- Kernel - mailweb.openeuler.org

[PATCH 1/6] net/hinic: Fix the driver does not report an error when setting MAC fails
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- When using the ip link command to configure the MAC for the VF in the PF, the status 4 will be returned when the MAC is set on the VF; when the PF driver receives the status 4 returned by the firmwre, the MAC setting failed and an error should be reported. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Wangxiaoyun <cloud.wangxiaoyun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- .../net/ethernet/huawei/hinic/hinic_main.c | 7 +++- .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 41 ++++++++++++------- 2 files changed, 31 insertions(+), 17 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c index b5d0bdadf509..cf7b6ceef060 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_main.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c @@ -1305,8 +1305,11 @@ static int hinic_set_mac_addr(struct net_device *netdev, void *addr) err = hinic_update_mac(nic_dev->hwdev, netdev->dev_addr, saddr->sa_data, 0, func_id); - if (err) - return err; + if (err) { + nicif_err(nic_dev, drv, netdev, "Failed to update mac, err: %d\n", + err); + return err == HINIC_PF_SET_VF_ALREADY ? -EPERM : err; + } memcpy(netdev->dev_addr, saddr->sa_data, ETH_ALEN); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c index a42dea0ad707..2b349e17260b 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c @@ -231,6 +231,23 @@ int hinic_get_fw_support_func(void *hwdev) #define HINIC_ADD_VLAN_IN_MAC 0x8000 #define HINIC_VLAN_ID_MASK 0x7FFF +#define PF_SET_VF_MAC(hwdev, status) \ + (HINIC_FUNC_TYPE(hwdev) == TYPE_VF && \ + (status) == HINIC_PF_SET_VF_ALREADY) + +static int hinic_check_mac_status(struct hinic_hwdev *hwdev, u8 status, + u16 vlan_id) +{ + if ((status && status != HINIC_MGMT_STATUS_EXIST) || + (vlan_id & CHECK_IPSU_15BIT && status == HINIC_MGMT_STATUS_EXIST)) { + if (PF_SET_VF_MAC(hwdev, status)) + return 0; + + return -EINVAL; + } + + return 0; +} int hinic_set_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) { @@ -255,17 +272,14 @@ int hinic_set_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) err = l2nic_msg_to_mgmt_sync(hwdev, HINIC_PORT_CMD_SET_MAC, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_MGMT_STATUS_EXIST && - mac_info.status != HINIC_PF_SET_VF_ALREADY) || - (mac_info.vlan_id & CHECK_IPSU_15BIT && - mac_info.status == HINIC_MGMT_STATUS_EXIST)) { + hinic_check_mac_status(hwdev, mac_info.status, mac_info.vlan_id)) { nic_err(nic_hwdev->dev_hdl, "Failed to update MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF mac, Ignore set operation\n"); return HINIC_PF_SET_VF_ALREADY; } @@ -302,13 +316,13 @@ int hinic_del_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) err = l2nic_msg_to_mgmt_sync(hwdev, HINIC_PORT_CMD_DEL_MAC, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_PF_SET_VF_ALREADY)) { + (mac_info.status && !PF_SET_VF_MAC(nic_hwdev, mac_info.status))) { nic_err(nic_hwdev->dev_hdl, "Failed to delete MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF mac, Ignore delete operation\n"); return HINIC_PF_SET_VF_ALREADY; } @@ -343,17 +357,14 @@ int hinic_update_mac(void *hwdev, u8 *old_mac, u8 *new_mac, u16 vlan_id, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_MGMT_STATUS_EXIST && - mac_info.status != HINIC_PF_SET_VF_ALREADY) || - (mac_info.vlan_id & CHECK_IPSU_15BIT && - mac_info.status == HINIC_MGMT_STATUS_EXIST)) { + hinic_check_mac_status(hwdev, mac_info.status, mac_info.vlan_id)) { nic_err(nic_hwdev->dev_hdl, "Failed to update MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF MAC. Ignore update operation\n"); return HINIC_PF_SET_VF_ALREADY; } -- 2.25.1

