July 2024 - Linux-stable-mirror

[PATCH v3 0/2] media: qcom: camss: Fix two CAMSS bugs found by dogfooding with SoftISP

by Bryan O'Donoghue

v3: - Amends the commit log for patch #1 per Johan's suggestion. - Link to v2: https://lore.kernel.org/r/20240716-linux-next-24-07-13-camss-fixes-v2-0-e60… v2: - Updates commits with Johan's Review/Reported tags - Adds Closes: https://lore.kernel.org/lkml/ZoVNHOTI0PKMNt4_@hovoldconsulting.com - Cc's stable - Adds in suggested kernel log to allow others to more easily match kernel log to fixes - Link to v1: https://lore.kernel.org/r/20240714-linux-next-24-07-13-camss-fixes-v1-0-8f8… V1: Dogfooding with SoftISP has uncovered two bugs in this series which I'm posting fixes for. - The first error: A simple race condition which to be honest I'm surprised I haven't found earlier nor has anybody else. Simply stated the order we typically end up loading CAMSS on boot has masked out the pm_runtime_enable() race condition that has been present in CAMSS for a long time. If you blacklist qcom-camss in modules.d and then modprobe after boot, the race condition shows up easily. Moving the pm_runtime_enable prior to subdevice registration fixes the problem. The second error: Nomenclature: - CSIPHY: CSI Physical layer analogue to digital domain serialiser - CSID: CSI Decoder - VFE: Video Front End - RDI: Raw Data Interface - VC: Virtual Channel In order to support streaming multiple virtual-channels on the same RDI a V4L2 provided use_count variable is used to decide whether or not to actually terminate streaming and release buffers for 'msm_vfe_rdiX'. Unfortunately use_count indicates the number of times msm_vfe_rdiX has been opened by user-space not the number of concurrent streams on msm_vfe_rdiX. Simply stated use_count and stream_count are two different things. The silicon enabling code to select between VCs is valid but, a different solution needs to be found to support _concurrent_ VC streams. Right now the upstream use_count as-is is breaking the non concurrent VC case and I don't believe there are upstream users of concurrent VCs on CAMSS. This series implements a revert for the invalid use_count check, retaining the ability to select which VC is active on the RDI. Dogfooding with libcamera's SoftISP in Hangouts, Zoom and multiple runs of libcamera's "qcam" application is a very different test-case to the simple capture of frames we previously did when validating the 'use_count' change. A partial revert in expectation of a renewed push to fixup that concurrent VC issue is included. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> --- Bryan O'Donoghue (2): media: qcom: camss: Remove use_count guard in stop_streaming media: qcom: camss: Fix ordering of pm_runtime_enable drivers/media/platform/qcom/camss/camss-video.c | 6 ------ drivers/media/platform/qcom/camss/camss.c | 5 +++-- 2 files changed, 3 insertions(+), 8 deletions(-) --- base-commit: c6ce8f9ab92edc9726996a0130bfc1c408132d47 change-id: 20240713-linux-next-24-07-13-camss-fixes-fa98c0965a5d Best regards, -- Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>

6 months, 1 week

3
4
0 0

[PATCH V2] mm/gup: Clear the LRU flag of a page before adding to LRU batch

by yangge1116＠126.com

From: yangge <yangge1116(a)126.com> If a large number of CMA memory are configured in system (for example, the CMA memory accounts for 50% of the system memory), starting a virtual virtual machine, it will call pin_user_pages_remote(..., FOLL_LONGTERM, ...) to pin memory. Normally if a page is present and in CMA area, pin_user_pages_remote() will migrate the page from CMA area to non-CMA area because of FOLL_LONGTERM flag. But the current code will cause the migration failure due to unexpected page refcounts, and eventually cause the virtual machine fail to start. If a page is added in LRU batch, its refcount increases one, remove the page from LRU batch decreases one. Page migration requires the page is not referenced by others except page mapping. Before migrating a page, we should try to drain the page from LRU batch in case the page is in it, however, folio_test_lru() is not sufficient to tell whether the page is in LRU batch or not, if the page is in LRU batch, the migration will fail. To solve the problem above, we modify the logic of adding to LRU batch. Before adding a page to LRU batch, we clear the LRU flag of the page so that we can check whether the page is in LRU batch by folio_test_lru(page). Seems making the LRU flag of the page invisible a long time is no problem, because a new page is allocated from buddy and added to the lru batch, its LRU flag is also not visible for a long time. Cc: <stable(a)vger.kernel.org> Signed-off-by: yangge <yangge1116(a)126.com> --- mm/swap.c | 43 +++++++++++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 12 deletions(-) diff --git a/mm/swap.c b/mm/swap.c index dc205bd..9caf6b0 100644 --- a/mm/swap.c +++ b/mm/swap.c @@ -211,10 +211,6 @@ static void folio_batch_move_lru(struct folio_batch *fbatch, move_fn_t move_fn) for (i = 0; i < folio_batch_count(fbatch); i++) { struct folio *folio = fbatch->folios[i]; - /* block memcg migration while the folio moves between lru */ - if (move_fn != lru_add_fn && !folio_test_clear_lru(folio)) - continue; - folio_lruvec_relock_irqsave(folio, &lruvec, &flags); move_fn(lruvec, folio); @@ -255,11 +251,16 @@ static void lru_move_tail_fn(struct lruvec *lruvec, struct folio *folio) void folio_rotate_reclaimable(struct folio *folio) { if (!folio_test_locked(folio) && !folio_test_dirty(folio) && - !folio_test_unevictable(folio) && folio_test_lru(folio)) { + !folio_test_unevictable(folio)) { struct folio_batch *fbatch; unsigned long flags; folio_get(folio); + if (!folio_test_clear_lru(folio)) { + folio_put(folio); + return; + } + local_lock_irqsave(&lru_rotate.lock, flags); fbatch = this_cpu_ptr(&lru_rotate.fbatch); folio_batch_add_and_move(fbatch, folio, lru_move_tail_fn); @@ -352,11 +353,15 @@ static void folio_activate_drain(int cpu) void folio_activate(struct folio *folio) { - if (folio_test_lru(folio) && !folio_test_active(folio) && - !folio_test_unevictable(folio)) { + if (!folio_test_active(folio) && !folio_test_unevictable(folio)) { struct folio_batch *fbatch; folio_get(folio); + if (!folio_test_clear_lru(folio)) { + folio_put(folio); + return; + } + local_lock(&cpu_fbatches.lock); fbatch = this_cpu_ptr(&cpu_fbatches.activate); folio_batch_add_and_move(fbatch, folio, folio_activate_fn); @@ -700,6 +705,11 @@ void deactivate_file_folio(struct folio *folio) return; folio_get(folio); + if (!folio_test_clear_lru(folio)) { + folio_put(folio); + return; + } + local_lock(&cpu_fbatches.lock); fbatch = this_cpu_ptr(&cpu_fbatches.lru_deactivate_file); folio_batch_add_and_move(fbatch, folio, lru_deactivate_file_fn); @@ -716,11 +726,16 @@ void deactivate_file_folio(struct folio *folio) */ void folio_deactivate(struct folio *folio) { - if (folio_test_lru(folio) && !folio_test_unevictable(folio) && - (folio_test_active(folio) || lru_gen_enabled())) { + if (!folio_test_unevictable(folio) && (folio_test_active(folio) || + lru_gen_enabled())) { struct folio_batch *fbatch; folio_get(folio); + if (!folio_test_clear_lru(folio)) { + folio_put(folio); + return; + } + local_lock(&cpu_fbatches.lock); fbatch = this_cpu_ptr(&cpu_fbatches.lru_deactivate); folio_batch_add_and_move(fbatch, folio, lru_deactivate_fn); @@ -737,12 +752,16 @@ void folio_deactivate(struct folio *folio) */ void folio_mark_lazyfree(struct folio *folio) { - if (folio_test_lru(folio) && folio_test_anon(folio) && - folio_test_swapbacked(folio) && !folio_test_swapcache(folio) && - !folio_test_unevictable(folio)) { + if (folio_test_anon(folio) && folio_test_swapbacked(folio) && + !folio_test_swapcache(folio) && !folio_test_unevictable(folio)) { struct folio_batch *fbatch; folio_get(folio); + if (!folio_test_clear_lru(folio)) { + folio_put(folio); + return; + } + local_lock(&cpu_fbatches.lock); fbatch = this_cpu_ptr(&cpu_fbatches.lru_lazyfree); folio_batch_add_and_move(fbatch, folio, lru_lazyfree_fn); -- 2.7.4

6 months, 1 week

8
26
0 0

[PATCH] usb: gadget: dummy_hcd: execute hrtimer callback in softirq context

by andrey.konovalov＠linux.dev

From: Andrey Konovalov <andreyknvl(a)gmail.com> Commit a7f3813e589f ("usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler") switched dummy_hcd to use hrtimer and made the timer's callback be executed in the hardirq context. With that change, __usb_hcd_giveback_urb now gets executed in the hardirq context, which causes problems for KCOV and KMSAN. One problem is that KCOV now is unable to collect coverage from the USB code that gets executed from the dummy_hcd's timer callback, as KCOV cannot collect coverage in the hardirq context. Another problem is that the dummy_hcd hrtimer might get triggered in the middle of a softirq with KCOV remote coverage collection enabled, and that causes a WARNING in KCOV, as reported by syzbot. (I sent a separate patch to shut down this WARNING, but that doesn't fix the other two issues.) Finally, KMSAN appears to ignore tracking memory copying operations that happen in the hardirq context, which causes false positive kernel-infoleaks, as reported by syzbot. Change the hrtimer in dummy_hcd to execute the callback in the softirq context. Reported-by: syzbot+2388cdaeb6b10f0c13ac(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2388cdaeb6b10f0c13ac Reported-by: syzbot+17ca2339e34a1d863aad(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=17ca2339e34a1d863aad Fixes: a7f3813e589f ("usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler") Cc: stable(a)vger.kernel.org Signed-off-by: Andrey Konovalov <andreyknvl(a)gmail.com> --- Marcello, would this change be acceptable for your use case? If we wanted to keep the hardirq hrtimer, we would need teach KCOV to collect coverage in the hardirq context (or disable it, which would be unfortunate) and also fix whatever is wrong with KMSAN, but all that requires some work. --- drivers/usb/gadget/udc/dummy_hcd.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c index f37b0d8386c1a..ff7bee78bcc49 100644 --- a/drivers/usb/gadget/udc/dummy_hcd.c +++ b/drivers/usb/gadget/udc/dummy_hcd.c @@ -1304,7 +1304,8 @@ static int dummy_urb_enqueue( /* kick the scheduler, it'll do the rest */ if (!hrtimer_active(&dum_hcd->timer)) - hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), + HRTIMER_MODE_REL_SOFT); done: spin_unlock_irqrestore(&dum_hcd->dum->lock, flags); @@ -1325,7 +1326,7 @@ static int dummy_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) rc = usb_hcd_check_unlink_urb(hcd, urb, status); if (!rc && dum_hcd->rh_state != DUMMY_RH_RUNNING && !list_empty(&dum_hcd->urbp_list)) - hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL_SOFT); spin_unlock_irqrestore(&dum_hcd->dum->lock, flags); return rc; @@ -1995,7 +1996,8 @@ static enum hrtimer_restart dummy_timer(struct hrtimer *t) dum_hcd->udev = NULL; } else if (dum_hcd->rh_state == DUMMY_RH_RUNNING) { /* want a 1 msec delay here */ - hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), + HRTIMER_MODE_REL_SOFT); } spin_unlock_irqrestore(&dum->lock, flags); @@ -2389,7 +2391,7 @@ static int dummy_bus_resume(struct usb_hcd *hcd) dum_hcd->rh_state = DUMMY_RH_RUNNING; set_link_state(dum_hcd); if (!list_empty(&dum_hcd->urbp_list)) - hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL_SOFT); hcd->state = HC_STATE_RUNNING; } spin_unlock_irq(&dum_hcd->dum->lock); @@ -2467,7 +2469,7 @@ static DEVICE_ATTR_RO(urbs); static int dummy_start_ss(struct dummy_hcd *dum_hcd) { - hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); dum_hcd->timer.function = dummy_timer; dum_hcd->rh_state = DUMMY_RH_RUNNING; dum_hcd->stream_en_ep = 0; @@ -2497,7 +2499,7 @@ static int dummy_start(struct usb_hcd *hcd) return dummy_start_ss(dum_hcd); spin_lock_init(&dum_hcd->dum->lock); - hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); dum_hcd->timer.function = dummy_timer; dum_hcd->rh_state = DUMMY_RH_RUNNING; -- 2.25.1

