- Kernel - mailweb.openeuler.org

[PATCH 00/14] Some bug and CVE fixes
by Yang Yingliang 05 Feb '20

05 Feb '20

Cheng Jian (2): membarrier/kabi: fix kabi for membarrier_state selftest/membarrier: fix build error Mathieu Desnoyers (5): sched/membarrier: Remove redundant check sched/membarrier: Fix p->mm->membarrier_state racy load selftests, sched/membarrier: Add multi-threaded test sched/membarrier: Skip IPIs when mm->mm_users == 1 sched/membarrier: Return -ENOMEM to userspace on memory allocation failure Peter Zijlstra (2): sched: Clean up active_mm reference counting membarrier: Fix RCU locking bug caused by faulty merge Tyler Hicks (1): drm/i915: Fix use-after-free when destroying GEM context Xiongfeng Wang (2): PCI: add a member in 'struct pci_bus' to record the original 'pci_ops' PCI: fix kabi change in struct pci_bus Ying Fang (2): KVM: arm/arm64: use esr_ec as trace field of kvm_exit tracepoint KVM: tools/kvm_stat: Fix kvm_exit filter name drivers/gpu/drm/i915/i915_gem_context.c | 13 +- drivers/pci/probe.c | 7 +- fs/exec.c | 2 +- include/linux/mm_types.h | 8 + include/linux/pci.h | 5 +- include/linux/sched/mm.h | 8 +- kernel/sched/core.c | 49 ++-- kernel/sched/membarrier.c | 236 +++++++++------ kernel/sched/sched.h | 37 +++ tools/kvm/kvm_stat/kvm_stat | 8 +- tools/testing/selftests/membarrier/.gitignore | 3 +- tools/testing/selftests/membarrier/Makefile | 4 +- .../testing/selftests/membarrier/membarrier_test.c | 312 -------------------- .../selftests/membarrier/membarrier_test_impl.h | 317 +++++++++++++++++++++ .../membarrier/membarrier_test_multi_thread.c | 72 +++++ .../membarrier/membarrier_test_single_thread.c | 23 ++ virt/kvm/arm/arm.c | 2 +- virt/kvm/arm/trace.h | 14 +- 18 files changed, 678 insertions(+), 442 deletions(-) delete mode 100644 tools/testing/selftests/membarrier/membarrier_test.c create mode 100644 tools/testing/selftests/membarrier/membarrier_test_impl.h create mode 100644 tools/testing/selftests/membarrier/membarrier_test_multi_thread.c create mode 100644 tools/testing/selftests/membarrier/membarrier_test_single_thread.c -- 1.8.3

1 14

[PATCH] PCI/AER: increments pci bus reference count in aer-inject process
by Yang Yingliang 19 Jan '20

19 Jan '20

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> hulk inclusion category: bugfix bugzilla: 28335 CVE: NA ------------------------------------------------- When I test 'aer-inject' with the following procedures: 1. inject a fatal error into a PCI device 2. remove the parent device by sysfs 3. execute command 'rmmod aer-inject' I came across the following use-after-free. [ 297.581524] ================================================================== [ 297.581543] BUG: KASAN: use-after-free in pci_bus_set_ops+0xb4/0xb8 [ 297.581545] Read of size 8 at addr ffff802edbde80e0 by task rmmod/21839 [ 297.581552] CPU: 119 PID: 21839 Comm: rmmod Kdump: loaded Not tainted 4.19.36 #1 [ 297.581554] Hardware name: Huawei TaiShan 2280 V2/BC82AMDD, BIOS 1.05 09/18/2019 [ 297.581556] Call trace: [ 297.581561] dump_backtrace+0x0/0x360 [ 297.581563] show_stack+0x24/0x30 [ 297.581569] dump_stack+0xd8/0x104 [ 297.581576] print_address_description+0x68/0x278 [ 297.581578] kasan_report+0x204/0x330 [ 297.581580] __asan_report_load8_noabort+0x30/0x40 [ 297.581582] pci_bus_set_ops+0xb4/0xb8 [ 297.581591] aer_inject_exit+0x198/0x334 [aer_inject] [ 297.581595] __arm64_sys_delete_module+0x310/0x490 [ 297.581601] el0_svc_common+0xfc/0x278 [ 297.581603] el0_svc_handler+0x50/0xc0 [ 297.581605] el0_svc+0x8/0xc [ 297.581608] Allocated by task 1: [ 297.581611] kasan_kmalloc+0xe0/0x190 [ 297.581614] kmem_cache_alloc_trace+0x104/0x218 [ 297.581616] pci_alloc_bus+0x50/0x2e0 [ 297.581618] pci_add_new_bus+0xa8/0xe08 [ 297.581620] pci_scan_bridge_extend+0x884/0xb28 [ 297.581623] pci_scan_child_bus_extend+0x350/0x628 [ 297.581625] pci_scan_child_bus+0x24/0x30 [ 297.581627] pci_scan_bridge_extend+0x3b8/0xb28 [ 297.581629] pci_scan_child_bus_extend+0x350/0x628 [ 297.581631] pci_scan_child_bus+0x24/0x30 [ 297.581635] acpi_pci_root_create+0x558/0x888 [ 297.581640] pci_acpi_scan_root+0x198/0x330 [ 297.581641] acpi_pci_root_add+0x7bc/0xbb0 [ 297.581646] acpi_bus_attach+0x2f4/0x728 [ 297.581647] acpi_bus_attach+0x1b0/0x728 [ 297.581649] acpi_bus_attach+0x1b0/0x728 [ 297.581651] acpi_bus_scan+0xa0/0x110 [ 297.581657] acpi_scan_init+0x20c/0x500 [ 297.581659] acpi_init+0x54c/0x5d4 [ 297.581661] do_one_initcall+0xbc/0x480 [ 297.581665] kernel_init_freeable+0x5fc/0x6ac [ 297.581670] kernel_init+0x18/0x128 [ 297.581671] ret_from_fork+0x10/0x18 [ 297.581673] Freed by task 19270: [ 297.581675] __kasan_slab_free+0x120/0x228 [ 297.581677] kasan_slab_free+0x10/0x18 [ 297.581678] kfree+0x80/0x1f8 [ 297.581680] release_pcibus_dev+0x54/0x68 [ 297.581686] device_release+0xd4/0x1c0 [ 297.581689] kobject_put+0x12c/0x400 [ 297.581691] device_unregister+0x30/0xc0 [ 297.581693] pci_remove_bus+0xe8/0x1c0 [ 297.581695] pci_remove_bus_device+0xd0/0x2f0 [ 297.581697] pci_stop_and_remove_bus_device_locked+0x2c/0x40 [ 297.581701] remove_store+0x1b8/0x1d0 [ 297.581703] dev_attr_store+0x60/0x80 [ 297.581708] sysfs_kf_write+0x104/0x170 [ 297.581710] kernfs_fop_write+0x23c/0x430 [ 297.581713] __vfs_write+0xec/0x4e0 [ 297.581714] vfs_write+0x12c/0x3d0 [ 297.581715] ksys_write+0xd0/0x190 [ 297.581716] __arm64_sys_write+0x70/0xa0 [ 297.581718] el0_svc_common+0xfc/0x278 [ 297.581720] el0_svc_handler+0x50/0xc0 [ 297.581721] el0_svc+0x8/0xc [ 297.581724] The buggy address belongs to the object at ffff802edbde8000 which belongs to the cache kmalloc-2048 of size 2048 [ 297.581726] The buggy address is located 224 bytes inside of 2048-byte region [ffff802edbde8000, ffff802edbde8800) [ 297.581727] The buggy address belongs to the page: [ 297.581730] page:ffff7e00bb6f7a00 count:1 mapcount:0 mapping:ffff8026de810780 index:0x0 compound_mapcount: 0 [ 297.591520] flags: 0x2ffffe0000008100(slab|head) [ 297.596121] raw: 2ffffe0000008100 ffff7e00bb6f5008 ffff7e00bb6ff608 ffff8026de810780 [ 297.596123] raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000 [ 297.596124] page dumped because: kasan: bad access detected [ 297.596126] Memory state around the buggy address: [ 297.596128] ffff802edbde7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 297.596129] ffff802edbde8000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596131] >ffff802edbde8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596132] ^ [ 297.596133] ffff802edbde8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596135] ffff802edbde8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596135] ================================================================== It is because when we unload the module and restore the member 'pci_ops' of 'pci_bus', the 'pci_bus' has been freed. This patch increments the reference count of 'pci_bus' when we modify its member 'pci_ops' and decrements the reference count after we have restored its member. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pci/pcie/aer_inject.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/pci/pcie/aer_inject.c b/drivers/pci/pcie/aer_inject.c index 48024a8..03ee265 100644 --- a/drivers/pci/pcie/aer_inject.c +++ b/drivers/pci/pcie/aer_inject.c @@ -304,6 +304,13 @@ static int pci_bus_set_aer_ops(struct pci_bus *bus) spin_lock_irqsave(&inject_lock, flags); if (ops == &aer_inj_pci_ops) goto out; + /* + * increments the reference count of the pci bus. Otherwise, when we + * restore the 'pci_ops' in 'aer_inject_exit', the 'pci_bus' may have + * been freed. + */ + pci_bus_get(bus); + pci_bus_ops_init(bus_ops, bus, ops); list_add(&bus_ops->list, &pci_bus_ops_list); bus_ops = NULL; @@ -543,6 +550,7 @@ static void __exit aer_inject_exit(void) while ((bus_ops = pci_bus_ops_pop())) { pci_bus_set_ops(bus_ops->bus, bus_ops->ops); + pci_bus_put(bus_ops->bus); kfree(bus_ops); } -- 1.8.3