1 5

[PATCH 01/20] nvme-rdma: remove redundant reference between ib_device and tagset
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Max Gurtovoy <maxg(a)mellanox.com> mainline inclusion from mainline-v5.2-rc1 commit 87fd125344d68adf7699ec7396aa9f905ce79a80 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE ------------------------------------------------- In the past, before adding f41725bb ("nvme-rdma: Use mr pool") commit, we needed a reference on the ib_device as long as the tagset was alive, as the MRs in the request structures needed a valid ib_device. Now, we allocate/deallocate MR pool per QP and consume on demand. Also remove nvme_rdma_free_tagset function and use blk_mq_free_tag_set instead, as it unneeded anymore. This commit also fixes a memory leakage and possible segmentation fault. When configuring the system with NIC teaming (aka bonding), we use 1 network interface to create an HA connection to the target side. In case one connection breaks down, nvme-rdma driver will get notification from rdma-cm layer that underlying address was change and will start error recovery process. During this process, we'll reconnect to the target via the second interface in the bond without destroying the tagset. This will cause a leakage of the initial rdma device (ndev) and miscount in the reference count of the new created rdma device (new ndev). In the final destruction (or in another error flow), we'll get a warning dump from the ib_dealloc_pd that we still have inflight MR's related to that pd. This happens becasue of the miscount of the reference tag of the rdma device and causing access violation to it's elements (some queues are not destroyed yet). Signed-off-by: Max Gurtovoy <maxg(a)mellanox.com> Signed-off-by: Israel Rukshin <israelr(a)mellanox.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Chao Leng <lengchao(a)huawei.com> Reviewed-by: Jike Cheng <chengjike.cheng(a)huawei.com> Conflicts: drivers/nvme/host/rdma.c [lrz: adjust context] Signed-off-by: Ruozhu Li <liruozhu(a)huawei.com> Signed-off-by: Lijie <lijie34(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/nvme/host/rdma.c | 34 +++++----------------------------- 1 file changed, 5 insertions(+), 29 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index 077c67816665..0bfc1875575d 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -666,15 +666,6 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl) return ret; } -static void nvme_rdma_free_tagset(struct nvme_ctrl *nctrl, - struct blk_mq_tag_set *set) -{ - struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl); - - blk_mq_free_tag_set(set); - nvme_rdma_dev_put(ctrl->device); -} - static struct blk_mq_tag_set *nvme_rdma_alloc_tagset(struct nvme_ctrl *nctrl, bool admin) { @@ -712,24 +703,9 @@ static struct blk_mq_tag_set *nvme_rdma_alloc_tagset(struct nvme_ctrl *nctrl, ret = blk_mq_alloc_tag_set(set); if (ret) - goto out; - - /* - * We need a reference on the device as long as the tag_set is alive, - * as the MRs in the request structures need a valid ib_device. - */ - ret = nvme_rdma_dev_get(ctrl->device); - if (!ret) { - ret = -EINVAL; - goto out_free_tagset; - } + return ERR_PTR(ret); return set; - -out_free_tagset: - blk_mq_free_tag_set(set); -out: - return ERR_PTR(ret); } static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, @@ -737,7 +713,7 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, { if (remove) { blk_cleanup_queue(ctrl->ctrl.admin_q); - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); + blk_mq_free_tag_set(ctrl->ctrl.admin_tagset); } if (ctrl->async_event_sqe.data) { cancel_work_sync(&ctrl->ctrl.async_event_work); @@ -815,7 +791,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, blk_cleanup_queue(ctrl->ctrl.admin_q); out_free_tagset: if (new) - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); + blk_mq_free_tag_set(ctrl->ctrl.admin_tagset); out_free_async_qe: if (ctrl->async_event_sqe.data) { nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe, @@ -832,7 +808,7 @@ static void nvme_rdma_destroy_io_queues(struct nvme_rdma_ctrl *ctrl, { if (remove) { blk_cleanup_queue(ctrl->ctrl.connect_q); - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset); + blk_mq_free_tag_set(ctrl->ctrl.tagset); } nvme_rdma_free_io_queues(ctrl); } @@ -873,7 +849,7 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) blk_cleanup_queue(ctrl->ctrl.connect_q); out_free_tag_set: if (new) - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset); + blk_mq_free_tag_set(ctrl->ctrl.tagset); out_free_io_queues: nvme_rdma_free_io_queues(ctrl); return ret; -- 2.25.1

1 19

【议题收集】【Meeting Notice】openEuler kernel sig meeting Time: 2020-10-16 10:00-12:00
by Xie XiuQi 20 Oct '20

20 Oct '20

openEuler kernel sig meeting 定于 2020-10-16 10:00-12:00 召开，欢迎回复邮件申报议题。 --- 会议信息 --- 会议链接：https://zoom.us/j/94156903933 会议 ID : 94156903933 --- 会议纪要归档 --- Meeting Record 20200918： https://gitee.com/openeuler/kernel/issues/I1WGN0

1 3

[PATCH 00/19] backport stable-4.19.152
by Yang Yingliang 19 Oct '20

19 Oct '20

Anant Thazhemadam (1): staging: comedi: check validity of wMaxPacketSize of usb endpoints found Arnaud Patard (1): drivers/net/ethernet/marvell/mvmdio.c: Fix non OF case Dmitry Golovin (1): ARM: 8939/1: kbuild: use correct nm executable Dominik Przychodni (1): crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA Greg Kroah-Hartman (1): Linux 4.19.152 Herbert Xu (1): crypto: bcm - Verify GCM/CCM key length in setkey Jan Kara (2): reiserfs: Initialize inode keys properly reiserfs: Fix oops during mount Jason A. Donenfeld (1): ARM: 8867/1: vdso: pass --be8 to linker if necessary Leo Yan (1): perf cs-etm: Move definition of 'traceid_list' global variable from header file Leonid Bloch (1): USB: serial: option: Add Telit FT980-KS composition Luiz Augusto von Dentz (2): Bluetooth: Consolidate encryption handling in hci_encrypt_cfm Bluetooth: Disconnect if E0 is used for Level 4 Masahiro Yamada (1): ARM: 8858/1: vdso: use $(LD) instead of $(CC) to link VDSO Mychaela N. Falconia (1): USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters Oliver Neukum (1): media: usbtv: Fix refcounting mixup Patrick Steinhardt (1): Bluetooth: Fix update of connection state in `hci_encrypt_cfm` Scott Chen (1): USB: serial: pl2303: add device-id for HP GC device Wilken Gottwalt (1): USB: serial: option: add Cellient MPL200 card Makefile | 2 +- arch/arm/boot/compressed/Makefile | 4 +- arch/arm/vdso/Makefile | 22 +++++------ drivers/crypto/bcm/cipher.c | 15 +++++++- drivers/crypto/qat/qat_common/qat_algs.c | 10 ++++- drivers/media/usb/usbtv/usbtv-core.c | 3 +- drivers/net/ethernet/marvell/mvmdio.c | 22 ++++++++--- drivers/staging/comedi/drivers/vmk80xx.c | 3 ++ drivers/usb/serial/ftdi_sio.c | 5 +++ drivers/usb/serial/ftdi_sio_ids.h | 7 ++++ drivers/usb/serial/option.c | 5 +++ drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + fs/reiserfs/inode.c | 6 +-- fs/reiserfs/xattr.c | 7 ++++ include/net/bluetooth/hci_core.h | 30 ++++++++++++--- net/bluetooth/hci_conn.c | 17 +++++++++ net/bluetooth/hci_event.c | 48 ++++++------------------ tools/perf/util/cs-etm.c | 3 ++ tools/perf/util/cs-etm.h | 3 -- 20 files changed, 138 insertions(+), 76 deletions(-) -- 2.25.1

