- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS 0/2] add debug info
by Wang ShaoBo 09 Dec '22

09 Dec '22

add debug info Wang ShaoBo (1): waitqueue: add info for debugging Yu Liao (1): timer: add info for debugging include/linux/dwait.h | 6 +++++ kernel/sched/wait.c | 39 +++++++++++++++++++++++++++++ kernel/time/timer.c | 8 ++++++ lib/list_debug.c | 57 +++++++++++++++++++++++++++++++++++++++---- 4 files changed, 105 insertions(+), 5 deletions(-) create mode 100644 include/linux/dwait.h -- 2.25.1

1 2

【知会】https://gitee.com/openeuler/kernel 仓 openEuler-22.03-LTS-SP1分支已从主干OLK-5.10分支拉取
by Zhengzengkai 08 Dec '22

08 Dec '22

Hi All, https://gitee.com/openeuler/kernel 仓 openEuler-22.03-LTS-SP1分支已从主干OLK-5.10分支拉取，后续合入openEuler-22.03-LTS-SP1分支的补丁，目标分支请提到openEuler-22.03-LTS-SP1分支，如需同步主干，请在PR中评论/sync OLK-5.10 或另提到OLK-5.10分支。谢谢！

1 0

[PATCH openEuler-5.10 01/37] sched: Fix null-ptr-deref in free_fair_sched_group
by Zheng Zengkai 08 Dec '22

08 Dec '22

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187419, https://gitee.com/openeuler/kernel/issues/I612FD ------------------------------- do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353 el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369 el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683 ================================================================== BUG: KASAN: null-ptr-deref in rq_of kernel/sched/sched.h:1118 [inline] BUG: KASAN: null-ptr-deref in unthrottle_qos_sched_group kernel/sched/fair.c:7619 [inline] BUG: KASAN: null-ptr-deref in free_fair_sched_group+0x124/0x320 kernel/sched/fair.c:12131 Read of size 8 at addr 0000000000000130 by task syz-executor100/223 CPU: 3 PID: 223 Comm: syz-executor100 Not tainted 5.10.0 #6 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132 show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b4/0x248 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:551 [inline] kasan_report+0x18c/0x210 mm/kasan/report.c:564 check_memory_region_inline mm/kasan/generic.c:187 [inline] __asan_load8+0x98/0xc0 mm/kasan/generic.c:253 rq_of kernel/sched/sched.h:1118 [inline] unthrottle_qos_sched_group kernel/sched/fair.c:7619 [inline] free_fair_sched_group+0x124/0x320 kernel/sched/fair.c:12131 sched_free_group kernel/sched/core.c:7767 [inline] sched_create_group+0x48/0xc0 kernel/sched/core.c:7798 cpu_cgroup_css_alloc+0x18/0x40 kernel/sched/core.c:7930 css_create+0x7c/0x4a0 kernel/cgroup/cgroup.c:5328 cgroup_apply_control_enable+0x288/0x340 kernel/cgroup/cgroup.c:3135 cgroup_apply_control kernel/cgroup/cgroup.c:3217 [inline] cgroup_subtree_control_write+0x668/0x8b0 kernel/cgroup/cgroup.c:3375 cgroup_file_write+0x1a8/0x37c kernel/cgroup/cgroup.c:3909 kernfs_fop_write_iter+0x220/0x2f4 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:1960 [inline] new_sync_write+0x260/0x370 fs/read_write.c:515 vfs_write+0x3dc/0x4ac fs/read_write.c:602 ksys_write+0xfc/0x200 fs/read_write.c:655 __do_sys_write fs/read_write.c:667 [inline] __se_sys_write fs/read_write.c:664 [inline] __arm64_sys_write+0x50/0x60 fs/read_write.c:664 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155 do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217 el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353 el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369 el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683 So add check for tg->cfs_rq[i] before unthrottle_qos_sched_group() called. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 7fa2eecac1f4..654e964b5c31 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -12157,7 +12157,7 @@ void free_fair_sched_group(struct task_group *tg) for_each_possible_cpu(i) { #ifdef CONFIG_QOS_SCHED - if (tg->cfs_rq) + if (tg->cfs_rq && tg->cfs_rq[i]) unthrottle_qos_sched_group(tg->cfs_rq[i]); #endif if (tg->cfs_rq) -- 2.20.1