1 0

[PATCH 0/2] Its support hibernation
by Yang Yingliang 19 Jan '20

19 Jan '20

Currently, if we test hibernation, it will fails at the ITS driver, because its can't resume and suspend successuly during the phase of hibernation. Add its herbinate state to support its resume correctly. Hongbo Yao (2): PM / hibernate: introduce system_in_hibernation irqchip/gic-v3-its: its support herbination drivers/irqchip/irq-gic-v3-its.c | 19 +++++++++++++++++-- include/linux/suspend.h | 2 ++ kernel/power/hibernate.c | 11 +++++++++++ 3 files changed, 30 insertions(+), 2 deletions(-) -- 1.8.3

1 2

[PATCH hulk-4.19-next 0/2] Its support hibernation
by Hongbo Yao 19 Jan '20

19 Jan '20

Currently, if we test hibernation, it will fails at the ITS driver, because its can't resume and suspend successuly during the phase of hibernation. Add its herbinate state to support its resume correctly. Hongbo Yao (2): PM / hibernate: introduce system_in_hibernation irqchip/gic-v3-its: its support herbination drivers/irqchip/irq-gic-v3-its.c | 19 +++++++++++++++++-- include/linux/suspend.h | 2 ++ kernel/power/hibernate.c | 11 +++++++++++ 3 files changed, 30 insertions(+), 2 deletions(-) -- 2.20.1

1 2

[PATCH] config: enable CONFIG_SMMU_BYPASS_DEV by default
by Yang Yingliang 17 Jan '20

17 Jan '20

hulk inclusion category: feature bugzilla: 28210 CVE: NA ------------------------------------------------- Enable CONFIG_SMMU_BYPASS_DEV by default. Reviewed-By: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/configs/hulk_defconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/configs/hulk_defconfig b/arch/arm64/configs/hulk_defconfig index 5ded386..7859fd4 100644 --- a/arch/arm64/configs/hulk_defconfig +++ b/arch/arm64/configs/hulk_defconfig @@ -4593,6 +4593,7 @@ CONFIG_IOMMU_PAGE_FAULT=y CONFIG_ARM_SMMU=y CONFIG_ARM_SMMU_V3=y # CONFIG_QCOM_IOMMU is not set +CONFIG_SMMU_BYPASS_DEV=y # # Remoteproc drivers -- 1.8.3

1 0

[PATCH 0/7] Fix some bugs and CVEs
by Yang Yingliang 16 Jan '20

16 Jan '20

Dedy Lansky (1): cfg80211/mac80211: make ieee80211_send_layer2_update a public function Jaegeuk Kim (1): f2fs: support swap file w/ DIO Jouni Malinen (1): mac80211: Do not send Layer 2 Update frame before authorization Keith Busch (1): PCI/AER: Refactor error injection fallbacks Peng Wang (1): kernfs: fix potential null pointer dereference Shmulik Ladkani (1): net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device Wei Li (1): arm64: fix calling nmi_enter() repeatedly when IPI_CPU_CRASH_STOP arch/arm64/kernel/smp.c | 7 ++- drivers/pci/pcie/aer_inject.c | 66 +++++++++++--------- fs/f2fs/data.c | 140 +++++++++++++++++++++++++++++++++++++++--- fs/f2fs/f2fs.h | 2 +- fs/kernfs/dir.c | 3 +- include/net/cfg80211.h | 11 ++++ include/trace/events/f2fs.h | 11 ++-- net/mac80211/cfg.c | 58 ++--------------- net/mac80211/sta_info.c | 4 ++ net/sched/act_mirred.c | 22 ++++--- net/wireless/util.c | 45 ++++++++++++++ 11 files changed, 259 insertions(+), 110 deletions(-) -- 1.8.3

1 7

[PATCH 00/83] Backport lts patches from Linux-4.19.95
by Yang Yingliang 16 Jan '20