1 19

[PATCH 00/26] huge vmalloc mappings
by Yang Yingliang 19 Oct '20

19 Oct '20

Anshuman Khandual (1): mm/ioremap: probe platform for p4d huge map support Christoph Hellwig (8): mm: remove __get_vm_area mm: unexport unmap_kernel_range_noflush mm: only allow page table mappings for built-in zsmalloc mm: pass addr as unsigned long to vb_free mm: remove vmap_page_range_noflush and vunmap_page_range mm: rename vmap_page_range to map_kernel_range mm: don't return the number of pages from map_kernel_range{, _noflush} mm: remove map_vm_range Daniel Axtens (1): mm/memory.c: add apply_to_existing_page_range() helper Ingo Molnar (1): mm/vmalloc: Add empty <asm/vmalloc.h> headers and use them from <linux/vmalloc.h> Mike Rapoport (1): mm: move lib/ioremap.c to mm/ Nicholas Piggin (9): mm/vmalloc: fix vmalloc_to_page for huge vmap mappings mm: apply_to_pte_range warn and fail if a large pte is encountered mm/vmalloc: rename vmap_*_range vmap_pages_*_range mm/ioremap: rename ioremap_*_range to vmap_*_range mm: HUGE_VMAP arch support cleanup arm64: inline huge vmap supported functions mm: Move vmap_range from mm/ioremap.c to mm/vmalloc.c mm/vmalloc: add vmap_range_noflush variant mm/vmalloc: Hugepage vmalloc mappings Steven Price (2): mm: add generic p?d_leaf() macros arm64: mm: add p?d_leaf() definitions Will Deacon (3): ioremap: rework pXd_free_pYd_page() API lib/ioremap: ensure phys_addr actually corresponds to a physical address lib/ioremap: ensure break-before-make is used for huge p4d mappings Documentation/core-api/cachetlb.rst | 2 +- arch/Kconfig | 4 + arch/alpha/include/asm/vmalloc.h | 4 + arch/arc/include/asm/vmalloc.h | 4 + arch/arm/include/asm/vmalloc.h | 4 + arch/arm64/include/asm/pgtable.h | 2 + arch/arm64/include/asm/vmalloc.h | 29 ++ arch/arm64/mm/mmu.c | 16 - arch/c6x/include/asm/vmalloc.h | 4 + arch/csky/include/asm/vmalloc.h | 4 + arch/h8300/include/asm/vmalloc.h | 4 + arch/hexagon/include/asm/vmalloc.h | 4 + arch/ia64/include/asm/vmalloc.h | 4 + arch/m68k/include/asm/vmalloc.h | 4 + arch/microblaze/include/asm/vmalloc.h | 4 + arch/mips/include/asm/vmalloc.h | 4 + arch/nds32/include/asm/vmalloc.h | 4 + arch/nios2/include/asm/vmalloc.h | 4 + arch/openrisc/include/asm/vmalloc.h | 4 + arch/parisc/include/asm/vmalloc.h | 4 + arch/powerpc/include/asm/vmalloc.h | 12 + arch/powerpc/kernel/pci_64.c | 3 +- arch/riscv/include/asm/vmalloc.h | 4 + arch/s390/include/asm/vmalloc.h | 4 + arch/sh/include/asm/vmalloc.h | 4 + arch/sh/kernel/cpu/sh4/sq.c | 3 +- arch/sparc/include/asm/vmalloc.h | 4 + arch/um/include/asm/vmalloc.h | 4 + arch/unicore32/include/asm/vmalloc.h | 4 + arch/x86/include/asm/vmalloc.h | 12 + arch/x86/mm/ioremap.c | 11 +- arch/x86/mm/pgtable.c | 8 + arch/xtensa/include/asm/vmalloc.h | 4 + include/asm-generic/pgtable.h | 25 ++ include/linux/io.h | 8 - include/linux/mm.h | 3 + include/linux/vmalloc.h | 24 +- init/main.c | 1 - kernel/dma/mapping.c | 3 +- lib/Makefile | 1 - lib/ioremap.c | 183 --------- mm/Kconfig | 2 +- mm/Makefile | 2 +- mm/ioremap.c | 34 ++ mm/memory.c | 152 ++++++-- mm/vmalloc.c | 518 +++++++++++++++++++------- mm/zsmalloc.c | 4 +- 47 files changed, 752 insertions(+), 398 deletions(-) create mode 100644 arch/alpha/include/asm/vmalloc.h create mode 100644 arch/arc/include/asm/vmalloc.h create mode 100644 arch/arm/include/asm/vmalloc.h create mode 100644 arch/arm64/include/asm/vmalloc.h create mode 100644 arch/c6x/include/asm/vmalloc.h create mode 100644 arch/csky/include/asm/vmalloc.h create mode 100644 arch/h8300/include/asm/vmalloc.h create mode 100644 arch/hexagon/include/asm/vmalloc.h create mode 100644 arch/ia64/include/asm/vmalloc.h create mode 100644 arch/m68k/include/asm/vmalloc.h create mode 100644 arch/microblaze/include/asm/vmalloc.h create mode 100644 arch/mips/include/asm/vmalloc.h create mode 100644 arch/nds32/include/asm/vmalloc.h create mode 100644 arch/nios2/include/asm/vmalloc.h create mode 100644 arch/openrisc/include/asm/vmalloc.h create mode 100644 arch/parisc/include/asm/vmalloc.h create mode 100644 arch/powerpc/include/asm/vmalloc.h create mode 100644 arch/riscv/include/asm/vmalloc.h create mode 100644 arch/s390/include/asm/vmalloc.h create mode 100644 arch/sh/include/asm/vmalloc.h create mode 100644 arch/sparc/include/asm/vmalloc.h create mode 100644 arch/um/include/asm/vmalloc.h create mode 100644 arch/unicore32/include/asm/vmalloc.h create mode 100644 arch/x86/include/asm/vmalloc.h create mode 100644 arch/xtensa/include/asm/vmalloc.h delete mode 100644 lib/ioremap.c create mode 100644 mm/ioremap.c -- 2.25.1

