- Kernel - mailweb.openeuler.org

[PATCH 00/91] backport stable-4.19.160
by Yang Yingliang 28 Nov '20

28 Nov '20

Aaron Lewis (1): selftests: kvm: Fix the segment descriptor layout to match the actual layout Alejandro Concepcion Rodriguez (1): can: dev: can_restart(): post buffer from the right context Anant Thazhemadam (2): can: af_can: prevent potential access of uninitialized member in can_rcv() can: af_can: prevent potential access of uninitialized member in canfd_rcv() Arvind Sankar (1): efi/x86: Free efi_pgd with free_pages() Aya Levin (1): net/mlx4_core: Fix init_hca fields offset Brian O'Keefe (1): staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids Can Guo (1): scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold() Chen Yu (1): x86/microcode/intel: Check patch signature before saving microcode for early loading Chen-Yu Tsai (4): Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high" ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY Colin Ian King (1): can: peak_usb: fix potential integer overflow on shift of a int Dan Carpenter (2): Input: adxl34x - clean up a data type in adxl34x_probe() ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() Darrick J. Wong (4): vfs: remove lockdep bogosity in __sb_start_write xfs: fix the minrecs logic when dealing with inode root child blocks xfs: strengthen rmap record flags checking xfs: revert "xfs: fix rmap key and record comparison functions" Dongli Zhang (1): page_frag: Recover from memory pressure Edwin Peer (1): bnxt_en: read EEPROM A2h address using page 0 Fabio Estevam (1): ARM: dts: imx50-evk: Fix the chip select 1 IOMUX Felix Fietkau (2): mac80211: minstrel: remove deferred sampling code mac80211: minstrel: fix tx status processing corner case Filip Moc (1): net: usb: qmi_wwan: Set DTR quirk for MR400 Florian Fainelli (1): net: Have netpoll bring-up DSA management interface Fugang Duan (1): tty: serial: imx: keep console clocks always on Gerald Schaefer (1): mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() Greg Kroah-Hartman (1): Linux 4.19.160 Hans de Goede (3): ACPI: button: Add DMI quirk for Medion Akoya E2228T iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode Heiner Kallweit (1): net: bridge: add missing counters to ndo_get_stats64 callback Ido Schimmel (1): mlxsw: core: Use variable timeout for EMAD retries Jan Kara (1): ext4: fix bogus warning in ext4_update_dx_flag() Jernej Skrabec (3): arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node Jianqun Xu (1): pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq Jimmy Assarsson (1): can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits Joakim Tjernlund (1): ALSA: usb-audio: Add delay quirk for all Logitech USB devices Joel Stanley (2): net/ncsi: Fix netlink registration net: ftgmac100: Fix crash when removing driver Johannes Berg (1): mac80211: free sta in sta_info_insert_finish() on errors Leo Yan (1): perf lock: Don't free "lock_seq_stat" if read_count isn't zero Luo Meng (1): fail_function: Remove a redundant mutex unlock Marc Kleine-Budde (1): can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() Max Filippov (1): xtensa: disable preemption around cache alias management calls Michał Mirosław (3): regulator: fix memory leak with repeated set_machine_constraints() regulator: avoid resolve_supply() infinite recursion regulator: workaround self-referent regulators Mickaël Salaün (2): ptrace: Set PF_SUPERPRIV when checking capability seccomp: Set PF_SUPERPRIV when checking capability Necip Fazil Yildiran (1): Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER Nenad Peric (1): arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node Nishanth Menon (1): regulator: ti-abb: Fix array out of bound read access on the first transition Paul Moore (2): netlabel: fix our progress tracking in netlbl_unlabel_staticlist() netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist() PeiSen Hou (1): ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) Randy Dunlap (1): MIPS: export has_transparent_hugepage() for modules Ryan Sharpelletti (1): tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Sean Nyekjaer (1): regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} Sebastian Andrzej Siewior (1): atm: nicstar: Unmap DMA on send error Sergey Matyukevich (1): arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy Srinivasa Rao Mandadapu (1): ASoC: qcom: lpass-platform: Fix memory leak Stefan Haberland (1): s390/dasd: fix null pointer dereference for ERP requests Subash Abhinov Kasiviswanathan (1): net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup Sven Van Asbroeck (2): lan743x: fix issue causing intermittent kernel log warnings lan743x: prevent entire kernel HANG on open, for some platforms Takashi Iwai (1): ALSA: mixart: Fix mutex deadlock Takashi Sakamoto (1): ALSA: ctl: fix error path at adding user-defined element set Thomas Richter (1): s390/cpum_sf.c: fix file permission for cpum_sfb_size