/r/20230824084905.422-1-markovicbudimir@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> [ v4.14: Delete NL_SET_ERR_MSG because extack is not added to hfsc_change_class ] Cc: <stable(a)vger.kernel.org> # 4.14 Signed-off-by: Shaoying Xu <shaoyi(a)amazon.com> --- net/sched/sch_hfsc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c index 3f88b75488b0..3a43abe4d9c4 100644 --- a/net/sched/sch_hfsc.c +++ b/net/sched/sch_hfsc.c @@ -1020,6 +1020,8 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, if (parent == NULL) return -ENOENT; } + if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) + return -EINVAL; if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0) return -EINVAL; -- 2.40.1

2 years

3
3
0 0

[PATCH 4.19 000/323] 4.19.291-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.291 release. There are 323 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 11 Aug 2023 10:36:10 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.291-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.291-rc1 Dinh Nguyen <dinguyen(a)kernel.org> arm64: dts: stratix10: fix incorrect I2C property for SCL signal Joe Perches <joe(a)perches.com> drivers core: Use sysfs_emit and sysfs_emit_at for show(device *...) functions Xu Yang <xu.yang_2(a)nxp.com> ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node Andreas Kemnade <andreas(a)kemnade.info> ARM: dts: imx6sll: fixup of operating points Peng Fan <peng.fan(a)nxp.com> ARM: dts: imx: add usb alias Shengjiu Wang <shengjiu.wang(a)nxp.com> ARM: dts: imx6sll: Make ssi node name same as other platforms Johan Hovold <johan+linaro(a)kernel.org> PM: sleep: wakeirq: fix wake irq arming Chunfeng Yun <chunfeng.yun(a)mediatek.com> PM / wakeirq: support enabling wake-up irq after runtime_suspend called Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> powerpc/mm/altmap: Fix altmap boundary check Roger Quadros <rogerq(a)kernel.org> mtd: rawnand: omap_elm: Fix incorrect type in assignment Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr> test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr> test_firmware: fix a memory leak with reqs buffer Jan Kara <jack(a)suse.cz> ext2: Drop fragment support Alan Stern <stern(a)rowland.harvard.edu> net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb Sungwoo Kim <iam(a)sung-woo.kim> Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb Prince Kumar Maurya <princekumarmaurya06(a)gmail.com> fs/sysv: Null check to prevent null-ptr-deref bug Ross Maynard <bids.7405(a)bigpond.com> USB: zaurus: Add ID for A-300/B-500/C-700 Ilya Dryomov <idryomov(a)gmail.com> libceph: fix potential hang in ceph_osdc_notify() Steffen Maier <maier(a)linux.ibm.com> scsi: zfcp: Defer fc_rport blocking until after ADISC response Eric Dumazet <edumazet(a)google.com> tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen Eric Dumazet <edumazet(a)google.com> tcp_metrics: annotate data-races around tm->tcpm_net Eric Dumazet <edumazet(a)google.com> tcp_metrics: annotate data-races around tm->tcpm_vals[] Eric Dumazet <edumazet(a)google.com> tcp_metrics: annotate data-races around tm->tcpm_lock Eric Dumazet <edumazet(a)google.com> tcp_metrics: annotate data-races around tm->tcpm_stamp Eric Dumazet <edumazet(a)google.com> tcp_metrics: fix addr_same() helper Yue Haibing <yuehaibing(a)huawei.com> ip6mr: Fix skb_under_panic in ip6mr_cache_report() valis <sec(a)valis.email> net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free valis <sec(a)valis.email> net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free Eric Dumazet <edumazet(a)google.com> net: add missing data-race annotation for sk_ll_usec Eric Dumazet <edumazet(a)google.com> net: add missing data-race annotations around sk->sk_peek_off Jamal Hadi Salim <jhs(a)mojatatu.com> net: sched: cls_u32: Fix match key mis-addressing Georg Müller <georgmueller(a)gmx.net> perf test uprobe_from_different_cu: Skip if there is no gcc Yuanjun Gong <ruc_gongyuanjun(a)163.com> net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() Heiko Carstens <hca(a)linux.ibm.com> KVM: s390: fix sthyi error handling ndesaulniers(a)google.com <ndesaulniers(a)google.com> word-at-a-time: use the same return type for has_zero regardless of endianness Bart Van Assche <bvanassche(a)acm.org> loop: Select I/O scheduler 'none' from inside add_disk() Peter Zijlstra <peterz(a)infradead.org> perf: Fix function pointer case Lee Jones <lee(a)kernel.org> net/sched: cls_u32: Fix reference counter leak leading to overflow Thomas Petazzoni <thomas.petazzoni(a)bootlin.com> ASoC: cs42l51: fix driver to properly autoload with automatic module loading Pedro Tammela <pctammela(a)mojatatu.com> net/sched: sch_qfq: account for stab overhead in qfq_enqueue M A Ramdhan <ramdhan(a)starlabs.sg> net/sched: cls_fw: Fix improper refcount update leads to use-after-free Jocelyn Falempe <jfalempe(a)redhat.com> drm/client: Fix memory leak in drm_client_target_cloned Joe Thornber <ejt(a)redhat.com> dm cache policy smq: ensure IO doesn't prevent cleaner policy progress Mark Brown <broonie(a)kernel.org> ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: fix hanging device after quiesce/resume Jason Wang <jasowang(a)redhat.com> virtio-net: fix race between set queues and probe Ruihong Luo <colorsu1922(a)gmail.com> serial: 8250_dw: Preserve original value of DLF register Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_dw: split Synopsys DesignWare 8250 common functions Jonas Gorski <jonas.gorski(a)gmail.com> irq-bcm6345-l1: Do not assume a fixed block to cpu mapping Alexander Steffen <Alexander.Steffen(a)infineon.com> tpm_tis: Explicitly check for error code Filipe Manana <fdmanana(a)suse.com> btrfs: check for commit error at btrfs_attach_transaction_barrier() Gilles Buloz <Gilles.Buloz(a)kontron.com> hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled Zhang Shurong <zhang_shurong(a)foxmail.com> staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Documentation: security-bugs.rst: clarify CVE handling Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group Ricardo Ribalda <ribalda(a)chromium.org> usb: xhci-mtk: set the dma max_seg_size Łukasz Bartosik <lb(a)semihalf.com> USB: quirks: add quirk for Focusrite Scarlett Guiting Shen <aarongt.shen(a)gmail.com> usb: ohci-at91: Fix the unhandle interrupt when resume Jisheng Zhang <jszhang(a)kernel.org> usb: dwc3: don't reset device side if dwc3 was configured as host-only Gratian Crisan <gratian.crisan(a)ni.com> usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy Jakub Vanek <linuxtardis(a)gmail.com> Revert "usb: dwc3: core: Enable AutoRetry feature in the controller" Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED Johan Hovold <johan(a)kernel.org> USB: serial: simple: sort driver entries Oliver Neukum <oneukum(a)suse.com> USB: serial: simple: add Kaufmann RKS+CAN VCP Mohsen Tahmasebi <moh53n(a)moh53n.ir> USB: serial: option: add Quectel EC200A module support Jerry Meng <jerry-meng(a)foxmail.com> USB: serial: option: support Quectel EM060K_128 Zheng Yejian <zhengyejian1(a)huawei.com> tracing: Fix warning in trace_buffered_event_disable() Zheng Yejian <zhengyejian1(a)huawei.com> ring-buffer: Fix wrong stat of cpu_buffer->read Arnd Bergmann <arnd(a)arndb.de> ata: pata_ns87415: mark ns87560_tf_read static Yu Kuai <yukuai3(a)huawei.com> dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths Bart Van Assche <bvanassche(a)acm.org> block: Fix a source code comment in include/uapi/linux/blkzoned.h Matus Gajdos <matuszpd(a)gmail.com> ASoC: fsl_spdif: Silence output on stop Gaosheng Cui <cuigaosheng1(a)huawei.com> drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() Dan Carpenter <dan.carpenter(a)linaro.org> RDMA/mlx4: Make check for invalid flags stricter Yuanjun Gong <ruc_gongyuanjun(a)163.com> benet: fix return value check in be_lancer_xmit_workarounds() Lin Ma <linma(a)zju.edu.cn> net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: mqprio: add extack to mqprio_parse_nlattr() Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: mqprio: refactor nlattr parsing to a separate function Maxim Mikityanskiy <maxtram95(a)gmail.com> platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 Hangbin Liu <liuhangbin(a)gmail.com> team: reset team's flags when down link is P2P device Hangbin Liu <liuhangbin(a)gmail.com> bonding: reset bond's flags when down link is P2P device Stewart Smith <trawets(a)amazon.com> tcp: Reduce chance of collisions in inet6_hashfn(). Maciej Żenczykowski <maze(a)google.com> ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address Yuanjun Gong <ruc_gongyuanjun(a)163.com> ethernet: atheros: fix return value check in atl1e_tso_csum() Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() Wang Ming <machel(a)vivo.com> i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() Chao Yu <chao(a)kernel.org> ext4: fix to check return value of freeze_bdev() in ext4_shutdown() Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Array index may go out of bound Ye Bin <yebin10(a)huawei.com> scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c Zheng Yejian <zhengyejian1(a)huawei.com> ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() Linus Torvalds <torvalds(a)linux-foundation.org> ftrace: Store the order of pages allocated in ftrace_page Steven Rostedt (VMware) <rostedt(a)goodmis.org> ftrace: Check if pages were allocated before calling free_pages() Steven Rostedt (VMware) <rostedt(a)goodmis.org> ftrace: Add information on number