1 26

[PATCH 0/4] fixes CVE-2020-12351 and CVE-2020-12352
by Yang Yingliang 19 Oct '20

19 Oct '20

Luiz Augusto von Dentz (4): Bluetooth: A2MP: Fix not initializing all members Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel Bluetooth: Disable High Speed by default Bluetooth: MGMT: Fix not checking if BT_HS is enabled include/net/bluetooth/l2cap.h | 2 ++ net/bluetooth/Kconfig | 1 - net/bluetooth/a2mp.c | 22 +++++++++++++++++++++- net/bluetooth/l2cap_core.c | 7 ++++--- net/bluetooth/l2cap_sock.c | 14 ++++++++++++++ net/bluetooth/mgmt.c | 7 ++++++- 6 files changed, 47 insertions(+), 6 deletions(-) -- 2.25.1

1 4

[PATCH 00/49] backport stable-4.19.151
by Yang Yingliang 19 Oct '20

19 Oct '20

Aaron Ma (1): platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse Anant Thazhemadam (3): net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() net: team: fix memory leak in __team_options_register net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails Antony Antony (4): xfrm: clone XFRMA_SET_MARK in xfrm_do_migrate xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate xfrm: clone XFRMA_SEC_CTX in xfrm_do_migrate xfrm: clone whole liftime_cur structure in xfrm_do_migrate Aya Levin (2): net/mlx5e: Fix VLAN cleanup flow net/mlx5e: Fix VLAN create flow Chaitanya Kulkarni (1): nvme-core: put ctrl ref when module ref get fail Coly Li (1): mmc: core: don't set limits.discard_granularity as 0 Cristian Ciocaltea (1): i2c: owl: Clear NACK and BUS error bits David Howells (3): rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() rxrpc: Fix some missing _bh annotations on locking conn->state_lock rxrpc: Fix server keyring leak Dinh Nguyen (1): arm64: dts: stratix10: add status to qspi dts node Dumitru Ceara (1): openvswitch: handle DNAT tuple collision Eric Dumazet (4): macsec: avoid use-after-free in macsec_handle_frame() sctp: fix sctp_auth_init_hmacs() error path team: set dev->needed_headroom in team_setup_by_port() bonding: set dev->needed_headroom in bond_setup_by_slave() Geert Uytterhoeven (1): Revert "ravb: Fixed to be able to unload modules" Greg Kroah-Hartman (1): Linux 4.19.151 Hans de Goede (2): platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on the HP Pavilion 11 x360 platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting Herbert Xu (1): xfrm: Use correct address family in xfrm_state_find Hugh Dickins (1): mm/khugepaged: fix filemap page_to_pgoff(page) != offset Jean Delvare (1): i2c: i801: Exclude device from suspend direct complete optimization Jerome Brunet (1): i2c: meson: fix clock setting overwrite Kajol Jain (1): perf: Fix task_function_call() error handling Karol Herbst (1): drm/nouveau/mem: guard against NULL pointer access in mem_del Linus Torvalds (1): usermodehelper: reset umask to default before executing user process Marc Dionne (1): rxrpc: Fix rxkad token xdr encoding Miquel Raynal (1): mtd: rawnand: sunxi: Fix the probe error path Necip Fazil Yildiran (1): platform/x86: fix kconfig dependency warning for FUJITSU_LAPTOP Nicolas Belin (1): i2c: meson: fixup rate calculation with filter delay Peilin Ye (3): fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts fbcon: Fix global-out-of-bounds read in fbcon_get_font() Philip Yang (1): drm/amdgpu: prevent double kfree ttm->sg Randy Dunlap (1): mdio: fix mdio-thunder.c dependency & build error Sabrina Dubroca (1): xfrmi: drop ignore_df check before updating pmtu Tetsuo Handa (1): driver core: Fix probe_count imbalance in really_probe() Tom Rix (1): platform/x86: thinkpad_acpi: initialize tp_nvram_state variable Vijay Balakrishna (1): mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged Vladimir Zapolskiy (1): cifs: Fix incomplete memory allocation on setxattr path Voon Weifeng (1): net: stmmac: removed enabling eee in EEE set callback Wilken Gottwalt (1): net: usb: ax88179_178a: fix missing stop entry in driver_info Makefile | 2 +- .../dts/altera/socfpga_stratix10_socdk.dts | 1 + drivers/base/dd.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + drivers/gpu/drm/nouveau/nouveau_mem.c | 2 + drivers/i2c/busses/i2c-i801.c | 1 + drivers/i2c/busses/i2c-meson.c | 42 +++++-- drivers/i2c/busses/i2c-owl.c | 6 + drivers/mmc/core/queue.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- drivers/net/bonding/bond_main.c | 1 + .../net/ethernet/mellanox/mlx5/core/en_fs.c | 14 ++- drivers/net/ethernet/renesas/ravb_main.c | 110 +++++++++--------- .