6 months, 1 week

6
8
0 0

[PATCH 6.6 000/166] 6.6.8-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.8 release. There are 166 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 20 Dec 2023 13:50:31 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.8-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.8-rc1 Patrisious Haddad <phaddad(a)nvidia.com> RDMA/mlx5: Change the key being sent for MPV device affiliation Fangrui Song <maskray(a)google.com> x86/speculation, objtool: Use absolute relocations for annotations Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Have rb_time_cmpxchg() set the msb counter too Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Do not try to put back write_stamp Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Fix writing to the buffer with max_data_size Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Have saved event hold the entire event Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Do not update before stamp when switching sub-buffers Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Update snapshot buffer on resize if it is allocated Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Fix memory leak of free page Paulo Alcantara <pc(a)manguebit.com> smb: client: fix OOB in smb2_query_reparse_point() Paulo Alcantara <pc(a)manguebit.com> smb: client: fix NULL deref in asn1_ber_decoder() Paulo Alcantara <pc(a)manguebit.com> smb: client: fix potential OOBs in smb2_parse_contexts() Paulo Alcantara <pc(a)manguebit.com> smb: client: fix OOB in receive_encrypted_standard() Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Fix remapped stride with CCS on ADL+ Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Fix intel_atomic_setup_scalers() plane_state handling Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Fix ADL+ tiled plane stride when the POT stride is smaller than the original Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Disable PSR-SU on Parade 0803 TCON again Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Restore guard against default backlight value < 1 nit Jani Nikula <jani.nikula(a)intel.com> drm/edid: also call add modes in EDID connector update fallback Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix tear down order in amdgpu_vm_pt_free Boris Burkov <boris(a)bur.io> btrfs: don't clear qgroup reserved bit in release_folio Boris Burkov <boris(a)bur.io> btrfs: fix qgroup_free_reserved_data int overflow Boris Burkov <boris(a)bur.io> btrfs: free qgroup reserve when ORDERED_IOERR is set Ignat Korchagin <ignat(a)cloudflare.com> kexec: drop dependency on ARCH_SUPPORTS_KEXEC from CRASH_DUMP David Stevens <stevensd(a)chromium.org> mm/shmem: fix race in shmem_undo_range w/THP Yu Zhao <yuzhao(a)google.com> mm/mglru: reclaim offlined memcgs harder Yu Zhao <yuzhao(a)google.com> mm/mglru: respect min_ttl_ms with memcgs Yu Zhao <yuzhao(a)google.com> mm/mglru: try to stop at high watermarks Yu Zhao <yuzhao(a)google.com> mm/mglru: fix underprotected page cache Frank Li <Frank.Li(a)nxp.com> dmaengine: fsl-edma: fix DMA channel leak in eDMAv4 Amelie Delaunay <amelie.delaunay(a)foss.st.com> dmaengine: stm32-dma: avoid bitfield overflow assertion Stuart Lee <stuart.lee(a)mediatek.com> drm/mediatek: Fix access violation in mtk_drm_crtc_dma_dev_get Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.2: add begin/end_use ring callbacks Florent Revest <revest(a)chromium.org> team: Fix use-after-free when an option instance allocation fails James Houghton <jthoughton(a)google.com> arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify John Hubbard <jhubbard(a)nvidia.com> Revert "selftests: error out if kernel header files are not yet built" Baokun Li <libaokun1(a)huawei.com> ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soundwire: stream: fix NULL pointer dereference for multi_link Dan Williams <dan.j.williams(a)intel.com> cxl/hdm: Fix dpa translation locking Josef Bacik <josef(a)toxicpanda.com> btrfs: do not allow non subvolume root targets for snapshot Mark Rutland <mark.rutland(a)arm.com> perf: Fix perf_event_validate_size() lockdep splat Denis Benato <benato.denis96(a)gmail.com> HID: hid-asus: add const to read-only outgoing usb buffer Masahiro Yamada <masahiroy(a)kernel.org> arm64: add dependency between vmlinuz.efi and Image Paulo Alcantara <pc(a)manguebit.com> smb: client: set correct file type from NFS reparse points Paulo Alcantara <pc(a)manguebit.com> smb: client: introduce ->parse_reparse_point() Paulo Alcantara <pc(a)manguebit.com> smb: client: implement ->query_reparse_point() for SMB1 Lech Perczak <lech.perczak(a)gmail.com> net: usb: qmi_wwan: claim interface 4 for ZTE MF290 Steven Rostedt (Google) <rostedt(a)goodmis.org> eventfs: Do not allow NULL parent to eventfs_start_creating() Linus Torvalds <torvalds(a)linux-foundation.org> asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation Heiko Carstens <hca(a)linux.ibm.com> scripts/checkstack.pl: match all stack sizes for s390 Nguyen Dinh Phi <phind.uet(a)gmail.com> nfc: virtual_ncidev: Add variable to check if ndev is running Aoba K <nexp_0x17(a)outlook.com> HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad Denis Benato <benato.denis96(a)gmail.com> HID: hid-asus: reset the backlight brightness level on resume Li Nan <linan122(a)huawei.com> nbd: pass nbd_sock to nbd_read_reply() instead of index Oliver Neukum <oneukum(a)suse.com> HID: add ALWAYS_POLL quirk for Apple kb Brett Raye <braye(a)fastmail.com> HID: glorious: fix Glorious Model I HID report Yihong Cao <caoyihong4(a)outlook.com> HID: apple: add Jamesdonkey and A3R to non-apple keyboards list Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> HID: mcp2221: Allow IO to start during probe Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> HID: mcp2221: Set driver data before I2C adapter add Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> platform/x86: intel_telemetry: Fix kernel doc descriptions Bibo Mao <maobibo(a)loongson.cn> LoongArch: Implement constant timer shutdown interface Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Mark {dmw,tlb}_virt_to_page() exports as non-GPL Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Silence the boot warning about 'nokaslr' WANG Rui <wangrui(a)loongson.cn> LoongArch: Record pc instead of offset in la_abs relocation Masahiro Yamada <masahiroy(a)kernel.org> LoongArch: Add dependency between vmlinuz.efi and vmlinux.efi Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: fix bpf_loop_bench for new callback verification scheme Hannes Reinecke <hare(a)suse.de> nvme: catch errors from nvme_configure_metadata() Mark O'Donovan <shiftee(a)posteo.net> nvme-auth: set explanation code for failure2 msgs Li Nan <linan122(a)huawei.com> nbd: fix null-ptr-dereference while accessing 'nbd->config' Li Nan <linan122(a)huawei.com> nbd: factor out a helper to get nbd_config without holding 'config_lock' Li Nan <linan122(a)huawei.com> nbd: fold nbd config initialization into nbd_alloc_config() Coly Li <colyli(a)suse.de> bcache: avoid NULL checking to c->root in run_cache_set() Coly Li <colyli(a)suse.de> bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() Colin Ian King <colin.i.king(a)gmail.com> bcache: remove redundant assignment to variable cur_idx Coly Li <colyli(a)suse.de> bcache: avoid oversize memory allocation by small stripe_size Ming Lei <ming.lei(a)redhat.com> blk-cgroup: bypass blkcg_deactivate_policy after destroying Ming Lei <ming.lei(a)redhat.com> blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" David Howells <dhowells(a)redhat.com> rxrpc: Fix some minor issues with bundle tracing Jean Delvare <jdelvare(a)suse.de> stmmac: dwmac-loongson: Add architecture dependency Oliver Neukum <oneukum(a)suse.com> usb: aqc111: check packet for fixup for true limit Saurabh Sengar <ssengar(a)linux.microsoft.com> x86/hyperv: Fix the detection of E820_TYPE_PRAM in a Gen2 VM David Hildenbrand <david(a)redhat.com> selftests/mm: cow: print ksft header before printing anything else Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> drm/i915: Use internal class when counting engine resets Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> drm/i915/selftests: Fix engine reset count storage for multi-tile Andrzej Kacprowski <Andrzej.Kacprowski(a)intel.com> accel/ivpu/37xx: Fix interrupt_clear_with_0 WA initialization Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> accel/ivpu: Print information about used workarounds Jason-JH.Lin <jason-jh.lin(a)mediatek.com> drm/mediatek: Add spinlock for setting vblank event in atomic_begin Michael Walle <mwalle(a)kernel.org> drm/mediatek: fix kernel oops if no crtc is found Johan Hovold <johan+linaro(a)kernel.org> PCI: vmd: Fix potential deadlock when enabling ASPM Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE Johan Hovold <johan+linaro(a)kernel.org> PCI/ASPM: Add pci_enable_link_state_locked() Jiaxun Yang <jiaxun.yang(a)flygoat.com> PCI: loongson: Limit MRRS to 256 Bjorn Helgaas <bhelgaas(a)google.com> Revert "PCI: acpiphp: Reassign resources on bridge if necessary" Gergo Koteles <soyer(a)irl.hu> ALSA: hda/tas2781: reset the amp before component_add Gergo Koteles <soyer(a)irl.hu> ALSA: hda/tas2781: call cleanup functions only once Gergo Koteles <soyer(a)irl.hu> ALSA: hda/tas2781: handle missing EFI calibration data Gergo Koteles <soyer(a)irl.hu> ALSA: hda/tas2781: leave hda_component in usable state Hartmut Knaack <knaack.h(a)gmx.de> ALSA: hda/realtek: Apply mute LED quirk for HP15-db Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB Al Viro <viro(a)zeniv.linux.org.uk> io_uring/cmd: fix breakage in SOCKET_URING_OP_SIOC* implementation Hangyu Hua <hbh25y(a)gmail.com> fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() Amir Goldstein <amir73il(a)gmail.com> fuse: disable FOPEN_PARALLEL_DIRECT_WRITES with FUSE_DIRECT_IO_ALLOW_MMAP Krister Johansen <kjlx(a)templeofstupid.com> fuse: share lookup state between submount and its parent Tyler Fanelli <tfanelli(a)redhat.com> fuse: Rename DIRECT_IO_RELAX to DIRECT_IO_ALLOW_MMAP Sebastian Parschauer <s.parschauer(a)gmx.de> HID: Add quirk for Labtec/ODDOR/aikeec handbrake Mario Limonciello <mario.limonciello(a)amd.com> HID: i2c-hid: Add IDEA5002 to i2c_hid_acpi_blacklist[] Jens Axboe <axboe(a)kernel.dk> cred: get rid of CONFIG_DEBUG_CREDENTIALS Jens Axboe <axboe(a)kernel.dk> cred: switch to using atomic_long_t Igor Russkikh <irusskikh(a)marvell.com> net: atlantic: fix double free in ring reinit logic Hyunwoo Kim <v4bel(a)theori.io> appletalk: Fix Use-After-Free in atalk_ioctl Andrew Halaney <ahalaney(a)redhat.com> net: stmmac: Handle disabled MDIO busses from devicetree Sneh Shah <quic_snehshah(a)quicinc.com> net: stmmac: dwmac-qcom-ethqos: Fix drops in 10M SGMII RX Ioana Ciornei <ioana.ciornei(a)nxp.com> dpaa2-switch: do not ask for MDB, VLAN and FDB replay Ioana Ciornei <ioana.ciornei(a)nxp.com> dpaa2-switch: fix size of the dma_unmap Nikolay Kuratov <kniv(a)yandex-team.ru> vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() Yusong Gao <a869920004(a)gmail.com> sign-file: Fix incorrect return values check Yanteng Si <siyanteng(a)loongson.cn> stmmac: dwmac-loongson: Make sure MDIO is initialized before use David Arinzon <darinzon(a)amazon.com> net: ena: Fix XDP redirection error David Arinzon <darinzon(a)amazon.com> net: ena: Fix DMA syncing in XDP path when SWIOTLB is on David Arinzon <darinzon(a)amazon.com> net: ena: Fix xdp drops handling due to multibuf packets David Arinzon <darinzon(a)amazon.com> net: ena: Destroy correct number of xdp queues upon failure Dong Chenchen <dongchenchen2(a)huawei.com> net: Remove acked SYN flag from packet in the transmit queue correctly Dinghao Liu <dinghao.liu(a)zju.edu.cn> qed: Fix a potential use-after-free in qed_cxt_tables_alloc Slawomir Laba <slawomirx.laba(a)intel.com> iavf: Fix iavf_shutdown to call iavf_remove instead iavf_close Piotr Gardocki <piotrx.gardocki(a)intel.com> iavf: Handle ntuple on/off based on new state machines for flow director Piotr Gardocki <piotrx.gardocki(a)intel.com> iavf: Introduce new state machines for flow director Hyunwoo Kim <v4bel(a)theori.io> net/rose: Fix Use-After-Free in rose_ioctl Hyunwoo Kim <v4bel(a)theori.io> atm: Fix Use-After-Free in do_vcc_ioctl Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Fix pause frame configuration Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Update RSS algorithm index Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-pf: Fix promisc mcam entry action Shinas Rasheed <srasheed(a)marvell.com> octeon_ep: explicitly test for firmware ready value Vlad Buslov <vladbu(a)nvidia.com> net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table Zhipeng Lu <alexious(a)zju.edu.cn> octeontx2-af: fix a use-after-free in rvu_nix_register_reporters Radu Bulie <radu-andrei.bulie(a)nxp.com> net: fec: correct queue selection Chengfeng Ye <dg573847474(a)gmail.com> atm: solos-pci: Fix potential deadlock on &tx_queue_lock Chengfeng Ye <dg573847474(a)gmail.com> atm: solos-pci: Fix potential deadlock on &cli_queue_lock Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Fix HWTSTAMP_FILTER_ALL packet timestamp logic Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> bnxt_en: Fix wrong return value check in bnxt_close_nic() Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> bnxt_en: Fix skb recycling logic in bnxt_deliver_skb() Somnath Kotur <somnath.kotur(a)broadcom.com> bnxt_en: Clear resource reservation during resume Stefan Wahren <wahrenst(a)gmx.net> qca_spi: Fix reset behavior Stefan Wahren <wahrenst(a)gmx.net> qca_debug: Fix ethtool -G iface tx behavior Stefan Wahren <wahrenst(a)gmx.net> qca_debug: Prevent crash on TX ring changes Maciej Żenczykowski <maze(a)google.com> net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX Dan Carpenter <dan.carpenter(a)linaro.org> net/mlx5: Fix a NULL vs IS_ERR() check Gavin Li <gavinl(a)nvidia.com> net/mlx5e: Check netdev pointer before checking its net ns Moshe Shemesh <moshe(a)nvidia.com> net/mlx5: Nack sync reset request when HotPlug is enabled Chris Mi <cmi(a)nvidia.com> net/mlx5e: TC, Don't offload post action rule if not supported Moshe Shemesh <moshe(a)nvidia.com> net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work Chris Mi <cmi(a)nvidia.com> net/mlx5e: Disable IPsec offload support if not FW steering Patrisious Haddad <phaddad(a)nvidia.com> RDMA/mlx5: Send events from IB driver about device affiliation state Jianbo Liu <jianbol(a)nvidia.com> net/mlx5e: Check the number of elements before walk TC rhashtable Jianbo Liu <jianbol(a)nvidia.com> net/mlx5e: Reduce eswitch mode_lock protection context Leon Romanovsky <leon(a)kernel.org> net/mlx5e: Tidy up IPsec NAT-T SA discovery Patrisious Haddad <phaddad(a)nvidia.com> net/mlx5e: Unify esw and normal IPsec status table creation/destruction Leon Romanovsky <leon(a)kernel.org> net/mlx5e: Ensure that IPsec sequence packet number starts from 1 Leon Romanovsky <leon(a)kernel.org> net/mlx5e: Honor user choice of IPsec replay window size Mikhail Khvainitski <me(a)khvoinitsky.org> HID: lenovo: Restrict detection of patched firmware only to USB cptkbd David Howells <dhowells(a)redhat.com> afs: Fix refcount underflow from error handling race Ard Biesheuvel <ardb(a)kernel.org> efi/x86: Avoid physical KASLR on older Dell systems Zizhi Wo <wozizhi(a)huawei.com> ksmbd: fix memory leak in smb2_lock() Jan Kara <jack(a)suse.cz> ext4: fix warning in ext4_dio_write_end_io() Kelly Kane <kelly(a)hawknetworks.com> r8152: add vendor/device ID pair for ASUS USB-C2500 ------------- Diffstat: Makefile | 4 +- arch/arm64/Makefile | 2 +- arch/arm64/include/asm/pgtable.h | 6 + arch/loongarch/Makefile | 2 + arch/loongarch/include/asm/asmmacro.h | 3 +- arch/loongarch/include/asm/setup.h | 2 +- arch/loongarch/kernel/relocate.c | 10 +- arch/loongarch/kernel/time.c | 27 +-- arch/loongarch/mm/pgtable.c | 4 +- arch/powerpc/configs/skiroot_defconfig | 1 - arch/riscv/Kconfig | 4 +- arch/riscv/kernel/crash_core.c | 4 +- arch/s390/configs/debug_defconfig | 1 - arch/x86/hyperv/hv_init.c | 25 ++- arch/x86/include/asm/alternative.h | 4 +- arch/x86/include/asm/nospec-branch.h | 4 +- block/blk-cgroup.c | 13 ++ block/blk-throttle.c | 2 + drivers/accel/ivpu/ivpu_drv.h | 5 + drivers/accel/ivpu/ivpu_hw_37xx.c | 17 +- drivers/accel/ivpu/ivpu_hw_40xx.c | 4 + drivers/atm/solos-pci.c | 8 +- drivers/block/nbd.c | 117 ++++++---- drivers/cxl/core/hdm.c | 3 +- drivers/cxl/core/port.c | 4 +- drivers/dma/fsl-edma-common.c | 1 + drivers/dma/stm32-dma.c | 8 +- drivers/firmware/efi/libstub/x86-stub.c | 31 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 3 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 28 +++ .../dc/link/protocols/link_edp_panel_control.c | 4 +- .../drm/amd/display/modules/power/power_helpers.c | 2 + drivers/gpu/drm/drm_edid.c | 3 +- drivers/gpu/drm/i915/display/intel_fb.c | 19 +- drivers/gpu/drm/i915/display/skl_scaler.c | 2 +- drivers/gpu/drm/i915/gt/intel_reset.c | 2 +- drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 5 +- drivers/gpu/drm/i915/i915_gpu_error.h | 12 +- drivers/gpu/drm/i915/selftests/igt_live_test.c | 9 +- drivers/gpu/drm/i915/selftests/igt_live_test.h | 3 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 14 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 +- drivers/hid/hid-apple.c | 2 + drivers/hid/hid-asus.c | 27 ++- drivers/hid/hid-glorious.c | 16 +- drivers/hid/hid-ids.h | 12 +- drivers/hid/hid-lenovo.c | 3 +- drivers/hid/hid-mcp2221.c | 4 +- drivers/hid/hid-multitouch.c | 5 + drivers/hid/hid-quirks.c | 2 + drivers/hid/i2c-hid/i2c-hid-acpi.c | 5 + drivers/infiniband/hw/mlx5/main.c | 17 ++ drivers/md/bcache/bcache.h | 1 + drivers/md/bcache/btree.c | 7 + drivers/md/bcache/super.c | 4 +- drivers/md/bcache/writeback.c | 2 +- drivers/net/ethernet/amazon/ena/ena_eth_com.c | 3 - drivers/net/ethernet/amazon/ena/ena_netdev.c | 53 +++-- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 38 +++- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 10 +- drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 11 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 19 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 5 +- .../ethernet/freescale/dpaa2/dpaa2-switch-flower.c | 7 +- .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 11 +- drivers/net/ethernet/freescale/fec_main.c | 27 +-- drivers/net/ethernet/intel/iavf/iavf.h | 1 + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 27 ++- drivers/net/ethernet/intel/iavf/iavf_fdir.h | 15 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 179 ++++++++++----- drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 71 +++++- .../net/ethernet/marvell/octeon_ep/octep_main.c | 3 +- drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 11 +- .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 55 ++++- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 25 ++- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + .../ethernet/mellanox/mlx5/core/en/tc/post_act.c | 6 + .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 56 +++-- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 222 +++++++++++++----- .../mellanox/mlx5/core/en_accel/ipsec_offload.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 27 ++- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 25 ++- .../net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 154 +------------ .../net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.h | 15 -- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 35 +-- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 + .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 56 +++-- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 29 +++ drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 1 + drivers/net/ethernet/qualcomm/qca_debug.c | 17 +- drivers/net/ethernet/qualcomm/qca_spi.c | 20 +- drivers/net/ethernet/stmicro/stmmac/Kconfig | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 14 +- .../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 10 + drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 6 +- drivers/net/team/team.c | 4 +- drivers/net/usb/aqc111.c | 8 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/r8152.c | 1 + drivers/nfc/virtual_ncidev.c | 7 +- drivers/nvme/host/auth.c | 2 + drivers/nvme/host/core.c | 19 +- drivers/pci/controller/pci-loongson.c | 46 +++- drivers/pci/controller/vmd.c | 2 +- drivers/pci/hotplug/acpiphp_glue.c | 9 +- drivers/pci/pcie/aspm.c | 53 +++-- drivers/platform/x86/intel/telemetry/core.c | 4 +- drivers/soundwire/stream.c | 7 +- fs/afs/rxrpc.c | 2 +- fs/btrfs/delalloc-space.c | 2 +- fs/btrfs/extent_io.c | 3 +- fs/btrfs/file.c | 2 +- fs/btrfs/inode.c | 16 +- fs/btrfs/ioctl.c | 9 + fs/btrfs/ordered-data.c | 11 +- fs/btrfs/qgroup.c | 25 ++- fs/btrfs/qgroup.h | 4 +- fs/ext4/file.c | 14 +- fs/ext4/mballoc.c | 4 + fs/fuse/dax.c | 1 + fs/fuse/file.c | 8 +- fs/fuse/fuse_i.h | 19 +- fs/fuse/inode.c | 81 ++++++- fs/nfsd/auth.c | 4 - fs/nfsd/nfssvc.c | 1 - fs/nfsd/vfs.c | 9 +- fs/open.c | 3 - fs/smb/client/cached_dir.c | 17 +- fs/smb/client/cifsglob.h | 14 +- fs/smb/client/cifspdu.h | 4 +- fs/smb/client/cifsproto.h | 11 +- fs/smb/client/cifssmb.c | 191 +++++++--------- fs/smb/client/inode.c | 74 ++++-- fs/smb/client/readdir.c | 6 +- fs/smb/client/smb1ops.c | 73 ++---- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smb2misc.c | 26 +-- fs/smb/client/smb2ops.c | 176 ++++++++------- fs/smb/client/smb2pdu.c | 95 ++++---- fs/smb/client/smb2proto.h | 12 +- fs/smb/common/smb2pdu.h | 2 +- fs/smb/server/smb2pdu.c | 1 + fs/tracefs/inode.c | 13 +- include/asm-generic/qspinlock.h | 2 +- include/linux/cred.h | 58 +---- include/linux/mlx5/device.h | 2 + include/linux/mlx5/driver.h | 2 + include/linux/mlx5/mlx5_ifc.h | 9 +- include/linux/mm_inline.h | 23 +- include/linux/mmzone.h | 34 +-- include/linux/objtool.h | 10 +- include/linux/pci.h | 3 + include/linux/usb/r8152.h | 1 + include/net/addrconf.h | 12 +- include/net/if_inet6.h | 4 - include/net/netfilter/nf_flow_table.h | 10 + include/uapi/linux/fuse.h | 10 +- io_uring/uring_cmd.c | 2 +- kernel/Kconfig.kexec | 1 - kernel/cred.c | 248 +++------------------ kernel/events/core.c | 10 + kernel/exit.c | 3 - kernel/trace/ring_buffer.c | 58 ++--- kernel/trace/trace.c | 4 +- lib/Kconfig.debug | 15 -- mm/shmem.c | 19 +- mm/vmscan.c | 92 +++++--- mm/workingset.c | 6 +- net/appletalk/ddp.c | 9 +- net/atm/ioctl.c | 7 +- net/ipv4/tcp_output.c | 6 + net/ipv6/addrconf.c | 6 +- net/rose/af_rose.c | 4 +- net/rxrpc/conn_client.c | 7 +- net/sched/act_ct.c | 34 ++- net/sunrpc/auth.c | 3 - net/vmw_vsock/virtio_transport_common.c | 2 +- scripts/checkstack.pl | 3 +- scripts/sign-file.c | 12 +- security/selinux/hooks.c | 6 - sound/pci/hda/patch_hdmi.c | 3 + sound/pci/hda/patch_realtek.c | 1 + sound/pci/hda/tas2781_hda_i2c.c | 21 +- tools/objtool/noreturns.h | 1 - tools/testing/selftests/Makefile | 21 +- tools/testing/selftests/bpf/config.x86_64 | 1 - tools/testing/selftests/bpf/progs/bpf_loop_bench.c | 13 +- tools/testing/selftests/hid/config.common | 1 - tools/testing/selftests/lib.mk | 40 +--- tools/testing/selftests/mm/cow.c | 3 +- 194 files changed, 2164 insertions(+), 1607 deletions(-)