of page groups allocated Alexander Aring <aahringo(a)redhat.com> fs: dlm: interrupt posix locks only when process is killed Alexander Aring <aahringo(a)redhat.com> dlm: rearrange async condition return Alexander Aring <aahringo(a)redhat.com> dlm: cleanup plock_op vs plock_xop Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> PCI/ASPM: Avoid link retraining race Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> PCI/ASPM: Factor out pcie_wait_for_retrain() Bjorn Helgaas <bhelgaas(a)google.com> PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link() Stefan Mätje <stefan.maetje(a)esd.eu> PCI: Rework pcie_retrain_link() wait loop Zhihao Cheng <chengzhihao1(a)huawei.com> ext4: Fix reusing stale buffer heads from last failed mounting Chunguang Xu <brookxu(a)tencent.com> ext4: rename journal_dev to s_journal_dev inside ext4_sb_info Filipe Manana <fdmanana(a)suse.com> btrfs: fix extent buffer leak after tree mod log failure at split_node() Zheng Wang <zyytlz.wz(a)163.com> bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent Coly Li <colyli(a)suse.de> bcache: remove 'int n' from parameter list of bch_bucket_alloc_set() Shenghui Wang <shhuiw(a)foxmail.com> bcache: use MAX_CACHES_PER_SET instead of magic number 8 in __bch_bucket_alloc_set Hans de Goede <hdegoede(a)redhat.com> gpio: tps68470: Make tps68470_gpio_output() always set the initial value Mohamed Khalfella <mkhalfella(a)purestorage.com> tracing/histograms: Return an error if we fail to add histogram to hist_vars list Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around fastopenq.max_qlen Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around tp->notsent_lowat Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around rskq_defer_accept Eric Dumazet <edumazet(a)google.com> tcp: annotate data-races around tp->linger2 Cambda Zhu <cambda(a)linux.alibaba.com> net: Replace the limit of TCP_LINGER2 with TCP_FIN_TIMEOUT_MAX Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: can't schedule in nft_chain_validate Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: fix spurious set element insertion failure Kuniyuki Iwashima <kuniyu(a)amazon.com> llc: Don't drop packet from non-root netns. Zhang Shurong <zhang_shurong(a)foxmail.com> fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe Kuniyuki Iwashima <kuniyu(a)amazon.com> Revert "tcp: avoid the lookup process failing to get sk in ehash table" Yuanjun Gong <ruc_gongyuanjun(a)163.com> net:ipv6: check return value of pskb_trim() Tanmay Patil <t-patil(a)ti.com> net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() Mario Limonciello <mario.limonciello(a)amd.com> pinctrl: amd: Use amd_pinconf_set() for all config options Martin Kaiser <martin(a)kaiser.cx> fbdev: imxfb: warn about invalid left/right margin Jonas Gorski <jonas.gorski(a)gmail.com> spi: bcm63xx: fix max prepend length Ying Hsu <yinghsu(a)chromium.org> igb: Fix igb_down hung on surprise removal Johannes Berg <johannes.berg(a)intel.com> wifi: iwlwifi: mvm: avoid baid size integer overflow Gustavo A. R. Silva <gustavoars(a)kernel.org> wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() Martin KaFai Lau <martin.lau(a)kernel.org> bpf: Address KCSAN report on bpf_lru_list Yicong Yang <yangyicong(a)hisilicon.com> sched/fair: Don't balance task to its current running CPU Thomas Gleixner <tglx(a)linutronix.de> posix-timers: Ensure timer ID search-loop limit is valid Yu Kuai <yukuai3(a)huawei.com> md/raid10: prevent soft lockup while flush writes Yu Kuai <yukuai3(a)huawei.com> md: fix data corruption for raid456 when reshape restart while grow up Zhong Jinghua <zhongjinghua(a)huawei.com> nbd: Add the maximum limit of allocated index in nbd_dev_add Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> debugobjects: Recheck debug_objects_enabled before reporting Eric Whitney <enwlinux(a)gmail.com> ext4: correct inline offset when handling xattrs in inode body YueHaibing <yuehaibing(a)huawei.com> can: bcm: Fix UAF in bcm_proc_show() Miklos Szeredi <mszeredi(a)redhat.com> fuse: revalidate: don't invalidate if interrupted Georg Müller <georgmueller(a)gmx.net> perf probe: Add test for regression introduced by switch to die_get_decl_file() Mohamed Khalfella <mkhalfella(a)purestorage.com> tracing/histograms: Add histograms to hist_vars if they have referenced variables Daniel Vetter <daniel.vetter(a)ffwll.ch> drm/atomic: Fix potential use-after-free in nonblocking commits Shreyas Deodhar <sdeodhar(a)marvell.com> scsi: qla2xxx: Pointer may be dereferenced Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() Bikash Hazarika <bhazarika(a)marvell.com> scsi: qla2xxx: Fix potential NULL pointer dereference Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Wait for io return on terminate rport Max Filippov <jcmvbkbc(a)gmail.com> xtensa: ISS: fix call to split_if_spec Zheng Yejian <zhengyejian1(a)huawei.com> ring-buffer: Fix deadloop issue on reading trace_pipe Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error Jiaqing Zhao <jiaqing.zhao(a)linux.intel.com> Revert "8250: add support for ASIX devices with a FIFO bug" George Stark <gnstark(a)sberdevices.ru> meson saradc: fix clock divider mask length Xiubo Li <xiubli(a)redhat.com> ceph: don't let check_caps skip sending responses for revoke msgs Martin Kaiser <martin(a)kaiser.cx> hwrng: imx-rngc - fix the timeout for init and self check Dan Carpenter <dan.carpenter(a)linaro.org> serial: atmel: don't enable IRQs prematurely Alexander Aring <aahringo(a)redhat.com> fs: dlm: return positive pid value for F_GETLK Jason Baron <jbaron(a)akamai.com> md/raid0: add discard support for the 'original' layout Damien Le Moal <dlemoal(a)kernel.org> misc: pci_endpoint_test: Re-init completion for every test Damien Le Moal <dlemoal(a)kernel.org> misc: pci_endpoint_test: Free IRQs before removing the device Rick Wertenbroek <rick.wertenbroek(a)gmail.com> PCI: rockchip: Use u32 variable to access 32-bit registers Rick Wertenbroek <rick.wertenbroek(a)gmail.com> PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core Rick Wertenbroek <rick.wertenbroek(a)gmail.com> PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked Rick Wertenbroek <rick.wertenbroek(a)gmail.com> PCI: rockchip: Write PCI Device ID to correct register Rick Wertenbroek <rick.wertenbroek(a)gmail.com> PCI: rockchip: Assert PCI Configuration Enable bit after probe Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> PCI: qcom: Disable write access to read only registers for IP v2.3.3 Robin Murphy <robin.murphy(a)arm.com> PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 Ondrej Zary <linux(a)zary.sk> PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold Siddh Raman Pant <code(a)siddh.me> jfs: jfs_dmap: Validate db_l2nbperpage while mounting Baokun Li <libaokun1(a)huawei.com> ext4: only update i_reserved_data_blocks on successful block allocation Kemeng Shi <shikemeng(a)huaweicloud.com> ext4: fix wrong unit use in ext4_mb_clear_bb Adrian Hunter <adrian.hunter(a)intel.com> perf intel-pt: Fix CYC timestamps after standalone CBR Ding Hui <dinghui(a)sangfor.com.cn> SUNRPC: Fix UAF in svc_tcp_listen_data_ready() Florian Fainelli <florian.fainelli(a)broadcom.com> net: bcmgenet: Ensure MDIO unregistration has clocks enabled Jarkko Sakkinen <jarkko.sakkinen(a)tuni.fi> tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation Mario Limonciello <mario.limonciello(a)amd.com> pinctrl: amd: Only use special debounce behavior for GPIO 0 Mario Limonciello <mario.limonciello(a)amd.com> pinctrl: amd: Detect internal GPIO0 debounce handling Mario Limonciello <mario.limonciello(a)amd.com> pinctrl: amd: Fix mistake in handling clearing pins at startup Pedro Tammela <pctammela(a)mojatatu.com> net/sched: make psched_mtu() RTNL-less safe Randy Dunlap <rdunlap(a)infradead.org> wifi: airo: avoid uninitialized warning in airo_get_rate() Ziyang Xuan <william.xuanziyang(a)huawei.com> ipv6/addrconf: fix a potential refcount underflow for idev Jiasheng Jiang <jiasheng(a)iscas.ac.cn> NTB: ntb_tool: Add check for devm_kcalloc Yang Yingliang <yangyingliang(a)huawei.com> NTB: ntb_transport: fix possible memory leak while device_register() fails Yuan Can <yuancan(a)huawei.com> ntb: intel: Fix error handling in intel_ntb_pci_driver_init() Yuan Can <yuancan(a)huawei.com> NTB: amd: Fix error handling in amd_ntb_pci_driver_init() Yuan Can <yuancan(a)huawei.com> ntb: idt: Fix error handling in idt_pci_driver_init() Eric Dumazet <edumazet(a)google.com> udp6: fix udp6_ehashfn() typo Kuniyuki Iwashima <kuniyu(a)amazon.com> icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). Stephen Suryaputra <ssuryaextr(a)gmail.com> vrf: Increment Icmp6InMsgs on the original netdev Klaus Kudielka <klaus.kudielka(a)gmail.com> net: mvneta: fix txq_map in case of txq_number==1 Linus Torvalds <torvalds(a)linux-foundation.org> workqueue: clean up WORK_* constant types, clarify masking Moritz Fischer <moritzf(a)google.com> net: lan743x: Don't sleep in atomic context Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> netfilter: nf_tables: prevent OOB access in nft_byteorder_eval Florent Revest <revest(a)chromium.org> netfilter: conntrack: Avoid nf_ct_helper_hash uses after free Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: fix scheduling-while-atomic splat Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: unbind non-anonymous set if rule construction fails Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: reject unbound anonymous set before