1 36

[PATCH openEuler-1.0-LTS] mm/sharepool: Fix a double free problem caused by init_local_group
by Yongqiang Liu 08 Dec '22

08 Dec '22

From: Chen Jun <chenjun102(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I64Y5Y CVE: NA ------------------------------- If local_group_add_task fails in init_local_group. ida free the same id twice. init_local_group local_group_add_task // failed goto free_spg free_spg: free_sp_group_locked free_sp_group_id // free spg->id free_spg_id: free_new_spg_id // double free spg->id To fix it, return before calling free_new_spg_id. Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: chenweilong <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index 41ed3a3b8682..d2591c73a503 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -301,8 +301,8 @@ static int init_local_group(struct mm_struct *mm) spg = create_spg(spg_id, 0); if (IS_ERR(spg)) { - ret = PTR_ERR(spg); - goto free_spg_id; + free_new_spg_id(true, spg_id); + return PTR_ERR(spg); } master->local = spg; @@ -322,11 +322,9 @@ static int init_local_group(struct mm_struct *mm) return 0; free_spg: + /* spg_id is freed in free_sp_group_locked */ free_sp_group_locked(spg); master->local = NULL; -free_spg_id: - free_new_spg_id(true, spg_id); - return ret; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 00/25] linux-4.19.y inclusion
by Yongqiang Liu 08 Dec '22

08 Dec '22

Alexander Potapenko (2): mm: fs: initialize fsdata passed to write_begin/write_end interface ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network Arnd Bergmann (1): security: commoncap: fix -Wstringop-overread warning Baisong Zhong (1): bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() Chen Zhongjin (1): net, neigh: Fix null-ptr-deref in neigh_table_clear() Christian A. Ehrhardt (1): kernfs: fix use-after-free in __kernfs_remove Chuang Wang (1): net: macvlan: fix memory leaks of macvlan_common_newlink Daniil Tatianin (1): ring_buffer: Do not deactivate non-existant pages Eric Dumazet (1): macvlan: enforce a consistent minimal mtu Gaosheng Cui (1): capabilities: fix potential memleak on error path from vfs_getxattr_alloc() Ilpo Järvinen (2): serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs serial: 8250: Flush DMA Rx on RLSI Jiri Benc (1): net: gso: fix panic on frag_list with mixed head alloc types Kuniyuki Iwashima (1): tcp/udp: Make early_demux back namespacified. Li Qiang (1): kprobe: reverse kp->flags when arm_kprobe failed Neal Cardwell (1): tcp: fix indefinite deferral of RTO with SACK reneging Rik van Riel (1): mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages Seth Jenkins (1): mm: /proc/pid/smaps_rollup: fix no vma's null-deref Wang Wensheng (1): ftrace: Optimize the allocation for mcount entries Xia Fukun (2): ida: don't use BUG_ON() for debugging signal handling: don't use BUG_ON() for debugging Xiu Jianfeng (1): ftrace: Fix null pointer dereference in ftrace_add_mod() Zhang Xiaoxu (1): nfs4: Fix kmemleak when allocate slot failed Zhengchao Shao (2): net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed ipv6: fix WARNING in ip6_route_net_exit_late() drivers/net/macvlan.c | 6 ++- drivers/tty/serial/8250/8250_port.c | 7 +++- fs/buffer.c | 4 +- fs/kernfs/dir.c | 5 ++- fs/namei.c | 2 +- fs/nfs/nfs4client.c | 1 + fs/proc/task_mmu.c | 2 +- include/net/protocol.h | 4 -- include/net/tcp.h | 2 + include/net/udp.h | 1 + kernel/kprobes.c | 5 ++- kernel/signal.c | 8 ++-- kernel/trace/ftrace.c | 3 +- kernel/trace/ring_buffer.c | 4 +- lib/idr.c | 4 +- mm/filemap.c | 2 +- mm/hugetlb.c | 2 +- net/bpf/test_run.c | 1 + net/core/neighbour.c | 2 +- net/core/net_namespace.c | 7 ++++ net/core/skbuff.c | 36 +++++++++--------- net/ipv4/af_inet.c | 14 +------ net/ipv4/ip_input.c | 32 ++++++++++------ net/ipv4/sysctl_net_ipv4.c | 59 +---------------------------- net/ipv4/tcp_input.c | 3 +- net/ipv6/addrlabel.c | 1 + net/ipv6/ip6_input.c | 23 +++++++---- net/ipv6/route.c | 14 +++++-- net/ipv6/tcp_ipv6.c | 9 +---- net/ipv6/udp.c | 9 +---- security/commoncap.c | 6 ++- 31 files changed, 127 insertions(+), 151 deletions(-) -- 2.25.1