Tobias Waldekranz (1): net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 Vamshi K Sthambamkadi (1): efivarfs: fix memory leak in efivarfs_create() Vladyslav Tarasiuk (1): net/mlx5: Disable QoS when min_rates on all VFs are zero Wang Hai (2): devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() Will Deacon (1): arm64: psci: Avoid printing in cpu_psci_cpu_die() Wu Bo (1): can: m_can: m_can_handle_state_change(): fix state change Xie He (1): net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request Xin Long (1): sctp: change to hold/put transport for proto_unreach_timer Xiongfeng Wang (1): drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() Yi-Hung Wei (1): ip_tunnels: Set tunnel option flag when tunnel metadata is present Yicong Yang (1): libfs: fix error cast of negative value in simple_attr_write() Zhang Changzhong (4): ah6: fix error return code in ah6_input() net: b44: fix error return code in b44_init_one() qed: fix error return code in qed_iwarp_ll2_start() qlcnic: fix error return code in qlcnic_83xx_restart_hw() Zhang Qilong (2): can: ti_hecc: Fix memleak in ti_hecc_probe MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu Makefile | 2 +- arch/arm/boot/dts/imx50-evk.dts | 2 +- arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +- arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts | 2 +- .../boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +- .../boot/dts/sun8i-h3-orangepi-pc-plus.dts | 5 -- .../arm/boot/dts/sun8i-h3-orangepi-plus2e.dts | 2 +- .../boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 2 +- .../dts/allwinner/sun50i-a64-bananapi-m64.dts | 2 +- .../dts/allwinner/sun50i-a64-pine64-plus.dts | 2 +- .../dts/allwinner/sun50i-h5-orangepi-pc2.dts | 2 +- .../allwinner/sun50i-h5-orangepi-prime.dts | 2 +- arch/arm64/kernel/psci.c | 5 +- arch/mips/alchemy/common/clock.c | 9 ++- arch/mips/mm/tlb-r4k.c | 1 + arch/s390/kernel/perf_cpum_sf.c | 2 +- arch/x86/kernel/cpu/microcode/intel.c | 63 +++---------------- arch/x86/platform/efi/efi_64.c | 24 +++---- arch/xtensa/mm/cache.c | 14 +++++ drivers/acpi/button.c | 13 +++- drivers/atm/nicstar.c | 2 + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 1 + drivers/iio/accel/kxcjk-1013.c | 51 +++++++++++++-- drivers/input/misc/adxl34x.c | 2 +- drivers/input/touchscreen/Kconfig | 1 + drivers/net/can/dev.c | 2 +- drivers/net/can/m_can/m_can.c | 4 +- drivers/net/can/ti_hecc.c | 13 ++-- .../net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- drivers/net/can/usb/mcba_usb.c | 4 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 +- drivers/net/dsa/mv88e6xxx/global1_vtu.c | 59 ++++++++++++++--- drivers/net/ethernet/broadcom/b44.c | 3 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 4 ++ drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +- drivers/net/ethernet/mellanox/mlx4/fw.h | 4 +- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 15 ++--- drivers/net/ethernet/mellanox/mlxsw/core.c | 3 +- drivers/net/ethernet/microchip/lan743x_main.c | 13 ++-- drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 12 +++- .../ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3 +- .../ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 ++ drivers/net/geneve.c | 3 +- drivers/net/usb/qmi_wwan.c | 2 +- drivers/pinctrl/pinctrl-rockchip.c | 2 + drivers/regulator/core.c | 38 ++++++----- drivers/regulator/pfuze100-regulator.c | 13 ++-- drivers/regulator/ti-abb-regulator.c | 12 +++- drivers/s390/block/dasd.c | 6 ++ drivers/scsi/ufs/ufshcd.c | 6 +- drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 1 + drivers/tty/serial/imx.c | 20 +----- fs/efivarfs/super.c | 1 + fs/ext4/ext4.h | 3 +- fs/libfs.c | 6 +- fs/super.c | 33 ++-------- fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++--- fs/xfs/scrub/bmap.c | 8 +-- fs/xfs/scrub/btree.c | 45 +++++++------ include/net/ip_tunnels.h | 7 ++- kernel/fail_function.c | 5 +- kernel/ptrace.c | 16 ++--- kernel/seccomp.c | 5 +- mm/huge_memory.c | 9 ++- mm/page_alloc.c | 5 ++ net/bridge/br_device.c | 1 + net/can/af_can.c | 38 ++++++++--- net/core/devlink.c | 6 +- net/core/netpoll.c | 22 +++++-- net/ipv4/inet_diag.c | 4 +- net/ipv4/tcp_bbr.c | 2 +- net/ipv6/ah6.c | 3 +- net/mac80211/rc80211_minstrel.c | 27 ++------ net/mac80211/rc80211_minstrel.h | 1 - net/mac80211/sta_info.c | 14 ++--- net/ncsi/ncsi-manage.c | 5 -- net/ncsi/ncsi-netlink.c | 22 +------ net/ncsi/ncsi-netlink.h | 3 - net/netlabel/netlabel_unlabeled.c | 17 +++-- net/sctp/input.c | 4 +- net/sctp/sm_sideeffect.c | 4 +- net/sctp/transport.c | 2 +- net/x25/af_x25.c | 1 + sound/core/control.c | 2 +- .../fireworks/fireworks_transaction.c | 4 +- sound/pci/hda/patch_realtek.c | 50 ++++++++++++++- sound/pci/mixart/mixart_core.c | 5 +- sound/soc/qcom/lpass-platform.c | 5 +- sound/usb/quirks.c | 10 +-- tools/perf/builtin-lock.c | 2 +- tools/testing/selftests/kvm/include/x86.h | 2 +- tools/testing/selftests/kvm/lib/x86.c | 3 +- 93 files changed, 517 insertions(+), 377 deletions(-) -- 2.25.1