commit phase Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: use net_generic infra for transaction data Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: add helper function to set up the nfnetlink header and use it Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nftables: add helper function to set the base sequence number Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: add rescheduling points during loop detection walks Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: fix nat hook table deletion Rasmus Villemoes <rasmus.villemoes(a)prevas.dk> spi: spi-fsl-spi: allow changing bits_per_word while CS is still active Rasmus Villemoes <rasmus.villemoes(a)prevas.dk> spi: spi-fsl-spi: relax message sanity checking a little Rasmus Villemoes <rasmus.villemoes(a)prevas.dk> spi: spi-fsl-spi: remove always-true conditional in fsl_spi_do_one_msg Arnd Bergmann <arnd(a)arndb.de> ARM: orion5x: fix d2net gpio initialization Filipe Manana <fdmanana(a)suse.com> btrfs: fix race when deleting quota root from the dirty cow roots list Fabian Frederick <fabf(a)skynet.be> jffs2: reduce stack usage in jffs2_build_xattr_subsystem() Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> integrity: Fix possible multiple allocation in integrity_inode_get() Zheng Wang <zyytlz.wz(a)163.com> bcache: Remove unnecessary NULL point check in node allocations Robert Marko <robimarko(a)gmail.com> mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M Robert Marko <robimarko(a)gmail.com> mmc: core: disable TRIM on Kingston EMMC04G-M627 Dai Ngo <dai.ngo(a)oracle.com> NFSD: add encoding of op_recall flag for write delegation Takashi Iwai <tiwai(a)suse.de> ALSA: jack: Fix mutex call in snd_jack_report() Robert Hancock <robert.hancock(a)calian.com> i2c: xiic: Don't try to handle more interrupt events after error Marek Vasut <marex(a)denx.de> i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process() Artur Rojek <contact(a)artur-rojek.eu> sh: dma: Fix DMA channel offset calculation Lin Ma <linma(a)zju.edu.cn> net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX Eric Dumazet <edumazet(a)google.com> tcp: annotate data races in __tcp_oow_rate_limited() Vladimir Oltean <vladimir.oltean(a)nxp.com> net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode Randy Dunlap <rdunlap(a)infradead.org> powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y Chao Yu <chao(a)kernel.org> f2fs: fix error path handling in truncate_dnode() Nishanth Menon <nm(a)ti.com> mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 Jonas Gorski <jonas.gorski(a)gmail.com> spi: bcm-qspi: return error if neither hif_mspi nor mspi is available Tobias Heider <me(a)tobhe.de> Add MODULE_FIRMWARE() for FIRMWARE_TG357766. Chengfeng Ye <dg573847474(a)gmail.com> sctp: fix potential deadlock on &net->sctp.addr_wq_lock Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> rtc: st-lpc: Release some resources in st_rtc_probe() in case of error Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mfd: stmpe: Only disable the regulators if they are enabled Jiasheng Jiang <jiasheng(a)iscas.ac.cn> mfd: intel-lpss: Add missing check for platform_get_resource Nico Boehr <nrb(a)linux.ibm.com> KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes Stephan Gerhold <stephan(a)gerhold.net> mfd: rt5033: Drop rt5033-battery sub-device Li Yang <lidaxian(a)hust.edu.cn> usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> extcon: Fix kernel doc of property capability fields to avoid warnings Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> extcon: Fix kernel doc of property fields to avoid warnings Duoming Zhou <duoming(a)zju.edu.cn> media: usb: siano: Fix warning due to null work_func_t function pointer Marek Vasut <marex(a)denx.de> media: videodev2.h: Fix struct v4l2_input tuner index comment Daniil Dulov <d.dulov(a)aladdin.ru> media: usb: Check az6007_read() return value John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> sh: j2: Use ioremap() to translate device tree address into kernel memory Dan Carpenter <dan.carpenter(a)oracle.com> w1: fix loop in w1_fini() Michael Schmitz <schmitzmic(a)gmail.com> block: change all __u32 annotations to __be32 in affs_hardblocks.h Davide Tronchin <davide.tronchin.94(a)gmail.com> USB: serial: option: add LARA-R6 01B PIDs Masahiro Yamada <masahiroy(a)kernel.org> ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard Vineet Gupta <vgupta(a)synopsys.com> ARCv2: entry: rewrite to enable use of double load/stores LDD/STD Vineet Gupta <vgupta(a)synopsys.com> ARCv2: entry: avoid a branch Vineet Gupta <vgupta(a)synopsys.com> ARCv2: entry: push out the Z flag unclobber from common EXCEPTION_PROLOGUE Vineet Gupta <vgupta(a)synopsys.com> ARCv2: entry: comments about hardware auto-save on taken interrupts Masahiro Yamada <masahiroy(a)kernel.org> modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} Masahiro Yamada <masahiroy(a)kernel.org> modpost: fix section mismatch message for R_ARM_ABS32 Randy Dunlap <rdunlap(a)infradead.org> crypto: nx - fix build warnings when DEBUG_FS is not enabled Herbert Xu <herbert(a)gondor.apana.org.au> hwrng: virtio - Fix race on data_avail and actual data Laurent Vivier <lvivier(a)redhat.com> hwrng: virtio - always add a pending request Laurent Vivier <lvivier(a)redhat.com> hwrng: virtio - don't waste entropy Laurent Vivier <lvivier(a)redhat.com> hwrng: virtio - don't wait on cleanup Laurent Vivier <lvivier(a)redhat.com> hwrng: virtio - add an internal buffer Claudiu Beznea <claudiu.beznea(a)microchip.com> pinctrl: at91-pio4: check return value of devm_kasprintf() Namhyung Kim <namhyung(a)kernel.org> perf dwarf-aux: Fix off-by-one in die_get_varname() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: cherryview: Return correct value if pin in push-pull mode Sui Jingfeng <suijingfeng(a)loongson.cn> PCI: Add pci_clear_master() stub for non-CONFIG_PCI Yuchen Yang <u202114568(a)hust.edu.cn> scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() Su Hui <suhui(a)nfschina.com> ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> drm/radeon: fix possible division-by-zero errors Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() Wolfram Sang <wsa+renesas(a)sang-engineering.com> arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 Patrick Kelsey <pat.kelsey(a)cornelisnetworks.com> IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors Randy Dunlap <rdunlap(a)infradead.org> soc/fsl/qe: fix usb.c build errors Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: es8316: Increment max value for ALC Capture Target Volume control Arnd Bergmann <arnd(a)arndb.de> ARM: ep93xx: fix missing-prototype warnings Dario Binacchi <dario.binacchi(a)amarulasolutions.com> drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H Marek Vasut <marex(a)denx.de> Input: adxl34x - do not hardcode interrupt trigger type Rafał Miłecki <rafal(a)milecki.pl> ARM: dts: BCM5301X: Drop "clock-names" from the SPI node Luca Weiss <luca(a)z3ntu.xyz> Input: drv260x - sleep between polling GO bit Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> radeon: avoid double free in ci_dpm_init() Kuniyuki Iwashima <kuniyu(a)amazon.com> netlink: Add __sock_i_ino() for __netlink_diag_dump(). Cambda Zhu <cambda(a)linux.alibaba.com> ipvlan: Fix return value of ipvlan_queue_xmit() Ilia.Gavrilov <Ilia.Gavrilov(a)infotecs.ru> netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. Jeremy Sowden <jeremy(a)azazel.net> lib/ts_bm: reset initial match offset for every block of text Kuniyuki Iwashima <kuniyu(a)amazon.com> gtp: Fix use-after-free in __gtp_encap_destroy(). Eric Dumazet <edumazet(a)google.com> netlink: do not hard code device address lenth in fdb dumps Eric Dumazet <edumazet(a)google.com> netlink: fix potential deadlock in netlink_set_err() Dmitry Antipov <dmantipov(a)yandex.ru> wifi: ath9k: convert msecs to jiffies where needed Remi Pommarel <repk(a)triplefau.lt> wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() Arnd Bergmann <arnd(a)arndb.de> memstick r592: make memstick_debug_get_tpc_name() static Zhen Lei <thunder.leizhen(a)huawei.com> kexec: fix a memory leak in crash_shrink_memory() Douglas Anderson <dianders(a)chromium.org> watchdog/perf: more properly prevent false positives with turbo modes Douglas Anderson <dianders(a)chromium.org> watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config Marek Vasut <marex(a)denx.de> wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> wifi: ray_cs: Fix an error handling path in ray_probe() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> wifi: ray_cs: Drop useless status variable in parse_addr() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> wifi: ray_cs: Utilize strnlen() in parse_addr() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> wifi: wl3501_cs: Fix an error handling path in wl3501_probe() Jakub Kicinski <kuba(a)kernel.org> wl3501_cs: use eth_hw_addr_set() Jakub Kicinski <kuba(a)kernel.org> net: create netdev->dev_addr assignment helpers Lee Jones <lee.jones(a)linaro.org> wl3501_cs: Fix misspelling and provide missing documentation Alex Dewar <alex.dewar90(a)gmail.com> wl3501_cs: Remove unnecessary NULL check Lee Jones <lee.jones(a)linaro.org> wl3501_cs: Fix a bunch of formatting issues related to function docs Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> wifi: atmel: Fix an error handling path in atmel_probe() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> wifi: orinoco: Fix an error handling path in