1 25

[PATCH openEuler-1.0-LTS] Bluetooth: L2CAP: Fix u8 overflow
by Yongqiang Liu 05 Dec '22

05 Dec '22

From: Sungwoo Kim <iam(a)sung-woo.kim> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I63D3E CVE: CVE-2022-45934 -------------------------------- By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...) > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet size (12 != 1033) 08 00 01 00 02 01 04 00 01 10 ff ff ............ > ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561 invalid packet size (14 != 1547) 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@..... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@....... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@....... = bluetoothd: Bluetooth daemon 5.43 14.401828 > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753 invalid packet size (12 != 1033) 08 00 01 00 04 01 04 00 40 00 00 00 ........@... Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 863ce43fa175..3b02e881cec1 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -4151,7 +4151,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, chan->ident = cmd->ident; l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp); - chan->num_conf_rsp++; + if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP) + chan->num_conf_rsp++; /* Reset config buffer. */ chan->conf_len = 0; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] l2tp: Serialize access to sk_user_data with sk_callback_lock
by Yongqiang Liu 05 Dec '22

05 Dec '22

From: Jakub Sitnicki <jakub(a)cloudflare.com> mainline inclusion from mainline-v6.1-rc6 commit b68777d54fac21fc833ec26ea1a2a84f975ab035 category: bugfix bugzilla: 188056, https://gitee.com/src-openeuler/kernel/issues/I62RNU CVE: CVE-2022-4129 -------------------------------- sk->sk_user_data has multiple users, which are not compatible with each other. Writers must synchronize by grabbing the sk->sk_callback_lock. l2tp currently fails to grab the lock when modifying the underlying tunnel socket fields. Fix it by adding appropriate locking. We err on the side of safety and grab the sk_callback_lock also inside the sk_destruct callback overridden by l2tp, even though there should be no refs allowing access to the sock at the time when sk_destruct gets called. v4: - serialize write to sk_user_data in l2tp sk_destruct v3: - switch from sock lock to sk_callback_lock - document write-protection for sk_user_data v2: - update Fixes to point to origin of the bug - use real names in Reported/Tested-by tags Cc: Tom Parkin <tparkin(a)katalix.com> Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core") Reported-by: Haowei Yan <g1042620637(a)gmail.com> Signed-off-by: Jakub Sitnicki <jakub(a)cloudflare.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> conflict: net/l2tp/l2tp_core.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/net/sock.h | 2 +- net/l2tp/l2tp_core.c | 19 +++++++++++++------ 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index 273f8226dbff..adfb0219fc29 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -304,7 +304,7 @@ struct sock_common { * @sk_tskey: counter to disambiguate concurrent tstamp requests * @sk_zckey: counter to order MSG_ZEROCOPY notifications * @sk_socket: Identd and reporting IO signals - * @sk_user_data: RPC layer private data + * @sk_user_data: RPC layer private data. Write-protected by @sk_callback_lock. * @sk_frag: cached page frag * @sk_peek_off: current peek_offset