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 15 +-- drivers/net/macsec.c | 4 +- drivers/net/phy/Kconfig | 1 + drivers/net/team/team.c | 3 +- drivers/net/usb/ax88179_178a.c | 1 + drivers/net/usb/rtl8150.c | 16 ++- drivers/nvme/host/core.c | 4 +- drivers/platform/x86/Kconfig | 1 + drivers/platform/x86/intel-vbtn.c | 64 +++++++--- drivers/platform/x86/thinkpad_acpi.c | 6 +- drivers/video/console/newport_con.c | 7 +- drivers/video/fbdev/core/fbcon.c | 12 ++ drivers/video/fbdev/core/fbcon.h | 7 -- drivers/video/fbdev/core/fbcon_rotate.c | 1 + drivers/video/fbdev/core/tileblit.c | 1 + fs/cifs/smb2ops.c | 2 +- include/linux/font.h | 13 +++ include/linux/khugepaged.h | 5 + include/net/xfrm.h | 16 +-- kernel/events/core.c | 5 +- kernel/umh.c | 9 ++ lib/fonts/font_10x18.c | 9 +- lib/fonts/font_6x10.c | 9 +- lib/fonts/font_6x11.c | 9 +- lib/fonts/font_7x14.c | 9 +- lib/fonts/font_8x16.c | 9 +- lib/fonts/font_8x8.c | 9 +- lib/fonts/font_acorn_8x8.c | 9 +- lib/fonts/font_mini_4x6.c | 8 +- lib/fonts/font_pearl_8x8.c | 9 +- lib/fonts/font_sun12x22.c | 9 +- lib/fonts/font_sun8x16.c | 7 +- mm/khugepaged.c | 25 +++- mm/page_alloc.c | 3 + net/openvswitch/conntrack.c | 22 ++-- net/rxrpc/conn_event.c | 6 +- net/rxrpc/key.c | 18 ++- net/sctp/auth.c | 1 + net/wireless/nl80211.c | 3 + net/xfrm/xfrm_interface.c | 2 +- net/xfrm/xfrm_state.c | 42 ++++++- 54 files changed, 391 insertions(+), 209 deletions(-) -- 2.25.1

1 49

[PATCH] perf/core: Fix race in the perf_mmap_close() function
by Yang Yingliang 16 Oct '20

16 Oct '20

From: Jiri Olsa <jolsa(a)redhat.com> mainline inclusion from mainline-v5.10 commit f91072ed1b7283b13ca57fcfbece5a3b92726143 category: bugfix bugzilla: NA CVE: CVE-2020-14351 -------------------------------- There's a possible race in perf_mmap_close() when checking ring buffer's mmap_count refcount value. The problem is that the mmap_count check is not atomic because we call atomic_dec() and atomic_read() separately. perf_mmap_close: ... atomic_dec(&rb->mmap_count); ... if (atomic_read(&rb->mmap_count)) goto out_put; <ring buffer detach> free_uid out_put: ring_buffer_put(rb); /* could be last */ The race can happen when we have two (or more) events sharing same ring buffer and they go through atomic_dec() and then they both see 0 as refcount value later in atomic_read(). Then both will go on and execute code which is meant to be run just once. The code that detaches ring buffer is probably fine to be executed more than once, but the problem is in calling free_uid(), which will later on demonstrate in related crashes and refcount warnings, like: refcount_t: addition on 0; use-after-free. ... RIP: 0010:refcount_warn_saturate+0x6d/0xf ... Call Trace: prepare_creds+0x190/0x1e0 copy_creds+0x35/0x172 copy_process+0x471/0x1a80 _do_fork+0x83/0x3a0 __do_sys_wait4+0x83/0x90 __do_sys_clone+0x85/0xa0 do_syscall_64+0x5b/0x1e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Using atomic decrease and check instead of separated calls. Tested-by: Michael Petlan <mpetlan(a)redhat.com> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Acked-by: Peter Zijlstra <a.p.zijlstra(a)chello.nl> Acked-by: Namhyung Kim <namhyung(a)kernel.org> Acked-by: Wade Mealing <wmealing(a)redhat.com> Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole"); Link: https://lore.kernel.org/r/20200916115311.GE2301783@krava Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Conflicts: kernel/events/core.c [yyl: adjust context] Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/events/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 30a81d1b7b5c..452775f68129 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5496,11 +5496,11 @@ static void perf_pmu_output_stop(struct perf_event *event); static void perf_mmap_close(struct vm_area_struct *vma) { struct perf_event *event = vma->vm_file->private_data; - struct ring_buffer *rb = ring_buffer_get(event); struct user_struct *mmap_user = rb->mmap_user; int mmap_locked = rb->mmap_locked; unsigned long size = perf_data_size(rb); + bool detach_rest = false; if (event->pmu->event_unmapped) event->pmu->event_unmapped(event, vma->vm_mm); @@ -5531,7 +5531,8 @@ static void perf_mmap_close(struct vm_area_struct *vma) mutex_unlock(&event->mmap_mutex); } - atomic_dec(&rb->mmap_count); + if (atomic_dec_and_test(&rb->mmap_count)) + detach_rest = true; if (!atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex)) goto out_put; @@ -5540,7 +5541,7 @@ static void perf_mmap_close(struct vm_area_struct *vma) mutex_unlock(&event->mmap_mutex); /* If there's still other mmap()s of this buffer, we're done. */ - if (atomic_read(&rb->mmap_count)) + if (!detach_rest) goto out_put; /* -- 2.25.1