16 Jan '20

Merge 83 patches from 4.19.95 stable branch (84 total) beside 1 already merged patches: 21f0802 mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() Aditya Pakki (1): rfkill: Fix incorrect check to avoid NULL pointer dereference Alexander Shishkin (1): perf/x86/intel: Fix PT PMI handling Andreas Kemnade (1): regulator: rn5t618: fix module aliases Andrew Lunn (1): net: dsa: mv88e6xxx: Preserve priority when setting CPU port. Andrey Konovalov (2): USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein USB: dummy-hcd: increase max number of devices to 32 Anson Huang (2): cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull ARM: dts: imx6ul: use nvmem-cells for cpu speed grading Arvind Sankar (3): efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs efi/gop: Return EFI_SUCCESS if a usable GOP was found efi/gop: Fix memory leak in __gop_query32/64() Chan Shu Tak, Alex (1): llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c) Chen-Yu Tsai (2): net: stmmac: dwmac-sun8i: Allow all RGMII modes net: stmmac: dwmac-sunxi: Allow all RGMII modes Christian Borntraeger (1): s390/purgatory: do not build purgatory with kcov, kasan and friends Chuhong Yuan (2): spi: spi-cavium-thunderx: Add missing pci_release_regions() drm/exynos: gsc: add missed component_del Cristian Birsan (1): net: usb: lan78xx: Fix error message format specifier Daniel Borkmann (1): bpf: Fix passing modified ctx to ld/abs/ind instruction Daniel T. Lee (2): samples: bpf: Replace symbol compare of trace_event samples: bpf: fix syscall_tp due to unused syscall Daniele Palmas (1): USB: serial: option: add Telit ME910G1 0x110a composition Dave Young (1): x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage Dragos Tarcatu (1): ASoC: topology: Check return value for soc_tplg_pcm_create() Eric Dumazet (6): gtp: fix bad unlock balance in gtp_encap_enable_socket macvlan: do not assume mac_header is set in macvlan_broadcast() net: usb: lan78xx: fix possible skb leak pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM vlan: fix memory leak in vlan_dev_set_egress_priority vlan: vlan_changelink() should propagate errors Eric Sandeen (1): fs: avoid softlockups in s_inodes iterators Florian Fainelli (2): ARM: dts: BCM5301X: Fix MDIO node address/size cells ARM: dts: Cygnus: Fix MDIO node address/size cells Florian Westphal (1): netfilter: ctnetlink: netns exit must wait for callbacks Greg Kroah-Hartman (1): Linux 4.19.95 Haiyang Zhang (1): hv_netvsc: Fix unwanted rx_table reset Hangbin Liu (1): vxlan: fix tos value before xmit Hans de Goede (1): ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89 Helge Deller (1): parisc: Fix compiler warnings in debug_core.c Jan Höppner (1): s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly Jason A. Donenfeld (1): powerpc/spinlocks: Include correct header for static key Johan Hovold (1): USB: core: fix check for duplicate endpoints Jose Abreu (4): net: stmmac: Do not accept invalid MTU values net: stmmac: xgmac: Clear previous RX buffer size net: stmmac: RX buffer size must be 16 byte aligned net: stmmac: Always arm TX Timer at end of transmission start Logan Gunthorpe (1): PCI/switchtec: Read all 64 bits of part_event_bitmap Lorenz Bauer (1): bpf: Clear skb->tstamp in bpf_redirect when necessary Manish Chopra (2): bnx2x: Do not handle requests from VFs after parity bnx2x: Fix logic to get total no. of PFs per engine Marco Elver (1): locking/spinlock/debug: Fix various data races Masami Hiramatsu (1): selftests/ftrace: Fix multiple kprobe testcase Mike Rapoport (1): powerpc: Ensure that swiotlb buffer is allocated from low memory Nikolay Borisov (1): btrfs: Fix error messages in qgroup_rescan_init Pablo Neira Ayuso (3): netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() Paul Chaignon (1): bpf, mips: Limit to 33 tail calls Pengcheng Yang (1): tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK Petr Machata (2): mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO net: sch_prio: When ungrafting, replace with FIFO Phil Sutter (1): netfilter: uapi: Avoid undefined left-shift in xt_sctp.h Qi Zhou (1): usb: missing parentheses in USE_NEW_SCHEME Shengjiu Wang (1): ASoC: wm8962: fix lambda value Srikar Dronamraju (1): powerpc/vcpu: Assume dedicated processors as non-preempt Stefan Haberland (1): s390/dasd: fix memleak in path handling error case Stefan Roese (1): ARM: dts: imx6ul: imx6ul-14x14-evk.dtsi: Fix SPI NOR probing Stefan Wahren (1): ARM: dts: bcm283x: Fix critical trip point Sudeep Holla (1): ARM: vexpress: Set-up shared OPP table instead of individual for each CPU Sudip Mukherjee (1): libtraceevent: Fix lib installation with O= Sven Schnelle (1): parisc: add missing __init annotation Thinh Nguyen (1): usb: dwc3: gadget: Fix request complete check Thomas Hebb (1): kconfig: don't crash on NULL expressions in expr_eq() Tomi Valkeinen (1): ARM: dts: am437x-gp/epos-evm: fix panel compatible Tzung-Bi Shih (1): ASoC: max98090: fix possible race conditions Vasundhara Volam (1): bnxt_en: Return error if FW returns more data than dump length Vignesh Raghavendra (1): spi: spi-ti-qspi: Fix a bug when accessing non default CS Vishal Kulkarni (1): cxgb4: Fix kernel panic while accessing sge_info Wen Yang (2): regulator: fix use after free issue sch_cake: avoid possible divide by zero in cake_enqueue() Xiaotao Yin (1): iommu/iova: Init the struct iova to fix the possible memleak Xin Long (1): sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY Yang Yingliang (1): block: fix memleak when __blk_rq_map_user_iov() is failed Makefile | 2 +- arch/arm/boot/dts/am437x-gp-evm.dts | 2 +- arch/arm/boot/dts/am43x-epos-evm.dts | 2 +- arch/arm/boot/dts/bcm-cygnus.dtsi | 4 +- arch/arm/boot/dts/bcm283x.dtsi | 2 +- arch/arm/boot/dts/bcm5301x.dtsi | 4 +- arch/arm/boot/dts/imx6ul-14x14-evk.dtsi | 2 +- arch/arm/boot/dts/imx6ul.dtsi | 6 ++ arch/arm/mach-vexpress/spc.c | 12 +++- arch/mips/net/ebpf_jit.c | 9 +-- arch/parisc/include/asm/cmpxchg.h | 10 ++- arch/parisc/kernel/drivers.c | 2 +- arch/powerpc/include/asm/spinlock.h | 5 +- arch/powerpc/mm/mem.c | 8 +++ arch/powerpc/platforms/pseries/setup.c | 7 ++ arch/s390/purgatory/Makefile | 6 +- arch/s390/purgatory/string.c | 3 + arch/x86/events/core.c | 9 ++- arch/x86/platform/efi/quirks.c | 6 +- block/blk-map.c | 2 +- drivers/cpufreq/imx6q-cpufreq.c | 52 +++++++++----- drivers/firmware/efi/libstub/gop.c | 80 +++++----------------- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 1 + drivers/iommu/iova.c | 2 +- drivers/net/dsa/mv88e6xxx/global1.c | 5 ++ drivers/net/dsa/mv88e6xxx/global1.h | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 12 +++- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c | 12 ++++ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 38 +++++++--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h | 4 ++ drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 4 ++ .../net/ethernet/mellanox/mlxsw/spectrum_qdisc.c | 7 ++ drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 3 + drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 2 + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 3 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 16 ++++- drivers/net/gtp.c | 5 +- drivers/net/hyperv/hyperv_net.h | 3 +- drivers/net/hyperv/netvsc_drv.c | 4 +- drivers/net/hyperv/rndis_filter.c | 10 ++- drivers/net/macvlan.c | 2 +- drivers/net/usb/lan78xx.c | 11 ++- drivers/net/vxlan.c | 4 +- drivers/pci/switch/switchtec.c | 4 +- drivers/regulator/core.c | 4 +- drivers/regulator/rn5t618-regulator.c | 1 + drivers/s390/block/dasd_eckd.c | 28 ++------ drivers/s390/cio/device_ops.c | 2 +- drivers/spi/spi-cavium-thunderx.c | 2 + drivers/spi/spi-ti-qspi.c | 6 +- drivers/usb/core/config.c | 70 +++++++++++++++---- drivers/usb/core/hub.c | 2 +- drivers/usb/dwc3/gadget.c | 7 ++ drivers/usb/gadget/udc/dummy_hcd.c | 10 +-- drivers/usb/serial/option.c | 2 + fs/btrfs/qgroup.c | 4 +- fs/drop_caches.c | 2 +- fs/inode.c | 7 ++ fs/notify/fsnotify.c | 1 + fs/quota/dquot.c | 1 + include/linux/if_ether.h | 8 +++ include/uapi/linux/netfilter/xt_sctp.h | 6 +- kernel/bpf/verifier.c | 9 ++- kernel/locking/spinlock_debug.c | 32 ++++----- net/8021q/vlan.h | 1 + net/8021q/vlan_dev.c | 3 +- net/8021q/vlan_netlink.c | 19 +++-- net/core/filter.c | 1 + net/ipv4/tcp_input.c | 5 +- net/llc/llc_station.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 3 + net/netfilter/nf_tables_api.c | 16 +++-- net/netfilter/nft_bitwise.c | 4 +- net/netfilter/nft_cmp.c | 6 ++ net/netfilter/nft_range.c | 10 +++ net/netfilter/nft_set_rbtree.c | 21 ++++-- net/rfkill/core.c | 7 +- net/sched/sch_cake.c | 2 +- net/sched/sch_fq.c | 6 +- net/sched/sch_prio.c | 10 ++- net/sctp/sm_sideeffect.c | 28 +++++--- samples/bpf/syscall_tp_kern.c | 18 ++++- samples/bpf/trace_event_user.c | 4 +- scripts/kconfig/expr.c | 7 ++ sound/soc/codecs/max98090.c | 8 +-- sound/soc/codecs/max98090.h | 1 - sound/soc/codecs/wm8962.c | 4 +- sound/soc/intel/boards/bytcr_rt5640.c | 8 ++- sound/soc/soc-topology.c | 8 ++- tools/lib/traceevent/Makefile | 1 + .../ftrace/test.d/kprobe/multiple_kprobes.tc | 6 +- 94 files changed, 543 insertions(+), 265 deletions(-) create mode 100644 arch/s390/purgatory/string.c -- 1.8.3

1 83

[PATCH] block: fix use-after-free on cached last_lookup partition
by Yang Yingliang 16 Jan '20