value * @sk_send_head: front of stuff to transmit diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index 9abdc0a04d99..a88e1fd1cfea 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1172,8 +1172,10 @@ static void l2tp_tunnel_destruct(struct sock *sk) } /* Remove hooks into tunnel socket */ + write_lock_bh(&sk->sk_callback_lock); sk->sk_destruct = tunnel->old_sk_destruct; sk->sk_user_data = NULL; + write_unlock_bh(&sk->sk_callback_lock); /* Call the original destructor */ if (sk->sk_destruct) @@ -1492,12 +1494,15 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, sock = sockfd_lookup(tunnel->fd, &ret); if (!sock) goto err; - - ret = l2tp_validate_socket(sock->sk, net, tunnel->encap); - if (ret < 0) - goto err_sock; } + sk = sock->sk; + write_lock(&sk->sk_callback_lock); + + ret = l2tp_validate_socket(sk, net, tunnel->encap); + if (ret < 0) + goto err_sock; + tunnel->l2tp_net = net; pn = l2tp_pernet(net); @@ -1513,7 +1518,6 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); spin_unlock_bh(&pn->l2tp_tunnel_list_lock); - sk = sock->sk; sock_hold(sk); tunnel->sock = sk; @@ -1527,7 +1531,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, setup_udp_tunnel_sock(net, sock, &udp_cfg); } else { - sk->sk_user_data = tunnel; + rcu_assign_sk_user_data(sk, tunnel); } tunnel->old_sk_destruct = sk->sk_destruct; @@ -1539,6 +1543,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, if (tunnel->fd >= 0) sockfd_put(sock); + write_unlock(&sk->sk_callback_lock); return 0; err_sock: @@ -1546,6 +1551,8 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, sock_release(sock); else sockfd_put(sock); + + write_unlock(&sk->sk_callback_lock); err: return ret; } -- 2.25.1

1 1

[PATCH openEuler-5.10 0/1] Backport 5.10.139 LTS
by Zheng Zengkai 02 Dec '22

02 Dec '22

Backport 5.10.139 LTS patches from upstream. git cherry-pick v5.10.138..v5.10.139~1 -s Total patches: 1 Ondrej Mosnacek (1): kbuild: dummy-tools: avoid tmpdir leak in dummy gcc scripts/dummy-tools/dummy-plugin-dir/include/plugin-version.h | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 scripts/dummy-tools/dummy-plugin-dir/include/plugin-version.h -- 2.20.1

1 1

[PATCH] iommu: bugfix for missing symbols when build arm_smmu_v3.ko
by Zhang Jian 02 Dec '22

02 Dec '22

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I63SDZ CVE: NA ------------------------------- In Ascend featue, when we make CONFIG_ARM_AMMU_V3 be M, and when we build arm-smmu-v3.ko, it will miss symbols for acpi_dev_prop_read_single. So use acpi_dev_get_property to replace the old interface Signed-off-by: Zhang Jian <zhangjian210(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 9ac1601c82ea..05be3a76e10f 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3061,6 +3061,7 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev); #ifdef CONFIG_ASCEND_FEATURES u32 sid; + const union acpi_object *obj = NULL; #endif if (!fwspec || fwspec->ops != &arm_smmu_ops) @@ -3109,8 +3110,9 @@ static struct iommu_device *arm_smmu_probe_device(struct device *dev) master->stall_enabled = true; #ifdef CONFIG_ASCEND_FEATURES - if (!acpi_dev_prop_read_single(ACPI_COMPANION(dev), - "streamid", DEV_PROP_U32, &sid)) { + if (!acpi_dev_get_property(ACPI_COMPANION(dev), + "streamid", ACPI_TYPE_INTEGER, &obj) && obj) { + sid = obj->integer.value; if (iommu_fwspec_add_ids(dev, &sid, 1)) dev_info(dev, "failed to add ids\n"); master->stall_enabled = true; -- 2.17.1