1 91

[PATCH 01/14] blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all()
by Yang Yingliang 28 Nov '20

28 Nov '20

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46357 CVE: NA --------------------------- test procedures: a. create 20000 cgroups, and echo "8:0 10000" to blkio.throttle.write_bps_device b. echo 1 > /sys/blocd/sda/device/delete test result: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [5/1143] rcu: 0-...0: (0 ticks this GP) idle=0f2/1/0x4000000000000000 softirq=15507/15507 fq rcu: (detected by 6, t=60012 jiffies, g=119977, q=27153) NMI backtrace for cpu 0 CPU: 0 PID: 443 Comm: bash Not tainted 4.19.95-00061-g0bcc83b30eec #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:blk_throtl_update_limit_valid.isra.0+0x116/0x2a0 Code: 01 00 00 e8 7c dd 74 ff 48 83 bb 78 01 00 00 00 0f 85 54 01 00 00 48 8d bb 88 01 1 RSP: 0018:ffff8881030bf9f0 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff8880b4f37080 RCX: ffffffff95da0afe RDX: dffffc0000000000 RSI: ffff888100373980 RDI: ffff8880b4f37208 RBP: ffff888100deca00 R08: ffffffff9528f951 R09: 0000000000000001 R10: ffffed10159dbf56 R11: ffff8880acedfab3 R12: ffff8880b9fda498 R13: ffff8880b9fda4f4 R14: 0000000000000050 R15: ffffffff98b622c0 FS: 00007feb51c51700(0000) GS:ffff888106200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561619547080 CR3: 0000000102bc9000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: throtl_pd_offline+0x98/0x100 blkg_destroy+0x133/0x630 ? blkcg_deactivate_policy+0x2c0/0x2c0 ? lock_timer_base+0x65/0x110 blkg_destroy_all+0x7f/0x100 blkcg_exit_queue+0x3f/0xa5 blk_exit_queue+0x69/0xa0 blk_cleanup_queue+0x226/0x360 __scsi_remove_device+0xb4/0x3c0 scsi_remove_device+0x38/0x60 sdev_store_delete+0x74/0x100 ? dev_driver_string+0xb0/0xb0 dev_attr_store+0x41/0x70 sysfs_kf_write+0x89/0xc0 kernfs_fop_write+0x1b6/0x2e0 ? sysfs_kf_bin_read+0x130/0x130 __vfs_write+0xca/0x420 ? kernel_read+0xc0/0xc0 ? __alloc_fd+0x16f/0x2d0 ? __fd_install+0x95/0x1a0 ? handle_mm_fault+0x3e0/0x560 vfs_write+0x11a/0x2f0 ksys_write+0xb9/0x1e0 ? __x64_sys_read+0x60/0x60 ? kasan_check_write+0x20/0x30 ? filp_close+0xb5/0xf0 __x64_sys_write+0x46/0x60 do_syscall_64+0xd9/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The usage of so many blkg is very rare, however, such problem do exist in theory. In order to avoid such warnings, release 'q->queue_lock' for a while when a batch of blkg were destroyed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index e592167449aa..c64f0afa27dc 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -364,16 +364,31 @@ static void blkg_destroy(struct blkcg_gq *blkg) */ static void blkg_destroy_all(struct request_queue *q) { +#define BLKG_DESTROY_BATCH 4096 struct blkcg_gq *blkg, *n; + int count; lockdep_assert_held(q->queue_lock); +again: + count = BLKG_DESTROY_BATCH; list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) { struct blkcg *blkcg = blkg->blkcg; spin_lock(&blkcg->lock); blkg_destroy(blkg); spin_unlock(&blkcg->lock); + /* + * If the list is too long, the loop can took a long time, + * thus relese the lock for a while when a batch of blkg + * were destroyed. + */ + if (!--count) { + spin_unlock_irq(q->queue_lock); + cond_resched(); + spin_lock_irq(q->queue_lock); + goto again; + } } q->root_blkg = NULL; -- 2.25.1

1 13

kernel sig meeting
by openEuler conference 26 Nov '20

26 Nov '20

2 1

[PATCH 00/26] KVM RISC-V Support
by MingWang Li 25 Nov '20

25 Nov '20

From: Mingwang Li <limingwang(a)huawei.com> euleros inclusion category: feature bugzilla: NA CVE: NA This series adds initial KVM RISC-V support. Currently, we are able to boot Linux on RV64/RV32 Guest with multiple VCPUs. This series can be found in riscv_kvm_v15 branch at: https//github.com/avpatel/linux.git Link: https://gitee.com/openeuler/kernel/issues/I26X9V Alistair Francis (1): Revert "riscv: Use latest system call ABI" Anup Patel (20): RISC-V: Add fragmented config for debug options RISC-V: Enable CPU Hotplug in defconfigs RISC-V: Add Microchip PolarFire kconfig option RISC-V: Initial DTS for Microchip ICICLE board RISC-V: Enable drivers for Microchip PolarFire ICICLE board RISC-V: Add missing jump label initialization RISC-V: Add hypervisor extension related CSR defines RISC-V: Add initial skeletal KVM support RISC-V: KVM: Implement VCPU create, init and destroy functions RISC-V: KVM: Implement VCPU interrupts and requests handling RISC-V: KVM: Implement KVM_GET_ONE_REG/KVM_SET_ONE_REG ioctls RISC-V: KVM: Implement VCPU world-switch RISC-V: KVM: Handle MMIO exits for VCPU RISC-V: KVM: Handle WFI exits for VCPU RISC-V: KVM: Implement VMID allocator RISC-V: KVM: Implement stage2 page table programming RISC-V: KVM: Implement MMU notifiers RISC-V: KVM: Document RISC-V specific parts of KVM API RISC-V: KVM: Add MAINTAINERS entry RISC-V: Enable KVM for RV64 and RV32 Atish Patra (4): RISC-V: KVM: Add timer functionality RISC-V: KVM: FP lazy save/restore RISC-V: KVM: Implement ONE REG interface for FP registers RISC-V: KVM: Add SBI v0.1 support m34782 (1): Microchip Polarfire SoC Clock Driver Documentation/virt/kvm/api.rst | 193 +++- MAINTAINERS | 11 + arch/riscv/Kconfig | 2 + arch/riscv/Kconfig.socs | 7 + arch/riscv/Makefile | 2 + arch/riscv/boot/dts/Makefile | 1 + arch/riscv/boot/dts/microchip/Makefile | 2 + .../boot/dts/microchip/icicle-kit-es.dts | 307 +++++ arch/riscv/configs/defconfig | 30 +- arch/riscv/configs/extra_debug.config | 21 + arch/riscv/configs/rv32_defconfig | 26 +- arch/riscv/include/asm/csr.h | 89 ++ arch/riscv/include/asm/kvm_host.h | 279 +++++ arch/riscv/include/asm/kvm_types.h | 7 + arch/riscv/include/asm/kvm_vcpu_timer.h | 44 + arch/riscv/include/asm/pgtable-bits.h | 1 + arch/riscv/include/uapi/asm/kvm.h | 128 +++ arch/riscv/include/uapi/asm/unistd.h | 5 +- arch/riscv/kernel/asm-offsets.c | 156 +++ arch/riscv/kernel/setup.c | 1 + arch/riscv/kvm/Kconfig | 36 + arch/riscv/kvm/Makefile | 15 + arch/riscv/kvm/main.c | 118 ++ arch/riscv/kvm/mmu.c | 860 ++++++++++++++ arch/riscv/kvm/tlb.S | 74 ++ arch/riscv/kvm/vcpu.c | 1012 +++++++++++++++++ arch/riscv/kvm/vcpu_exit.c | 701 ++++++++++++ arch/riscv/kvm/vcpu_sbi.c | 173 +++ arch/riscv/kvm/vcpu_switch.S | 400 +++++++ arch/riscv/kvm/vcpu_timer.c | 225 ++++ arch/riscv/kvm/vm.c | 81 ++ arch/riscv/kvm/vmid.c | 120 ++ drivers/clk/Kconfig | 5 + drivers/clk/Makefile | 1 + drivers/clk/microchip/Makefile | 2 + drivers/clk/microchip/clk-pfsoc.c | 508 +++++++++ drivers/clocksource/timer-riscv.c | 8 + include/clocksource/timer-riscv.h | 16 + include/uapi/linux/kvm.h | 8 + 39 files changed, 5621 insertions(+), 54 deletions(-) create mode 100644 arch/riscv/boot/dts/microchip/Makefile create mode 100644 arch/riscv/boot/dts/microchip/icicle-kit-es.dts create mode 100644 arch/riscv/configs/extra_debug.config create mode 100644 arch/riscv/include/asm/kvm_host.h create mode 100644 arch/riscv/include/asm/kvm_types.h create mode 100644 arch/riscv/include/asm/kvm_vcpu_timer.h create mode 100644 arch/riscv/include/uapi/asm/kvm.h create mode 100644 arch/riscv/kvm/Kconfig create mode 100644 arch/riscv/kvm/Makefile create mode 100644 arch/riscv/kvm/main.c create mode 100644 arch/riscv/kvm/mmu.c create mode 100644 arch/riscv/kvm/tlb.S create mode 100644 arch/riscv/kvm/vcpu.c create mode 100644 arch/riscv/kvm/vcpu_exit.c create mode 100644 arch/riscv/kvm/vcpu_sbi.c create mode 100644 arch/riscv/kvm/vcpu_switch.S create mode 100644 arch/riscv/kvm/vcpu_timer.c create mode 100644 arch/riscv/kvm/vm.c create mode 100644 arch/riscv/kvm/vmid.c create mode 100644 drivers/clk/microchip/clk-pfsoc.c create mode 100644 include/clocksource/timer-riscv.h -- 2.19.1