orinoco_cs_probe() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> wifi: orinoco: Fix an error handling path in spectrum_cs_probe() Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> nfc: constify several pointers to u8, char and sk_buff Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() Pengcheng Yang <yangpc(a)wangsu.com> samples/bpf: Fix buffer overflow in tcp_basertt Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx Peter Seiderer <ps.report(a)gmx.net> wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation Roberto Sassu <roberto.sassu(a)huawei.com> evm: Complete description of evm_inode_setattr() Arnd Bergmann <arnd(a)arndb.de> ARM: 9303/1: kprobes: avoid missing-declaration warnings Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> PM: domains: fix integer overflow issues in genpd_parse_state() Feng Mingxi <m202271825(a)hust.edu.cn> clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe Rajan Vaja <rajan.vaja(a)xilinx.com> clocksource/drivers/cadence-ttc: Use ttc driver as platform driver Daniel Lezcano <daniel.lezcano(a)linaro.org> clocksource/drivers: Unify the names to timer-* format John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> irqchip/jcore-aic: Fix missing allocation of IRQ descriptors Marc Zyngier <maz(a)kernel.org> irqchip/jcore-aic: Kill use of irq_create_strict_mappings() Li Nan <linan122(a)huawei.com> md/raid10: fix io loss while replacement replace rdev Li Nan <linan122(a)huawei.com> md/raid10: fix wrong setting of max_corr_read_errors Li Nan <linan122(a)huawei.com> md/raid10: fix overflow of md/safe_mode_delay Li Nan <linan122(a)huawei.com> md/raid10: check slab-out-of-bounds in md_bitmap_get_counter Kees Cook <keescook(a)chromium.org> treewide: Remove uninitialized_var() usage Bas Nieuwenhuizen <bas(a)basnieuwenhuizen.nl> drm/amdgpu: Validate VM ioctl flags. Ahmed S. Darwish <darwi(a)linutronix.de> scripts/tags.sh: Resolve gtags empty index generation Lyude Paul <lyude(a)redhat.com> drm/edid: Fix uninitialized variable in drm_cvt_modes() Zheng Wang <zyytlz.wz(a)163.com> fbdev: imsttfb: Fix use after free bug in imsttfb_probe Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> video: imsttfb: check for ioremap() failures Thomas Gleixner <tglx(a)linutronix.de> x86/smp: Use dedicated cache-line for mwait_play_dead() Bob Peterson <rpeterso(a)redhat.com> gfs2: Don't deref jdesc in evict ------------- Diffstat: Documentation/admin-guide/security-bugs.rst | 37 +- MAINTAINERS | 10 +- Makefile | 4 +- arch/arc/include/asm/entry-arcv2.h | 374 ++++++++-------- arch/arc/include/asm/linkage.h | 22 +- arch/arc/kernel/asm-offsets.c | 7 + arch/arc/kernel/entry-arcv2.S | 4 +- arch/arc/mm/tlbex.S | 11 + arch/arm/boot/dts/bcm5301x.dtsi | 1 - arch/arm/boot/dts/imx6qdl.dtsi | 4 + arch/arm/boot/dts/imx6sl.dtsi | 3 + arch/arm/boot/dts/imx6sll.dtsi | 32 +- arch/arm/boot/dts/imx6sx.dtsi | 3 + arch/arm/boot/dts/imx6ul.dtsi | 2 + arch/arm/boot/dts/imx7d.dtsi | 6 + arch/arm/boot/dts/imx7s.dtsi | 2 + arch/arm/mach-ep93xx/timer-ep93xx.c | 3 +- arch/arm/mach-orion5x/board-dt.c | 3 + arch/arm/mach-orion5x/common.h | 6 + arch/arm/mach-sa1100/assabet.c | 2 +- arch/arm/probes/kprobes/checkers-common.c | 2 +- arch/arm/probes/kprobes/core.c | 2 +- arch/arm/probes/kprobes/opt-arm.c | 2 - arch/arm/probes/kprobes/test-core.c | 2 +- arch/arm/probes/kprobes/test-core.h | 4 + .../boot/dts/altera/socfpga_stratix10_socdk.dts | 2 +- arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 3 +- arch/ia64/kernel/process.c | 2 +- arch/ia64/mm/discontig.c | 2 +- arch/ia64/mm/tlb.c | 2 +- arch/powerpc/Kconfig.debug | 2 +- arch/powerpc/include/asm/word-at-a-time.h | 2 +- arch/powerpc/mm/init_64.c | 3 +- arch/powerpc/platforms/52xx/mpc52xx_pic.c | 2 +- arch/s390/kernel/smp.c | 2 +- arch/s390/kernel/sthyi.c | 6 +- arch/s390/kvm/intercept.c | 9 +- arch/s390/kvm/kvm-s390.c | 4 + arch/sh/drivers/dma/dma-sh.c | 37 +- arch/sh/kernel/cpu/sh2/probe.c | 2 +- arch/x86/kernel/quirks.c | 10 +- arch/x86/kernel/smpboot.c | 24 +- arch/xtensa/platforms/iss/network.c | 2 +- drivers/acpi/acpi_pad.c | 2 +- drivers/ata/libata-scsi.c | 2 +- drivers/ata/pata_ns87415.c | 2 +- drivers/atm/zatm.c | 2 +- drivers/base/arch_topology.c | 2 +- drivers/base/cacheinfo.c | 18 +- drivers/base/core.c | 8 +- drivers/base/cpu.c | 34 +- drivers/base/firmware_loader/fallback.c | 2 +- drivers/base/memory.c | 24 +- drivers/base/node.c | 34 +- drivers/base/platform.c | 2 +- drivers/base/power/domain.c | 6 +- drivers/base/power/power.h | 8 +- drivers/base/power/runtime.c | 6 +- drivers/base/power/sysfs.c | 50 +-- drivers/base/power/wakeirq.c | 111 ++++- drivers/base/soc.c | 8 +- drivers/block/drbd/drbd_nl.c | 6 +- drivers/block/loop.c | 3 +- drivers/block/nbd.c | 3 +- drivers/char/hw_random/imx-rngc.c | 6 +- drivers/char/hw_random/virtio-rng.c | 86 +++- drivers/char/tpm/tpm_tis_core.c | 10 +- drivers/char/tpm/tpm_vtpm_proxy.c | 30 +- drivers/clk/clk-gate.c | 2 +- drivers/clocksource/Makefile | 26 +- ...{time-armada-370-xp.c => timer-armada-370-xp.c} | 0 .../{cadence_ttc_timer.c => timer-cadence-ttc.c} | 45 +- .../clocksource/{time-efm32.c => timer-efm32.c} | 0 .../{fsl_ftm_timer.c => timer-fsl-ftm.c} | 0 .../{time-lpc32xx.c => timer-lpc32xx.c} | 0 .../clocksource/{time-orion.c => timer-orion.c} | 0 drivers/clocksource/{owl-timer.c => timer-owl.c} | 0 .../{time-pistachio.c => timer-pistachio.c} | 0 drivers/clocksource/{qcom-timer.c => timer-qcom.c} | 0 .../clocksource/{versatile.c => timer-versatile.c} | 0 .../clocksource/{vf_pit_timer.c => timer-vf-pit.c} | 0 .../clocksource/{vt8500_timer.c => timer-vt8500.c} | 0 .../clocksource/{zevio-timer.c => timer-zevio.c} | 0 drivers/crypto/nx/Makefile | 2 +- drivers/crypto/nx/nx.h | 4 +- drivers/extcon/extcon.c | 8 + drivers/firewire/ohci.c | 14 +- drivers/gpio/gpio-tps68470.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 + drivers/gpu/drm/bridge/sil-sii8620.c | 2 +- drivers/gpu/drm/drm_atomic.c | 11 +- drivers/gpu/drm/drm_edid.c | 4 +- drivers/gpu/drm/drm_fb_helper.c | 5 + drivers/gpu/drm/exynos/exynos_drm_dsi.c | 6 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 2 +- drivers/gpu/drm/panel/panel-simple.c | 4 +- drivers/gpu/drm/radeon/ci_dpm.c | 28 +- drivers/gpu/drm/radeon/cypress_dpm.c | 8 +- drivers/gpu/drm/radeon/ni_dpm.c | 8 +- drivers/gpu/drm/radeon/rv740_dpm.c | 8 +- drivers/hwmon/nct7802.c | 2 +- drivers/i2c/busses/i2c-rk3x.c | 2 +- drivers/i2c/busses/i2c-xiic.c | 39 +- drivers/ide/ide-acpi.c | 2 +- drivers/ide/ide-atapi.c | 2 +- drivers/ide/ide-io-std.c | 4 +- drivers/ide/ide-io.c | 8 +- drivers/ide/ide-sysfs.c | 2 +- drivers/ide/umc8672.c | 2 +- drivers/iio/adc/meson_saradc.c | 2 +- drivers/infiniband/core/uverbs_cmd.c | 4 +- drivers/infiniband/hw/cxgb4/cm.c | 2 +- drivers/infiniband/hw/cxgb4/cq.c | 2 +- drivers/infiniband/hw/hfi1/sdma.c | 4 +- drivers/infiniband/hw/hfi1/sdma.h | 15 +- drivers/infiniband/hw/mlx4/qp.c | 24 +- drivers/infiniband/hw/mlx5/cq.c | 2 +- drivers/infiniband/hw/mthca/mthca_qp.c | 10 +- drivers/input/misc/adxl34x.c | 3 +- drivers/input/misc/drv260x.c | 1 + drivers/input/serio/serio_raw.c | 2 +- drivers/irqchip/irq-bcm6345-l1.c | 14 +- drivers/irqchip/irq-jcore-aic.c | 11 +- drivers/mailbox/ti-msgmgr.c | 12 +- drivers/md/bcache/alloc.c | 35 +- drivers/md/bcache/bcache.h | 4 +- drivers/md/bcache/btree.c | 16 +- drivers/md/bcache/super.c | 6 +- drivers/md/dm-cache-policy-smq.c | 28 +- drivers/md/dm-io.c | 2 +- drivers/md/dm-ioctl.c | 2 +- drivers/md/dm-raid.c | 9 +- drivers/md/dm-snap-persistent.c | 2 +- drivers/md/dm-table.c | 2 +- drivers/md/md-bitmap.c | 17 +- drivers/md/md.c | 23 +- drivers/md/raid0.c | 62 ++- drivers/md/raid0.h | 1 + drivers/md/raid10.c | 24 +- drivers/md/raid5.c | 2 +- drivers/media/dvb-frontends/rtl2832.c | 2 +- drivers/media/tuners/qt1010.c | 4 +- drivers/media/usb/dvb-usb-v2/az6007.c | 3 +- drivers/media/usb/gspca/vicam.c | 2 +- drivers/media/usb/siano/smsusb.c | 3 +- drivers/media/usb/uvc/uvc_video.c | 8 +- drivers/memstick/host/jmb38x_ms.c | 2 +- drivers/memstick/host/r592.c | 4 +- drivers/memstick/host/tifm_ms.c | 2 +- drivers/mfd/intel-lpss-acpi.c | 3 + drivers/mfd/rt5033.c | 3 - drivers/mfd/stmpe.c | 4 +- drivers/misc/pci_endpoint_test.c | 10 +- drivers/mmc/core/quirks.h | 14 + drivers/mmc/host/sdhci.c | 2 +- drivers/mtd/nand/raw/nand_ecc.c | 2 +- drivers/mtd/nand/raw/omap_elm.c | 24 +- drivers/mtd/nand/raw/s3c2410.c | 2 +- drivers/mtd/ubi/eba.c | 2 +- drivers/net/bonding/bond_main.c | 5 + drivers/net/can/janz-ican3.c | 2 +- drivers/net/can/usb/gs_usb.c | 2 + drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 7 +- drivers/net/ethernet/broadcom/bnx2.