1 0

[PATCH openEuler-5.10 00/76] Backport 5.10.140 LTS
by Zheng Zengkai 02 Dec '22

02 Dec '22

Backport 5.10.140 LTS patches from upstream. git cherry-pick v5.10.139..v5.10.140~1 -s Already merged(-9): 6a564bad3a64 xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list() 1b9b4139d794 xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP* 37837bc3ef31 xfs: return errors in xfs_fs_sync_fs 70d560e2fb5e xfs: only bother with sync_filesystem during readonly remount c5c4d4c9806d af_key: Do not call xfrm_probe_algs in parallel c08a104a8bce netfilter: nf_tables: disallow binding to already bound chain e3e0d117294d x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry 3ddbd0907f6d blk-mq: fix io hung due to missing commit_rqs e89798071784 bpf: Don't use tnum_range on array range checking for poke descriptors Context conflict: 4379a10c1db7 xfrm: clone missing x->lastused in xfrm_do_migrate 6301a73bd83d netfilter: nf_tables: disallow jump to implicit chain from set element Skipped(-1): 2761612bcde9 xfrm: policy: fix metadata dst->dev xmit null pointer dereference due to 5b7f84b1f9f4 ("xfrm: Add possibility to set the default to block if we have no policy") skipped Total patches: 86 - 9 - 1 = 76 Alex Elder (1): net: ipa: don't assume SMEM is page-aligned Anand Jain (2): btrfs: replace: drop assert for suspended replace btrfs: add info when mount fails due to stale replace target Antony Antony (1): xfrm: clone missing x->lastused in xfrm_do_migrate Basavaraj Natikar (1): pinctrl: amd: Don't save/restore interrupt status and wake status bits Bernard Pidoux (1): rose: check NULL rose_loopback_neigh->loopback Brian Foster (1): s390: fix double free of GS and RI CBs on fork() failure Christoph Hellwig (1): fs: remove __sync_filesystem Colin Ian King (1): netfilter: nftables: remove redundant assignment of variable err Darrick J. Wong (1): vfs: make sync_filesystem return errors from ->sync_fs David Hildenbrand (1): mm/hugetlb: fix hugetlb not supporting softdirty tracking David Howells (1): rxrpc: Fix locking in rxrpc's sendmsg Duoming Zhou (1): nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout Eric Dumazet (1): tcp: tweak len/truesize ratio for coalesce candidates Filipe Manana (1): btrfs: fix silent failure when deleting root reference Florian Westphal (1): netfilter: ebtables: reject blobs that don't provide all entry points Gaosheng Cui (1): audit: fix potential double free on error path from fsnotify_add_inode_mark Goldwyn Rodrigues (1): btrfs: check if root is readonly while setting security xattr Guoqing Jiang (2): Revert "md-raid: destroy the bitmap after destroying the thread" md: call __md_stop_writes in md_stop Helge Deller (1): parisc: Fix exception handler for fldw and fstw instructions Hui Su (1): kernel/sched: Remove dl_boosted flag comment Jacob Keller (1): ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter James Clark (1): perf python: Fix build when PYTHON_CONFIG is user supplied Jeremy Sowden (1): netfilter: bitwise: improve error goto labels Jonathan Toppins (1): bonding: 802.3ad: fix no transmission of LACPDUs Juergen Gross (1): xen/privcmd: fix error exit of privcmd_ioctl_dm_op() Kan Liang (1): perf/x86/lbr: Enable the branch type for the Arch LBR by default Kiwoong Kim (1): scsi: ufs: core: Enable link lost interrupt Kuniyuki Iwashima (15): net: Fix data-races around sysctl_[rw]mem(_offset)?. net: Fix data-races around sysctl_[rw]mem_(max|default). net: Fix data-races around weight_p and dev_weight_[rt]x_bias. net: Fix data-races around netdev_max_backlog. net: Fix data-races around netdev_tstamp_prequeue. ratelimit: Fix data-races in ___ratelimit(). net: Fix data-races around sysctl_optmem_max. net: Fix a data-race around sysctl_tstamp_allow_data. net: Fix a data-race around sysctl_net_busy_poll. net: Fix a data-race around sysctl_net_busy_read. net: Fix a data-race around netdev_budget. net: Fix a data-race around netdev_budget_usecs. net: Fix data-races around sysctl_fb_tunnels_only_for_init_net. net: Fix data-races around sysctl_devconf_inherit_init_net. net: Fix a data-race around sysctl_somaxconn. Maciej Fijalkowski (2): ice: xsk: Force rings to be sized to power of 2 ice: xsk: prohibit usage of non-balanced queue id Maciej Żenczykowski (1): net: ipvtap - add __init/__exit annotations to module init/exit funcs Martin KaFai Lau (1): bpf: Folding omem_charge() into sk_storage_charge() Miaohe Lin (1): mm/huge_memory.c: use helper function migration_entry_to_page() Olga Kornievskaia (1): NFSv4.2 fix problems with __nfs42_ssc_open Pablo Neira Ayuso (9): netfilter: nft_payload: report ERANGE for too long offset and length netfilter: nft_payload: do not truncate csum_offset and csum_type netfilter: nf_tables: do not leave chain stats enabled on error netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families netfilter: nft_tunnel: restrict it to netdev family netfilter: nf_tables: consolidate rule verdict trace call netfilter: nft_cmp: optimize comparison for 16-bytes netfilter: nf_tables: upfront validation of data via nft_data_init() netfilter: nf_tables: disallow jump to implicit chain from set element Pawan Gupta (1): x86/bugs: Add "unknown" reporting for MMIO Stale Data Peter Xu (1): mm/smaps: don't access young/dirty bit if pte unpresent Quanyang Wang (1): asm-generic: sections: refactor memory_intersects Randy Dunlap (1): kernel/sys_ni: add compat entry for fadvise64_64 Riwen Lu (1): ACPI: processor: Remove freq Qos request for all CPUs Salvatore Bonaccorso (1): Documentation/ABI: Mention retbleed vulnerability info file for sysfs Saurabh Sengar (1): scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq Sergei Antonov (1): net: moxa: get rid of asymmetry in DMA mapping/unmapping Shannon Nelson (1): ionic: fix up issues with handling EAGAIN on FW cmds Siddh Raman Pant (1): loop: Check for overflow while configuring loop Stephane Eranian (1): perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU Trond Myklebust (2): NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open() SUNRPC: RPC level errors should set task->tk_rpc_status Vikas Gupta (1): bnxt_en: fix NQ resource accounting during vf creation on 57500 chips Vlad Buslov (1): net/mlx5e: Properly disable vlan strip on non-UL reps Xin Xiong (1): xfrm: fix refcount leak in __xfrm_policy_check() Zenghui Yu (1): arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76 .../ABI/testing/sysfs-devices-system-cpu | 1 + .../hw-vuln/processor_mmio_stale_data.rst | 14 ++ Documentation/admin-guide/sysctl/net.rst | 2 +- arch/arm64/kernel/cpu_errata.c | 2 + arch/parisc/kernel/unaligned.c | 2 +- arch/s390/kernel/process.c | 22 ++- arch/x86/events/intel/lbr.c | 8 + arch/x86/events/intel/uncore_snb.c | 18 ++- arch/x86/include/asm/cpufeatures.h | 5 +- arch/x86/kernel/cpu/bugs.c | 14 +- arch/x86/kernel/cpu/common.c | 42 ++++-- drivers/acpi/processor_thermal.c | 2 +- drivers/block/loop.c | 5 + drivers/md/md.c | 3 +- drivers/net/bonding/bond_3ad.c | 38 ++--- .../net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +- drivers/net/ethernet/intel/ice/ice_xsk.c | 14 ++ drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 59 ++++++-- .../net/ethernet/mellanox/mlx5/core/en_rep.c | 2 + drivers/net/ethernet/moxa/moxart_ether.c | 11 +- .../net/ethernet/pensando/ionic/ionic_main.c | 4 +- drivers/net/ipa/ipa_mem.c | 2 +- drivers/net/ipvlan/ipvtap.c | 4 +- drivers/nfc/pn533/uart.c | 1 + drivers/pinctrl/pinctrl-amd.c | 11 +- drivers/scsi/storvsc_drv.c | 2 +- drivers/scsi/ufs/ufshci.h | 6 +- drivers/xen/privcmd.c | 21 +-- fs/btrfs/dev-replace.c | 5 +- fs/btrfs/root-tree.c | 5 +- fs/btrfs/xattr.c | 3 + fs/nfs/nfs4file.c | 16 +- fs/proc/task_mmu.c | 7 +- fs/sync.c | 48 +++--- include/asm-generic/sections.h | 7 +- include/linux/netdevice.h | 20 ++- include/linux/netfilter_bridge/ebtables.h | 4 - include/linux/sched.h | 4 - include/net/busy_poll.h | 2 +- include/net/netfilter/nf_tables.h | 9 +- include/net/netfilter/nf_tables_core.h | 9 ++ include/net/sock.h | 8 +- kernel/audit_fsnotify.c | 1 + kernel/sys_ni.c | 1 + lib/ratelimit.c | 12 +- mm/huge_memory.c | 4 +- mm/mmap.c | 8 +- net/bridge/netfilter/ebtable_broute.c | 8 - net/bridge/netfilter/ebtable_filter.c | 8 - net/bridge/netfilter/ebtable_nat.c | 8 - net/bridge/netfilter/ebtables.c | 8 +- net/core/bpf_sk_storage.c | 24 ++- net/core/dev.c | 18 +-- net/core/filter.c | 13 +- net/core/gro_cells.c | 2 +- net/core/skbuff.c | 2 +- net/core/sock.c | 18 ++- net/core/sysctl_net_core.c | 15 +- net/decnet/af_decnet.c | 4 +- net/ipv4/devinet.c | 16 +- net/ipv4/ip_output.c | 2 +- net/ipv4/ip_sockglue.c | 6 +- net/ipv4/tcp.c | 6 +- net/ipv4/tcp_input.c | 51 +++++-- net/ipv4/tcp_output.c | 4 +- net/ipv6/addrconf.c | 5 +- net/ipv6/ipv6_sockglue.c | 4 +- net/mptcp/protocol.c | 6 +- net/netfilter/ipvs/ip_vs_sync.c | 4 +- net/netfilter/nf_tables_api.c | 88 ++++++----- net/netfilter/nf_tables_core.c | 55 ++++++- net/netfilter/nft_bitwise.c | 67 +++++---- net/netfilter/nft_cmp.c | 142 +++++++++++++++--- net/netfilter/nft_immediate.c | 22 ++- net/netfilter/nft_osf.c | 18 ++- net/netfilter/nft_payload.c | 29 +++- net/netfilter/nft_range.c | 27 ++-- net/netfilter/nft_tunnel.c | 1 + net/rose/rose_loopback.c | 3 +- net/rxrpc/call_object.c | 4 +- net/rxrpc/sendmsg.c | 92 +++++++----- net/sched/sch_generic.c | 2 +- net/socket.c | 2 +- net/sunrpc/clnt.c | 2 +- net/tipc/socket.c | 2 +- net/xfrm/espintcp.c | 2 +- net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_policy.c | 1 + net/xfrm/xfrm_state.c | 1 + tools/perf/Makefile.config | 2 +- 90 files changed, 834 insertions(+), 452 deletions(-) -- 2.20.1

1 76