6 months, 1 week

13
179
0 0

FAILED: patch "[PATCH] btrfs: fix extent map use-after-free when adding pages to" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 8e7860543a94784d744c7ce34b78a2e11beefa5c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024072924-overact-drainable-8abb@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: 8e7860543a94 ("btrfs: fix extent map use-after-free when adding pages to compressed bio") b7d463a1d125 ("btrfs: store a pointer to the original btrfs_bio in struct compressed_bio") 690834e47cf7 ("btrfs: pass a btrfs_bio to btrfs_submit_compressed_read") 7edb9a3e7200 ("btrfs: move zero filling of compressed read bios into common code") 32586c5bca72 ("btrfs: factor out a btrfs_free_compressed_pages helper") 10e924bc320a ("btrfs: factor out a btrfs_add_compressed_bio_pages helper") d7294e4deeb9 ("btrfs: use the bbio file offset in add_ra_bio_pages") e7aff33e3161 ("btrfs: use the bbio file offset in btrfs_submit_compressed_read") 798c9fc74d03 ("btrfs: remove redundant free_extent_map in btrfs_submit_compressed_read") 544fe4a903ce ("btrfs: embed a btrfs_bio into struct compressed_bio") d5e4377d5051 ("btrfs: split zone append bios in btrfs_submit_bio") 35a8d7da3ca8 ("btrfs: remove now spurious bio submission helpers") 285599b6fe15 ("btrfs: remove the fs_info argument to btrfs_submit_bio") 48253076c3a9 ("btrfs: open code submit_encoded_read_bio") 30493ff49f81 ("btrfs: remove stripe boundary calculation for compressed I/O") 2380220e1e13 ("btrfs: remove stripe boundary calculation for buffered I/O") 67d669825090 ("btrfs: pass the iomap bio to btrfs_submit_bio") 852eee62d31a ("btrfs: allow btrfs_submit_bio to split bios") 69ccf3f4244a ("btrfs: handle recording of zoned writes in the storage layer") f8a53bb58ec7 ("btrfs: handle checksum generation in the storage layer") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 8e7860543a94784d744c7ce34b78a2e11beefa5c Mon Sep 17 00:00:00 2001 From: Filipe Manana <fdmanana(a)suse.com> Date: Thu, 4 Jul 2024 16:11:20 +0100 Subject: [PATCH] btrfs: fix extent map use-after-free when adding pages to compressed bio At add_ra_bio_pages() we are accessing the extent map to calculate 'add_size' after we dropped our reference on the extent map, resulting in a use-after-free. Fix this by computing 'add_size' before dropping our extent map reference. Reported-by: syzbot+853d80cba98ce1157ae6(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@google.com/ Fixes: 6a4049102055 ("btrfs: subpage: make add_ra_bio_pages() compatible") CC: stable(a)vger.kernel.org # 6.1+ Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c index a149f3659b15..a8e2c461aff7 100644 --- a/fs/btrfs/compression.c +++ b/fs/btrfs/compression.c @@ -515,6 +515,7 @@ static noinline int add_ra_bio_pages(struct inode *inode, put_page(page); break; } + add_size = min(em->start + em->len, page_end + 1) - cur; free_extent_map(em); if (page->index == end_index) { @@ -527,7 +528,6 @@ static noinline int add_ra_bio_pages(struct inode *inode, } } - add_size = min(em->start + em->len, page_end + 1) - cur; ret = bio_add_page(orig_bio, page, add_size, offset_in_page(cur)); if (ret != add_size) { unlock_extent(tree, cur, page_end, NULL);