1 26

[PATCH 0/7] fixes CVE-2020-4788
by Yang Yingliang 24 Nov '20

24 Nov '20

Andrew Donnellan (1): powerpc: Fix __clear_user() with KUAP enabled Christophe Leroy (2): powerpc: Add a framework for user access tracking powerpc: Implement user_access_begin and friends Daniel Axtens (1): powerpc/64s: move some exception handlers out of line Nicholas Piggin (3): powerpc/64s: flush L1D on kernel entry powerpc/uaccess: Evaluate macro arguments once, before user access is allowed powerpc/64s: flush L1D after user accesses .../admin-guide/kernel-parameters.txt | 7 + .../powerpc/include/asm/book3s/64/kup-radix.h | 22 +++ arch/powerpc/include/asm/exception-64s.h | 9 +- arch/powerpc/include/asm/feature-fixups.h | 19 +++ arch/powerpc/include/asm/futex.h | 4 + arch/powerpc/include/asm/kup.h | 40 +++++ arch/powerpc/include/asm/security_features.h | 7 + arch/powerpc/include/asm/setup.h | 4 + arch/powerpc/include/asm/uaccess.h | 147 ++++++++++++++---- arch/powerpc/kernel/exceptions-64s.S | 96 +++++++----- arch/powerpc/kernel/setup_64.c | 122 ++++++++++++++- arch/powerpc/kernel/vmlinux.lds.S | 14 ++ arch/powerpc/lib/checksum_wrappers.c | 4 + arch/powerpc/lib/feature-fixups.c | 104 +++++++++++++ arch/powerpc/lib/string_32.S | 4 +- arch/powerpc/lib/string_64.S | 6 +- arch/powerpc/platforms/powernv/setup.c | 17 ++ arch/powerpc/platforms/pseries/setup.c | 8 + 18 files changed, 553 insertions(+), 81 deletions(-) create mode 100644 arch/powerpc/include/asm/book3s/64/kup-radix.h create mode 100644 arch/powerpc/include/asm/kup.h -- 2.25.1

1 7

[PATCH 00/14] backport stable-4.19.159
by Yang Yingliang 23 Nov '20

23 Nov '20

Andrew Donnellan (1): powerpc: Fix __clear_user() with KUAP enabled Christophe Leroy (3): powerpc: Add a framework for user access tracking powerpc: Implement user_access_begin and friends powerpc/8xx: Always fault when _PAGE_ACCESSED is not set Daniel Axtens (1): powerpc/64s: move some exception handlers out of line David Edmondson (1): KVM: x86: clflushopt should be treated as a no-op by emulation Greg Kroah-Hartman (1): Linux 4.19.159 Johannes Berg (1): mac80211: always wind down STA state Nicholas Piggin (3): powerpc/64s: flush L1D on kernel entry powerpc/uaccess: Evaluate macro arguments once, before user access is allowed powerpc/64s: flush L1D after user accesses Nick Desaulniers (1): ACPI: GED: fix -Wformat Salvatore Bonaccorso (1): Revert "perf cs-etm: Move definition of 'traceid_list' global variable from header file" Zhang Changzhong (1): can: proc: can_remove_proc(): silence remove_proc_entry warning .../admin-guide/kernel-parameters.txt | 7 + Makefile | 2 +- .../powerpc/include/asm/book3s/64/kup-radix.h | 22 +++ arch/powerpc/include/asm/exception-64s.h | 9 +- arch/powerpc/include/asm/feature-fixups.h | 19 +++ arch/powerpc/include/asm/futex.h | 4 + arch/powerpc/include/asm/kup.h | 40 +++++ arch/powerpc/include/asm/security_features.h | 7 + arch/powerpc/include/asm/setup.h | 4 + arch/powerpc/include/asm/uaccess.h | 147 ++++++++++++++---- arch/powerpc/kernel/exceptions-64s.S | 96 +++++++----- arch/powerpc/kernel/head_8xx.S | 8 +- arch/powerpc/kernel/setup_64.c | 122 ++++++++++++++- arch/powerpc/kernel/vmlinux.lds.S | 14 ++ arch/powerpc/lib/checksum_wrappers.c | 4 + arch/powerpc/lib/feature-fixups.c | 104 +++++++++++++ arch/powerpc/lib/string_32.S | 4 +- arch/powerpc/lib/string_64.S | 6 +- arch/powerpc/platforms/powernv/setup.c | 17 ++ arch/powerpc/platforms/pseries/setup.c | 8 + arch/x86/kvm/emulate.c | 8 +- drivers/acpi/evged.c | 2 +- net/can/proc.c | 6 +- net/mac80211/sta_info.c | 18 +++ tools/perf/util/cs-etm.c | 3 - tools/perf/util/cs-etm.h | 3 + 26 files changed, 589 insertions(+), 95 deletions(-) create mode 100644 arch/powerpc/include/asm/book3s/64/kup-radix.h create mode 100644 arch/powerpc/include/asm/kup.h -- 2.25.1