1 0

[PATCH] geneve: add transport ports in route lookup for geneve
by Yang Yingliang 15 Oct '20

15 Oct '20

From: Mark Gray <mark.d.gray(a)redhat.com> stable inclusion from linux-4.19.148 commit c797110d97c48054d1491251fd713900ff51615c CVE: CVE-2020-25645 -------------------------------- [ Upstream commit 34beb21594519ce64a55a498c2fe7d567bc1ca20 ] This patch adds transport ports information for route lookup so that IPsec can select Geneve tunnel traffic to do encryption. This is needed for OVS/OVN IPsec with encrypted Geneve tunnels. This can be tested by configuring a host-host VPN using an IKE daemon and specifying port numbers. For example, for an Openswan-type configuration, the following parameters should be configured on both hosts and IPsec set up as-per normal: $ cat /etc/ipsec.conf conn in ... left=$IP1 right=$IP2 ... leftprotoport=udp/6081 rightprotoport=udp ... conn out ... left=$IP1 right=$IP2 ... leftprotoport=udp rightprotoport=udp/6081 ... The tunnel can then be setup using "ip" on both hosts (but changing the relevant IP addresses): $ ip link add tun type geneve id 1000 remote $IP2 $ ip addr add 192.168.0.1/24 dev tun $ ip link set tun up This can then be tested by pinging from $IP1: $ ping 192.168.0.2 Without this patch the traffic is unencrypted on the wire. Fixes: 2d07dc79fe04 ("geneve: add initial netdev driver for GENEVE tunnels") Signed-off-by: Qiuyu Xiao <qiuyu.xiao.qyx(a)gmail.com> Signed-off-by: Mark Gray <mark.d.gray(a)redhat.com> Reviewed-by: Greg Rose <gvrose8192(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/geneve.c | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c index 1506e913cebb..fdb251e1f471 100644 --- a/drivers/net/geneve.c +++ b/drivers/net/geneve.c @@ -721,7 +721,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb, struct net_device *dev, struct geneve_sock *gs4, struct flowi4 *fl4, - const struct ip_tunnel_info *info) + const struct ip_tunnel_info *info, + __be16 dport, __be16 sport) { bool use_cache = ip_tunnel_dst_cache_usable(skb, info); struct geneve_dev *geneve = netdev_priv(dev); @@ -737,6 +738,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb, fl4->flowi4_proto = IPPROTO_UDP; fl4->daddr = info->key.u.ipv4.dst; fl4->saddr = info->key.u.ipv4.src; + fl4->fl4_dport = dport; + fl4->fl4_sport = sport; tos = info->key.tos; if ((tos == 1) && !geneve->collect_md) { @@ -771,7 +774,8 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, struct net_device *dev, struct geneve_sock *gs6, struct flowi6 *fl6, - const struct ip_tunnel_info *info) + const struct ip_tunnel_info *info, + __be16 dport, __be16 sport) { bool use_cache = ip_tunnel_dst_cache_usable(skb, info); struct geneve_dev *geneve = netdev_priv(dev); @@ -787,6 +791,9 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, fl6->flowi6_proto = IPPROTO_UDP; fl6->daddr = info->key.u.ipv6.dst; fl6->saddr = info->key.u.ipv6.src; + fl6->fl6_dport = dport; + fl6->fl6_sport = sport; + prio = info->key.tos; if ((prio == 1) && !geneve->collect_md) { prio = ip_tunnel_get_dsfield(ip_hdr(skb), skb); @@ -833,14 +840,15 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, __be16 df; int err; - rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info); + sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); + rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info, + geneve->info.key.tp_dst, sport); if (IS_ERR(rt)) return PTR_ERR(rt); skb_tunnel_check_pmtu(skb, &rt->dst, GENEVE_IPV4_HLEN + info->options_len); - sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); if (geneve->collect_md) { tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb); ttl = key->ttl; @@ -875,13 +883,14 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, __be16 sport; int err; - dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info); + sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); + dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info, + geneve->info.key.tp_dst, sport); if (IS_ERR(dst)) return PTR_ERR(dst); skb_tunnel_check_pmtu(skb, dst, GENEVE_IPV6_HLEN + info->options_len); - sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); if (geneve->collect_md) { prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb); ttl = key->ttl; @@ -957,13 +966,18 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) { struct ip_tunnel_info *info = skb_tunnel_info(skb); struct geneve_dev *geneve = netdev_priv(dev); + __be16 sport; if (ip_tunnel_info_af(info) == AF_INET) { struct rtable *rt; struct flowi4 fl4; + struct geneve_sock *gs4 = rcu_dereference(geneve->sock4); + sport = udp_flow_src_port(geneve->net, skb, + 1, USHRT_MAX, true); - rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info); + rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info, + geneve->info.key.tp_dst, sport); if (IS_ERR(rt)) return PTR_ERR(rt); @@ -973,9 +987,13 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) } else if (ip_tunnel_info_af(info) == AF_INET6) { struct dst_entry *dst; struct flowi6 fl6; + struct geneve_sock *gs6 = rcu_dereference(geneve->sock6); + sport = udp_flow_src_port(geneve->net, skb, + 1, USHRT_MAX, true); - dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info); + dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info, + geneve->info.key.tp_dst, sport); if (IS_ERR(dst)) return PTR_ERR(dst); @@ -986,8 +1004,7 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) return -EINVAL; } - info->key.tp_src = udp_flow_src_port(geneve->net, skb, - 1, USHRT_MAX, true); + info->key.tp_src = sport; info->key.tp_dst = geneve->info.key.tp_dst; return 0; } -- 2.25.1