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmmii.c | 2 + drivers/net/ethernet/broadcom/tg3.c | 1 + drivers/net/ethernet/emulex/benet/be_main.c | 3 +- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +- drivers/net/ethernet/intel/igb/igb_main.c | 5 + drivers/net/ethernet/marvell/mvneta.c | 4 +- .../mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 4 +- .../net/ethernet/mellanox/mlx5/core/pagealloc.c | 4 +- drivers/net/ethernet/microchip/lan743x_main.c | 21 +- drivers/net/ethernet/neterion/s2io.c | 2 +- drivers/net/ethernet/qlogic/qla3xxx.c | 2 +- drivers/net/ethernet/sun/cassini.c | 2 +- drivers/net/ethernet/sun/niu.c | 6 +- drivers/net/ethernet/ti/cpsw_ale.c | 24 +- drivers/net/gtp.c | 2 + drivers/net/ipvlan/ipvlan_core.c | 9 +- drivers/net/team/team.c | 9 + drivers/net/usb/cdc_ether.c | 21 + drivers/net/usb/usbnet.c | 6 + drivers/net/usb/zaurus.c | 21 + drivers/net/virtio_net.c | 4 +- drivers/net/wan/z85230.c | 2 +- drivers/net/wireless/ath/ath10k/core.c | 2 +- drivers/net/wireless/ath/ath6kl/init.c | 2 +- drivers/net/wireless/ath/ath9k/ar9003_hw.c | 27 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 8 +- drivers/net/wireless/ath/ath9k/init.c | 2 +- drivers/net/wireless/ath/ath9k/main.c | 11 +- drivers/net/wireless/ath/ath9k/wmi.c | 4 + drivers/net/wireless/atmel/atmel_cs.c | 13 +- drivers/net/wireless/broadcom/b43/debugfs.c | 2 +- drivers/net/wireless/broadcom/b43/dma.c | 2 +- drivers/net/wireless/broadcom/b43/lo.c | 2 +- drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- drivers/net/wireless/broadcom/b43/xmit.c | 12 +- drivers/net/wireless/broadcom/b43legacy/debugfs.c | 2 +- drivers/net/wireless/broadcom/b43legacy/main.c | 2 +- drivers/net/wireless/cisco/airo.c | 5 +- drivers/net/wireless/intel/iwlegacy/3945.c | 2 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 +- drivers/net/wireless/intersil/orinoco/orinoco_cs.c | 13 +- .../net/wireless/intersil/orinoco/spectrum_cs.c | 13 +- drivers/net/wireless/marvell/mwifiex/scan.c | 6 +- drivers/net/wireless/ray_cs.c | 36 +- drivers/net/wireless/rsi/rsi_91x_sdio.c | 3 - drivers/net/wireless/wl3501_cs.c | 51 ++- drivers/ntb/hw/amd/ntb_hw_amd.c | 7 +- drivers/ntb/hw/idt/ntb_hw_idt.c | 7 +- drivers/ntb/hw/intel/ntb_hw_gen1.c | 7 +- drivers/ntb/ntb_transport.c | 2 +- drivers/ntb/test/ntb_tool.c | 2 + drivers/pci/controller/dwc/pcie-qcom.c | 2 + drivers/pci/controller/pcie-rockchip-ep.c | 64 +-- drivers/pci/controller/pcie-rockchip.c | 17 + drivers/pci/controller/pcie-rockchip.h | 11 +- drivers/pci/pci.c | 10 +- drivers/pci/pcie/aspm.c | 57 ++- drivers/pci/quirks.c | 2 + drivers/phy/hisilicon/phy-hisi-inno-usb2.c | 2 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 15 +- drivers/pinctrl/pinctrl-amd.c | 41 +- drivers/pinctrl/pinctrl-amd.h | 1 + drivers/pinctrl/pinctrl-at91-pio4.c | 2 + drivers/platform/x86/hdaps.c | 4 +- drivers/platform/x86/msi-laptop.c | 8 +- drivers/rtc/rtc-st-lpc.c | 2 +- drivers/s390/block/dasd_ioctl.c | 1 + drivers/s390/scsi/zfcp_fc.c | 6 +- drivers/scsi/3w-xxxx.c | 4 +- drivers/scsi/dc395x.c | 2 +- drivers/scsi/pm8001/pm8001_hwi.c | 2 +- drivers/scsi/pm8001/pm80xx_hwi.c | 2 +- drivers/scsi/qla2xxx/qla_attr.c | 13 + drivers/scsi/qla2xxx/qla_bsg.c | 6 + drivers/scsi/qla2xxx/qla_iocb.c | 3 +- drivers/scsi/qla2xxx/qla_os.c | 5 +- drivers/soc/fsl/qe/Kconfig | 1 + drivers/spi/spi-bcm-qspi.c | 10 +- drivers/spi/spi-bcm63xx.c | 2 +- drivers/spi/spi-fsl-spi.c | 25 +- drivers/ssb/driver_chipcommon.c | 4 +- drivers/staging/ks7010/ks_wlan_net.c | 6 +- drivers/tty/cyclades.c | 2 +- drivers/tty/isicom.c | 2 +- drivers/tty/serial/8250/8250.h | 1 - drivers/tty/serial/8250/8250_dwlib.c | 128 ++++++ drivers/tty/serial/8250/8250_dwlib.h | 19 + drivers/tty/serial/8250/8250_pci.c | 19 - drivers/tty/serial/8250/8250_port.c | 11 +- drivers/tty/serial/8250/Kconfig | 3 + drivers/tty/serial/8250/Makefile | 1 + drivers/tty/serial/atmel_serial.c | 4 +- drivers/tty/serial/samsung.c | 14 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc3/core.c | 20 +- drivers/usb/dwc3/core.h | 3 - drivers/usb/dwc3/dwc3-pci.c | 6 +- drivers/usb/host/ohci-at91.c | 8 +- drivers/usb/host/xhci-mtk.c | 1 + drivers/usb/musb/cppi_dma.c | 2 +- drivers/usb/phy/phy-tahvo.c | 2 +- drivers/usb/serial/option.c | 10 + drivers/usb/serial/usb-serial-simple.c | 73 ++-- drivers/usb/storage/sddr55.c | 4 +- drivers/vhost/net.c | 4 +- drivers/video/fbdev/au1200fb.c | 3 + drivers/video/fbdev/imsttfb.c | 34 +- drivers/video/fbdev/imxfb.c | 4 +- drivers/video/fbdev/matrox/matroxfb_maven.c | 6 +- drivers/video/fbdev/omap/lcd_mipid.c | 6 +- drivers/video/fbdev/pm3fb.c | 6 +- drivers/video/fbdev/riva/riva_hw.c | 3 +- drivers/virtio/virtio_ring.c | 2 +- drivers/w1/w1.c | 4 +- fs/afs/dir.c | 2 +- fs/afs/security.c | 2 +- fs/btrfs/ctree.c | 2 + fs/btrfs/qgroup.c | 2 + fs/btrfs/transaction.c | 9 +- fs/ceph/caps.c | 9 + fs/dlm/netlink.c | 2 +- fs/dlm/plock.c | 104 +++-- fs/ext2/ext2.h | 12 - fs/ext2/super.c | 23 +- fs/ext4/ext4.h | 2 +- fs/ext4/fsmap.c | 8 +- fs/ext4/indirect.c | 8 + fs/ext4/inode.c | 10 - fs/ext4/ioctl.c | 5 +- fs/ext4/mballoc.c | 4 +- fs/ext4/super.c | 25 +- fs/ext4/xattr.c | 14 + fs/f2fs/node.c | 4 +- fs/fat/dir.c | 2 +- fs/fuse/control.c | 2 +- fs/fuse/cuse.c | 2 +- fs/fuse/dir.c | 2 +- fs/fuse/file.c | 2 +- fs/gfs2/aops.c | 2 +- fs/gfs2/bmap.c | 2 +- fs/gfs2/super.c | 8 + fs/hfsplus/unicode.c | 2 +- fs/isofs/namei.c | 4 +- fs/jffs2/build.c | 5 +- fs/jffs2/erase.c | 2 +- fs/jffs2/xattr.c | 13 +- fs/jffs2/xattr.h | 4 +- fs/jfs/jfs_dmap.c | 6 + fs/jfs/jfs_filsys.h | 2 + fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfsctl.c | 2 +- fs/ocfs2/alloc.c | 4 +- fs/ocfs2/dir.c | 14 +- fs/ocfs2/extent_map.c | 4 +- fs/ocfs2/namei.c | 2 +- fs/ocfs2/refcounttree.c | 2 +- fs/ocfs2/xattr.c | 2 +- fs/omfs/file.c | 2 +- fs/overlayfs/copy_up.c | 2 +- fs/sysv/itree.c | 4 + fs/ubifs/commit.c | 6 +- fs/ubifs/dir.c | 2 +- fs/ubifs/file.c | 4 +- fs/ubifs/journal.c | 2 +- fs/ubifs/lpt.c | 2 +- fs/ubifs/tnc.c | 6 +- fs/ubifs/tnc_misc.c | 4 +- fs/udf/balloc.c | 2 +- fs/xfs/xfs_bmap_util.c | 2 +- include/asm-generic/word-at-a-time.h | 2 +- include/linux/etherdevice.h | 12 + include/linux/netdevice.h | 18 + include/linux/netfilter/nfnetlink.h | 27 ++ include/linux/nmi.h | 2 +- include/linux/pci.h | 1 + include/linux/pm_wakeirq.h | 9 +- include/linux/sched/signal.h | 2 +- include/linux/serial_8250.h | 1 - include/linux/tcp.h | 2 +- include/linux/workqueue.h | 15 +- include/net/addrconf.h | 16 + include/net/ipv6.h | 8 +- include/net/netfilter/nf_tables.h | 14 + include/net/netns/nftables.h | 5 - include/net/nfc/nfc.h | 4 +- include/net/pkt_sched.h | 2 +- include/net/sock.h | 1 + include/net/tcp.h | 7 +- include/uapi/linux/affs_hardblocks.h | 68 +-- include/uapi/linux/blkzoned.h | 10 +- include/uapi/linux/videodev2.h | 2 +- kernel/async.c | 4 +- kernel/audit.c | 2 +- kernel/bpf/bpf_lru_list.c | 21 +- kernel/bpf/bpf_lru_list.h | 7 +- kernel/dma/debug.c | 2 +- kernel/events/core.c | 10 +- kernel/events/uprobes.c | 2 +- kernel/exit.c | 2 +- kernel/futex.c | 12 +- kernel/kexec_core.c | 5 +- kernel/locking/lockdep.c | 6 +- kernel/sched/fair.c | 2 +- kernel/time/posix-timers.c | 31 +- kernel/trace/ftrace.c | 75 +++- kernel/trace/ring_buffer.c | 48 +- kernel/trace/trace.c | 21 +- kernel/trace/trace.h | 2 + kernel/trace/trace_events.c | 14 +- kernel/trace/trace_events_hist.c | 9 +- kernel/watchdog_hld.c | 6 +- kernel/workqueue.c | 13 +- lib/debugobjects.c | 9 + lib/radix-tree.c | 2 +- lib/test_firmware.c | 18 +- lib/ts_bm.c | 4 +- mm/frontswap.c | 2 +- mm/ksm.c | 2 +- mm/memcontrol.c | 2 +- mm/mempolicy.c | 4 +- mm/percpu.c | 2 +- mm/slub.c | 4 +- mm/swap.c | 4 +- net/bluetooth/l2cap_sock.c | 2 + net/bridge/br_if.c | 5 +- net/can/bcm.c | 12 +- net/ceph/osd_client.c | 20 +- net/core/rtnetlink.c | 8 +- net/core/sock.c | 23 +- net/dccp/options.c | 2 +- net/ipv4/inet_hashtables.c | 17 +- net/ipv4/inet_timewait_sock.c | 8 +- net/ipv4/netfilter/nf_socket_ipv4.c | 6 +- net/ipv4/tcp.c | 27 +- net/ipv4/tcp_fastopen.c | 6 +- net/ipv4/tcp_input.c | 12 +- net/ipv4/tcp_metrics.c | 70 +-- net/ipv6/addrconf.c | 17 +- net/ipv6/icmp.c | 22 +- net/ipv6/ip6_flowlabel.c | 2 +- net/ipv6/ip6_gre.c | 3 +- net/ipv6/ip6mr.c | 2 +- net/ipv6/netfilter/nf_socket_ipv6.c | 2 +- net/ipv6/reassembly.c | 4 +- net/ipv6/udp.c | 2 +- net/llc/llc_input.c | 3 - net/netfilter/ipset/ip_set_core.c | 17 +- net/netfilter/nf_conntrack_ftp.c | 2 +- net/netfilter/nf_conntrack_helper.c | 4 + net/netfilter/nf_conntrack_netlink.c | 77 +--- net/netfilter/nf_conntrack_sip.c | 2 +- net/netfilter/nf_tables_api.c | 486 ++++++++++++--------- net/netfilter/nf_tables_trace.c | 9 +- net/netfilter/nfnetlink_acct.c | 11 +- net/netfilter/nfnetlink_cthelper.c | 11 +- net/netfilter/nfnetlink_cttimeout.c | 22 +- net/netfilter/nfnetlink_log.c | 13 +- net/netfilter/nfnetlink_queue.c | 16 +- net/netfilter/nft_byteorder.c | 14 +- net/netfilter/nft_chain_filter.c | 11 +- net/netfilter/nft_compat.c | 11 +- net/netfilter/nft_dynset.c | 6 +- net/netlink/af_netlink.c | 5 +- net/netlink/diag.c | 7 +- net/nfc/core.c | 4 +- net/nfc/hci/llc_shdlc.c | 10 +- net/nfc/llcp.h | 8 +- net/nfc/llcp_commands.c | 47 +- net/nfc/llcp_core.c | 44 +- net/nfc/nfc.h | 2 +- net/sched/act_pedit.c | 1 + net/sched/cls_flow.c | 2 +- net/sched/cls_fw.c | 10 +- net/sched/cls_route.c | 1 - net/sched/cls_u32.c | 77 +++- net/sched/sch_cake.c | 2 +- net/sched/sch_cbq.c | 2 +- net/sched/sch_fq_codel.c | 2 +- net/sched/sch_mqprio.c | 144 +++--- net/sched/sch_qfq.c | 7 +- net/sched/sch_sfq.c | 2 +- net/sctp/socket.c | 4 +- net/sunrpc/svcsock.c | 27 +- net/unix/af_unix.c | 2 +- net/wireless/wext-core.c | 6 + samples/bpf/tcp_basertt_kern.c | 2 +- scripts/mod/modpost.c | 24 +- scripts/tags.sh | 9 +- security/integrity/evm/evm_main.c | 2 + security/integrity/iint.c | 15 +- sound/core/control_compat.c | 2 +- sound/core/jack.c | 15 +- sound/isa/sb/sb16_csp.c | 2 +- sound/pci/ac97/ac97_codec.c | 4 +- sound/soc/codecs/cs42l51-i2c.c | 6 + sound/soc/codecs/cs42l51.c | 7 - sound/soc/codecs/cs42l51.h | 1 - sound/soc/codecs/es8316.c | 9 +- sound/soc/codecs/wm8904.c | 3 + sound/soc/fsl/fsl_spdif.c | 2 + sound/usb/endpoint.c | 2 +- .../tests/shell/test_uprobe_from_different_cu.sh | 83 ++++ tools/perf/util/dwarf-aux.c | 2 +- .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 2 + 469 files changed, 3441 insertions(+), 2100 deletions(-)