6 months, 2 weeks

3
2
0 0

[PATCH 6.6 000/139] 6.6.39-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.39 release. There are 139 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 11 Jul 2024 11:06:25 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.39-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.39-rc1 Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix incorrect inode allocation from reserved inodes Damien Le Moal <dlemoal(a)kernel.org> null_blk: Do not allow runt zone with zone capacity smaller then zone size Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: silence UBSAN warning Takashi Iwai <tiwai(a)suse.de> ALSA: ump: Set default protocol when not given explicitly Witold Sadowski <wsadowski(a)marvell.com> spi: cadence: Ensure data lines set to low during dummy-cycle period Edward Adam Davis <eadavis(a)qq.com> nfc/nci: Add the inconsistency check between the input data length and count Masahiro Yamada <masahiroy(a)kernel.org> kbuild: fix short log for AS in link-vmlinux.sh Sagi Grimberg <sagi(a)grimberg.me> nvmet: fix a possible leak when destroy a ctrl during qp establishment hmtheboy154 <buingoc67(a)gmail.com> platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro hmtheboy154 <buingoc67(a)gmail.com> platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW 11.6" tablet Jim Wylder <jwylder(a)google.com> regmap-i2c: Subtract reg size from max_write Kundan Kumar <kundan.kumar(a)samsung.com> nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset Matt Jan <zoo868e(a)gmail.com> connector: Fix invalid conversion in cn_proc.h Fedor Pchelkin <pchelkin(a)ispras.ru> dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails Nilay Shroff <nilay(a)linux.ibm.com> nvme-multipath: find NUMA path only for online numa-node Mike Christie <michael.christie(a)oracle.com> vhost-scsi: Handle vhost_vq_work_queue failures for events Jian-Hong Pan <jhp(a)endlessos.org> ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897 Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: Mark volume as dirty if xattr is broken Piotr Wojtaszczyk <piotr.wojtaszczyk(a)timesys.com> i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr Pin-yen Lin <treapking(a)chromium.org> clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg Gabor Juhos <j4g8y7(a)gmail.com> clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs Luca Weiss <luca.weiss(a)fairphone.com> clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents Mauro Carvalho Chehab <mchehab(a)kernel.org> media: dw2102: fix a potential buffer overflow GUO Zihua <guozihua(a)huawei.com> ima: Avoid blocking in RCU read-side critical section Dragan Simic <dsimic(a)manjaro.org> arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 Model B Ghadi Elie Rahme <ghadi.rahme(a)canonical.com> bnx2x: Fix multiple UBSAN array-index-out-of-bounds Yijie Yang <quic_yijiyang(a)quicinc.com> net: stmmac: dwmac-qcom-ethqos: fix error array size Val Packett <val(a)packett.cool> mtd: rawnand: rockchip: ensure NVDDR timings are rejected Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: Bypass a couple of sanity checks during NAND identification Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: Fix the nand_read_data_op() early check Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: Ensure ECC configuration is propagated to upper layers Jinglin Wen <jinglin.wen(a)shingroup.cn> powerpc/64s: Fix unnecessary copy to 0 when kernel is booted at address 0 Nicholas Piggin <npiggin(a)gmail.com> powerpc/pseries: Fix scv instruction crash with kexec Frank Oltmanns <frank(a)oltmanns.dev> clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common Md Sadre Alam <quic_mdalam(a)quicinc.com> clk: qcom: gcc-ipq9574: Add BRANCH_HALT_VOTED flag John Schoenick <johns(a)valvesoftware.com> drm: panel-orientation-quirks: Add quirk for Valve Galileo Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/atomfirmware: silence UBSAN warning Ma Ke <make24(a)iscas.ac.cn> drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes Jan Kara <jack(a)suse.cz> Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" Jan Kara <jack(a)suse.cz> fsnotify: Do not generate events for O_PATH file descriptors Jimmy Assarsson <extja(a)kvaser.com> can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct Zijun Hu <quic_zijuhu(a)quicinc.com> Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot Hector Martin <marcan(a)marcan.st> Bluetooth: hci_bcm4377: Fix msgid release Nathan Chancellor <nathan(a)kernel.org> scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() Nathan Chancellor <nathan(a)kernel.org> f2fs: Add inline to f2fs_build_fault_attr() stub Naohiro Aota <naohiro.aota(a)wdc.com> btrfs: fix adding block group to a reclaim list and the unused list during reclaim Jan Kara <jack(a)suse.cz> mm: avoid overflows in dirty throttling logic Jinliang Zheng <alexjlzheng(a)tencent.com> mm: optimize the redundant loop of mm_update_owner_next() Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: add missing check for inode numbers on directory entries Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix inode number range checks Sasha Neftin <sasha.neftin(a)intel.com> Revert "igc: fix a log entry using uninitialized netdev" Armin Wolf <W_Armin(a)gmx.de> platform/x86: toshiba_acpi: Fix quickstart quirk handling Huacai Chen <chenhuacai(a)kernel.org> cpu: Fix broken cmdline "nosmp" and "maxcpus=0" Dmitry Torokhov <dmitry.torokhov(a)gmail.com> gpiolib: of: add polarity quirk for TSC2005 Aleksandr Mishin <amishin(a)t-argos.ru> mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file Shigeru Yoshida <syoshida(a)redhat.com> inet_diag: Initialize pad field in struct inet_diag_req_v2 Zijian Zhang <zijianzhang(a)bytedance.com> selftests: make order checking verbose in msg_zerocopy selftest Zijian Zhang <zijianzhang(a)bytedance.com> selftests: fix OOM in msg_zerocopy selftest Sam Sun <samsun1006219(a)gmail.com> bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: unconditionally flush pending work before notifier Song Shuai <songshuaishuai(a)tinylab.org> riscv: kexec: Avoid deadlock in kexec crash path Jozef Hopko <jozef.hopko(a)altana.com> wifi: wilc1000: fix ies_len type in connect path Shiji Yang <yangshiji66(a)outlook.com> gpio: mmio: do not calculate bgpio_bits via "ngpios" Dave Jiang <dave.jiang(a)intel.com> net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: initialize num_q_vectors for MSI/INTx interrupts Sagi Grimberg <sagi(a)grimberg.me> net: allow skb_datagram_iter to be called from any context Dmitry Torokhov <dmitry.torokhov(a)gmail.com> gpiolib: of: fix lookup quirk for MIPS Lantiq Dima Ruinskiy <dima.ruinskiy(a)intel.com> e1000e: Fix S0ix residency on corporate systems Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: fix LPSWEY handling Jakub Kicinski <kuba(a)kernel.org> tcp_metrics: validate source addr length Pavel Skripkin <paskripkin(a)gmail.com> bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX Iulia Tanasescu <iulia.tanasescu(a)nxp.com> Bluetooth: ISO: Check socket flag instead of hcon Edward Adam Davis <eadavis(a)qq.com> Bluetooth: Ignore too large handle values in BIG Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix setting of unicast qos interval Jianbo Liu <jianbol(a)nvidia.com> net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup() Chris Mi <cmi(a)nvidia.com> net/mlx5: E-switch, Create ingress ACL when needed Neal Cardwell <ncardwell(a)google.com> UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open() Marek Vasut <marex(a)denx.de> net: phy: phy_device: Fix PHY LED blinking code comment Dmitry Antipov <dmantipov(a)yandex.ru> mac802154: fix time calculation in ieee802154_configure_durations() Mike Christie <michael.christie(a)oracle.com> vhost_task: Handle SIGKILL by flushing work and exiting Mike Christie <michael.christie(a)oracle.com> vhost: Release worker mutex during flushes Mike Christie <michael.christie(a)oracle.com> vhost: Use virtqueue mutex for swapping worker Len Brown <len.brown(a)intel.com> tools/power turbostat: Remember global max_die_id Justin Stitt <justinstitt(a)google.com> cdrom: rearrange last_media_change check to avoid unintentional overflow Lu Yao <yaolu(a)kylinos.cn> btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation warning Holger Dengler <dengler(a)linux.ibm.com> s390/pkey: Wipe sensitive data on failure Sven Schnelle <svens(a)linux.ibm.com> s390: Mark psw in __load_psw_mask() as __unitialized Wang Yong <wang.yong12(a)zte.com.cn> jffs2: Fix potential illegal address access in jffs2_free_inode Matthias Schiffer <matthias.schiffer(a)ew.tq-group.com> serial: imx: Raise TX trigger level to 8 Tomas Henzl <thenzl(a)redhat.com> scsi: mpi3mr: Sanitise num_phys Chao Yu <chao(a)kernel.org> f2fs: check validation of fault attrs in f2fs_build_fault_attr() Jose E. Marchesi <jose.marchesi(a)oracle.com> bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD Corinna Vinschen <vinschen(a)redhat.com> igc: fix a log entry using uninitialized netdev John Hubbard <jhubbard(a)nvidia.com> selftests/net: fix uninitialized variables Greg Kurz <groug(a)kaod.org> powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#" Mickaël Salaün <mic(a)digikod.net> kunit: Handle test faults Mickaël Salaün <mic(a)digikod.net> kunit: Fix timeout message Mike Marshall <hubcap(a)omnibond.com> orangefs: fix out-of-bounds fsid access Michael Ellerman <mpe(a)ellerman.id.au> powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n Heiner Kallweit <hkallweit1(a)gmail.com> i2c: i801: Annotate apanel_addr as __ro_after_init Benjamin Gray <bgray(a)linux.ibm.com> powerpc/dexcr: Track the DEXCR per-process Ricardo Ribalda <ribalda(a)chromium.org> media: dvb-frontends: tda10048: Fix integer overflow Ricardo Ribalda <ribalda(a)chromium.org> media: s2255: Use refcount_t instead of atomic_t for num_channels Ricardo Ribalda <ribalda(a)chromium.org> media: dvb-frontends: tda18271c2dd: Remove casting during div Simon Horman <horms(a)kernel.org> net: dsa: mv88e6xxx: Correct check for empty list Julien Panis <jpanis(a)baylibre.com> thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data StanleyYP Wang <StanleyYP.Wang(a)mediatek.com> wifi: mt76: mt7996: add sanity checks for background radar trigger Felix Fietkau <nbd(a)nbd.name> wifi: mt76: replace skb_put with skb_put_zero Niklas Neronin <niklas.neronin(a)linux.intel.com> usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB Erick Archer <erick.archer(a)outlook.com> Input: ff-core - prefer struct_size over open coded arithmetic Jean Delvare <jdelvare(a)suse.de> firmware: dmi: Stop decoding on broken entry Erick Archer <erick.archer(a)outlook.com> sctp: prefer struct_size over open coded arithmetic Samuel Holland <samuel.holland(a)sifive.com> riscv: Apply SiFive CIP-1200 workaround to single-ASID sfence.vma Michael Bunk <micha(a)freedict.org> media: dw2102: Don't translate i2c read into write Jesse Zhang <jesse.zhang(a)amd.com> drm/amdgpu: fix the warning about the expression (int)size - len Tim Huang <Tim.Huang(a)amd.com> drm/amdgpu: fix uninitialized scalar variable warning Alex Hung <alex.hung(a)amd.com> drm/amd/display: Fix uninitialized variables in DM Alex Hung <alex.hung(a)amd.com> drm/amd/display: Skip finding free audio for unknown engine_id Alex Hung <alex.hung(a)amd.com> drm/amd/display: Check pipe offset before setting vblank Alex Hung <alex.hung(a)amd.com> drm/amd/display: Check index msg_id before read or write Ma Jun <Jun.Ma2(a)amd.com> drm/amdgpu: Initialize timestamp for some legacy SOCs Jesse Zhang <jesse.zhang(a)amd.com> drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Ma Jun <Jun.Ma2(a)amd.com> drm/amdgpu: Fix uninitialized variable warnings Fei Shao <fshao(a)chromium.org> media: mediatek: vcodec: Only free buffer VA that is not NULL Hailey Mothershead <hailmo(a)amazon.com> crypto: aead,cipher - zeroize key buffer after use Atish Patra <atishp(a)rivosinc.com> RISC-V: KVM: Fix the initial sample period value Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: dummy_st_ops should reject 0 for non-nullable params Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: do not pass NULL for non-nullable params in dummy_st_ops Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: adjust dummy_st_ops_success to detect additional error Guanrui Huang <guanrui.huang(a)linux.alibaba.com> irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc John Meneghini <jmeneghi(a)redhat.com> scsi: qedf: Make qedf_execute_tmf() non-preemptible Michael Guralnik <michaelgur(a)nvidia.com> IB/core: Implement a limit on UMAD receive List Ricardo Ribalda <ribalda(a)chromium.org> media: dvb-usb: dib0700_devices: Add missing release_firmware() Ricardo Ribalda <ribalda(a)chromium.org> media: dvb: as102-fe: Fix as10x_register_addr packing Mahesh Salgaonkar <mahesh(a)linux.ibm.com> powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. Erico Nunes <nunes.erico(a)gmail.com> drm/lima: fix shared irq handling on driver remove Chenghai Huang <huangchenghai2(a)huawei.com> crypto: hisilicon/debugfs - Fix debugfs uninit process issue George Stark <gnstark(a)salutedevices.com> leds: an30259a: Use devm_mutex_init() for mutex initialization George Stark <gnstark(a)salutedevices.com> locking/mutex: Introduce devm_mutex_init() ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts | 2 +- arch/powerpc/include/asm/interrupt.h | 10 ++ arch/powerpc/include/asm/io.h | 2 +- arch/powerpc/include/asm/percpu.h | 10 ++ arch/powerpc/include/asm/processor.h | 1 + arch/powerpc/kernel/head_64.S | 5 +- arch/powerpc/kernel/process.c | 10 ++ arch/powerpc/kernel/ptrace/ptrace-view.c | 7 +- arch/powerpc/kernel/setup_64.c | 2 + arch/powerpc/kexec/core_64.c | 11 ++ arch/powerpc/platforms/pseries/kexec.c | 8 -- arch/powerpc/platforms/pseries/pseries.h | 1 - arch/powerpc/platforms/pseries/setup.c | 1 - arch/powerpc/xmon/xmon.c | 6 +- arch/riscv/include/asm/errata_list.h | 12 +- arch/riscv/include/asm/tlbflush.h | 19 ++- arch/riscv/kernel/machine_kexec.c | 10 +- arch/riscv/kvm/vcpu_pmu.c | 2 +- arch/riscv/mm/tlbflush.c | 23 ---- arch/s390/include/asm/kvm_host.h | 1 + arch/s390/include/asm/processor.h | 2 +- arch/s390/kvm/kvm-s390.c | 1 + arch/s390/kvm/kvm-s390.h | 15 +++ arch/s390/kvm/priv.c | 32 +++++ crypto/aead.c | 3 +- crypto/cipher.c | 3 +- drivers/base/regmap/regmap-i2c.c | 3 +- drivers/block/null_blk/zoned.c | 11 ++ drivers/bluetooth/hci_bcm4377.c | 2 +- drivers/bluetooth/hci_qca.c | 18 ++- drivers/cdrom/cdrom.c | 2 +- drivers/clk/mediatek/clk-mt8183-mfgcfg.c | 1 + drivers/clk/mediatek/clk-mtk.c | 24 ++-- drivers/clk/mediatek/clk-mtk.h | 2 + drivers/clk/qcom/clk-alpha-pll.c | 3 + drivers/clk/qcom/gcc-ipq9574.c | 10 +- drivers/clk/qcom/gcc-sm6350.c | 10 +- drivers/clk/sunxi-ng/ccu_common.c | 18 ++- drivers/crypto/hisilicon/debugfs.c | 21 +++- drivers/firmware/dmi_scan.c | 11 ++ drivers/gpio/gpio-mmio.c | 2 - drivers/gpio/gpiolib-of.c | 22 +++- drivers/gpu/drm/amd/amdgpu/aldebaran.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 8 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 +- drivers/gpu/drm/amd/amdgpu/sienna_cichlid.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 4 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 + .../amd/display/dc/irq/dce110/irq_service_dce110.c | 8 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 8 ++ drivers/gpu/drm/amd/include/atomfirmware.h | 4 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 7 ++ drivers/gpu/drm/lima/lima_gp.c | 2 + drivers/gpu/drm/lima/lima_mmu.c | 5 + drivers/gpu/drm/lima/lima_pp.c | 4 + drivers/gpu/drm/nouveau/nouveau_connector.c | 3 + drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-pnx.c | 48 ++------ drivers/infiniband/core/user_mad.c | 21 +++- drivers/input/ff-core.c | 7 +- drivers/irqchip/irq-gic-v3-its.c | 2 - drivers/leds/leds-an30259a.c | 14 +-- drivers/media/dvb-frontends/as102_fe_types.h | 2 +- drivers/media/dvb-frontends/tda10048.c | 9 +- drivers/media/dvb-frontends/tda18271c2dd.c | 4 +- .../vcodec/decoder/vdec/vdec_av1_req_lat_if.c | 22 ++-- .../mediatek/vcodec/encoder/venc/venc_h264_if.c | 5 +- drivers/media/usb/dvb-usb/dib0700_devices.c | 18 ++- drivers/media/usb/dvb-usb/dw2102.c | 120 +++++++++++-------- drivers/media/usb/s2255/s2255drv.c | 20 ++-- drivers/mtd/nand/raw/nand_base.c | 68 ++++++----- drivers/mtd/nand/raw/rockchip-nand-controller.c | 6 +- drivers/net/bonding/bond_options.c | 6 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + drivers/net/dsa/mv88e6xxx/chip.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 +- drivers/net/ethernet/intel/e1000e/netdev.c | 132 ++++++++++----------- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 + .../mellanox/mlx5/core/esw/acl/ingress_ofld.c | 37 ++++-- .../net/ethernet/mellanox/mlxsw/core_linecards.c | 1 + .../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 2 +- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 1 + drivers/net/ntb_netdev.c | 2 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 10 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +- .../net/wireless/mediatek/mt76/mt7996/debugfs.c | 5 + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 5 +- drivers/net/wireless/microchip/wilc1000/hif.c | 3 +- drivers/nfc/virtual_ncidev.c | 4 + drivers/nvme/host/multipath.c | 2 +- drivers/nvme/host/pci.c | 3 +- drivers/nvme/target/core.c | 9 ++ drivers/platform/x86/toshiba_acpi.c | 31 +++-- drivers/platform/x86/touchscreen_dmi.c | 36 ++++++ drivers/s390/crypto/pkey_api.c | 4 +- drivers/scsi/mpi3mr/mpi3mr_transport.c | 10 ++ drivers/scsi/qedf/qedf_io.c | 6 +- drivers/spi/spi-cadence-xspi.c | 20 +++- drivers/thermal/mediatek/lvts_thermal.c | 2 + drivers/tty/serial/imx.c | 2 +- drivers/usb/host/xhci-ring.c | 5 +- drivers/vhost/scsi.c | 17 ++- drivers/vhost/vhost.c | 118 ++++++++++++++---- drivers/vhost/vhost.h | 2 + fs/btrfs/block-group.c | 13 +- fs/btrfs/scrub.c | 2 +- fs/f2fs/f2fs.h | 12 +- fs/f2fs/super.c | 27 +++-- fs/f2fs/sysfs.c | 14 ++- fs/jffs2/super.c | 1 + fs/nilfs2/alloc.c | 18 ++- fs/nilfs2/alloc.h | 4 +- fs/nilfs2/dat.c | 2 +- fs/nilfs2/dir.c | 6 + fs/nilfs2/ifile.c | 7 +- fs/nilfs2/nilfs.h | 10 +- fs/nilfs2/the_nilfs.c | 6 + fs/nilfs2/the_nilfs.h | 2 +- fs/ntfs3/xattr.c | 5 +- fs/orangefs/super.c | 3 +- include/kunit/try-catch.h | 3 - include/linux/fsnotify.h | 8 +- include/linux/lsm_hook_defs.h | 2 +- include/linux/mutex.h | 27 +++++ include/linux/phy.h | 2 +- include/linux/sched/vhost_task.h | 3 +- include/linux/security.h | 5 +- include/uapi/linux/cn_proc.h | 3 +- kernel/auditfilter.c | 5 +- kernel/cpu.c | 3 + kernel/dma/map_benchmark.c | 3 + kernel/exit.c | 2 + kernel/kthread.c | 1 + kernel/locking/mutex-debug.c | 12 ++ kernel/vhost_task.c | 53 ++++++--- lib/kunit/try-catch.c | 22 ++-- mm/page-writeback.c | 32 ++++- net/bluetooth/hci_conn.c | 15 ++- net/bluetooth/hci_event.c | 26 +++- net/bluetooth/iso.c | 3 +- net/core/datagram.c | 19 ++- net/ipv4/inet_diag.c | 2 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_metrics.c | 1 + net/mac802154/main.c | 14 ++- net/netfilter/nf_tables_api.c | 3 +- net/sctp/socket.c | 7 +- scripts/link-vmlinux.sh | 2 +- security/apparmor/audit.c | 6 +- security/apparmor/include/audit.h | 2 +- security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_policy.c | 15 ++- security/security.c | 6 +- security/selinux/include/audit.h | 4 +- security/selinux/ss/services.c | 5 +- security/smack/smack_lsm.c | 4 +- sound/core/ump.c | 8 ++ sound/pci/hda/patch_realtek.c | 9 ++ tools/lib/bpf/bpf_core_read.h | 1 + tools/power/x86/turbostat/turbostat.c | 10 +- .../selftests/bpf/prog_tests/dummy_st_ops.c | 34 +++++- .../selftests/bpf/progs/dummy_st_ops_success.c | 15 ++- tools/testing/selftests/net/gro.c | 3 + tools/testing/selftests/net/ip_local_port_range.c | 2 +- tools/testing/selftests/net/mptcp/pm_nl_ctl.c | 2 +- tools/testing/selftests/net/msg_zerocopy.c | 14 ++- 170 files changed, 1283 insertions(+), 570 deletions(-)