1 0

[PATCH 00/78] bugfixes for openEuler-1.0-LTS
by Yang Yingliang 15 Oct '20

15 Oct '20

Al Grant (1): perf tools: Correct SNOOPX field offset Al Viro (2): do_epoll_ctl(): clean the failure exits up a bit fix regression in "epoll: Keep a reference on files added to the check list" Alex Williamson (1): vfio/type1: Add proper error unwind for vfio_iommu_replay() Alvin Šipraga (1): macvlan: validate setting of multiple remote source MAC addresses Bodo Stroesser (1): scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM Brian Foster (3): xfs: acquire superblock freeze protection on eofblocks scans xfs: reset buffer write failure state on successful completion xfs: fix duplicate verification from xfs_qm_dqflush() Charan Teja Reddy (1): mm, page_alloc: fix core hung in free_pcppages_bulk() Chris Wilson (1): locking/lockdep: Fix overflow in presentation of average lock-time Chuck Lever (1): NFS: Zero-stateid SETATTR should first return delegation Daniel Borkmann (1): uaccess: Add non-pagefault user-space write function Darrick J. Wong (4): xfs: fix partially uninitialized structure in xfs_reflink_remap_extent xfs: fix inode quota reservation checks xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt files xfs: initialize the shortform attr header padding entry Dave Chinner (1): xfs: Don't allow logging of XFS_ISTALE inodes David Milburn (2): nvme-fc: cancel async events before freeing event struct nvme-rdma: cancel async events before freeing event struct Doug Berger (1): mm: include CMA pages in lowmem_reserve at boot Eiichi Tsukata (1): xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init Eric Biggers (1): xfs: clear PF_MEMALLOC before exiting xfsaild thread George Kennedy (1): vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() Gustav Wiklander (1): spi: Fix memory leak on splited transfers Heikki Krogerus (1): device property: Fix the secondary firmware node handling in set_primary_fwnode() Helge Deller (1): fs/signalfd.c: fix inconsistent return codes for signalfd4 Hou Pu (1): scsi: target: iscsi: Fix hang in iscsit_access_np() when getting tpg->np_login_sem Hugh Dickins (2): khugepaged: khugepaged_test_exit() check mmget_still_valid() khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() Jan Kara (5): ext4: fix checking of directory entry validity for inline directories ext4: don't BUG on inconsistent journal feature writeback: Protect inode->i_io_list with inode->i_lock writeback: Avoid skipping inode writeback writeback: Fix sync livelock due to b_dirty_time processing Jarkko Sakkinen (1): tpm: Unify the mismatching TPM space buffer sizes Jason Gunthorpe (1): include/linux/log2.h: add missing () around n in roundup_pow_of_two() Javed Hasan (1): scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() Jens Axboe (1): block: ensure bdi->io_pages is always initialized Jing Xiangfeng (1): scsi: iscsi: Do not put host in iscsi_set_flashnode_param() Li Heng (1): efi: add missed destroy_workqueue when efisubsys_init fails Lukas Czerner (3): jbd2: make sure jh have b_transaction set in refile/unfile_buffer ext4: handle read only external journal device ext4: handle option set by mount flags correctly Lukas Wunner (4): spi: Prevent adding devices below an unregistering controller serial: pl011: Fix oops on -EPROBE_DEFER serial: pl011: Don't leak amba_ports entry on driver register error serial: 8250: Avoid error message on reprobe Luo Meng (1): ext4: only set last error block when check system zone failed Mao Wenan (1): virtio_ring: Avoid loop when vq is broken in virtqueue_poll Marc Zyngier (1): epoll: Keep a reference on files added to the check list Masami Hiramatsu (2): perf probe: Fix memory leakage when the probe point is not found uaccess: Add non-pagefault user-space read functions Max Reitz (1): xfs: Fix tail rounding in xfs_alloc_file_space() Mikulas Patocka (2): xfs: don't update mtime on COW faults dm writecache: handle DAX to partitions on persistent memory correctly Ming Lei (1): blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART Muchun Song (1): kprobes: fix kill kprobe which