2 years

6
334
0 0

hwmon: (nzxt-smart2) backport device ids to v6.1

by Aleksandr Mezin

Please pick the following commits: - e247510e1baad04e9b7b8ed7190dbb00989387b9 hwmon: (nzxt-smart2) Add device id - 4a148e9b1ee04e608263fa9536a96214d5561220 hwmon: (nzxt-smart2) add another USB ID into v6.1 stable kernel. They add device ids for nzxt-smart2 hwmon driver, and they don't require any other code changes. This will synchronize the driver code with v6.3.

2 years

2
1
0 0

[PATCH] block: fix use-after-free of q->q_usage_counter

by Saranya Muruganandam

From: Ming Lei <ming.lei(a)redhat.com> commit d36a9ea5e7766961e753ee38d4c331bbe6ef659b upstream. For blk-mq, queue release handler is usually called after blk_mq_freeze_queue_wait() returns. However, the q_usage_counter->release() handler may not be run yet at that time, so this can cause a use-after-free. Fix the issue by moving percpu_ref_exit() into blk_free_queue_rcu(). Since ->release() is called with rcu read lock held, it is agreed that the race should be covered in caller per discussion from the two links. Backport-notes: Not a clean cherry-pick since a lot has changed, however essentially the same fix. Reported-by: Zhang Wensheng <zhangwensheng(a)huaweicloud.com> Reported-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Link: https://lore.kernel.org/linux-block/Y5prfOjyyjQKUrtH@T590/T/#u Link: https://lore.kernel.org/lkml/Y4%2FmzMd4evRg9yDi@fedora/ Cc: Hillf Danton <hdanton(a)sina.com> Cc: Yu Kuai <yukuai3(a)huawei.com> Cc: Dennis Zhou <dennis(a)kernel.org> Fixes: 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path") Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20221215021629.74870-1-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Saranya Muruganandam <saranyamohan(a)google.com> --- block/blk-core.c | 2 -- block/blk-sysfs.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/block/blk-core.c b/block/blk-core.c index d0d0dd8151f7..e5eeec801f56 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -414,8 +414,6 @@ void blk_cleanup_queue(struct request_queue *q) blk_mq_sched_free_requests(q); mutex_unlock(&q->sysfs_lock); - percpu_ref_exit(&q->q_usage_counter); - /* @q is and will stay empty, shutdown and put */ blk_put_queue(q); } diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 8c5816364dd1..9174137a913c 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -726,6 +726,8 @@ static void blk_free_queue_rcu(struct rcu_head *rcu_head) { struct request_queue *q = container_of(rcu_head, struct request_queue, rcu_head); + + percpu_ref_exit(&q->q_usage_counter); kmem_cache_free(blk_requestq_cachep, q); } -- 2.42.0.515.g380fc7ccd1-goog