6 months, 2 weeks

16
160
0 0

[PATCH 5.10 000/317] 5.10.219-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.219 release. There are 317 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 15 Jun 2024 11:31:50 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.219-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.219-rc1 Chengchang Tang <tangchengchang(a)huawei.com> RDMA/hns: Fix CQ and QP cache affinity Yangyang Li <liyangyang20(a)huawei.com> RDMA/hns: Use mutex instead of spinlock for ida allocation Chao Yu <chao(a)kernel.org> f2fs: compress: fix compression chksum Neil Armstrong <neil.armstrong(a)linaro.org> scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5 Anna Schumaker <Anna.Schumaker(a)Netapp.com> NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS Sergey Shtylyov <s.shtylyov(a)omp.ru> nfs: fix undefined behavior in nfs_block_bits() Harald Freudenberger <freude(a)linux.ibm.com> s390/ap: Fix crash in AP internal function modify_bitmap() Baokun Li <libaokun1(a)huawei.com> ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() Mike Gilbert <floppym(a)gentoo.org> sparc: move struct termio to asm/termios.h Eric Dumazet <edumazet(a)google.com> net: fix __dst_negative_advice() race Daniel Thompson <daniel.thompson(a)linaro.org> kdb: Use format-specifiers rather than memset() for padding in kdb_read() Daniel Thompson <daniel.thompson(a)linaro.org> kdb: Merge identical case statements in kdb_read() Daniel Thompson <daniel.thompson(a)linaro.org> kdb: Fix console handling when editing and tab-completing commands Daniel Thompson <daniel.thompson(a)linaro.org> kdb: Use format-strings rather than '\0' injection in kdb_read() Daniel Thompson <daniel.thompson(a)linaro.org> kdb: Fix buffer overflow during tab-complete Judith Mendez <jm(a)ti.com> watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin Sam Ravnborg <sam(a)ravnborg.org> sparc64: Fix number of online CPUs Alexander Shishkin <alexander.shishkin(a)linux.intel.com> intel_th: pci: Add Meteor Lake-S CPU support Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> net/9p: fix uninit-value in p9_client_rpc() xu xin <xu.xin16(a)zte.com.cn> net/ipv6: Fix route deleting failure when metric equals 0 Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak Vitaly Chikunov <vt(a)altlinux.org> crypto: ecrdsa - Fix module auto-load on add_key Marc Zyngier <maz(a)kernel.org> KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode Cai Xinchen <caixinchen1(a)huawei.com> fbdev: savage: Handle err return when savagefb_check_var failed Hans de Goede <hdegoede(a)redhat.com> mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A Hans de Goede <hdegoede(a)redhat.com> mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working Hans de Goede <hdegoede(a)redhat.com> mmc: sdhci-acpi: Sort DMI quirks alphabetically Hans de Goede <hdegoede(a)redhat.com> mmc: core: Add mmc_gpiod_set_cd_config() function Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: v4l2-core: hold videodev_lock until dev reg, finishes Nathan Chancellor <nathan(a)kernel.org> media: mxl5xx: Move xpt structures off stack Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: mc: mark the media devnode as registered from the, start Yang Xiwen <forbidden405(a)outlook.com> arm64: dts: hi3798cv200: fix the size of GICR Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU Yu Kuai <yukuai3(a)huawei.com> md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING Johan Hovold <johan+linaro(a)kernel.org> arm64: dts: qcom: qcs404: fix bluetooth device address Krzysztof Kozlowski <krzk(a)kernel.org> arm64: tegra: Correct Tegra132 I2C alias Christoffer Sandberg <cs(a)tuxedo.de> ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx Sergey Shtylyov <s.shtylyov(a)omp.ru> ata: pata_legacy: make legacy_exit() work again Bob Zhou <bob.zhou(a)amd.com> drm/amdgpu: add error handle to avoid out-of-bounds Zheyu Ma <zheyuma97(a)gmail.com> media: lgdt3306a: Add a check against null-pointer-def Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() Ziyang Xuan <william.xuanziyang(a)huawei.com> netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV Linus Torvalds <torvalds(a)linux-foundation.org> x86/mm: Remove broken vsyscall emulation code from the page fault code Daniel Borkmann <daniel(a)iogearbox.net> vxlan: Fix regression when dropping packets due to invalid src addresses Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix use-after-free of timer for log writer thread Marc Dionne <marc.dionne(a)auristor.com> afs: Don't cross .backup mountpoint from backup volume Ming Lei <ming.lei(a)redhat.com> io_uring: fail NOP if non-zero op flags is passed in Jorge Ramirez-Ortiz <jorge(a)foundries.io> mmc: core: Do not force a retune before RPMB switch Carlos Llamas <cmllamas(a)google.com> binder: fix max_thread type inconsistency Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Fix loop termination condition in gss_free_in_token_pages() Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: core: add adap_nb_transmit_canceled() callback Dongli Zhang <dongli.zhang(a)oracle.com> genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Set lower bound of start tick time Guenter Roeck <linux(a)roeck-us.net> hwmon: (shtc1) Fix property misspelling Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/uaccess: Use asm goto for get_user when compiler supports it Yue Haibing <yuehaibing(a)huawei.com> ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: stm32: Don't warn about spurious interrupts Masahiro Yamada <masahiroy(a)kernel.org> kconfig: fix comparison to constant symbols, 'm', 'n' Florian Westphal <fw(a)strlen.de> netfilter: tproxy: bail out if IP has been disabled on the device Xiaolei Wang <xiaolei.wang(a)windriver.com> net:fec: Add fec_enet_deinit() Jakub Sitnicki <jakub(a)cloudflare.com> bpf: Allow delete from sockmap/sockhash only if update is allowed Parthiban Veerasooran <Parthiban.Veerasooran(a)microchip.com> net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM Roded Zats <rzats(a)paloaltonetworks.com> enic: Validate length of nl attributes in enic_set_vf_port Friedrich Vock <friedrich.vock(a)gmx.de> bpf: Fix potential integer overflow in resolve_btfids Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> dma-buf/sw-sync: don't enable IRQ from sync_print_obj() Carolina Jubran <cjubran(a)nvidia.com> net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion Sagi Grimberg <sagi(a)grimberg.me> nvmet: fix ns enable/disable possible hang Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> spi: Don't mark message DMA mapped when no transfer in it is Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_payload: restore vlan q-in-q match support Eric Dumazet <edumazet(a)google.com> netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() Ryosuke Yasuoka <ryasuoka(a)redhat.com> nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> nfc: nci: Fix kcov check in nci_rx_work() Dae R. Jeong <threeearcat(a)gmail.com> tls: fix missing memory barrier in tls_init Wei Fang <wei.fang(a)nxp.com> net: fec: avoid lock evasion when reading pps_enable Matthew Bystrin <dev.mbstr(a)gmail.com> riscv: stacktrace: fixed walk_stackframe() Guo Ren <guoren(a)linux.alibaba.com> riscv: stacktrace: Make walk_stackframe cross pt_regs frame Kefeng Wang <wangkefeng.wang(a)huawei.com> riscv: Cleanup stacktrace Jiri Pirko <jiri(a)nvidia.com> virtio: delete vq in vp_find_vqs_msix() when request_irq() fails Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY Aaron Conole <aconole(a)redhat.com> openvswitch: Set the skbuff pkt_type for proper pmtud support. Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). Sagi Grimberg <sagi(a)grimberg.me> params: lift param_set_uint_minmax to common code Hangbin Liu <liuhangbin(a)gmail.com> ipv6: sr: fix memleak in seg6_hmac_init_algo Dan Aloni <dan.aloni(a)vastdata.com> rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL Dan Aloni <dan.aloni(a)vastdata.com> sunrpc: fix NFSACL RPC retry on soft mount Shenghao Ding <shenghao-ding(a)ti.com> ASoC: tas2552: Add TX path for capturing AUDIO-OUT data Ryosuke Yasuoka <ryasuoka(a)redhat.com> nfc: nci: Fix uninit-value in nci_rx_work Masahiro Yamada <masahiroy(a)kernel.org> x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y Matti Vaittinen <mazziesaccount(a)gmail.com> regulator: bd71828: Don't overwrite runtime voltages Zhu Yanjun <yanjun.zhu(a)linux.dev> null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: core: avoid confusing "transmit timed out" message Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: core: avoid recursive cec_claim_log_addrs Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec-adap.c: drop activate_cnt, use state info instead Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: use call_op and check for !unregistered Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: correctly pass on reply results Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: abort if the current transmit was canceled Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: call enable_adap on s_log_addrs Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: fix a deadlock situation Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: core headers: fix kernel-doc warnings Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: cec-api: add locking in cec_release() Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: cec: cec-adap: always cancel work in cec_transmit_msg_fh Tiwei Bie <tiwei.btw(a)antgroup.com> um: Fix the -Wmissing-prototypes warning for __switch_mm Shrikanth Hegde <sshegde(a)linux.ibm.com> powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp Dongliang Mu <mudongliangabcd(a)gmail.com> media: flexcop-usb: fix sanity check of bNumEndpoints Johan Hovold <johan(a)kernel.org> media: flexcop-usb: clean up endpoint sanity checks Azeem Shaikh <azeemshaikh38(a)gmail.com> scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy() Dan Carpenter <dan.carpenter(a)linaro.org> media: stk1160: fix bounds checking in stk1160_copy_video() Michael Walle <mwalle(a)kernel.org> drm/bridge: tc358775: fix support for jeida-18 and jeida-24 Johannes Berg <johannes.berg(a)intel.com> um: vector: fix bpfflash parameter evaluation Roberto Sassu <roberto.sassu(a)huawei.com> um: Add winch to winch_handlers before registering winch IRQ Duoming Zhou <duoming(a)zju.edu.cn> um: Fix return value in ubd_init() Marijn Suijten <marijn.suijten(a)somainline.org> drm/msm/dpu: Always flush the slave INTF on the CTL Fenglin Wu <quic_fenglinw(a)quicinc.com> Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation Judith Mendez <jm(a)ti.com> mmc: sdhci_am654: Fix ITAPDLY for HS400 timing Judith Mendez <jm(a)ti.com> mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock Judith Mendez <jm(a)ti.com> mmc: sdhci_am654: Add OTAP/ITAP delay enable Vignesh Raghavendra <vigneshr(a)ti.com> mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel Judith Mendez <jm(a)ti.com> mmc: sdhci_am654: Write ITAPDLY for DDR52 timing Judith Mendez <jm(a)ti.com> mmc: sdhci_am654: Add tuning algorithm for delay chain Karel Balej <balejk(a)matfyz.cz> Input: ioc3kbd - add device table Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Input: ioc3kbd - convert to platform remove callback returning void Arnd Bergmann <arnd(a)arndb.de> Input: ims-pcu - fix printf string overflow Alexander Egorenkov <egorenar(a)linux.ibm.com> s390/ipl: Fix incorrect initialization of nvme dump block Alexander Egorenkov <egorenar(a)linux.ibm.com> s390/ipl: Fix incorrect initialization of len fields in nvme reipl block Ian Rogers <irogers(a)google.com> perf stat: Don't display metric header for non-leader uncore events Ian Rogers <irogers(a)google.com> libsubcmd: Fix parse-options memory leak Wolfram Sang <wsa+renesas(a)sang-engineering.com> serial: sh-sci: protect invalidating RXDMA on shutdown Chao Yu <chao(a)kernel.org> f2fs: compress: don't allow unaligned truncation on released compress inode Chao Yu <chao(a)kernel.org> f2fs: fix to release node block count in error path of f2fs_new_node_page() Chao Yu <chao(a)kernel.org> f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock Ian Rogers <irogers(a)google.com> perf report: Avoid SEGV in report__setup_sample_type() Ian Rogers <irogers(a)google.com> perf ui browser: Avoid SEGV on title Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy(a)linux.intel.com> PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy(a)linux.intel.com> PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 Randy Dunlap <rdunlap(a)infradead.org> extcon: max8997: select IRQ_DOMAIN instead of depending on it Ian Rogers <irogers(a)google.com> perf ui browser: Don't save pointer to stack memory Ian Rogers <irogers(a)google.com> perf ui: Update use of pthread mutex yaowenbin <yaowenbin1(a)huawei.com> perf top: Fix TUI exit screen refresh race condition He Zhe <zhe.he(a)windriver.com> perf bench internals inject-build-id: Fix trap divide when collecting just one DSO Huai-Yuan Liu <qq810974084(a)gmail.com> ppdev: Add an error check in register_device Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> ppdev: Remove usage of the deprecated ida_simple_xx() API Dan Carpenter <dan.carpenter(a)linaro.org> stm class: Fix a double free in stm_register_device() Chris Wulff <Chris.Wulff(a)biamp.com> usb: gadget: u_audio: Clear uac pointer when freed. Miklos Szeredi <mszeredi(a)redhat.com> ovl: remove upper umask handling from ovl_create_upper() Adrian Hunter <adrian.hunter(a)intel.com> perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer) Michal Simek <michal.simek(a)amd.com> microblaze: Remove early printk call from cpuinfo-static.c Michal Simek <michal.simek(a)amd.com> microblaze: Remove gcc flag for non existing early_printk.c file Marco Pagani <marpagan(a)redhat.com> fpga: region: add owner module and take its refcount Russ Weight <russell.h.weight(a)intel.com> fpga: region: Use standard dev_release for class driver Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> docs: driver-api: fpga: avoid using UTF-8 chars Russ Weight <russell.h.weight(a)intel.com> fpga: region: Rename dev to parent for parent device Tom Rix <trix(a)redhat.com> fpga: region: change FPGA indirect article to an Thomas Haemmerle <thomas.haemmerle(a)leica-geosystems.com> iio: pressure: dps310: support negative temperature values Chao Yu <chao(a)kernel.org> f2fs: fix to check pinfile flag in f2fs_move_file_range() Chao Yu <chao(a)kernel.org> f2fs: fix to relocate check condition in f2fs_fallocate() Jinyoung CHOI <j-young.choi(a)samsung.com> f2fs: fix typos in comments Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: do not allow partial truncation on pinned file Chao Yu <chao(a)kernel.org> f2fs: fix to force keeping write barrier for strict fsync mode Chao Yu <chao(a)kernel.org> f2fs: add cp_error check in f2fs_write_compressed_pages Chao Yu <chao(a)kernel.org> f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks() Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: introduce FI_COMPRESS_RELEASED instead of using IMMUTABLE bit Chao Yu <chao(a)kernel.org> f2fs: compress: remove unneeded preallocation Chao Yu <chao(a)kernel.org> f2fs: compress: clean up parameter of __f2fs_cluster_blocks() Daeho Jeong <daehojeong(a)google.com> f2fs: add compress_mode mount option Chao Yu <chao(a)kernel.org> f2fs: compress: support chksum Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: add proper sched.h include for sched_set_fifo() Arnd Bergmann <arnd(a)arndb.de> greybus: arche-ctrl: move device table to its right location Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: max3100: Fix bitwise types Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: max3100: Update uart_driver_registered on driver removal Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: max3100: Lock port->lock when calling uart_handle_cts_change() Arnd Bergmann <arnd(a)arndb.de> firmware: dmi-id: add a release callback function Chen Ni <nichen(a)iscas.ac.cn> dmaengine: idma64: Add check for dma_set_max_seg_size Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> soundwire: cadence: fix invalid PDI offset Namhyung Kim <namhyung(a)kernel.org> perf annotate: Get rid of duplicate --group option item Martin Liška <mliska(a)suse.cz> perf annotate: Add --demangle and --demangle-kernel Chao Yu <chao(a)kernel.org> f2fs: fix to wait on page writeback in __clone_blkaddrs() Rui Miguel Silva <rmfrfs(a)gmail.com> greybus: lights: check return of get_channel_from_mode Arnaldo Carvalho de Melo <acme(a)redhat.com> perf probe: Add missing libgen.h header needed for using basename() Ian Rogers <irogers(a)google.com> perf record: Delete session after stopping sideband thread Arnaldo Carvalho de Melo <acme(a)redhat.com> perf evlist: Use the right prefix for 'struct evlist' sideband thread methods Vitalii Bursov <vitaly(a)bursov.com> sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level Eric Dumazet <edumazet(a)google.com> af_packet: do not call packet_read_pending() from tpacket_destruct_skb() Eric Dumazet <edumazet(a)google.com> netrom: fix possible dead-lock in nr_rt_ioctl() Chris Lew <quic_clew(a)quicinc.com> net: qrtr: ns: Fix module refcnt Qinglang Miao <miaoqinglang(a)huawei.com> net: qrtr: fix null-ptr-deref in qrtr_ns_remove Leon Romanovsky <leon(a)kernel.org> RDMA/IPoIB: Fix format truncation compilation errors Edward Liaw <edliaw(a)google.com> selftests/kcmp: remove unused open mode Gautam Menghani <gautammenghani201(a)gmail.com> selftests/kcmp: Make the test output consistent and clear Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Fix gss_free_in_token_pages() Dan Carpenter <dan.carpenter(a)linaro.org> ext4: fix potential unnitialized variable Kemeng Shi <shikemeng(a)huaweicloud.com> ext4: remove unused parameter from ext4_mb_new_blocks_simple() Kemeng Shi <shikemeng(a)huaweicloud.com> ext4: try all groups in ext4_mb_new_blocks_simple Kemeng Shi <shikemeng(a)huaweicloud.com> ext4: fix unit mismatch in ext4_mb_new_blocks_simple Kemeng Shi <shikemeng(a)huaweicloud.com> ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple Aleksandr Aprelkov <aaprelkov(a)usergate.com> sunrpc: removed redundant procp check Jan Kara <jack(a)suse.cz> ext4: avoid excessive credit estimate in ext4_tmpfile() Adrian Hunter <adrian.hunter(a)intel.com> x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map Marc Gonzalez <mgonzalez(a)freebox.fr> clk: qcom: mmcc-msm8998: fix venus clock issue Chengchang Tang <tangchengchang(a)huawei.com> RDMA/hns: Modify the print level of CQE error Chengchang Tang <tangchengchang(a)huawei.com> RDMA/hns: Use complete parentheses in macros Zhengchao Shao <shaozhengchao(a)huawei.com> RDMA/hns: Fix return value in hns_roce_map_mr_sg Wenpeng Liang <liangwenpeng(a)huawei.com> RDMA/hns: Fix incorrect symbol types Yangyang Li <liyangyang20(a)huawei.com> RDMA/hns: Create QP with selected QPN for bank load balance Xi Wang <wangxi11(a)huawei.com> RDMA/hns: Refactor the hns_roce_buf allocation flow Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/mipi-dsi: use correct return type for the DSC functions Marek Vasut <marex(a)denx.de> drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector Nícolas F. R. A. Prado <nfraprado(a)collabora.com> drm/bridge: tc358775: Don't log an error when DSI host can't be found Nícolas F. R. A. Prado <nfraprado(a)collabora.com> drm/bridge: lt9611: Don't log an error when DSI host can't be found Steven Rostedt <rostedt(a)goodmis.org> ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value Aleksandr Mishin <amishin(a)t-argos.ru> drm: vc4: Fix possible null pointer dereference Huai-Yuan Liu <qq810974084(a)gmail.com> drm/arm/malidp: fix a possible null pointer dereference Zhipeng Lu <alexious(a)zju.edu.cn> media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries Randy Dunlap <rdunlap(a)infradead.org> fbdev: sh7760fb: allow modular build Aleksandr Mishin <amishin(a)t-argos.ru> drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference Ricardo Ribalda <ribalda(a)chromium.org> media: radio-shark2: Avoid led_names truncations Aleksandr Burakov <a.burakov(a)rosalinux.ru> media: ngene: Add dvb_ca_en50221_init return value check Arnd Bergmann <arnd(a)arndb.de> fbdev: sisfb: hide unused variables Arnd Bergmann <arnd(a)arndb.de> powerpc/fsl-soc: hide unused const variable Justin Green <greenjustin(a)chromium.org> drm/mediatek: Add 0 size check to mtk_drm_gem_obj Christian Hewitt <christianshewitt(a)gmail.com> drm/meson: vclk: fix calculation of 59.94 fractional rates Arnd Bergmann <arnd(a)arndb.de> fbdev: shmobile: fix snprintf truncation Maxim Korotkov <korotkov.maxim.s(a)gmail.com> mtd: rawnand: hynix: fixed typo Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: Disable route checks for Skylake boards Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> ASoC: soc-acpi: add helper to identify parent driver. Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Fix potential index out of bounds in color transformation function Akiva Goldberger <agoldberger(a)nvidia.com> net/mlx5: Discard command completions in internal error Hangbin Liu <liuhangbin(a)gmail.com> ipv6: sr: fix invalid unregister error path Hangbin Liu <liuhangbin(a)gmail.com> ipv6: sr: fix incorrect unregister order Hangbin Liu <liuhangbin(a)gmail.com> ipv6: sr: add missing seg6_local_exit Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix overwriting ct original tuple for ICMPv6 Eric Dumazet <edumazet(a)google.com> net: usb: smsc95xx: stop lying about skb->truesize Breno Leitao <leitao(a)debian.org> af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg Linus Walleij <linus.walleij(a)linaro.org> net: ethernet: cortina: Locking fixes Jakub Kicinski <kuba(a)kernel.org> eth: sungem: remove .ndo_poll_controller to avoid deadlocks gaoxingwang <gaoxingwang1(a)huawei.com> net: ipv6: fix wrong start position when receive hop-by-hop fragment Finn Thain <fthain(a)linux-m68k.org> m68k: mac: Fix reboot hang on Mac IIci Michael Schmitz <schmitzmic(a)gmail.com> m68k: Fix spinlock race in kernel thread creation Eric Dumazet <edumazet(a)google.com> net: usb: sr9700: stop lying about skb->truesize Eric Dumazet <edumazet(a)google.com> usb: aqc111: stop lying about skb->truesize Dan Carpenter <dan.carpenter(a)linaro.org> wifi: mwl8k: initialize cmd->addr[] properly Bui Quang Minh <minhquangbui99(a)gmail.com> scsi: qedf: Ensure the copied buf is NUL terminated Bui Quang Minh <minhquangbui99(a)gmail.com> scsi: bfa: Ensure the copied buf is NUL terminated Chen Ni <nichen(a)iscas.ac.cn> HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors John Hubbard <jhubbard(a)nvidia.com> selftests/binderfs: use the Makefile's rules, not Make's implicit rules Guenter Roeck <linux(a)roeck-us.net> Revert "sh: Handle calling csum_partial with misaligned data" Geert Uytterhoeven <geert+renesas(a)glider.be> sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> wifi: ar5523: enable proper endpoint verification Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> wifi: carl9170: add a proper sanity check for endpoints Finn Thain <fthain(a)linux-m68k.org> macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" Eric Dumazet <edumazet(a)google.com> net: give more chances to rcu in netdev_wait_allrefs_any() Eric Dumazet <edumazet(a)google.com> tcp: avoid premature drops in tcp_add_backlog() Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> wifi: ath10k: populate board data for WCN3990 Su Hui <suhui(a)nfschina.com> wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() Ard Biesheuvel <ardb(a)kernel.org> x86/purgatory: Switch to the position-independent small code model Yuri Karpov <YKarpov(a)ispras.ru> scsi: hpsa: Fix allocation size for Scsi_Host private data Xingui Yang <yangxingui(a)huawei.com> scsi: libsas: Fix the failure of adding phy with zero-address to port Gabriel Krisman Bertazi <krisman(a)suse.de> udp: Avoid call to compute_score on multiple sites Lorenz Bauer <lmb(a)isovalent.com> net: remove duplicate reuseport_lookup functions Lorenz Bauer <lmb(a)isovalent.com> net: export inet_lookup_reuseport and inet6_lookup_reuseport Viresh Kumar <viresh.kumar(a)linaro.org> cpufreq: exit() callback is optional Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: Rearrange locking in cpufreq_remove_dev() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: Split cpufreq_offline() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: Reorganize checks in cpufreq_offline() Geliang Tang <tanggeliang(a)kylinos.cn> selftests/bpf: Fix umount cgroup2 error in test_sockmap Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Fix "ignore unlock failures after withdraw" Arnd Bergmann <arnd(a)arndb.de> ACPI: disable -Wstringop-truncation Zenghui Yu <yuzenghui(a)huawei.com> irqchip/loongson-pch-msi: Fix off-by-one on allocation error path Zenghui Yu <yuzenghui(a)huawei.com> irqchip/alpine-msi: Fix off-by-one in allocation error path Andrew Halaney <ahalaney(a)redhat.com> scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL Andrew Halaney <ahalaney(a)redhat.com> scsi: ufs: core: Perform read back after disabling interrupts Andrew Halaney <ahalaney(a)redhat.com> scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV Andrew Halaney <ahalaney(a)redhat.com> scsi: ufs: qcom: Perform read back after writing CGC enable Andrew Halaney <ahalaney(a)redhat.com> scsi: ufs: qcom: Perform read back after writing unipro mode Abel Vesa <abel.vesa(a)linaro.org> scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5 Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0 Andrew Halaney <ahalaney(a)redhat.com> scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US Ziqi Chen <ziqichen(a)codeaurora.org> scsi: ufs-qcom: Fix ufs RST_n spec violation Andrew Halaney <ahalaney(a)redhat.com> scsi: ufs: qcom: Perform read back after writing reset bit Arnd Bergmann <arnd(a)arndb.de> qed: avoid truncating work queue length Guixiong Wei <weiguixiong(a)bytedance.com> x86/boot: Ignore relocations in .notes sections in walk_relocs() too Baochen Qiang <quic_bqiang(a)quicinc.com> wifi: ath10k: poll service ready message before failing Yu Kuai <yukuai3(a)huawei.com> md: fix resync softlockup when bitmap size is less than array size Zhu Yanjun <yanjun.zhu(a)linux.dev> null_blk: Fix missing mutex_destroy() at module removal Chun-Kuang Hu <chunkuang.hu(a)kernel.org> soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE Ilya Denisyev <dev(a)elkcl.ru> jffs2: prevent xattr node from overflowing the eraseblock Peter Oberparleiter <oberpar(a)linux.ibm.com> s390/cio: fix tracepoint subchannel type field Eric Biggers <ebiggers(a)google.com> crypto: x86/sha256-avx2 - add missing vzeroupper Eric Biggers <ebiggers(a)google.com> crypto: x86/nh-avx2 - add missing vzeroupper Arnd Bergmann <arnd(a)arndb.de> crypto: ccp - drop platform ifdef checks Al Viro <viro(a)zeniv.linux.org.uk> parisc: add missing export of __cmpxchg_u8() Arnd Bergmann <arnd(a)arndb.de> nilfs2: fix out-of-range warning Brian Kubisiak <brian(a)kubisiak.com> ecryptfs: Fix buffer size for tag 66 packet Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> firmware: raspberrypi: Use correct device for DMA mappings Aleksandr Mishin <amishin(a)t-argos.ru> crypto: bcm - Fix pointer arithmetic Eric Sandeen <sandeen(a)redhat.com> openpromfs: finish conversion to the new mount API Nilay Shroff <nilay(a)linux.ibm.com> nvme: find numa distance only if controller has valid numa id Lancelot SIX <lancelot.six(a)amd.com> drm/amdkfd: Flush the process wq before creating a kfd_process Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> ASoC: da7219-aad: fix usage of device_get_named_child_node() Jack Yu <jack.yu(a)realtek.com> ASoC: rt715: add vendor clear control register Krzysztof