1 14

[PATCH] vt: Disable KD_FONT_OP_COPY
by Yang Yingliang 23 Nov '20

23 Nov '20

From: Daniel Vetter <daniel.vetter(a)ffwll.ch> stable inclusion from linux-4.19.156 commit 6612b754ac0c85ca8b1181b5d3ea4461a8c1bbcb CVE: CVE-2020-28974 -------------------------------- commit 3c4e0dff2095c579b142d5a0693257f1c58b4804 upstream. It's buggy: On Fri, Nov 06, 2020 at 10:30:08PM +0800, Minh Yuan wrote: > We recently discovered a slab-out-of-bounds read in fbcon in the latest > kernel ( v5.10-rc2 for now ). The root cause of this vulnerability is that > "fbcon_do_set_font" did not handle "vc->vc_font.data" and > "vc->vc_font.height" correctly, and the patch > <https://lkml.org/lkml/2020/9/27/223> for VT_RESIZEX can't handle this > issue. > > Specifically, we use KD_FONT_OP_SET to set a small font.data for tty6, and > use KD_FONT_OP_SET again to set a large font.height for tty1. After that, > we use KD_FONT_OP_COPY to assign tty6's vc_font.data to tty1's vc_font.data > in "fbcon_do_set_font", while tty1 retains the original larger > height. Obviously, this will cause an out-of-bounds read, because we can > access a smaller vc_font.data with a larger vc_font.height. Further there was only one user ever. - Android's loadfont, busybox and console-tools only ever use OP_GET and OP_SET - fbset documentation only mentions the kernel cmdline font: option, not anything else. - systemd used OP_COPY before release 232 published in Nov 2016 Now unfortunately the crucial report seems to have gone down with gmane, and the commit message doesn't say much. But the pull request hints at OP_COPY being broken https://github.com/systemd/systemd/pull/3651 So in other words, this never worked, and the only project which foolishly every tried to use it, realized that rather quickly too. Instead of trying to fix security issues here on dead code by adding missing checks, fix the entire thing by removing the functionality. Note that systemd code using the OP_COPY function ignored the return value, so it doesn't matter what we're doing here really - just in case a lone server somewhere happens to be extremely unlucky and running an affected old version of systemd. The relevant code from font_copy_to_all_vcs() in systemd was: /* copy font from active VT, where the font was uploaded to */ cfo.op = KD_FONT_OP_COPY; cfo.height = vcs.v_active-1; /* tty1 == index 0 */ (void) ioctl(vcfd, KDFONTOP, &cfo); Note this just disables the ioctl, garbage collecting the now unused callbacks is left for -next. v2: Tetsuo found the old mail, which allowed me to find it on another archive. Add the link too. Acked-by: Peilin Ye <yepeilin.cs(a)gmail.com> Reported-by: Minh Yuan <yuanmingbuaa(a)gmail.com> References: https://lists.freedesktop.org/archives/systemd-devel/2016-June/036935.html References: https://github.com/systemd/systemd/pull/3651 Cc: Greg KH <greg(a)kroah.com> Cc: Peilin Ye <yepeilin.cs(a)gmail.com> Cc: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> Link: https://lore.kernel.org/r/20201108153806.3140315-1-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tty/vt/vt.c | 24 ++---------------------- 1 file changed, 2 insertions(+), 22 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 758f522f331e..13ea0579f104 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4574,27 +4574,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) return rc; } -static int con_font_copy(struct vc_data *vc, struct console_font_op *op) -{ - int con = op->height; - int rc; - - - console_lock(); - if (vc->vc_mode != KD_TEXT) - rc = -EINVAL; - else if (!vc->vc_sw->con_font_copy) - rc = -ENOSYS; - else if (con < 0 || !vc_cons_allocated(con)) - rc = -ENOTTY; - else if (con == vc->vc_num) /* nothing to do */ - rc = 0; - else - rc = vc->vc_sw->con_font_copy(vc, con); - console_unlock(); - return rc; -} - int con_font_op(struct vc_data *vc, struct console_font_op *op) { switch (op->op) { @@ -4605,7 +4584,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op) case KD_FONT_OP_SET_DEFAULT: return con_font_default(vc, op); case KD_FONT_OP_COPY: - return con_font_copy(vc, op); + /* was buggy and never really used */ + return -EINVAL; } return -ENOSYS; } -- 2.25.1

1 0

[PATCH 1/3] fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h
by Yang Yingliang 23 Nov '20