16 Jan '20

From: Yufen Yu <yuyufen(a)huawei.com> hulk inclusion category: bugfix bugzilla: 27962 CVE: NA --------------------------- delete_partition() clears the cached last_lookup partition. However the .last_lookup cache may be overwritten by one IO path after it is cleared from delete_partition(). Then another IO path may use the cached deleting partition after __delete_partition() is called, then use-after-free is triggered on the cached partition. Fixes the issue by the following approach: 1) always get the partition's refcount via hd_struct_try_get() before setting .last_lookup 2) move clearing .last_lookup from delete_partition() to __delete_partition() which is release handle of the partition's percpu-refcount, so that no IO path can overwrite .last_lookup after it is cleared in __delete_partition(). It is one candidate approach of Yufen's patch[1] which adds overhead in fast path by indirect lookup which may introduce one extra cacheline in IO path. Also this patch relies on percpu-refcount's protection, and it is easier to understand and verify. [1] https://lore.kernel.org/linux-block/20200109013551.GB9655@ming.t460p/T/#t Reported-by: Yufen Yu <yuyufen(a)huawei.com> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Conflict: include/linux/genhd.h block/blk-core.c Signed-off-by: Yufen Yu <yuyufen(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-core.c | 12 ------------ block/genhd.c | 6 +++++- block/partition-generic.c | 10 +++++++++- include/linux/genhd.h | 1 + 4 files changed, 15 insertions(+), 14 deletions(-) diff --git a/block/blk-core.c b/block/blk-core.c index dcf1ab0..a52a2f5 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -2788,18 +2788,6 @@ void blk_account_io_start(struct request *rq, bool new_io) part_stat_inc(cpu, part, merges[rw]); } else { part = disk_map_sector_rcu(rq->rq_disk, blk_rq_pos(rq)); - if (!hd_struct_try_get(part)) { - /* - * The partition is already being removed, - * the request will be accounted on the disk only - * - * We take a reference on disk->part0 although that - * partition will never be deleted, so we can treat - * it as any other partition. - */ - part = &rq->rq_disk->part0; - hd_struct_get(part); - } part_round_stats(rq->q, cpu, part); part_inc_in_flight(rq->q, part, rw); rq->part = part; diff --git a/block/genhd.c b/block/genhd.c index 6e8543c..ff9d46d 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -272,17 +272,21 @@ struct hd_struct *disk_map_sector_rcu(struct gendisk *disk, sector_t sector) ptbl = rcu_dereference(disk->part_tbl); part = rcu_dereference(ptbl->last_lookup); - if (part && sector_in_part(part, sector)) + if (part && sector_in_part(part, sector) && hd_struct_try_get(part)) return part; for (i = 1; i < ptbl->len; i++) { part = rcu_dereference(ptbl->part[i]); if (part && sector_in_part(part, sector)) { + if (!hd_struct_try_get(part)) + goto exit; rcu_assign_pointer(ptbl->last_lookup, part); return part; } } + exit: + hd_struct_get(&disk->part0); return &disk->part0; } EXPORT_SYMBOL_GPL(disk_map_sector_rcu); diff --git a/block/partition-generic.c b/block/partition-generic.c index 98d60a5..8ad6dca 100644 --- a/block/partition-generic.c +++ b/block/partition-generic.c @@ -263,6 +263,12 @@ static void delete_partition_work_fn(struct work_struct *work) void __delete_partition(struct percpu_ref *ref) { struct hd_struct *part = container_of(ref, struct hd_struct, ref); + struct disk_part_tbl *ptbl = + rcu_dereference_protected(part->disk->part_tbl, 1); + + rcu_assign_pointer(ptbl->last_lookup, NULL); + put_device(disk_to_dev(part->disk)); + INIT_RCU_WORK(&part->rcu_work, delete_partition_work_fn); queue_rcu_work(system_wq, &part->rcu_work); } @@ -284,8 +290,9 @@ void delete_partition(struct gendisk *disk, int partno) if (!part) return; + get_device(disk_to_dev(disk)); rcu_assign_pointer(ptbl->part[partno], NULL); - rcu_assign_pointer(ptbl->last_lookup, NULL); + kobject_put(part->holder_dir); device_del(part_to_dev(part)); @@ -350,6 +357,7 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno, p->nr_sects = len; p->partno = partno; p->policy = get_disk_ro(disk); + p->disk = disk; if (info) { struct partition_meta_info *pinfo = alloc_part_info(disk); diff --git a/include/linux/genhd.h b/include/linux/genhd.h index be6fe1e..df0d01d 100644 --- a/include/linux/genhd.h +++ b/include/linux/genhd.h @@ -129,6 +129,7 @@ struct hd_struct { struct disk_stats dkstats; #endif struct percpu_ref ref; + struct gendisk *disk; struct rcu_work rcu_work; KABI_RESERVE(1) -- 1.8.3

1 0

[PATCH 000/429] Backport lts patches from Linux-4.19.92 & 93 & 94
by Yang Yingliang 16 Jan '20