Kozlowski <krzk(a)kernel.org> regulator: vqmmc-ipq4019: fix module autoloading Derek Fang <derek.fang(a)realtek.com> ASoC: dt-bindings: rt5645: add cbj sleeve gpio property Derek Fang <derek.fang(a)realtek.com> ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating Joshua Ashton <joshua(a)froggi.es> drm/amd/display: Set color_mgmt_changed to true on unsuspend Daniele Palmas <dnlplm(a)gmail.com> net: usb: qmi_wwan: add Telit FN920C04 compositions Igor Artemiev <Igor.A.Artemiev(a)mcst.ru> wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix NULL module pointer assignment at card init Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix potential hang in nilfs_detach_log_writer() Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix unexpected freezing of nilfs_segctor_sync() Thorsten Blum <thorsten.blum(a)toblux.com> net: smc91x: Fix m68k kernel compilation for ColdFire CPU Petr Pavlu <petr.pavlu(a)suse.com> ring-buffer: Fix a race between readers and resize checks Ken Milmore <ken.milmore(a)gmail.com> r8169: Fix possible ring buffer corruption on fragmented Tx packets. Dan Carpenter <dan.carpenter(a)linaro.org> speakup: Fix sizeof() vs ARRAY_SIZE() bug Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Daniel J Blueman <daniel(a)quora.org> x86/tsc: Trust initial offset in architectural TSC-adjust MSRs ------------- Diffstat: Documentation/devicetree/bindings/sound/rt5645.txt | 6 + Documentation/driver-api/fpga/fpga-bridge.rst | 10 +- Documentation/driver-api/fpga/fpga-mgr.rst | 12 +- Documentation/driver-api/fpga/fpga-programming.rst | 8 +- Documentation/driver-api/fpga/fpga-region.rst | 35 ++- Documentation/filesystems/f2fs.rst | 36 +++ Makefile | 4 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 2 +- arch/arm64/boot/dts/nvidia/tegra132-norrin.dts | 4 +- arch/arm64/boot/dts/nvidia/tegra132.dtsi | 2 +- arch/arm64/boot/dts/qcom/qcs404-evb.dtsi | 2 +- arch/arm64/include/asm/asm-bug.h | 1 + arch/arm64/kvm/guest.c | 1 + arch/m68k/kernel/entry.S | 4 +- arch/m68k/mac/misc.c | 36 +-- arch/microblaze/kernel/Makefile | 1 - arch/microblaze/kernel/cpu/cpuinfo-static.c | 2 +- arch/parisc/kernel/parisc_ksyms.c | 1 + arch/powerpc/include/asm/hvcall.h | 2 +- arch/powerpc/include/asm/uaccess.h | 55 ++++ arch/powerpc/platforms/pseries/lpar.c | 6 +- arch/powerpc/platforms/pseries/lparcfg.c | 6 +- arch/powerpc/sysdev/fsl_msi.c | 2 + arch/riscv/include/asm/stacktrace.h | 17 ++ arch/riscv/kernel/entry.S | 3 +- arch/riscv/kernel/perf_callchain.c | 10 +- arch/riscv/kernel/stacktrace.c | 36 ++- arch/s390/kernel/ipl.c | 10 +- arch/sh/kernel/kprobes.c | 7 +- arch/sh/lib/checksum.S | 67 ++--- arch/sparc/include/asm/smp_64.h | 2 - arch/sparc/include/uapi/asm/termbits.h | 10 - arch/sparc/include/uapi/asm/termios.h | 9 + arch/sparc/kernel/prom_64.c | 4 +- arch/sparc/kernel/setup_64.c | 1 - arch/sparc/kernel/smp_64.c | 14 - arch/um/drivers/line.c | 14 +- arch/um/drivers/ubd_kern.c | 4 +- arch/um/drivers/vector_kern.c | 2 +- arch/um/include/asm/mmu.h | 2 - arch/um/include/shared/skas/mm_id.h | 2 + arch/x86/Kconfig.debug | 5 +- arch/x86/crypto/nh-avx2-x86_64.S | 1 + arch/x86/crypto/sha256-avx2-asm.S | 1 + arch/x86/entry/vsyscall/vsyscall_64.c | 28 +- arch/x86/include/asm/processor.h | 1 - arch/x86/kernel/apic/vector.c | 9 +- arch/x86/kernel/tsc_sync.c | 6 +- arch/x86/lib/x86-opcode-map.txt | 2 +- arch/x86/mm/fault.c | 27 +- arch/x86/purgatory/Makefile | 3 +- arch/x86/tools/relocs.c | 9 + crypto/ecrdsa.c | 1 + drivers/accessibility/speakup/main.c | 2 +- drivers/acpi/acpica/Makefile | 1 + drivers/acpi/resource.c | 12 + drivers/android/binder.c | 4 +- drivers/ata/pata_legacy.c | 8 +- drivers/block/null_blk/main.c | 3 + drivers/char/ppdev.c | 21 +- drivers/clk/qcom/mmcc-msm8998.c | 8 + drivers/cpufreq/cpufreq.c | 85 +++--- drivers/crypto/bcm/spu2.c | 2 +- drivers/crypto/ccp/sp-platform.c | 14 +- drivers/crypto/qat/qat_common/adf_aer.c | 19 +- drivers/dma-buf/sync_debug.c | 4 +- drivers/dma/idma64.c | 4 +- drivers/extcon/Kconfig | 3 +- drivers/firmware/dmi-id.c | 7 +- drivers/firmware/raspberrypi.c | 7 +- drivers/fpga/dfl-fme-region.c | 17 +- drivers/fpga/dfl.c | 12 +- drivers/fpga/fpga-region.c | 145 +++++----- drivers/fpga/of-fpga-region.c | 10 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 8 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + .../gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 5 + drivers/gpu/drm/arm/malidp_mw.c | 5 +- .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 + drivers/gpu/drm/bridge/lontium-lt9611.c | 6 +- drivers/gpu/drm/bridge/tc358775.c | 27 +- drivers/gpu/drm/drm_mipi_dsi.c | 6 +- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 3 + drivers/gpu/drm/meson/meson_vclk.c | 6 +- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 3 - drivers/gpu/drm/panel/panel-simple.c | 3 + drivers/gpu/drm/vc4/vc4_hdmi.c | 2 + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 5 + drivers/hwmon/shtc1.c | 2 +- drivers/hwtracing/intel_th/pci.c | 5 + drivers/hwtracing/stm/core.c | 11 +- drivers/iio/pressure/dps310.c | 11 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 128 +++++---- drivers/infiniband/hw/hns/hns_roce_cmd.c | 10 +- drivers/infiniband/hw/hns/hns_roce_cmd.h | 2 +- drivers/infiniband/hw/hns/hns_roce_common.h | 14 +- drivers/infiniband/hw/hns/hns_roce_db.c | 8 +- drivers/infiniband/hw/hns/hns_roce_device.h | 115 ++++---- drivers/infiniband/hw/hns/hns_roce_hem.h | 12 +- drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 8 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 35 +-- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 65 ++--- drivers/infiniband/hw/hns/hns_roce_qp.c | 129 +++++++-- drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 8 +- drivers/input/misc/ims-pcu.c | 4 +- drivers/input/misc/pm8xxx-vibrator.c | 7 +- drivers/input/serio/ioc3kbd.c | 13 +- drivers/irqchip/irq-alpine-msi.c | 2 +- drivers/irqchip/irq-loongson-pch-msi.c | 2 +- drivers/macintosh/via-macii.c | 11 +- drivers/md/md-bitmap.c | 6 +- drivers/md/raid5.c | 15 +- drivers/media/cec/core/cec-adap.c | 291 +++++++++++++-------- drivers/media/cec/core/cec-api.c | 31 +-- drivers/media/cec/core/cec-core.c | 7 +- drivers/media/cec/core/cec-pin-priv.h | 11 + drivers/media/cec/core/cec-pin.c | 23 +- drivers/media/cec/core/cec-priv.h | 10 + drivers/media/dvb-frontends/lgdt3306a.c | 5 + drivers/media/dvb-frontends/mxl5xx.c | 22 +- drivers/media/mc/mc-devnode.c | 5 +- drivers/media/pci/ngene/ngene-core.c | 4 +- drivers/media/radio/radio-shark2.c | 2 +- drivers/media/usb/b2c2/flexcop-usb.c | 12 +- drivers/media/usb/stk1160/stk1160-video.c | 20 +- drivers/media/v4l2-core/v4l2-dev.c | 3 + drivers/mmc/core/host.c | 3 +- drivers/mmc/core/slot-gpio.c | 20 ++ drivers/mmc/host/sdhci-acpi.c | 48 +++- drivers/mmc/host/sdhci_am654.c | 205 ++++++++++----- drivers/mtd/nand/raw/nand_hynix.c | 2 +- drivers/net/ethernet/cisco/enic/enic_main.c | 12 + drivers/net/ethernet/cortina/gemini.c | 12 +- drivers/net/ethernet/freescale/fec_main.c | 10 + drivers/net/ethernet/freescale/fec_ptp.c | 14 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_main.c | 9 +- drivers/net/ethernet/realtek/r8169_main.c | 3 +- drivers/net/ethernet/smsc/smc91x.h | 4 +- drivers/net/ethernet/sun/sungem.c | 14 - drivers/net/ipvlan/ipvlan_core.c | 4 +- drivers/net/usb/aqc111.c | 8 +- drivers/net/usb/qmi_wwan.c | 3 + drivers/net/usb/smsc95xx.c | 26 +- drivers/net/usb/sr9700.c | 10 +- drivers/net/vxlan/vxlan_core.c | 4 - drivers/net/wireless/ath/ar5523/ar5523.c | 14 + drivers/net/wireless/ath/ath10k/core.c | 3 + drivers/net/wireless/ath/ath10k/debugfs_sta.c | 2 +- drivers/net/wireless/ath/ath10k/hw.h | 1 + drivers/net/wireless/ath/ath10k/targaddrs.h | 3 + drivers/net/wireless/ath/ath10k/wmi.c | 26 +- drivers/net/wireless/ath/carl9170/usb.c | 32 +++ drivers/net/wireless/marvell/mwl8k.c | 2 +- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 26 +- .../net/wireless/realtek/rtlwifi/rtl8192de/trx.c | 21 +- .../net/wireless/realtek/rtlwifi/rtl8192de/trx.h | 79 ++---- drivers/nvme/host/multipath.c | 3 +- drivers/nvme/target/configfs.c | 8 + drivers/pci/pcie/edr.c | 28 +- drivers/regulator/bd71828-regulator.c | 58 +--- drivers/regulator/vqmmc-ipq4019-regulator.c | 1 + drivers/s390/cio/trace.h | 2 +- drivers/s390/crypto/ap_bus.c | 2 +- drivers/scsi/bfa/bfad_debugfs.c | 4 +- drivers/scsi/hpsa.c | 2 +- drivers/scsi/libsas/sas_expander.c | 3 +- drivers/scsi/qedf/qedf_debugfs.c | 2 +- drivers/scsi/qla2xxx/qla_init.c | 8 +- drivers/scsi/qla2xxx/qla_mr.c | 20 +- drivers/scsi/ufs/cdns-pltfrm.c | 2 +- drivers/scsi/ufs/ufs-qcom.c | 31 ++- drivers/scsi/ufs/ufs-qcom.h | 21 +- drivers/scsi/ufs/ufshcd.c | 4 +- drivers/soc/mediatek/mtk-cmdq-helper.c | 5 +- drivers/soundwire/cadence_master.c | 2 +- drivers/spi/spi-stm32.c | 2 +- drivers/spi/spi.c | 4 + drivers/staging/greybus/arche-apb-ctrl.c | 1 + drivers/staging/greybus/arche-platform.c | 9 +- drivers/staging/greybus/light.c | 8 +- drivers/staging/media/atomisp/pci/sh_css.c | 1 + drivers/tty/n_gsm.c | 8 +- drivers/tty/serial/max3100.c | 22 +- drivers/tty/serial/sc16is7xx.c | 2 +- drivers/tty/serial/sh-sci.c | 5 + drivers/usb/gadget/function/u_audio.c | 2 + drivers/video/fbdev/Kconfig | 4 +- drivers/video/fbdev/savage/savagefb_driver.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 2 +- drivers/video/fbdev/sis/init301.c | 3 +- drivers/virtio/virtio_pci_common.c | 4 +- drivers/watchdog/rti_wdt.c | 34 ++- fs/afs/mntpt.c | 5 + fs/ecryptfs/keystore.c | 4 +- fs/ext4/mballoc.c | 134 +++++----- fs/ext4/namei.c | 2 +- fs/ext4/xattr.c | 4 +- fs/f2fs/checkpoint.c | 4 +- fs/f2fs/compress.c | 91 +++---- fs/f2fs/data.c | 10 +- fs/f2fs/extent_cache.c | 4 +- fs/f2fs/f2fs.h | 52 +++- fs/f2fs/file.c | 86 ++++-- fs/f2fs/inode.c | 9 + fs/f2fs/namei.c | 2 +- fs/f2fs/node.c | 2 +- fs/f2fs/segment.c | 4 +- fs/f2fs/super.c | 32 +++ fs/gfs2/glock.c | 4 +- fs/gfs2/util.c | 1 - fs/jffs2/xattr.c | 3 + fs/nfs/internal.h | 4 +- fs/nfs/nfs4proc.c | 2 +- fs/nilfs2/ioctl.c | 2 +- fs/nilfs2/segment.c | 63 ++++- fs/openpromfs/inode.c | 8 +- fs/overlayfs/dir.c | 3 - include/drm/drm_mipi_dsi.h | 6 +- include/linux/f2fs_fs.h | 3 +- include/linux/fpga/fpga-region.h | 43 ++- include/linux/mmc/slot-gpio.h | 1 + include/linux/moduleparam.h | 2 + include/media/cec.h | 26 +- include/media/v4l2-h264.h | 6 +- include/media/v4l2-jpeg.h | 2 + include/net/dst_ops.h | 2 +- include/net/inet6_hashtables.h | 16 ++ include/net/inet_hashtables.h | 18 +- include/net/netfilter/nf_tables.h | 2 + include/net/sock.h | 13 +- include/sound/soc-acpi.h | 6 + include/trace/events/asoc.h | 2 + include/uapi/linux/cec.h | 3 +- include/uapi/linux/v4l2-subdev.h | 12 +- include/uapi/linux/videodev2.h | 15 +- io_uring/io_uring.c | 2 + kernel/bpf/verifier.c | 10 +- kernel/cgroup/cpuset.c | 2 +- kernel/debug/kdb/kdb_io.c | 99 ++++--- kernel/irq/cpuhotplug.c | 16 +- kernel/params.c | 18 ++ kernel/sched/topology.c | 2 +- kernel/trace/ring_buffer.c | 9 + net/9p/client.c | 2 + net/core/dev.c | 3 +- net/ipv4/inet_hashtables.c | 29 +- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 + net/ipv4/route.c | 22 +- net/ipv4/tcp_dctcp.c | 13 +- net/ipv4/tcp_ipv4.c | 13 +- net/ipv4/udp.c | 55 ++-- net/ipv6/inet6_hashtables.c | 27 +- net/ipv6/reassembly.c | 2 +- net/ipv6/route.c | 34 +-- net/ipv6/seg6.c | 5 +- net/ipv6/seg6_hmac.c | 42 ++- net/ipv6/udp.c | 61 +++-- net/netfilter/nf_tables_api.c | 22 +- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_payload.c | 23 +- net/netfilter/nft_tunnel.c | 1 + net/netrom/nr_route.c | 19 +- net/nfc/nci/core.c | 17 +- net/openvswitch/actions.c | 6 + net/openvswitch/flow.c | 3 +- net/packet/af_packet.c | 3 +- net/qrtr/af_qrtr.c | 16 +- net/qrtr/ns.c | 34 ++- net/qrtr/qrtr.h | 2 +- net/sunrpc/auth_gss/svcauth_gss.c | 12 +- net/sunrpc/clnt.c | 1 + net/sunrpc/svc.c | 2 - net/sunrpc/xprtrdma/verbs.c | 6 +- net/sunrpc/xprtsock.c | 18 -- net/tls/tls_main.c | 10 +- net/unix/af_unix.c | 2 +- net/wireless/trace.h | 4 +- net/xfrm/xfrm_policy.c | 11 +- scripts/kconfig/symbol.c | 6 +- sound/core/init.c | 2 +- sound/core/timer.c | 10 + sound/soc/codecs/da7219-aad.c | 6 +- sound/soc/codecs/rt5645.c | 25 ++ sound/soc/codecs/rt715-sdw.c | 1 + sound/soc/codecs/tas2552.c | 15 +- sound/soc/intel/boards/bxt_da7219_max98357a.c | 1 + sound/soc/intel/boards/bxt_rt298.c | 1 + sound/soc/intel/boards/glk_rt5682_max98357a.c | 2 + sound/soc/intel/boards/kbl_da7219_max98357a.c | 1 + sound/soc/intel/boards/kbl_da7219_max98927.c | 4 + sound/soc/intel/boards/kbl_rt5660.c | 1 + sound/soc/intel/boards/kbl_rt5663_max98927.c | 2 + .../soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 1 + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 + sound/soc/intel/boards/skl_nau88l25_max98357a.c | 1 + sound/soc/intel/boards/skl_rt286.c | 1 + tools/arch/x86/lib/x86-opcode-map.txt | 2 +- tools/bpf/resolve_btfids/main.c | 2 +- tools/lib/subcmd/parse-options.c | 8 +- tools/perf/Documentation/perf-annotate.txt | 7 + tools/perf/bench/inject-buildid.c | 2 +- tools/perf/builtin-annotate.c | 6 +- tools/perf/builtin-record.c | 8 +- tools/perf/builtin-report.c | 2 +- tools/perf/builtin-top.c | 4 +- tools/perf/ui/browser.c | 26 +- tools/perf/ui/browser.h | 2 +- tools/perf/ui/browsers/annotate.c | 2 +- tools/perf/ui/setup.c | 5 +- tools/perf/ui/tui/helpline.c | 5 +- tools/perf/ui/tui/progress.c | 8 +- tools/perf/ui/tui/setup.c | 12 +- tools/perf/ui/tui/util.c | 18 +- tools/perf/ui/ui.h | 4 +- tools/perf/util/bpf-event.c | 2 +- tools/perf/util/evlist.h | 11 +- .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 2 + tools/perf/util/intel-pt.c | 2 + tools/perf/util/probe-event.c | 1 + tools/perf/util/sideband_evlist.c | 8 +- tools/perf/util/stat-display.c | 3 + tools/testing/selftests/bpf/test_sockmap.c | 2 +- .../selftests/filesystems/binderfs/Makefile | 2 - tools/testing/selftests/kcmp/kcmp_test.c | 8 +- 328 files changed, 2834 insertions(+), 1844 deletions(-)