23 Nov '20

From: Peilin Ye <yepeilin.cs(a)gmail.com> stable inclusion from linux-4.19.151 commit 7b9eaa7241ea2cfa580b854d461be72107a4b35c CVE: CVE-2020-28915 It's prepare for fixing CVE-2020-28915. -------------------------------- commit bb0890b4cd7f8203e3aa99c6d0f062d6acdaad27 upstream. drivers/video/console/newport_con.c is borrowing FONT_EXTRA_WORDS macros from drivers/video/fbdev/core/fbcon.h. To keep things simple, move all definitions into <linux/font.h>. Since newport_con now uses four extra words, initialize the fourth word in newport_set_font() properly. Cc: stable(a)vger.kernel.org Signed-off-by: Peilin Ye <yepeilin.cs(a)gmail.com> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/7fb8bc9b0abc676ada6b7ac0e0bd4… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/video/console/newport_con.c | 7 +------ drivers/video/fbdev/core/fbcon.h | 7 ------- drivers/video/fbdev/core/fbcon_rotate.c | 1 + drivers/video/fbdev/core/tileblit.c | 1 + include/linux/font.h | 8 ++++++++ 5 files changed, 11 insertions(+), 13 deletions(-) diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c index 7f2526b43b33..46a6e6568994 100644 --- a/drivers/video/console/newport_con.c +++ b/drivers/video/console/newport_con.c @@ -33,12 +33,6 @@ #define FONT_DATA ((unsigned char *)font_vga_8x16.data) -/* borrowed from fbcon.c */ -#define REFCOUNT(fd) (((int *)(fd))[-1]) -#define FNTSIZE(fd) (((int *)(fd))[-2]) -#define FNTCHARCNT(fd) (((int *)(fd))[-3]) -#define FONT_EXTRA_WORDS 3 - static unsigned char *font_data[MAX_NR_CONSOLES]; static struct newport_regs *npregs; @@ -519,6 +513,7 @@ static int newport_set_font(int unit, struct console_font *op) FNTSIZE(new_data) = size; FNTCHARCNT(new_data) = op->charcount; REFCOUNT(new_data) = 0; /* usage counter */ + FNTSUM(new_data) = 0; p = new_data; for (i = 0; i < op->charcount; i++) { diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h index ac11200fd2d5..609280281a47 100644 --- a/drivers/video/fbdev/core/fbcon.h +++ b/drivers/video/fbdev/core/fbcon.h @@ -152,13 +152,6 @@ static inline int attr_col_ec(int shift, struct vc_data *vc, #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0) #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1) -/* Font */ -#define REFCOUNT(fd) (((int *)(fd))[-1]) -#define FNTSIZE(fd) (((int *)(fd))[-2]) -#define FNTCHARCNT(fd) (((int *)(fd))[-3]) -#define FNTSUM(fd) (((int *)(fd))[-4]) -#define FONT_EXTRA_WORDS 4 - /* * Scroll Method */ diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c index c0d445294aa7..ac72d4f85f7d 100644 --- a/drivers/video/fbdev/core/fbcon_rotate.c +++ b/drivers/video/fbdev/core/fbcon_rotate.c @@ -14,6 +14,7 @@ #include <linux/fb.h> #include <linux/vt_kern.h> #include <linux/console.h> +#include <linux/font.h> #include <asm/types.h> #include "fbcon.h" #include "fbcon_rotate.h" diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c index eb664dbf96f6..adff8d6ffe6f 100644 --- a/drivers/video/fbdev/core/tileblit.c +++ b/drivers/video/fbdev/core/tileblit.c @@ -13,6 +13,7 @@ #include <linux/fb.h> #include <linux/vt_kern.h> #include <linux/console.h> +#include <linux/font.h> #include <asm/types.h> #include "fbcon.h" diff --git a/include/linux/font.h b/include/linux/font.h index d6821769dd1e..0a3639a00b3a 100644 --- a/include/linux/font.h +++ b/include/linux/font.h @@ -57,4 +57,12 @@ extern const struct font_desc *get_default_font(int xres, int yres, /* Max. length for the name of a predefined font */ #define MAX_FONT_NAME 32 +/* Extra word getters */ +#define REFCOUNT(fd) (((int *)(fd))[-1]) +#define FNTSIZE(fd) (((int *)(fd))[-2]) +#define FNTCHARCNT(fd) (((int *)(fd))[-3]) +#define FNTSUM(fd) (((int *)(fd))[-4]) + +#define FONT_EXTRA_WORDS 4 + #endif /* _VIDEO_FONT_H */ -- 2.25.1

1 2

[PATCH] speakup: Do not let the line discipline be used several times
by Yang Yingliang 23 Nov '20

23 Nov '20

From: Samuel Thibault <samuel.thibault(a)ens-lyon.org> mainline inclusion from mainline-v5.10 commit d4122754442799187d5d537a9c039a49a67e57f1 category: bugfix bugzilla: NA CVE: CVE-2020-28941 -------------------------------- Speakup has only one speakup_tty variable to store the tty it is managing. This makes sense since its codebase currently assumes that there is only one user who controls the screen reading. That however means that we have to forbid using the line discipline several times, otherwise the second closure would try to free a NULL ldisc_data, leading to general protection fault: 0000 [#1] SMP KASAN PTI RIP: 0010:spk_ttyio_ldisc_close+0x2c/0x60 Call Trace: tty_ldisc_release+0xa2/0x340 tty_release_struct+0x17/0xd0 tty_release+0x9d9/0xcc0 __fput+0x231/0x740 task_work_run+0x12c/0x1a0 do_exit+0x9b5/0x2230 ? release_task+0x1240/0x1240 ? __do_page_fault+0x562/0xa30 do_group_exit+0xd5/0x2a0 __x64_sys_exit_group+0x35/0x40 do_syscall_64+0x89/0x2b0 ? page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Cc: stable(a)vger.kernel.org Reported-by: 秦世松 <qinshisong1205(a)gmail.com> Signed-off-by: Samuel Thibault <samuel.thibault(a)ens-lyon.org> Tested-by: Shisong Qin <qinshisong1205(a)gmail.com> Link: https://lore.kernel.org/r/20201110183541.fzgnlwhjpgqzjeth@function Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/accessibility/speakup/spk_ttyio.c [yyl: spk_ttyio.c is in drivers/staging/ in kernel-4.19] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/staging/speakup/spk_ttyio.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c index 93742dbdee77..6c754ddf1257 100644 --- a/drivers/staging/speakup/spk_ttyio.c +++ b/drivers/staging/speakup/spk_ttyio.c @@ -49,15 +49,25 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty) if (tty->ops->write == NULL) return -EOPNOTSUPP; + + mutex_lock(&speakup_tty_mutex); + if (speakup_tty) { + mutex_unlock(&speakup_tty_mutex); + return -EBUSY; + } speakup_tty = tty; ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL); - if (!ldisc_data) + if (!ldisc_data) { + speakup_tty = NULL; + mutex_unlock(&speakup_tty_mutex); return -ENOMEM; + } sema_init(&ldisc_data->sem, 0); ldisc_data->buf_free = true; speakup_tty->disc_data = ldisc_data; + mutex_unlock(&speakup_tty_mutex); return 0; } -- 2.25.1