has been marked as gone Namhyung Kim (1): perf jevents: Fix suspicious code in fixregex() Peter Xu (1): mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible Peter Zijlstra (1): cpuidle: Fixup IRQ state Qiushi Wu (1): PCI: Fix pci_create_slot() reference count leak Rafael J. Wysocki (1): PM: sleep: core: Fix the handling of pending runtime resume requests Ralph Campbell (1): mm/thp: fix __split_huge_pmd_locked() for migration PMD Robin Murphy (1): iommu/iova: Don't BUG on invalid PFNs Selvin Xavier (1): RDMA/bnxt_re: Do not add user qps to flushlist Sergey Senozhatsky (1): serial: 8250: change lock order in serial8250_do_startup() Sunghyun Jin (1): percpu: fix first chunk size calculation for populated bitmap Tejun Heo (1): libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks Tetsuo Handa (1): vt: defer kfree() of vc_screenbuf in vc_do_resize() Valmer Huhn (1): serial: 8250_exar: Fix number of ports for Commtech PCIe cards Varun Prakash (1): scsi: target: iscsi: Fix data digest calculation Wei Yongjun (1): kernel/relay.c: fix memleak on destroy relay channel Xianting Tian (1): fs: prevent BUG_ON in submit_bh_wbc() Xunlei Pang (1): mm: memcg: fix memcg reclaim soft lockup Yang Xu (1): KEYS: reaching the keys quotas correctly kaixuxia (1): xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT zhangyi (F) (1): jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock() block/blk-core.c | 2 + block/blk-mq-sched.c | 9 ++ block/blk-mq.c | 9 ++ drivers/ata/libata-core.c | 5 +- drivers/ata/libata-scsi.c | 8 +- drivers/base/core.c | 12 +- drivers/base/power/main.c | 16 ++- drivers/char/tpm/tpm-chip.c | 9 +- drivers/char/tpm/tpm.h | 6 +- drivers/char/tpm/tpm2-space.c | 26 ++-- drivers/char/tpm/tpmrm-dev.c | 2 +- drivers/cpuidle/cpuidle.c | 3 +- drivers/firmware/efi/efi.c | 2 + drivers/infiniband/hw/bnxt_re/main.c | 3 +- drivers/iommu/iova.c | 4 +- drivers/md/dm-writecache.c | 12 +- drivers/net/macvlan.c | 21 ++- drivers/nvme/host/fc.c | 1 + drivers/nvme/host/rdma.c | 1 + drivers/pci/slot.c | 6 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_transport_iscsi.c | 2 +- drivers/spi/Kconfig | 3 + drivers/spi/spi.c | 30 +++- drivers/target/iscsi/iscsi_target.c | 17 ++- drivers/target/iscsi/iscsi_target_login.c | 6 +- drivers/target/iscsi/iscsi_target_login.h | 3 +- drivers/target/iscsi/iscsi_target_nego.c | 3 +- drivers/target/target_core_user.c | 2 +- drivers/tty/serial/8250/8250_core.c | 11 +- drivers/tty/serial/8250/8250_exar.c | 24 +++- drivers/tty/serial/8250/8250_port.c | 9 +- drivers/tty/serial/amba-pl011.c | 16 ++- drivers/tty/vt/vt.c | 5 +- drivers/tty/vt/vt_ioctl.c | 12 +- drivers/vfio/vfio_iommu_type1.c | 71 ++++++++- drivers/virtio/virtio_ring.c | 3 + fs/buffer.c | 9 ++ fs/eventpoll.c | 23 +-- fs/ext4/block_validity.c | 3 +- fs/ext4/namei.c | 6 +- fs/ext4/super.c | 147 ++++++++++++------- fs/fs-writeback.c | 83 ++++++----- fs/jbd2/journal.c | 4 +- fs/jbd2/transaction.c | 10 ++ fs/nfs/nfs4proc.c | 4 +- fs/signalfd.c | 10 +- fs/xfs/libxfs/xfs_attr_leaf.c | 4 +- fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/xfs_bmap_util.c | 4 +- fs/xfs/xfs_buf.c | 8 +- fs/xfs/xfs_dquot.c | 9 +- fs/xfs/xfs_file.c | 12 +- fs/xfs/xfs_icache.c | 13 +- fs/xfs/xfs_inode.c | 110 ++++++++------ fs/xfs/xfs_ioctl.c | 5 +- fs/xfs/xfs_reflink.c | 1 + fs/xfs/xfs_sysfs.h | 6 +- fs/xfs/xfs_trans_ail.c | 4 +- fs/xfs/xfs_trans_dquot.c | 2 +- fs/xfs/xfs_trans_inode.c | 2 + include/linux/fs.h | 8 +- include/linux/libata.h | 1 + include/linux/log2.h | 2 +- include/linux/uaccess.h | 26 ++++ include/trace/events/writeback.h | 13 +- kernel/kprobes.c | 9 +- kernel/locking/lockdep_proc.c | 2 +- kernel/relay.c | 1 + mm/huge_memory.c | 40 +++--- mm/hugetlb.c | 24 ++-- mm/khugepaged.c | 7 +- mm/maccess.c | 167 ++++++++++++++++++++-- mm/page_alloc.c | 7 +- mm/percpu.c | 2 +- mm/vmscan.c | 8 ++ security/keys/key.c | 2 +- security/keys/keyctl.c | 4 +- tools/include/uapi/linux/perf_event.h | 2 +- tools/perf/pmu-events/jevents.c | 2 +- tools/perf/util/probe-finder.c | 2 +- 81 files changed, 864 insertions(+), 322 deletions(-) -- 2.25.1

1 78