16 Jan '20

Merge 211 patches from 4.19.92 stable branch (219 total) beside 8 already merged patches: e99af2c af_packet: set defaule value for tmo 3717a45 rtlwifi: prevent memory leak in rtl_usb_probe 60bb696 libertas: fix a potential NULL pointer dereference 5524867 drm/amdkfd: fix a potential NULL pointer dereference (v2) 1b3e52d mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring e7e11c0 net: hns3: add struct netdev_queue debug info for TX timeout debdd16 media: rcar_drif: fix a memory disclosure e83a26a nbd: fix shutdown and recv work deadlock v2 Merge 109 patches from 4.19.93 stable branch (113 total) beside 3 already merged patches: 332ed88 perf strbuf: Remove redundant va_end() in strbuf_addv() 40696eb Make filldir[64]() verify the directory entry filename is valid 0643c3d filldir[64]: remove WARN_ON_ONCE() for bad directory entries Delay to merge commit 0af1ad3b1ce5 ("ext4: update direct I/O read lock pattern for IOCB_NOWAIT") because it conflicts with 7d434de5f404 ("Revert "ext4: Allow parallel DIO reads""). Merge 111 patches from 4.19.94 stable branch (114 total) beside 3 already merged patches: 8b9bf46 scsi: libsas: stop discovering if oob mode is disconnected d933de8 media: usb: fix memory leak in af9005_identify_state 67f028a tcp: annotate tp->rcv_nxt lockless reads Adrian Hunter (4): x86/insn: Add some Intel instructions to the opcode map mmc: sdhci: Workaround broken command queuing on Intel GLK mmc: sdhci: Add a quirk for broken command queuing perf script: Fix brstackinsn for AUXTRACE Al Viro (1): fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP Aleksandr Yashkin (1): pstore/ram: Write new dumps to start of recycled zones Alexander Lobakin (1): net, sysctl: Fix compiler warning when only cBPF is present Alexander Shishkin (3): intel_th: pci: Add Comet Lake PCH-V support intel_th: pci: Add Elkhart Lake SOC support perf/x86/intel/bts: Fix the use of page_private() Alexandru Ardelean (1): iio: dln2-adc: fix iio_triggered_buffer_postenable() position Amir Goldstein (1): locks: print unsigned ino in /proc/locks Anand Jain (1): btrfs: send: remove WARN_ON for readonly mount Anand Moon (1): arm64: dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed warning Anatol Pomazau (1): scsi: iscsi: Don't send data to unbound connection Andrea Righi (1): bcache: fix deadlock in bcache_allocator Andrew Duggan (1): HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device Andrew Jeffery (1): fsi: core: Fix small accesses and unaligned offsets via sysfs Andy Shevchenko (1): fbtft: Make sure string is NULL terminated Andy Whitcroft (1): PM / hibernate: memory_bm_find_bit(): Tighten node optimisation Aneesh Kumar K.V (2): powerpc/pseries: Don't fail hash page table insert for bolted mapping powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning Anilkumar Kolli (1): ath10k: fix backtrace on coredump Anthony Steinhauser (1): powerpc/security/book3s64: Report L1TF status in sysfs Antonio Messina (1): udp: fix integer overflow while computing available space in sk_rcvbuf Ard Biesheuvel (1): crypto: virtio - deal with unsupported input sizes Arnaldo Carvalho de Melo (1): perf regs: Make perf_reg_name() return "unknown" instead of NULL Arnd Bergmann (3): compat_ioctl: block: handle Persistent Reservations compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE drm/msm: include linux/sched/task.h Bart Van Assche (3): block: Fix writeback throttling W=1 compiler warnings scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6) scsi: target: iscsi: Wait for all commands to finish before freeing a session Bean Huo (1): scsi: ufs: fix potential bug which ends in system hang Ben Dooks (Codethink) (2): Bluetooth: missed cpu_to_le16 conversion in hci_init4_req pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler() Ben Greear (1): ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq Ben Hutchings (1): net: qlogic: Fix error paths in ql_alloc_large_buffers() Ben Zhang (1): ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile Benjamin Berg (1): x86/mce: Lower throttling MCE messages' priority to warning Benoit Parrot (10): media: am437x-vpfe: Setting STD to current value is not an error media: i2c: ov2659: fix s_stream return value media: i2c: ov2659: Fix missing 720p register config media: ti-vpe: vpe: Fix Motion Vector vpdma stride media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number media: ti-vpe: vpe: Make sure YUYV is set as default format media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort cases media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid sizeimage Bjorn Andersson (1): ath10k: Correct error handling of dma_map_single() Blaž Hrastnik (1): HID: Improve Windows Precision Touchpad detection. Bo Wu (1): scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func Brian Foster (1): xfs: fix mount failure crash on invalid iclog memory access Brian Masney (1): drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings Cambda Zhu (1): tcp: Fix highest_sack and highest_sack_seq Catalin Marinas (1): arm64: Revert support for execute-only user mappings Chad Dupuis (1): scsi: qedf: Do not retry ELS request if qedf_alloc_cmd fails Chanho Min (1): mm/zsmalloc.c: fix the migrated zspage statistics. Chao Yu (2): f2fs: fix to update time in lazytime mode f2fs: fix to update dir's i_pino during cross_rename Chaotian Jing (1): mmc: mediatek: fix CMD_TA to 2 for MT8173 HS200/HS400 mode Chris Chiu (2): rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC Christian Brauner (1): taskstats: fix data-race Christian König (1): drm/amdgpu: grab the id mgr lock while accessing passid_mapping Christophe JAILLET (1): media: cx88: Fix some error handling path in 'cx8800_initdev()' Christophe Leroy (3): powerpc/irq: fix stack overflow verification spi: fsl: don't map irq during probe spi: fsl: use platform_get_irq() instead of of_irq_to_resource() Chuhong Yuan (9): fjes: fix missed check in fjes_acpi_add media: si470x-i2c: add missed operations in remove spi: pxa2xx: Add missed security checks spi: tegra20-slink: add missed clk_unprepare ASoC: wm2200: add missed operations in remove and probe failure spi: st-ssc4: add missed pm_runtime_disable ASoC: wm5100: add missed pm_runtime_disable clocksource/drivers/asm9260: Add a check for of_clk_get RDMA/cma: add missed unregister_pernet_subsys in init failure Colin Ian King (4): drm/amdgpu: fix uninitialized variable pasid_mapping_needed apparmor: fix unsigned len comparison with less than zero ALSA: cs4236: fix error return comparison of an unsigned integer media: flexcop-usb: ensure -EIO is returned on error condition Coly Li (2): bcache: fix static checker warning in bcache_device_free() bcache: at least try to shrink 1 node in bch_mca_scan() Connor Kuehl (1): staging: rtl8188eu: fix possible null dereference Corentin Labbe (1): crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c Corey Minyard (1): ipmi: Don't allow device module unload when in use Cristian Birsan (1): net: usb: lan78xx: Fix suspend/resume PHY register access error Dan Carpenter (5): btrfs: return error pointer from alloc_test_extent_buffer ext4: unlock on error in ext4_expand_extra_isize() scsi: csiostor: Don't enable IRQs too early scsi: iscsi: qla4xxx: fix double free in probe Bluetooth: delete a stray unlock Daniel Axtens (1): powerpc/pseries/hvconsole: Fix stack overread via udbg Daniel Baluta (1): mailbox: imx: Fix Tx doorbell shutdown path Daniel Kurtz (1): drm/bridge: dw-hdmi: Restore audio when setting a mode Daniel T. Lee (1): samples: pktgen: fix proc_cmd command result check logic Daniel Vetter (1): drm: limit to INT_MAX in create_blob ioctl Darrick J. Wong (2): loop: fix no-unmap write-zeroes request behavior xfs: periodically yield scrub threads to the scheduler David Disseldorp (1): scsi: target: compare full CHAP_A Algorithm strings David Engraf (1): tty/serial: atmel: fix out of range clock divider handling David Galiffi (2): drm/amd/display: Fix dongle_caps containing stale information. drm/amd/display: Fixed kernel panic when booting with DP-to-HDMI dongle David Hildenbrand (1): powerpc/pseries/cmm: Implement release() function for sysfs device David Howells (3): afs: Fix SELinux setting security label on /afs afs: Fix creation calls in the dynamic root to fail with EOPNOTSUPP rxrpc: Fix possible NULL pointer access in ICMP handling Diego Elio Pettenò (1): cdrom: respect device capabilities during opening action Ding Xiang (1): ocfs2: fix passing zero to 'PTR_ERR' warning Doug Berger (1): ARM: 8937/1: spectre-v2: remove Brahma-B53 from hardening EJ Hsu (1): usb: gadget: fix wrong endpoint desc Eduard Hasenleithner (1): nvme: Discard workaround for non-conformant devices Eric Dumazet (10): dma-debug: add a schedule point in debug_dma_dump_mappings() 6pack,mkiss: fix possible deadlock netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() inetpeer: fix data-race in inet_putpeer / inet_putpeer net: add a READ_ONCE() in skb_peek_tail() net: icmp: fix data-race in cmp_global_allow() hrtimer: Annotate lockless access to timer->state tcp/dccp: fix possible race __inet_lookup_established() tcp: do not send empty skb from tcp_write_xmit() net: add annotations on hh->hh_len lockless accesses Erkka Talvitie (1): USB: EHCI: Do not return -EPIPE when hub is disconnected Eugeniu Rosca (1): mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests Evan Green (1): Input: atmel_mxt_ts - disable IRQ across suspend Ezequiel Garcia (1): iommu: rockchip: Free domain on .domain_free Faiz Abbas (2): Revert "mmc: sdhci: Fix incorrect switch to HS mode" mmc: sdhci: Update the tuning failed messages to pr_debug level Filipe Manana (2): Btrfs: fix missing data checksums after replaying a log tree Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues Finn Thain (2): scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE scsi: NCR5380: Add disconnect_mask module parameter Florian Fainelli (6): irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys() ata: ahci_brcm: Fix AHCI resources management ata: ahci_brcm: Allow optional reset controller to be used ata: ahci_brcm: Add missing clock management during recovery ata: ahci_brcm: BCM7425 AHCI requires AHCI_HFLAG_DELAY_ENGINE Florian Westphal (2): netfilter: ebtables: compat: reject all padding in matches/watchers selftests: rtnetlink: add addresses with fixed life time Geert Uytterhoeven (5): net: dst: Force 4-byte alignment of dst_metrics pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B clocksource/drivers/timer-of: Use unique device name instead of timer iio: adc: max9611: Fix too short conversion time delay dt-bindings: clock: renesas: rcar-usb2-clock-sel: Fix typo in example Gerald Schaefer (1): s390/mm: add mm_pxd_folded() checks to pxd_free() Greg Kroah-Hartman (4): Linux 4.19.92 Revert "powerpc/vcpu: Assume dedicated processors as non-preempt" Linux 4.19.93 Linux 4.19.94 Grygorii Strashko (2): net: phy: dp83867: enable robust auto-mdix net: ethernet: ti: ale: clean ale tbl on init and intf restart Guchun Chen (1): drm/amdgpu: add check before enabling/disabling broadcast mode Guenter Roeck (1): usb: xhci: Fix build warning seen with CONFIG_PM=n Guido Günther (1): leds: lm3692x: Handle failure to probe the regulator Guoqing Jiang (1): md/bitmap: avoid race window between md_bitmap_resize and bitmap_file_clear_bit Gustavo L. F. Walbon (1): powerpc/security: Fix wrong message when RFI Flush is disable Hangbin Liu (8): net: add bool confirm_neigh parameter for dst_ops.update_pmtu ip6_gre: do not confirm neighbor when do pmtu update gtp: do not confirm neighbor when do pmtu update net/dst: add new function skb_dst_update_pmtu_no_confirm tunnel: do not confirm neighbor when do pmtu update vti: do not confirm neighbor when do pmtu update sit: do not confirm neighbor when do pmtu update net/dst: do not confirm neighbor for vxlan and geneve pmtu update Hans Verkuil (5): media: cec-funcs.h: add status_req checks media: pulse8-cec: fix lost cec_transmit_attempt_done() call media: cec: CEC 2.0-only bcast messages were ignored media: cec: avoid decrementing transmit_queue_sz if it is 0 media: cec: check 'transmit_in_progress', not 'transmitting' Hans de Goede (6): ACPI: button: Add DMI quirk for Medion Akoya E2215T ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012 2-in-1 platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes HID: logitech-hidpp: Silence intermittent get_battery_capacity errors pinctrl: baytrail: Really serialize all register accesses drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit Harald Freudenberger (1): s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR Hawking Zhang (1): drm/amdgpu: disallow direct upload save restore list from gfx driver Heiko Carstens (2): s390/time: ensure get_clock_monotonic() returns monotonic values s390/smp: fix physical to logical CPU map for SMT Herbert Xu (2): crypto: atmel - Fix authenc support when it is set to m crypto: sun4i-ss - Fix 64-bit size_t warnings Hewenliang (1): libtraceevent: Fix memory leakage in copy_filter_type Hui Wang (1): ALSA: usb-audio: set the interface format after resume on Dell WD19 Ian Abbott (1): staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value Ian Rogers (2): perf tools: Splice events onto evlist even on error perf parse: If pmu configuration fails free terms Ido Schimmel (1): selftests: forwarding: Delete IPv6 address at the end Ilya Leoshkevich (1): s390/disassembler: don't hide instruction addresses Imre Deak (1): drm/mst: Fix MST sideband up-reply failure handling Ingo Rohloff (1): usb: usbfs: Suppress problematic bind and unbind uevents. Ivan Khoronzhuk (1): selftests/bpf: Correct path to include msg + path James Clark (1): libsubcmd: Use -O0 with DEBUG=1 James Smart (7): scsi: lpfc: Fix discovery failures when target device connectivity bounces scsi: lpfc: Fix locking on mailbox command completion scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences nvme_fc: add module to ops template to allow module references nvme-fc: fix double-free scenarios on hw queues Jan H. Schönherr (1): x86/mce: Fix possibly incorrect severity calculation on AMD Jan Kara (3): jbd2: Fix statistics for the number of logged blocks bdev: Factor out bdev revalidation into a common helper bdev: Refresh bdev size for disks without partitioning Janusz Krzysztofik (3): media: ov6650: Fix crop rectangle alignment not passed back media: ov6650: Fix stored frame format not in sync with hardware media: ov6650: Fix stored crop rectangle not in sync with hardware Jaroslav Kysela (1): ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen Jason Gunthorpe (1): xen/gntdev: Use select for DMA_SHARED_BUFFER Jeffrey Hugo (1): clk: qcom: Allow constant ratio freq tables for rcg Jens Axboe (1): net: make socket read/write_iter() honor IOCB_NOWAIT Jia-Ju Bai (1): net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive() Jiangfeng Xiao (1): net: hisilicon: Fix a BUG trigered by wrong bytes_compl Jin Yao (1): perf report: Add warning when libunwind not compiled in Jinke Fan (1): HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse Johan Hovold (1): ALSA: usb-audio: fix set_format altsetting sanity check Johannes Berg (1): iwlwifi: check kasprintf() return value Johannes Weiner (1): kernel: sysctl: make drop_caches write-only John Garry (1): libata: Ensure ata_port probe has completed before detach John Johansen (1): apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock Josef Bacik (6): btrfs: don't double lock the subvol_sem for rename exchange btrfs: do not call synchronize_srcu() in inode_tree_del btrfs: abort transaction after failed inode updates in create_subvol btrfs: skip log replay on orphaned roots btrfs: do not leak reloc root if we fail to read the fs root btrfs: handle ENOENT in btrfs_uuid_tree_iterate Juergen Gross (1): xen/balloon: fix ballooned page accounting without hotplug enabled Kai-Heng Feng (1): HID: i2c-hid: Reset ALPS touchpads on resume Kailang Yang (2): ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker ALSA: hda/realtek - Add headset Mic no shutup for ALC283 Kangjie Lu (1): drm/gma500: fix memory disclosures due to uninitialized bytes Keita Suzuki (1): tracing: Avoid memory leak in process_system_preds() Kevin Hao (1): watchdog: Fix the race between the release of watchdog_core_data and cdev Konstantin Khlebnikov (2): x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long Krzysztof Wilczynski (1): iio: light: bh1750: Resolve compiler warning and make code more readable Laurent Pinchart (1): drm/panel: Add missing drm_panel_init() in panel drivers Leo Yan (3): perf test: Report failure for mmap events perf tests: Disable bp_signal testing for arm64 tty: serial: msm_serial: Fix lockup for sysrq and oops Leonard Crestez (4): PM / devfreq: Fix devfreq_notifier_call returning errno PM / devfreq: Set scaling_max_freq to max on OPP notifier error PM / devfreq: Don't fail devfreq_dev_release if not in list PM / devfreq: Check NULL governor in available_governors_show Lianbo Jiang (1): x86/crash: Add a forward declaration of struct kimage Lingling Xu (1): spi: sprd: adi: Add missing lock protection when rebooting Loic Poulain (1): media: venus: core: Fix msm8996 frequency table Lucas Stach (1): nvmem: imx-ocotp: reset error status on probe Luiz Augusto von Dentz (1): Bluetooth: Fix advertising duplicated flags Lukas Wunner (1): dmaengine: Fix access to uninitialized dma_slave_caps Lukasz Majewski (1): spi: Add call to spi_slave_abort() function when spidev driver is released Mahesh Bandewar (1): bonding: fix active-backup transition after link failure Manish Chopra (3): qede: Disable hardware gro when xdp prog is installed qede: Fix multicast mac configuration bnx2x: Fix PF-VF communication over multi-cos queues. Manjunath Patil (1): ixgbe: protect TX timestamping from API misuse Mao Wenan (1): net: dsa: LAN9303: select REGMAP when LAN9303 enable Maor Gottlieb (1): IB/mlx5: Fix steering rule of drop and count Marc Dionne (1): afs: Fix afs_find_server lookups for ipv4 peers Marcel Holtmann (1): rfkill: allocate static minor Marco Oliverio (1): netfilter: nf_queue: enqueue skbs with NULL dst Martin Blumenstingl (1): net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs Masahiro Yamada (2): scripts/kallsyms: fix definitely-lost memory leak libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h Masami Hiramatsu (14): perf probe: Fix to find range-only function instance perf probe: Fix to list probe event with correct line number perf probe: Walk function lines in lexical blocks perf probe: Fix to probe an inline function which has no entry pc perf probe: Fix to show ranges of variables in functions without entry_pc perf probe: Fix to show inlined function callsite without entry_pc perf probe: Fix to probe a function which has no entry pc perf probe: Skip overlapped location on searching variables perf probe: Return a better scope DIE if there is no best scope perf probe: Fix to show calling lines of inlined functions perf