1 0

[PATCH 00/98] backport stable-4.19.158
by Yang Yingliang 23 Nov '20

23 Nov '20

Al Viro (1): don't dump the threads that had been already exiting when zapped. Alexander Usyskin (1): mei: protect mei_cl_mtu from null dereference Anand Jain (1): btrfs: dev-replace: fail mount if we don't have replace item with target device Anand K Mistry (1): x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP Andrew Jeffery (1): ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template Andy Shevchenko (1): pinctrl: intel: Set default bias in case no particular value given Ard Biesheuvel (1): crypto: arm64/aes-modes - get rid of literal load of addend vector Arnaldo Carvalho de Melo (1): perf scripting python: Avoid declaring function pointers with a visibility attribute Arnaud de Turckheim (3): gpio: pcie-idio-24: Fix irq mask when masking gpio: pcie-idio-24: Fix IRQ Enable Register value gpio: pcie-idio-24: Enable PEX8311 interrupts Baolin Wang (1): mfd: sprd: Add wakeup capability for PMIC IRQ Billy Tsai (1): pinctrl: aspeed: Fix GPI only function problem. Bob Peterson (3): gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free gfs2: Add missing truncate_inode_pages_final for sd_aspace gfs2: check for live vs. read-only file system in gfs2_fitrim Boris Protopopov (1): Convert trailing spaces and periods in path components Brian Foster (1): xfs: flush new eof page on truncate to avoid post-eof corruption Chen Zhou (1): selinux: Fix error return code in sel_ib_pkey_sid_slow() Chris Brandt (1): usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode Christoph Hellwig (2): nbd: fix a block_device refcount leak in nbd_release xfs: fix a missing unlock on error in xfs_fs_map_blocks Chunyan Zhang (1): tick/common: Touch watchdog in tick_unfreeze() on all CPUs Coiby Xu (2): pinctrl: amd: use higher precision for 512 RtcClk pinctrl: amd: fix incorrect way to disable debounce filter Dan Carpenter (3): ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() can: peak_usb: add range checking in decode operations futex: Don't enable IRQs unconditionally in put_pi_state() Darrick J. Wong (6): xfs: set xefi_discard when creating a deferred agfl free log intent item xfs: fix scrub flagging rtinherit even if there is no rt device xfs: fix flags argument to rmap lookup when converting shared file rmaps xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents xfs: fix rmap key and record comparison functions xfs: fix brainos in the refcount scrubber's rmap fragment processor Dinghao Liu (1): btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod Evan Nimmo (1): of/address: Fix of_node memory leak in of_dma_is_coherent Evan Quan (3): drm/amdgpu: perform srbm soft reset always on SDMA resume drm/amd/pm: perform SMC reset on suspend/hibernation drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running Evgeny Novikov (1): usb: gadget: goku_udc: fix potential crashes in probe Filipe Manana (1): Btrfs: fix missing error return if writeback for extent buffer never started Gao Xiang (1): erofs: derive atime instead of leaving it empty George Spelvin (1): random32: make prandom_u32() output unpredictable Greg Kroah-Hartman (1): Linux 4.19.158 Hannes Reinecke (1): scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() Heiner Kallweit (1): r8169: fix potential skb double free in an error path Jason A. Donenfeld (1): netfilter: use actual socket sk rather than skb sk when routing harder Jerry Snitselaar (1): tpm_tis: Disable interrupts on ThinkPad T490s Jing Xiangfeng (1): thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() Jiri Olsa (1): perf tools: Add missing swap for ino_generation Joakim Zhang (1): can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A Johannes Berg (1): mac80211: fix use of skb payload instead of header Johannes Thumshirn (1): btrfs: reschedule when cloning lots of extents Josef Bacik (1): btrfs: sysfs: init devices outside of the chunk_mutex Joseph Qi (1): ext4: unlock xattr_sem properly in ext4_inline_data_truncate() Kaixu Xia (1): ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA Keita Suzuki (1): scsi: hpsa: Fix memory leak in hpsa_init_one() Mao Wenan (1): net: Update window_clamp if SOCK_RCVBUF is set Marc Kleine-Budde (1): can: rx-offload: don't call kfree_skb() from IRQ context Marc Zyngier (1): genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY Martin Schiller (1): net/x25: Fix null-ptr-deref in x25_connect Martin Willi (1): vrf: Fix fast path output packet handling with async Netfilter rules Masashi Honma (1): ath9k_htc: Use appropriate rs_datalen type Matteo Croce (2): Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" reboot: fix overflow parsing reboot cpu number Matthew Wilcox (Oracle) (1): btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch Michał Mirosław (1): regulator: defer probe when trying to get voltage from unresolved supply Mika Westerberg (1): thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services() Olaf Hering (1): hv_balloon: disable warning when floor reached Oleksij Rempel (1): can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() Oliver Hartkopp (1): can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames Oliver Herms (1): IPv6: Set SIT tunnel hard_header_len to zero Peter Zijlstra (1): perf: Fix get_recursion_context() Qian Cai (1): s390/smp: move rcu_cpu_starting() earlier Shin'ichiro Kawasaki (1): uio: Fix use-after-free in uio_unregister_device() Stefano Brivio (1): netfilter: ipset: Update byte and packet counters regardless of whether they match