2 years

4
5
0 0

FAILED: patch "[PATCH] ext4: fix rec_len verify error" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y git checkout FETCH_HEAD git cherry-pick -x 7fda67e8c3ab6069f75888f67958a6d30454a9f6 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023092057-company-unworried-210b@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^.. Possible dependencies: 7fda67e8c3ab ("ext4: fix rec_len verify error") 46c116b920eb ("ext4: verify dir block before splitting it") f036adb39976 ("ext4: rename "dirent_csum" functions to use "dirblock"") b886ee3e778e ("ext4: Support case-insensitive file name lookups") ee73f9a52a34 ("ext4: convert to new i_version API") ae5e165d855d ("fs: new API for handling inode->i_version") 5cea7647e646 ("Merge branch 'for-4.15' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 7fda67e8c3ab6069f75888f67958a6d30454a9f6 Mon Sep 17 00:00:00 2001 From: Shida Zhang <zhangshida(a)kylinos.cn> Date: Thu, 3 Aug 2023 14:09:38 +0800 Subject: [PATCH] ext4: fix rec_len verify error With the configuration PAGE_SIZE 64k and filesystem blocksize 64k, a problem occurred when more than 13 million files were directly created under a directory: EXT4-fs error (device xx): ext4_dx_csum_set:492: inode #xxxx: comm xxxxx: dir seems corrupt? Run e2fsck -D. EXT4-fs error (device xx): ext4_dx_csum_verify:463: inode #xxxx: comm xxxxx: dir seems corrupt? Run e2fsck -D. EXT4-fs error (device xx): dx_probe:856: inode #xxxx: block 8188: comm xxxxx: Directory index failed checksum When enough files are created, the fake_dirent->reclen will be 0xffff. it doesn't equal to the blocksize 65536, i.e. 0x10000. But it is not the same condition when blocksize equals to 4k. when enough files are created, the fake_dirent->reclen will be 0x1000. it equals to the blocksize 4k, i.e. 0x1000. The problem seems to be related to the limitation of the 16-bit field when the blocksize is set to 64k. To address this, helpers like ext4_rec_len_{from,to}_disk has already been introduced to complete the conversion between the encoded and the plain form of rec_len. So fix this one by using the helper, and all the other in this file too. Cc: stable(a)kernel.org Fixes: dbe89444042a ("ext4: Calculate and verify checksums for htree nodes") Suggested-by: Andreas Dilger <adilger(a)dilger.ca> Suggested-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Shida Zhang <zhangshida(a)kylinos.cn> Reviewed-by: Andreas Dilger <adilger(a)dilger.ca> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Link: https://lore.kernel.org/r/20230803060938.1929759-1-zhangshida@kylinos.cn Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index c0f0b4e2413b..c1ceccab05f5 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -343,17 +343,17 @@ static struct ext4_dir_entry_tail *get_dirent_tail(struct inode *inode, struct buffer_head *bh) { struct ext4_dir_entry_tail *t; + int blocksize = EXT4_BLOCK_SIZE(inode->i_sb); #ifdef PARANOID struct ext4_dir_entry *d, *top; d = (struct ext4_dir_entry *)bh->b_data; top = (struct ext4_dir_entry *)(bh->b_data + - (EXT4_BLOCK_SIZE(inode->i_sb) - - sizeof(struct ext4_dir_entry_tail))); - while (d < top && d->rec_len) + (blocksize - sizeof(struct ext4_dir_entry_tail))); + while (d < top && ext4_rec_len_from_disk(d->rec_len, blocksize)) d = (struct ext4_dir_entry *)(((void *)d) + - le16_to_cpu(d->rec_len)); + ext4_rec_len_from_disk(d->rec_len, blocksize)); if (d != top) return NULL; @@ -364,7 +364,8 @@ static struct ext4_dir_entry_tail *get_dirent_tail(struct inode *inode, #endif if (t->det_reserved_zero1 || - le16_to_cpu(t->det_rec_len) != sizeof(struct ext4_dir_entry_tail) || + (ext4_rec_len_from_disk(t->det_rec_len, blocksize) != + sizeof(struct ext4_dir_entry_tail)) || t->det_reserved_zero2 || t->det_reserved_ft != EXT4_FT_DIR_CSUM) return NULL; @@ -445,13 +446,14 @@ static struct dx_countlimit *get_dx_countlimit(struct inode *inode, struct ext4_dir_entry *dp; struct dx_root_info *root; int count_offset; + int blocksize = EXT4_BLOCK_SIZE(inode->i_sb); + unsigned int rlen = ext4_rec_len_from_disk(dirent->rec_len, blocksize); - if (le16_to_cpu(dirent->rec_len) == EXT4_BLOCK_SIZE(inode->i_sb)) + if (rlen == blocksize) count_offset = 8; - else if (le16_to_cpu(dirent->rec_len) == 12) { + else if (rlen == 12) { dp = (struct ext4_dir_entry *)(((void *)dirent) + 12); - if (le16_to_cpu(dp->rec_len) != - EXT4_BLOCK_SIZE(inode->i_sb) - 12) + if (ext4_rec_len_from_disk(dp->rec_len, blocksize) != blocksize - 12) return NULL; root = (struct dx_root_info *)(((void *)dp + 12)); if (root->reserved_zero || @@ -1315,6 +1317,7 @@ static int dx_make_map(struct inode *dir, struct buffer_head *bh, unsigned int buflen = bh->b_size; char *base = bh->b_data; struct dx_hash_info h = *hinfo; + int blocksize = EXT4_BLOCK_SIZE(dir->i_sb); if (ext4_has_metadata_csum(dir->i_sb)) buflen -= sizeof(struct ext4_dir_entry_tail); @@ -1335,11 +1338,12 @@ static int dx_make_map(struct inode *dir, struct buffer_head *bh, map_tail--; map_tail->hash = h.hash; map_tail->offs = ((char *) de - base)>>2; - map_tail->size = le16_to_cpu(de->rec_len); + map_tail->size = ext4_rec_len_from_disk(de->rec_len, + blocksize); count++; cond_resched(); } - de = ext4_next_entry(de, dir->i_sb->s_blocksize); + de = ext4_next_entry(de, blocksize); } return count; }

2 years

5
5
0 0

[PATCH 5.10] drm/mediatek: Fix backport issue in mtk_drm_gem_prime_vmap()

by Nathan Chancellor

When building with clang: drivers/gpu/drm/mediatek/mtk_drm_gem.c:255:10: error: incompatible integer to pointer conversion returning 'int' from a function with result type 'void *' [-Wint-conversion] 255 | return -ENOMEM; | ^~~~~~~ 1 error generated. GCC reports the same issue as a warning, rather than an error. Prior to commit 7e542ff8b463 ("drm/mediatek: Use struct dma_buf_map in GEM vmap ops"), this function returned a pointer rather than an integer. This function is indirectly called in drm_gem_vmap(), which treats NULL as -ENOMEM through an error pointer. Return NULL in this block to resolve the warning but keep the same end result. Fixes: 43f561e809aa ("drm/mediatek: Fix potential memory leak if vmap() fail") Signed-off-by: Nathan Chancellor <nathan(a)kernel.org> --- This is a fix for a 5.10 backport, so it has no upstream relevance but I've still cc'd the relevant maintainers in case they have any comments or want to double check my work. --- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c index fe64bf2176f3..b20ea58907c2 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c @@ -252,7 +252,7 @@ void *mtk_drm_gem_prime_vmap(struct drm_gem_object *obj) if (!mtk_gem->kvaddr) { kfree(sgt); kfree(mtk_gem->pages); - return -ENOMEM; + return NULL; } out: kfree(sgt); --- base-commit: ff0bfa8f23eb4c5a65ee6b0d0b7dc2e3439f1063 change-id: 20230922-5-10-fix-drm-mediatek-backport-0ee69329fef0 Best regards, -- Nathan Chancellor <nathan(a)kernel.org>

2 years

3
2
0 0

[PATCH 6.1] drm/amd/display: Adjust the MST resume flow

by Mario Limonciello

From: Wayne Lin <wayne.lin(a)amd.com> [Why] In drm_dp_mst_topology_mgr_resume() today, it will resume the mst branch to be ready handling mst mode and also consecutively do the mst topology probing. Which will cause the dirver have chance to fire hotplug event before restoring the old state. Then Userspace will react to the hotplug event based on a wrong state. [How] Adjust the mst resume flow as: 1. set dpcd to resume mst branch status 2. restore source old state 3. Do mst resume topology probing For drm_dp_mst_topology_mgr_resume(), it's better to adjust it to pull out topology probing work into a 2nd part procedure of the mst resume. Will have a follow up patch in drm. Reviewed-by: Chao-kai Wang <stylon.wang(a)amd.com> Cc: Mario Limonciello <mario.limonciello(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Acked-by: Stylon Wang <stylon.wang(a)amd.com> Signed-off-by: Wayne Lin <wayne.lin(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit ec5fa9fcdeca69edf7dab5ca3b2e0ceb1c08fe9a) Adjust for missing variable rename in f0127cb11299 ("drm/amdgpu/display/mst: adjust the naming of mst_port and port of aconnector") Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com> --- This is a follow up for https://lore.kernel.org/stable/2023092029-banter-truth-cf72@gregkh/ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 93 ++++++++++++++++--- 1 file changed, 80 insertions(+), 13 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index c8e562dcd99d..b98ee4b41863 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -2339,14 +2339,62 @@ static int dm_late_init(void *handle) return detect_mst_link_for_all_connectors(adev_to_drm(adev)); } +static void resume_mst_branch_status(struct drm_dp_mst_topology_mgr *mgr) +{ + int ret; + u8 guid[16]; + u64 tmp64; + + mutex_lock(&mgr->lock); + if (!mgr->mst_primary) + goto out_fail; + + if (drm_dp_read_dpcd_caps(mgr->aux, mgr->dpcd) < 0) { + drm_dbg_kms(mgr->dev, "dpcd read failed - undocked during suspend?\n"); + goto out_fail; + } + + ret = drm_dp_dpcd_writeb(mgr->aux, DP_MSTM_CTRL, + DP_MST_EN | + DP_UP_REQ_EN | + DP_UPSTREAM_IS_SRC); + if (ret < 0) { + drm_dbg_kms(mgr->dev, "mst write failed - undocked during suspend?\n"); + goto out_fail; + } + + /* Some hubs forget their guids after they resume */ + ret = drm_dp_dpcd_read(mgr->aux, DP_GUID, guid, 16); + if (ret != 16) { + drm_dbg_kms(mgr->dev, "dpcd read failed - undocked during suspend?\n"); + goto out_fail; + } + + if (memchr_inv(guid, 0, 16) == NULL) { + tmp64 = get_jiffies_64(); + memcpy(&guid[0], &tmp64, sizeof(u64)); + memcpy(&guid[8], &tmp64, sizeof(u64)); + + ret = drm_dp_dpcd_write(mgr->aux, DP_GUID, guid, 16); + + if (ret != 16) { + drm_dbg_kms(mgr->dev, "check mstb guid failed - undocked during suspend?\n"); + goto out_fail; + } + } + + memcpy(mgr->mst_primary->guid, guid, 16); + +out_fail: + mutex_unlock(&mgr->lock); +} + static void s3_handle_mst(struct drm_device *dev, bool suspend) { struct amdgpu_dm_connector *aconnector; struct drm_connector *connector; struct drm_connector_list_iter iter; struct drm_dp_mst_topology_mgr *mgr; - int ret; - bool need_hotplug = false; drm_connector_list_iter_begin(dev, &iter); drm_for_each_connector_iter(connector, &iter) { @@ -2368,18 +2416,15 @@ static void s3_handle_mst(struct drm_device *dev, bool suspend) if (!dp_is_lttpr_present(aconnector->dc_link)) dc_link_aux_try_to_configure_timeout(aconnector->dc_link->ddc, LINK_AUX_DEFAULT_TIMEOUT_PERIOD); - ret = drm_dp_mst_topology_mgr_resume(mgr, true); - if (ret < 0) { - dm_helpers_dp_mst_stop_top_mgr(aconnector->dc_link->ctx, - aconnector->dc_link); - need_hotplug = true; - } + /* TODO: move resume_mst_branch_status() into drm mst resume again + * once topology probing work is pulled out from mst resume into mst + * resume 2nd step. mst resume 2nd step should be called after old + * state getting restored (i.e. drm_atomic_helper_resume()). + */ + resume_mst_branch_status(mgr); } } drm_connector_list_iter_end(&iter); - - if (need_hotplug) - drm_kms_helper_hotplug_event(dev); } static int amdgpu_dm_smu_write_watermarks_table(struct amdgpu_device *adev) @@ -2768,7 +2813,8 @@ static int dm_resume(void *handle) struct dm_atomic_state *dm_state = to_dm_atomic_state(dm->atomic_obj.state); enum dc_connection_type new_connection_type = dc_connection_none; struct dc_state *dc_state; - int i, r, j; + int i, r, j, ret; + bool need_hotplug = false; if (amdgpu_in_reset(adev)) { dc_state = dm->cached_dc_state; @@ -2866,7 +2912,7 @@ static int dm_resume(void *handle) continue; /* - * this is the case when traversing through already created + * this is the case when traversing through already created end sink * MST connectors, should be skipped */ if (aconnector && aconnector->mst_port) @@ -2926,6 +2972,27 @@ static int dm_resume(void *handle) dm->cached_state = NULL; + /* Do mst topology probing after resuming cached state*/ + drm_connector_list_iter_begin(ddev, &iter); + drm_for_each_connector_iter(connector, &iter) { + aconnector = to_amdgpu_dm_connector(connector); + if (aconnector->dc_link->type != dc_connection_mst_branch || + aconnector->mst_port) + continue; + + ret = drm_dp_mst_topology_mgr_resume(&aconnector->mst_mgr, true); + + if (ret < 0) { + dm_helpers_dp_mst_stop_top_mgr(aconnector->dc_link->ctx, + aconnector->dc_link); + need_hotplug = true; + } + } + drm_connector_list_iter_end(&iter); + + if (need_hotplug) + drm_kms_helper_hotplug_event(ddev); + amdgpu_dm_irq_resume_late(adev); amdgpu_dm_smu_write_watermarks_table(adev); -- 2.34.1