probe: Skip end-of-sequence and non statement lines perf probe: Filter out instances except for inlined subroutine and subprogram tracing/kprobe: Check whether the non-suffixed symbol is notrace perf probe: Fix to show function entry line as probe-able Masashi Honma (2): ath9k_htc: Modify byte order for an error message ath9k_htc: Discard undersized packets Mathieu Desnoyers (1): rseq/selftests: Fix: Namespace gettid() for compatibility with glibc 2.30 Matthew Bobrowski (1): ext4: iomap that extends beyond EOF should be marked dirty Matthias Kaehlcke (1): drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C controller Mattijs Korpershoek (1): Bluetooth: hci_core: fix init for HCI_USER_CHANNEL Maurizio Lombardi (1): scsi: scsi_debug: num_tgts must be >= 0 Max Gurtovoy (1): IB/iser: bound protection_sg size by data_sg size Miaoqing Pan (1): ath10k: fix get invalid tx rate for Mesh metric Michael Ellerman (3): crypto: vmx - Avoid weird build failures powerpc/pseries: Mark accumulate_stolen_time() as notrace powerpc/tools: Don't quote $objdump in scripts Michael Haener (1): platform/x86: pmc_atom: Add Siemens CONNECT X300 to critclk_systems DMI table Michael Hennerich (1): clk: clk-gpio: propagate rate change to parent Michael Roth (1): KVM: PPC: Book3S HV: use smp_mb() when setting/clearing host_ipi flag Michael Walle (1): ASoC: wm8904: fix regcache handling Michal Kalderon (1): RDMA/qedr: Fix memory leak in user qp and mr Mike Isely (1): media: pvrusb2: Fix oops on tear-down when radio support is not present Mike Rapoport (2): mips: fix build when "48 bits virtual memory" is enabled userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK Miquel Raynal (1): iio: adc: max1027: Reset the device at probe time Mitch Williams (1): ice: delay less Nathan Chancellor (2): tools/power/cpupower: Fix initializer override in hsw_ext_cstates powerpc: Don't add -mabi= flags when building with Clang Navid Emamdoost (3): net: gemini: Fix memory leak in gmac_setup_txqs staging: rtl8192u: fix multiple memory leaks on error path Bluetooth: Fix memory leak in hci_connect_le_scan Netanel Belgazal (1): net: ena: fix napi handler misbehavior when the napi budget is zero Nicholas Graumann (1): dmaengine: xilinx_dma: Clear desc_pendingcount in xilinx_dma_reset Nicholas Nunley (1): i40e: initialize ITRN registers with correct values Oliver Neukum (1): Bluetooth: btusb: fix PM leak in error case of setup Omar Sandoval (5): btrfs: don't prematurely free work in end_workqueue_fn() btrfs: don't prematurely free work in run_ordered_work() btrfs: don't prematurely free work in reada_start_machine_worker() btrfs: don't prematurely free work in scrub_missing_raid56_worker() xfs: don't check for AG deadlock for realtime files in bunmapi Pan Bian (2): spi: img-spfi: fix potential double release drm/amdgpu: fix potential double drop fence reference Parav Pandit (1): IB/mlx4: Follow mirror sequence of device add during device removal Paul Burton (1): MIPS: Avoid VDSO ABI breakage due to global register variable Paul Cercueil (1): irqchip: ingenic: Error out if IRQ domain creation failed Paul Durrant (1): xen-blkback: prevent premature module unload Petar Penkov (1): tun: fix data-race in gro_normal_list() Phil Sutter (1): netfilter: nft_tproxy: Fix port selector on Big Endian Pierre-Eric Pelloux-Prayer (1): drm/amdgpu: add cache flush workaround to gfx8 emit_fence Pierre-Louis Bossart (1): soundwire: intel: fix PDI/stream mapping for Bulk Ping-Ke Shih (1): rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt() Prateek Sood (1): tracing: Fix lock inversion in trace_event_enable_tgid_record() Qian Cai (1): libnvdimm/btt: fix variable 'rc' set but not used Rafael J. Wysocki (1): cpufreq: Avoid leaving stale IRQ work items during CPU offline Rafał Miłecki (1): brcmfmac: remove monitor interface when detaching Rasmus Villemoes (1): mmc: sdhci-of-esdhc: Revert "mmc: sdhci-of-esdhc: add erratum A-009204 support" Robert Jarzmik (1): clk: pxa: fix one of the pxa RTC clocks Robert Richter (1): EDAC/ghes: Fix grain calculation Rodrigo Siqueira (1): drm/drm_vblank: Change EINVAL by the correct errno Roman Bolshakov (6): scsi: qla2xxx: Drop superfluous INIT_WORK of del_work scsi: qla2xxx: Don't call qlt_async_event twice scsi: qla2xxx: Fix PLOGI payload and ELS IOCB dump length scsi: qla2xxx: Configure local loop for N2N target scsi: qla2xxx: Send Notify ACK after N2N PLOGI scsi: qla2xxx: Ignore PORT UPDATE after N2N PLOGI Russell King (4): mod_devicetable: fix PHY module format net: phy: initialise phydev speed and duplex sanely net: marvell: mvpp2: phylink requires the link interrupt gpiolib: fix up emulated open drain outputs Sakari Ailus (1): media: smiapp: Register sensor after enabling runtime PM on the device Sam Bobroff (1): drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2 Sami Tolvanen (2): syscalls/x86: Use the correct function type in SYSCALL_DEFINE0 x86/mm: Use the correct function type for native_set_fixmap() Sascha Hauer (1): libata: Fix retrieving of active qcs Scott Mayhew (1): nfsd4: fix up replay_matches_cache() Sean Paul (1): drm: mst: Fix query_payload ack reply struct SeongJae Park (1): xen/blkback: Avoid unmapping unmapped grant pages Shakeel Butt (1): memcg: account security cred as well to kmemcg Song Liu (1): bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack() Sreekanth Reddy (1): scsi: mpt3sas: Fix clear pending bit in ioctl status Srikar Dronamraju (1): powerpc/vcpu: Assume dedicated processors as non-preempt Stanimir Varbanov (1): media: venus: Fix occasionally failures to suspend Stefan Mavrodiev (1): drm/sun4i: hdmi: Remove duplicate cleanup calls Stefan Popa (1): iio: dac: ad5446: Add support for new AD5600 DAC Stefano Garzarella (1): vhost/vsock: accept only packets with the right dst_cid Stephan Gerhold (3): extcon: sm5502: Reset registers during initialization phy: qcom-usb-hs: Fix extcon double register after power cycle regulator: ab8500: Remove AB8505 USB regulator Steve Wise (1): rxe: correctly calculate iCRC for unaligned payloads Steven Rostedt (VMware) (1): tracing: Have the histogram compare functions convert to u64 first Subhash Jadavani (1): scsi: ufs: Fix error handing during hibern8 enter Sudip Mukherjee (1): parport: load lowlevel driver if ports not found Suwan Kim (2): usbip: Fix receive error in vhci-hcd when using scatter-gather usbip: Fix error path of vhci_recv_ret_submit() Sven Schnelle (2): s390/ftrace: fix endless recursion in function_graph tracer tracing: Fix endianness bug in histogram trigger Szymon Janc (1): Bluetooth: Workaround directed advertising bug in Broadcom controllers Taehee Yoo (5): gtp: do not allow adding duplicate tid and ms_addr pdp context gtp: fix wrong condition in gtp_genl_dump_pdp() gtp: fix an use-after-free in ipv4_pdp_find() gtp: avoid zero size hashtable net: core: limit nested device depth Takashi Iwai (8): ALSA: pcm: Avoid possible info leaks from PCM stream buffers ALSA: hda/ca0132 - Keep power on during processing DSP response ALSA: hda/ca0132 - Avoid endless loop ALSA: hda/ca0132 - Fix work handling in delayed HP detection ALSA: timer: Limit max amount of slave instances ALSA: hda - Downgrade error message for single-cmd fallback ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code ALSA: firewire-motu: Correct a typo in the clock proc string Thierry Reding (3): drm/tegra: sor: Use correct SOR index on Tegra210 gpu: host1x: Allocate gather copy for host1x iommu/tegra-smmu: Fix page tables in > 4 GiB memory Thomas Gleixner (1): x86/ioapic: Prevent inconsistent state when moving an interrupt Thomas Pedersen (1): mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED Thomas Richter (3): s390/cpum_sf: Check for SDBT and SDB consistency s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits s390/cpum_sf: Avoid SBD overflow condition in irq handler Toke Høiland-Jørgensen (1): libbpf: Fix error handling in bpf_map__reuse_fd() Tony Lindgren (1): hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled Tyrel Datwyler (4): PCI: rpaphp: Fix up pointer to first drc-info entry PCI: rpaphp: Don't rely on firmware feature to imply drc-info support PCI: rpaphp: Annotate and correctly byte swap DRC properties PCI: rpaphp: Correctly match ibm, my-drc-index to drc-name when using drc-info Vandana BN (1): media: v4l2-core: fix touch support in v4l_g_fmt Veerabhadrarao Badiganti (1): mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG register Veeraiyan Chidambaram (1): usb: renesas_usbhs: add suspend event support in gadget mode Viresh Kumar (1): cpufreq: Register drivers only after CPU devices have been registered Vladimir Oltean (1): gpio: mpc8xxx: Don't overwrite default irq_set_type callback Vladis Dronov (1): ptp: fix the race between the release of ptp_clock and cdev Vladyslav Tarasiuk (1): net/mlxfw: Fix out-of-memory error in mfa2 flash burning Wang Xuerui (1): iwlwifi: mvm: fix unaligned read of rx_pkt_status Wen Yang (1): ftrace: Avoid potential division by zero in function profiler Will Deacon (2): pinctrl: devicetree: Avoid taking direct reference to device name string KVM: arm64: Ensure 'params' is initialised when looking up sys register Xiang Chen (1): scsi: hisi_sas: Replace in_softirq() check in hisi_sas_task_exec() Xiaolong Huang (1): can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices Xin Long (1): sctp: fully initialize v4 addr in some functions Yang Shi (1): mm: move_pages: return valid node id in status if the page is already on the target node