Stefano Stabellini (1): swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb" Stephane Grosjean (2): can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on Suravee Suthikulpanit (1): iommu/amd: Increase interrupt remapping table limit to 512 entries Sven Van Asbroeck (1): lan743x: fix "BUG: invalid wait context" when setting rx mode Thinh Nguyen (2): usb: dwc3: gadget: Continue to process pending requests usb: dwc3: gadget: Reclaim extra TRBs after request completion Thomas Zimmermann (1): drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] Tommi Rantala (1): selftests: proc: fix warning: _GNU_SOURCE redefined Tyler Hicks (1): tpm: efi: Don't create binary_bios_measurements file for an empty log Ursula Braun (1): net/af_iucv: fix null pointer dereference on shutdown Vincent Mailhol (1): can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context Wang Hai (2): cosa: Add missing kfree in error path of cosa_write tipc: fix memory leak in tipc_topsrv_start() Wengang Wang (1): ocfs2: initialize ip_next_orphan Ye Bin (1): cfg80211: regulatory: Fix inconsistent format argument Yoshihiro Shimoda (1): mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove Yunsheng Lin (1): net: sch_generic: fix the missing new qdisc assignment bug Zeng Tao (1): time: Prevent undefined behaviour in timespec64_to_ns() Zhang Qilong (2): vfio: platform: fix reference leak in vfio_platform_open xhci: hisilicon: fix refercence leak in xhci_histb_probe zhuoliang zhang (1): net: xfrm: fix a race condition during allocing spi Makefile | 2 +- arch/arm/include/asm/kprobes.h | 22 +- arch/arm/probes/kprobes/opt-arm.c | 18 +- arch/arm64/crypto/aes-modes.S | 16 +- arch/s390/kernel/smp.c | 3 +- arch/x86/kernel/cpu/bugs.c | 52 +- drivers/block/nbd.c | 1 + drivers/char/random.c | 1 - drivers/char/tpm/eventlog/efi.c | 5 + drivers/char/tpm/tpm_tis.c | 29 +- drivers/gpio/gpio-pcie-idio-24.c | 62 ++- drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 +- .../gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 4 + drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 + drivers/gpu/drm/amd/powerplay/inc/smumgr.h | 2 + .../gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 29 +- drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 8 + drivers/gpu/drm/gma500/psb_irq.c | 34 +- drivers/hv/hv_balloon.c | 2 +- drivers/iommu/amd_iommu_types.h | 6 +- drivers/mfd/sprd-sc27xx-spi.c | 28 +- drivers/misc/mei/client.h | 4 +- drivers/mmc/host/renesas_sdhi_core.c | 1 + drivers/net/can/dev.c | 14 +- drivers/net/can/flexcan.c | 3 +- drivers/net/can/peak_canfd/peak_canfd.c | 11 +- drivers/net/can/rx-offload.c | 4 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 51 +- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 48 +- drivers/net/ethernet/microchip/lan743x_main.c | 12 +- drivers/net/ethernet/microchip/lan743x_main.h | 3 - drivers/net/ethernet/realtek/r8169.c | 3 +- drivers/net/vrf.c | 92 +++- drivers/net/wan/cosa.c | 1 + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 2 +- drivers/of/address.c | 4 +- drivers/pinctrl/aspeed/pinctrl-aspeed.c | 7 +- drivers/pinctrl/intel/pinctrl-intel.c | 8 + drivers/pinctrl/pinctrl-amd.c | 6 +- drivers/regulator/core.c | 2 + drivers/scsi/device_handler/scsi_dh_alua.c | 9 +- drivers/scsi/hpsa.c | 4 +- drivers/staging/erofs/inode.c | 21 +- drivers/thunderbolt/nhi.c | 19 +- drivers/thunderbolt/xdomain.c | 1 + drivers/uio/uio.c | 10 +- drivers/usb/class/cdc-acm.c | 9 + drivers/usb/dwc3/gadget.c | 32 +- drivers/usb/gadget/udc/goku_udc.c | 2 +- drivers/usb/host/xhci-histb.c | 2 +- drivers/vfio/platform/vfio_platform_common.c | 3 +- fs/btrfs/dev-replace.c | 26 +- fs/btrfs/extent_io.c | 4 + fs/btrfs/ioctl.c | 12 +- fs/btrfs/ref-verify.c | 1 + fs/btrfs/volumes.c | 33 +- fs/cifs/cifs_unicode.c | 8 +- fs/ext4/inline.c | 1 + fs/ext4/super.c | 4 +- fs/gfs2/rgrp.c | 5 +- fs/gfs2/super.c | 1 + fs/ocfs2/super.c | 1 + fs/xfs/libxfs/xfs_alloc.c | 1 + fs/xfs/libxfs/xfs_bmap.h | 2 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/libxfs/xfs_rmap_btree.c | 16 +- fs/xfs/scrub/bmap.c | 2 + fs/xfs/scrub/inode.c | 3 +- fs/xfs/scrub/refcount.c | 8 +- fs/xfs/xfs_iops.c | 10 + fs/xfs/xfs_pnfs.c | 2 +- include/linux/can/skb.h | 20 +- include/linux/netfilter_ipv4.h | 2 +- include/linux/netfilter_ipv6.h | 2 +- include/linux/prandom.h | 36 +- include/linux/time64.h | 4 + kernel/dma/swiotlb.c | 6 +- kernel/events/internal.h | 2 +- kernel/exit.c | 5 +- kernel/futex.c | 5 +- kernel/irq/Kconfig | 1 + kernel/reboot.c | 28 +- kernel/time/itimer.c | 4 - kernel/time/tick-common.c | 2 + kernel/time/timer.c | 7 - lib/random32.c | 462 +++++++++++------- net/ipv4/netfilter.c | 12 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_route_ipv4.c | 2 +- net/ipv4/syncookies.c | 9 +- net/ipv6/netfilter.c | 6 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_route_ipv6.c | 2 +- net/ipv6/sit.c | 2 - net/ipv6/syncookies.c | 10 +- net/iucv/af_iucv.c | 3 +- net/mac80211/tx.c | 37 +- net/netfilter/ipset/ip_set_core.c | 3 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/sched/sch_generic.c | 3 + net/tipc/topsrv.c | 10 +- net/wireless/reg.c | 2 +- net/x25/af_x25.c | 2 +- net/xfrm/xfrm_state.c | 8 +- security/selinux/ibpkey.c | 4 +- sound/hda/ext/hdac_ext_controller.c | 2 + .../scripting-engines/trace-event-python.c | 7 +- tools/perf/util/session.c | 1 + .../testing/selftests/proc/proc-loadavg-001.c | 1 - .../selftests/proc/proc-self-syscall.c | 1 - .../testing/selftests/proc/proc-uptime-002.c | 1 - 115 files changed, 1073 insertions(+), 539 deletions(-) -- 2.25.1

1 98