6 months, 2 weeks

11
335
0 0

FAILED: patch "[PATCH] media: uvcvideo: Fix integer overflow calculating timestamp" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 8676a5e796fa18f55897ca36a94b2adf7f73ebd1 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024072959-overpass-sapling-797e@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: 8676a5e796fa ("media: uvcvideo: Fix integer overflow calculating timestamp") 9e56380ae625 ("media: uvcvideo: Rename debug functions") ed4c5fa4d804 ("media: uvcvideo: use dev_printk() for uvc_trace()") 59e92bf62771 ("media: uvcvideo: New macro uvc_trace_cont") 69df09547e7a ("media: uvcvideo: Use dev_ printk aliases") 2886477ff987 ("media: uvcvideo: Implement UVC_EXT_GPIO_UNIT") 351509c604dc ("media: uvcvideo: Move guid to entity") dc9455ffae02 ("media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values") b400b6f28af0 ("media: uvcvideo: Force UVC version to 1.0a for 1bcf:0b40") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 8676a5e796fa18f55897ca36a94b2adf7f73ebd1 Mon Sep 17 00:00:00 2001 From: Ricardo Ribalda <ribalda(a)chromium.org> Date: Mon, 10 Jun 2024 19:17:49 +0000 Subject: [PATCH] media: uvcvideo: Fix integer overflow calculating timestamp The function uvc_video_clock_update() supports a single SOF overflow. Or in other words, the maximum difference between the first ant the last timestamp can be 4096 ticks or 4.096 seconds. This results in a maximum value for y2 of: 0x12FBECA00, that overflows 32bits. y2 = (u32)ktime_to_ns(ktime_sub(last->host_time, first->host_time)) + y1; Extend the size of y2 to u64 to support all its values. Without this patch: # yavta -s 1920x1080 -f YUYV -t 1/5 -c /dev/video0 Device /dev/v4l/by-id/usb-Shine-Optics_Integrated_Camera_0001-video-index0 opened. Device `Integrated Camera: Integrated C' on `usb-0000:00:14.0-6' (driver 'uvcvideo') supports video, capture, without mplanes. Video format set: YUYV (56595559) 1920x1080 (stride 3840) field none buffer size 4147200 Video format: YUYV (56595559) 1920x1080 (stride 3840) field none buffer size 4147200 Current frame rate: 1/5 Setting frame rate to: 1/5 Frame rate set: 1/5 8 buffers requested. length: 4147200 offset: 0 timestamp type/source: mono/SoE Buffer 0/0 mapped at address 0x7947ea94c000. length: 4147200 offset: 4149248 timestamp type/source: mono/SoE Buffer 1/0 mapped at address 0x7947ea557000. length: 4147200 offset: 8298496 timestamp type/source: mono/SoE Buffer 2/0 mapped at address 0x7947ea162000. length: 4147200 offset: 12447744 timestamp type/source: mono/SoE Buffer 3/0 mapped at address 0x7947e9d6d000. length: 4147200 offset: 16596992 timestamp type/source: mono/SoE Buffer 4/0 mapped at address 0x7947e9978000. length: 4147200 offset: 20746240 timestamp type/source: mono/SoE Buffer 5/0 mapped at address 0x7947e9583000. length: 4147200 offset: 24895488 timestamp type/source: mono/SoE Buffer 6/0 mapped at address 0x7947e918e000. length: 4147200 offset: 29044736 timestamp type/source: mono/SoE Buffer 7/0 mapped at address 0x7947e8d99000. 0 (0) [-] none 0 4147200 B 507.554210 508.874282 242.836 fps ts mono/SoE 1 (1) [-] none 2 4147200 B 508.886298 509.074289 0.751 fps ts mono/SoE 2 (2) [-] none 3 4147200 B 509.076362 509.274307 5.261 fps ts mono/SoE 3 (3) [-] none 4 4147200 B 509.276371 509.474336 5.000 fps ts mono/SoE 4 (4) [-] none 5 4147200 B 509.476394 509.674394 4.999 fps ts mono/SoE 5 (5) [-] none 6 4147200 B 509.676506 509.874345 4.997 fps ts mono/SoE 6 (6) [-] none 7 4147200 B 509.876430 510.074370 5.002 fps ts mono/SoE 7 (7) [-] none 8 4147200 B 510.076434 510.274365 5.000 fps ts mono/SoE 8 (0) [-] none 9 4147200 B 510.276421 510.474333 5.000 fps ts mono/SoE 9 (1) [-] none 10 4147200 B 510.476391 510.674429 5.001 fps ts mono/SoE 10 (2) [-] none 11 4147200 B 510.676434 510.874283 4.999 fps ts mono/SoE 11 (3) [-] none 12 4147200 B 510.886264 511.074349 4.766 fps ts mono/SoE 12 (4) [-] none 13 4147200 B 511.070577 511.274304 5.426 fps ts mono/SoE 13 (5) [-] none 14 4147200 B 511.286249 511.474301 4.637 fps ts mono/SoE 14 (6) [-] none 15 4147200 B 511.470542 511.674251 5.426 fps ts mono/SoE 15 (7) [-] none 16 4147200 B 511.672651 511.874337 4.948 fps ts mono/SoE 16 (0) [-] none 17 4147200 B 511.873988 512.074462 4.967 fps ts mono/SoE 17 (1) [-] none 18 4147200 B 512.075982 512.278296 4.951 fps ts mono/SoE 18 (2) [-] none 19 4147200 B 512.282631 512.482423 4.839 fps ts mono/SoE 19 (3) [-] none 20 4147200 B 518.986637 512.686333 0.149 fps ts mono/SoE 20 (4) [-] none 21 4147200 B 518.342709 512.886386 -1.553 fps ts mono/SoE 21 (5) [-] none 22 4147200 B 517.909812 513.090360 -2.310 fps ts mono/SoE 22 (6) [-] none 23 4147200 B 517.590775 513.294454 -3.134 fps ts mono/SoE 23 (7) [-] none 24 4147200 B 513.298465 513.494335 -0.233 fps ts mono/SoE 24 (0) [-] none 25 4147200 B 513.510273 513.698375 4.721 fps ts mono/SoE 25 (1) [-] none 26 4147200 B 513.698904 513.902327 5.301 fps ts mono/SoE 26 (2) [-] none 27 4147200 B 513.895971 514.102348 5.074 fps ts mono/SoE 27 (3) [-] none 28 4147200 B 514.099091 514.306337 4.923 fps ts mono/SoE 28 (4) [-] none 29 4147200 B 514.310348 514.510567 4.734 fps ts mono/SoE 29 (5) [-] none 30 4147200 B 514.509295 514.710367 5.026 fps ts mono/SoE 30 (6) [-] none 31 4147200 B 521.532513 514.914398 0.142 fps ts mono/SoE 31 (7) [-] none 32 4147200 B 520.885277 515.118385 -1.545 fps ts mono/SoE 32 (0) [-] none 33 4147200 B 520.411140 515.318336 -2.109 fps ts mono/SoE 33 (1) [-] none 34 4147200 B 515.325425 515.522278 -0.197 fps ts mono/SoE 34 (2) [-] none 35 4147200 B 515.538276 515.726423 4.698 fps ts mono/SoE 35 (3) [-] none 36 4147200 B 515.720767 515.930373 5.480 fps ts mono/SoE Cc: stable(a)vger.kernel.org Fixes: 66847ef013cc ("[media] uvcvideo: Add UVC timestamps support") Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Link: https://lore.kernel.org/r/20240610-hwtimestamp-followup-v1-2-f9eaed7be7f0@c… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c index aebcf9b25a16..4dfc1b86bdee 100644 --- a/drivers/media/usb/uvc/uvc_video.c +++ b/drivers/media/usb/uvc/uvc_video.c @@ -760,11 +760,11 @@ void uvc_video_clock_update(struct uvc_streaming *stream, unsigned long flags; u64 timestamp; u32 delta_stc; - u32 y1, y2; + u32 y1; u32 x1, x2; u32 mean; u32 sof; - u64 y; + u64 y, y2; if (!uvc_hw_timestamps_param) return; @@ -816,7 +816,7 @@ void uvc_video_clock_update(struct uvc_streaming *stream, sof = y; uvc_dbg(stream->dev, CLOCK, - "%s: PTS %u y %llu.%06llu SOF %u.%06llu (x1 %u x2 %u y1 %u y2 %u SOF offset %u)\n", + "%s: PTS %u y %llu.%06llu SOF %u.%06llu (x1 %u x2 %u y1 %u y2 %llu SOF offset %u)\n", stream->dev->name, buf->pts, y >> 16, div_u64((y & 0xffff) * 1000000, 65536), sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536), @@ -831,7 +831,7 @@ void uvc_video_clock_update(struct uvc_streaming *stream, goto done; y1 = NSEC_PER_SEC; - y2 = (u32)ktime_to_ns(ktime_sub(last->host_time, first->host_time)) + y1; + y2 = ktime_to_ns(ktime_sub(last->host_time, first->host_time)) + y1; /* * Interpolated and host SOF timestamps can wrap around at slightly @@ -852,7 +852,7 @@ void uvc_video_clock_update(struct uvc_streaming *stream, timestamp = ktime_to_ns(first->host_time) + y - y1; uvc_dbg(stream->dev, CLOCK, - "%s: SOF %u.%06llu y %llu ts %llu buf ts %llu (x1 %u/%u/%u x2 %u/%u/%u y1 %u y2 %u)\n", + "%s: SOF %u.%06llu y %llu ts %llu buf ts %llu (x1 %u/%u/%u x2 %u/%u/%u y1 %u y2 %llu)\n", stream->dev->name, sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536), y, timestamp, vbuf->vb2_buf.timestamp,

6 months, 2 weeks

3
2
0 0

[PATCH v5] x86/entry_32: Use stack segment selector for VERW operand

by Pawan Gupta

Robert Gill reported below #GP when dosemu software was executing vm86() system call: general protection fault: 0000 [#1] PREEMPT SMP CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1 Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010 EIP: restore_all_switch_stack+0xbe/0xcf EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000 ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046 CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0 Call Trace: show_regs+0x70/0x78 die_addr+0x29/0x70 exc_general_protection+0x13c/0x348 exc_bounds+0x98/0x98 handle_exception+0x14d/0x14d exc_bounds+0x98/0x98 restore_all_switch_stack+0xbe/0xcf exc_bounds+0x98/0x98 restore_all_switch_stack+0xbe/0xcf This only happens when VERW based mitigations like MDS/RFDS are enabled. This is because segment registers with an arbitrary user value can result in #GP when executing VERW. Intel SDM vol. 2C documents the following behavior for VERW instruction: #GP(0) - If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. CLEAR_CPU_BUFFERS macro executes VERW instruction before returning to user space. Replace CLEAR_CPU_BUFFERS with a safer version that uses %ss to refer VERW operand mds_verw_sel. This ensures VERW will not #GP for an arbitrary user %ds. Also, in NMI return path, move VERW to after RESTORE_ALL_NMI that touches GPRs. For clarity, below are the locations where the new CLEAR_CPU_BUFFERS_SAFE version is being used: * entry_INT80_32(), entry_SYSENTER_32() and interrupts (via handle_exception_return) do: restore_all_switch_stack: [...] mov %esi,%esi verw %ss:0xc0fc92c0 <------------- iret * Opportunistic SYSEXIT: [...] verw %ss:0xc0fc92c0 <------------- btrl $0x9,(%esp) popf pop %eax sti sysexit * nmi_return and nmi_from_espfix: mov %esi,%esi verw %ss:0xc0fc92c0 <------------- jmp .Lirq_return Fixes: a0e2dab44d22 ("x86/entry_32: Add VERW just before userspace transition") Cc: stable(a)vger.kernel.org # 5.10+ Reported-by: Robert Gill <rtgill82(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218707 Closes: https://lore.kernel.org/all/8c77ccfd-d561-45a1-8ed5-6b75212c7a58@leemhuis.i… Suggested-by: Dave Hansen <dave.hansen(a)linux.intel.com> Suggested-by: Brian Gerst <brgerst(a)gmail.com> # Use %ss Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> --- v5: - Simplify the use of ALTERNATIVE construct (Uros/Jiri/Peter). v4: https://lore.kernel.org/r/20240710-fix-dosemu-vm86-v4-1-aa6464e1de6f@linux.… - Further simplify the patch by using %ss for all VERW calls in 32-bit mode (Brian). - In NMI exit path move VERW after RESTORE_ALL_NMI that touches GPRs (Dave). v3: https://lore.kernel.org/r/20240701-fix-dosemu-vm86-v3-1-b1969532c75a@linux.… - Simplify CLEAR_CPU_BUFFERS_SAFE by using %ss instead of %ds (Brian). - Do verw before popf in SYSEXIT path (Jari). v2: https://lore.kernel.org/r/20240627-fix-dosemu-vm86-v2-1-d5579f698e77@linux.… - Safe guard against any other system calls like vm86() that might change %ds (Dave). v1: https://lore.kernel.org/r/20240426-fix-dosemu-vm86-v1-1-88c826a3f378@linux.… --- --- arch/x86/entry/entry_32.S | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S index d3a814efbff6..25c942149fb5 100644 --- a/arch/x86/entry/entry_32.S +++ b/arch/x86/entry/entry_32.S @@ -253,6 +253,14 @@ .Lend_\@: .endm +/* + * Safer version of CLEAR_CPU_BUFFERS that uses %ss to reference VERW operand + * mds_verw_sel. This ensures VERW will not #GP for an arbitrary user %ds. + */ +.macro CLEAR_CPU_BUFFERS_SAFE + ALTERNATIVE "", __stringify(verw %ss:_ASM_RIP(mds_verw_sel)), X86_FEATURE_CLEAR_CPU_BUF +.endm + .macro RESTORE_INT_REGS popl %ebx popl %ecx @@ -871,6 +879,8 @@ SYM_FUNC_START(entry_SYSENTER_32) /* Now ready to switch the cr3 */ SWITCH_TO_USER_CR3 scratch_reg=%eax + /* Clobbers ZF */ + CLEAR_CPU_BUFFERS_SAFE /* * Restore all flags except IF. (We restore IF separately because @@ -881,7 +891,6 @@ SYM_FUNC_START(entry_SYSENTER_32) BUG_IF_WRONG_CR3 no_user_check=1 popfl popl %eax - CLEAR_CPU_BUFFERS /* * Return back to the vDSO, which will pop ecx and edx. @@ -951,7 +960,7 @@ restore_all_switch_stack: /* Restore user state */ RESTORE_REGS pop=4 # skip orig_eax/error_code - CLEAR_CPU_BUFFERS + CLEAR_CPU_BUFFERS_SAFE .Lirq_return: /* * ARCH_HAS_MEMBARRIER_SYNC_CORE rely on IRET core serialization @@ -1144,7 +1153,6 @@ SYM_CODE_START(asm_exc_nmi) /* Not on SYSENTER stack. */ call exc_nmi - CLEAR_CPU_BUFFERS jmp .Lnmi_return .Lnmi_from_sysenter_stack: @@ -1165,6 +1173,7 @@ SYM_CODE_START(asm_exc_nmi) CHECK_AND_APPLY_ESPFIX RESTORE_ALL_NMI cr3_reg=%edi pop=4 + CLEAR_CPU_BUFFERS_SAFE jmp .Lirq_return #ifdef CONFIG_X86_ESPFIX32 @@ -1206,6 +1215,7 @@ SYM_CODE_START(asm_exc_nmi) * 1 - orig_ax */ lss (1+5+6)*4(%esp), %esp # back to espfix stack + CLEAR_CPU_BUFFERS_SAFE jmp .Lirq_return #endif SYM_CODE_END(asm_exc_nmi) --- base-commit: f2661062f16b2de5d7b6a5c42a9a5c96326b8454 change-id: 20240426-fix-dosemu-vm86-dd111a01737e

6 months, 2 weeks

2
2
0 0

[PATCH v2 0/5] soc: qcom: fix rpm_requests module probing

by Dmitry Baryshkov

The GLINK RPMSG channels get modalias based on the compatible string rather than the channel type, however the smd-rpm module uses rpmsg ID instead. Thus if the smd-rpm is built as a module, it doesn't get automatically loaded. Add generic compatible to such devices and fix module's ID table. Module loading worked before the commit bcabe1e09135 ("soc: qcom: smd-rpm: Match rpmsg channel instead of compatible"), because the driver listed all compatible strings, but the mentioned commit changed ID table. Revert the offending commit and add generic compatible strings instead. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> --- Changes in v2: - Separate fix from the improvements (Krzysztof - Split the qcom,glink-smd-rpm compat from the qcom,smd-rpm as they use different channels underneath. - Link to v1: https://lore.kernel.org/r/20240729-fix-smd-rpm-v1-0-99a96133cc65@linaro.org --- Dmitry Baryshkov (5): Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible" dt-bindings: soc: qcom: smd-rpm: add generic compatibles soc: qcom: smd-rpm: add qcom,smd-rpm compatible ARM: dts: qcom: add generic compat string to RPM glink channels arm64: dts: qcom: add generic compat string to RPM glink channels .../devicetree/bindings/clock/qcom,rpmcc.yaml | 2 +- .../bindings/remoteproc/qcom,glink-rpm-edge.yaml | 2 +- .../bindings/remoteproc/qcom,rpm-proc.yaml | 4 +- .../devicetree/bindings/soc/qcom/qcom,smd-rpm.yaml | 74 ++++++++++------------ .../devicetree/bindings/soc/qcom/qcom,smd.yaml | 2 +- arch/arm/boot/dts/qcom/qcom-apq8084.dtsi | 2 +- arch/arm/boot/dts/qcom/qcom-msm8226.dtsi | 2 +- arch/arm/boot/dts/qcom/qcom-msm8974.dtsi | 2 +- arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +- arch/arm64/boot/dts/qcom/ipq9574.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8939.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8953.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8976.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8994.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +- arch/arm64/boot/dts/qcom/qcm2290.dtsi | 2 +- arch/arm64/boot/dts/qcom/qcs404.dtsi | 2 +- arch/arm64/boot/dts/qcom/sdm630.dtsi | 2 +- arch/arm64/boot/dts/qcom/sm6115.dtsi | 2 +- arch/arm64/boot/dts/qcom/sm6125.dtsi | 2 +- arch/arm64/boot/dts/qcom/sm6375.dtsi | 2 +- drivers/soc/qcom/smd-rpm.c | 41 +++++++++--- 24 files changed, 88 insertions(+), 73 deletions(-) --- base-commit: 668d33c9ff922c4590c58754ab064aaf53c387dd change-id: 20240729-fix-smd-rpm-9651e87a9bb0 Best regards, -- Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>

6 months, 2 weeks

3
3
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror July 2024