2 years

2
1
0 0

[PATCH stable 4.14.y] vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF

by Suraj Jitindar Singh

From: George Kennedy <george.kennedy(a)oracle.com> commit 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 upstream. After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port_destruct(). Because of that, the struct vc_data pointer must be reloaded in the while loop in vcs_write() after console_lock() to avoid a UAF when vcs_size() is called. Syzkaller reported a UAF in vcs_size(). BUG: KASAN: slab-use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8880beab89a8 by task repro_vcs_size/4119 Call Trace: <TASK> __asan_report_load4_noabort (mm/kasan/report_generic.c:380) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_write (drivers/tty/vt/vc_screen.c:664) vfs_write (fs/read_write.c:582 fs/read_write.c:564) ... <TASK> Allocated by task 1213: kmalloc_trace (mm/slab_common.c:1064) vc_allocate (./include/linux/slab.h:559 ./include/linux/slab.h:680 drivers/tty/vt/vt.c:1078 drivers/tty/vt/vt.c:1058) con_install (drivers/tty/vt/vt.c:3334) tty_init_dev (drivers/tty/tty_io.c:1303 drivers/tty/tty_io.c:1415 drivers/tty/tty_io.c:1392) tty_open (drivers/tty/tty_io.c:2082 drivers/tty/tty_io.c:2128) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:921) vfs_open (fs/open.c:1052) ... Freed by task 4116: kfree (mm/slab_common.c:1016) vc_port_destruct (drivers/tty/vt/vt.c:1044) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2778) ... The buggy address belongs to the object at ffff8880beab8800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of freed 1024-byte region [ffff8880beab8800, ffff8880beab8c00) The buggy address belongs to the physical page: page:00000000afc77580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbeab8 head:00000000afc77580 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 000fffffc0010200 ffff888100042dc0 ffffea000426de00 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880beab8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880beab8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880beab8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint Fixes: ac751efa6a0d ("console: rename acquire/release_console_sem() to console_lock/unlock()") Cc: stable <stable(a)kernel.org> Reported-by: syzkaller <syzkaller(a)googlegroups.com> Signed-off-by: George Kennedy <george.kennedy(a)oracle.com> Reviewed-by: Thomas Weißschuh <linux(a)weissschuh.net> Link: https://lore.kernel.org/r/1683889728-10411-1-git-send-email-george.kennedy@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ Adjust context due to missing commit 71d4abfab322 ("vc_screen: rewrite vcs_size to accept vc, not inode") in 4.14.y stable ] Signed-off-by: Suraj Jitindar Singh <surajjs(a)amazon.com> --- drivers/tty/vt/vc_screen.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c index 85b6634f518a..42c9ef64108f 100644 --- a/drivers/tty/vt/vc_screen.c +++ b/drivers/tty/vt/vc_screen.c @@ -437,10 +437,17 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) } } - /* The vcs_size might have changed while we slept to grab - * the user buffer, so recheck. + /* The vc might have been freed or vcs_size might have changed + * while we slept to grab the user buffer, so recheck. * Return data written up to now on failure. */ + vc = vcs_vc(inode, &viewed); + if (!vc) { + if (written) + break; + ret = -ENXIO; + goto unlock_out; + } size = vcs_size(inode); if (size < 0) { if (written) -- 2.34.1

2 years

2
1
0 0

FAILED: patch "[PATCH] arm64: cpufeature: Fix CLRBHB and BC detection" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 479965a2b7ec481737df0cadf553331063b9c343 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023100424-cheer-freeness-471f@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 479965a2b7ec481737df0cadf553331063b9c343 Mon Sep 17 00:00:00 2001 From: Kristina Martsenko <kristina.martsenko(a)arm.com> Date: Tue, 12 Sep 2023 14:34:29 +0100 Subject: [PATCH] arm64: cpufeature: Fix CLRBHB and BC detection ClearBHB support is indicated by the CLRBHB field in ID_AA64ISAR2_EL1. Following some refactoring the kernel incorrectly checks the BC field instead. Fix the detection to use the right field. (Note: The original ClearBHB support had it as FTR_HIGHER_SAFE, but this patch uses FTR_LOWER_SAFE, which seems more correct.) Also fix the detection of BC (hinted conditional branches) to use FTR_LOWER_SAFE, so that it is not reported on mismatched systems. Fixes: 356137e68a9f ("arm64/sysreg: Make BHB clear feature defines match the architecture") Fixes: 8fcc8285c0e3 ("arm64/sysreg: Convert ID_AA64ISAR2_EL1 to automatic generation") Cc: stable(a)vger.kernel.org Signed-off-by: Kristina Martsenko <kristina.martsenko(a)arm.com> Reviewed-by: Mark Brown <broonie(a)kernel.org> Link: https://lore.kernel.org/r/20230912133429.2606875-1-kristina.martsenko@arm.c… Signed-off-by: Will Deacon <will(a)kernel.org> diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h index 96e50227f940..5bba39376055 100644 --- a/arch/arm64/include/asm/cpufeature.h +++ b/arch/arm64/include/asm/cpufeature.h @@ -663,7 +663,7 @@ static inline bool supports_clearbhb(int scope) isar2 = read_sanitised_ftr_reg(SYS_ID_AA64ISAR2_EL1); return cpuid_feature_extract_unsigned_field(isar2, - ID_AA64ISAR2_EL1_BC_SHIFT); + ID_AA64ISAR2_EL1_CLRBHB_SHIFT); } const struct cpumask *system_32bit_el0_cpumask(void); diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index b018ae12ff5f..444a73c2e638 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -222,7 +222,8 @@ static const struct arm64_ftr_bits ftr_id_aa64isar1[] = { static const struct arm64_ftr_bits ftr_id_aa64isar2[] = { ARM64_FTR_BITS(FTR_VISIBLE, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64ISAR2_EL1_CSSC_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64ISAR2_EL1_RPRFM_SHIFT, 4, 0), - ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, ID_AA64ISAR2_EL1_BC_SHIFT, 4, 0), + ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR2_EL1_CLRBHB_SHIFT, 4, 0), + ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR2_EL1_BC_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR2_EL1_MOPS_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE_IF_IS_ENABLED(CONFIG_ARM64_PTR_AUTH), FTR_STRICT, FTR_EXACT, ID_AA64ISAR2_EL1_APA3_SHIFT, 4, 0), diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg index 2517ef7c21cf..76ce150e7347 100644 --- a/arch/arm64/tools/sysreg +++ b/arch/arm64/tools/sysreg @@ -1347,7 +1347,11 @@ UnsignedEnum 51:48 RPRFM 0b0000 NI 0b0001 IMP EndEnum -Res0 47:28 +Res0 47:32 +UnsignedEnum 31:28 CLRBHB + 0b0000 NI + 0b0001 IMP +EndEnum UnsignedEnum 27:24 PAC_frac 0b0000 NI 0b0001 IMP

2 years

3
2
0 0

[PATCH 6.1 0/3] net: add sysctl accept_ra_min_lft

by Patrick Rohr

This series adds a new sysctl accept_ra_min_lft which enforces a minimum lifetime value for individual RA sections; in particular, router lifetime, PIO preferred lifetime, and RIO lifetime. If any of those lifetimes are lower than the configured value, the specific RA section is ignored. This fixes a potential denial of service attack vector where rogue WiFi routers (or devices) can send RAs with low lifetimes to actively drain a mobile device's battery (by preventing sleep). In addition to this change, Android uses hardware offloads to drop RAs for a fraction of the minimum of all lifetimes present in the RA (some networks have very frequent RAs (5s) with high lifetimes (2h)). Despite this, we have encountered networks that set the router lifetime to 30s which results in very frequent CPU wakeups. Instead of disabling IPv6 (and dropping IPv6 ethertype in the WiFi firmware) entirely on such networks, misconfigured routers must be ignored while still processing RAs from other IPv6 routers on the same network (i.e. to support IoT applications). Patches: - 1671bcfd76fd ("net: add sysctl accept_ra_min_rtr_lft") - 5027d54a9c30 ("net: change accept_ra_min_rtr_lft to affect all RA lifetimes") - 5cb249686e67 ("net: release reference to inet6_dev pointer") Patrick Rohr (3): net: add sysctl accept_ra_min_rtr_lft net: change accept_ra_min_rtr_lft to affect all RA lifetimes net: release reference to inet6_dev pointer Documentation/networking/ip-sysctl.rst | 8 ++++++++ include/linux/ipv6.h | 1 + include/uapi/linux/ipv6.h | 1 + net/ipv6/addrconf.c | 13 +++++++++++++ net/ipv6/ndisc.c | 13 +++++++++++-- 5 files changed, 34 insertions(+), 2 deletions(-) -- 2.42.0.515.g380fc7ccd1-goog

2 years

4
12
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror October 2023