Yang Yingliang (1): media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init() Yangbo Lu (1): mmc: sdhci-of-esdhc: fix P2020 errata handling Yazen Ghannam (1): x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] Yizhuo (1): regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe() Yu-Hsuan Hsu (1): ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format constraint Yuming Han (1): tracing: use kvcalloc for tgid_map array allocation Yunfeng Ye (3): arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() perf jevents: Fix resource leak in process_mapfile() and main() ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100 Zhihao Cheng (1): ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps Zhiqiang Liu (1): md: raid1: check rdev before reference in raid1_sync_request func Zong Li (1): riscv: ftrace: correct the condition logic in function graph tracer chenqiwu (1): exit: panic before exit_mm() on global init exit peter chang (1): scsi: pm80xx: Fix for SATA device discovery Documentation/admin-guide/kernel-parameters.txt | 2 +- .../bindings/clock/renesas,rcar-usb2-clock-sel.txt | 2 +- Makefile | 2 +- arch/arm/boot/compressed/libfdt_env.h | 4 +- arch/arm/mm/proc-v7-bugs.c | 3 + .../arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 4 +- arch/arm64/include/asm/pgtable-prot.h | 5 +- arch/arm64/include/asm/pgtable.h | 10 +- arch/arm64/kernel/psci.c | 15 +- arch/arm64/kvm/sys_regs.c | 5 +- arch/arm64/mm/fault.c | 2 +- arch/mips/include/asm/pgtable-64.h | 9 +- arch/mips/include/asm/thread_info.h | 20 +- arch/powerpc/Makefile | 4 + arch/powerpc/boot/libfdt_env.h | 2 + arch/powerpc/include/asm/kvm_ppc.h | 100 +++++++- arch/powerpc/kernel/dbell.c | 6 +- arch/powerpc/kernel/irq.c | 4 +- arch/powerpc/kernel/security.c | 21 +- arch/powerpc/kernel/time.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +- arch/powerpc/mm/hash_utils_64.c | 10 +- arch/powerpc/platforms/powernv/smp.c | 2 +- arch/powerpc/platforms/pseries/cmm.c | 5 + arch/powerpc/platforms/pseries/hvconsole.c | 2 +- arch/powerpc/sysdev/xics/icp-native.c | 6 +- arch/powerpc/sysdev/xics/icp-opal.c | 6 +- arch/powerpc/tools/relocs_check.sh | 2 +- arch/powerpc/tools/unrel_branch_check.sh | 4 +- arch/riscv/kernel/ftrace.c | 2 +- arch/s390/include/asm/pgalloc.h | 16 +- arch/s390/include/asm/timex.h | 16 +- arch/s390/kernel/dis.c | 13 +- arch/s390/kernel/perf_cpum_sf.c | 39 ++- arch/s390/kernel/smp.c | 80 ++++-- arch/sh/include/cpu-sh4/cpu/sh7734.h | 2 +- arch/x86/events/intel/bts.c | 16 +- arch/x86/include/asm/crash.h | 2 + arch/x86/include/asm/fixmap.h | 2 +- arch/x86/include/asm/syscall_wrapper.h | 23 +- arch/x86/kernel/apic/io_apic.c | 9 +- arch/x86/kernel/cpu/mce/amd.c | 4 +- arch/x86/kernel/cpu/mce/core.c | 2 +- arch/x86/kernel/cpu/mce/therm_throt.c | 2 +- arch/x86/lib/x86-opcode-map.txt | 18 +- arch/x86/mm/pgtable.c | 4 +- block/compat_ioctl.c | 11 + drivers/acpi/button.c | 11 + drivers/acpi/sysfs.c | 6 +- drivers/ata/ahci_brcm.c | 140 ++++++++--- drivers/ata/libahci_platform.c | 6 +- drivers/ata/libata-core.c | 27 ++ drivers/ata/sata_fsl.c | 2 +- drivers/ata/sata_mv.c | 2 +- drivers/ata/sata_nv.c | 2 +- drivers/block/loop.c | 26 +- drivers/block/xen-blkback/blkback.c | 2 + drivers/block/xen-blkback/xenbus.c | 10 + drivers/bluetooth/btusb.c | 3 +- drivers/cdrom/cdrom.c | 12 +- drivers/char/hw_random/omap3-rom-rng.c | 3 +- drivers/char/ipmi/ipmi_msghandler.c | 23 +- drivers/clk/clk-gpio.c | 2 +- drivers/clk/pxa/clk-pxa27x.c | 1 + drivers/clk/qcom/clk-rcg2.c | 2 + drivers/clk/qcom/common.c | 3 + drivers/clocksource/asm9260_timer.c | 4 + drivers/clocksource/timer-of.c | 2 +- drivers/cpufreq/cpufreq.c | 7 + drivers/crypto/atmel-aes.c | 18 +- drivers/crypto/atmel-authenc.h | 2 +- drivers/crypto/atmel-sha.c | 2 +- drivers/crypto/sunxi-ss/sun4i-ss-cipher.c | 22 +- drivers/crypto/sunxi-ss/sun4i-ss-hash.c | 12 +- drivers/crypto/virtio/virtio_crypto_algs.c | 12 +- drivers/crypto/vmx/Makefile | 6 +- drivers/devfreq/devfreq.c | 30 +-- drivers/dma/xilinx/xilinx_dma.c | 1 + drivers/edac/ghes_edac.c | 10 +- drivers/extcon/extcon-sm5502.c | 4 + drivers/extcon/extcon-sm5502.h | 2 + drivers/firewire/net.c | 6 +- drivers/fsi/fsi-core.c | 31 ++- drivers/gpio/gpio-mpc8xxx.c | 3 +- drivers/gpio/gpiolib.c | 8 + drivers/gpu/drm/amd/amdgpu/amdgpu_test.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 12 +- drivers/gpu/drm/amd/amdgpu/df_v3_6.c | 38 +-- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 22 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 +- drivers/gpu/drm/amd/amdgpu/si_ih.c | 3 +- drivers/gpu/drm/amd/display/dc/core/dc_link.c | 4 +- drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 1 + drivers/gpu/drm/bridge/analogix-anx78xx.c | 8 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 12 +- drivers/gpu/drm/drm_dp_mst_topology.c | 6 +- drivers/gpu/drm/drm_property.c | 2 +- drivers/gpu/drm/drm_vblank.c | 6 +- drivers/gpu/drm/gma500/oaktrail_crtc.c | 2 + drivers/gpu/drm/msm/msm_gpu.c | 1 + drivers/gpu/drm/nouveau/nouveau_connector.h | 110 ++++----- .../gpu/drm/panel/panel-raspberrypi-touchscreen.c | 1 + drivers/gpu/drm/panel/panel-sitronix-st7789v.c | 1 + drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 - drivers/gpu/drm/tegra/sor.c | 5 + drivers/gpu/host1x/job.c | 11 +- drivers/hid/hid-core.c | 4 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-hidpp.c | 3 + drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-rmi.c | 3 +- drivers/hid/i2c-hid/i2c-hid-core.c | 12 +- drivers/hwtracing/intel_th/pci.c | 10 + drivers/iio/adc/dln2-adc.c | 20 +- drivers/iio/adc/max1027.c | 8 + drivers/iio/adc/max9611.c | 16 +- drivers/iio/dac/Kconfig | 4 +- drivers/iio/dac/ad5446.c | 6 + drivers/iio/light/bh1750.c | 4 +- drivers/infiniband/core/cma.c | 1 + drivers/infiniband/hw/mlx4/main.c | 9 +- drivers/infiniband/hw/mlx5/main.c | 13 +- drivers/infiniband/hw/qedr/verbs.c | 12 +- drivers/infiniband/sw/rxe/rxe_recv.c | 2 +- drivers/infiniband/sw/rxe/rxe_req.c | 6 + drivers/infiniband/sw/rxe/rxe_resp.c | 7 + drivers/infiniband/ulp/iser/iscsi_iser.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 4 + drivers/iommu/rockchip-iommu.c | 7 +- drivers/iommu/tegra-smmu.c | 11 +- drivers/irqchip/irq-bcm7038-l1.c | 4 + drivers/irqchip/irq-ingenic.c | 15 +- drivers/leds/leds-lm3692x.c | 13 +- drivers/mailbox/imx-mailbox.c | 4 +- drivers/md/bcache/alloc.c | 5 +- drivers/md/bcache/bcache.h | 2 +- drivers/md/bcache/btree.c | 2 + drivers/md/bcache/super.c | 51 ++-- drivers/md/md-bitmap.c | 2 +- drivers/md/raid1.c | 2 +- drivers/media/cec/cec-adap.c | 40 ++- drivers/media/i2c/ov2659.c | 18 +- drivers/media/i2c/ov6650.c | 42 ++-- drivers/media/i2c/smiapp/smiapp-core.c | 12 +- drivers/media/pci/cx88/cx88-video.c | 11 +- drivers/media/platform/am437x/am437x-vpfe.c | 4 + drivers/media/platform/qcom/venus/core.c | 9 +- drivers/media/platform/qcom/venus/hfi_venus.c | 6 + drivers/media/platform/ti-vpe/vpdma.h | 1 + drivers/media/platform/ti-vpe/vpe.c | 52 ++-- drivers/media/radio/si470x/radio-si470x-i2c.c | 2 + drivers/media/usb/b2c2/flexcop-usb.c | 10 +- drivers/media/usb/pulse8-cec/pulse8-cec.c | 17 +- drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 9 +- drivers/media/v4l2-core/v4l2-ioctl.c | 33 +-- drivers/mmc/host/mtk-sd.c | 2 + drivers/mmc/host/sdhci-msm.c | 28 ++- drivers/mmc/host/sdhci-of-esdhc.c | 7 +- drivers/mmc/host/sdhci-pci-core.c | 10 +- drivers/mmc/host/sdhci.c | 11 +- drivers/mmc/host/sdhci.h | 2 + drivers/mmc/host/tmio_mmc_core.c | 2 +- drivers/net/bonding/bond_main.c | 3 - drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 6 +- drivers/net/dsa/Kconfig | 1 + drivers/net/ethernet/amazon/ena/ena_netdev.c | 10 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 16 +- drivers/net/ethernet/cortina/gemini.c | 2 + drivers/net/ethernet/hisilicon/hip04_eth.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 10 +- drivers/net/ethernet/intel/ice/ice_controlq.c | 2 +- drivers/net/ethernet/intel/ice/ice_controlq.h | 5 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +- drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c | 7 +- drivers/net/ethernet/qlogic/qede/qede_filter.c | 2 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 4 +- drivers/net/ethernet/qlogic/qla3xxx.c | 8 +- .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 14 +- drivers/net/ethernet/ti/cpsw_ale.c | 2 + drivers/net/fjes/fjes_main.c | 3 + drivers/net/gtp.c | 111 +++++---- drivers/net/hamradio/6pack.c | 4 +- drivers/net/hamradio/mkiss.c | 4 +- drivers/net/phy/dp83867.c | 15 +- drivers/net/phy/phy_device.c | 4 +- drivers/net/tun.c | 4 +- drivers/net/usb/lan78xx.c | 1 + drivers/net/wireless/ath/ath10k/coredump.c | 11 +- drivers/net/wireless/ath/ath10k/mac.c | 26 +- drivers/net/wireless/ath/ath10k/txrx.c | 2 + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 23 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 5 + drivers/net/wireless/intel/iwlwifi/dvm/led.c | 3 + drivers/net/wireless/intel/iwlwifi/mvm/led.c | 3 + drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 3 +- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 1 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c | 1 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 3 + .../net/wireless/realtek/rtlwifi/rtl8192cu/hw.c | 2 + drivers/nvdimm/btt.c | 8 +- drivers/nvme/host/core.c | 12 +- drivers/nvme/host/fc.c | 32 ++- drivers/nvme/target/fcloop.c | 1 + drivers/nvmem/imx-ocotp.c | 4 + drivers/parport/share.c | 21 ++ drivers/pci/hotplug/rpaphp_core.c | 38 +-- drivers/phy/qualcomm/phy-qcom-usb-hs.c | 7 +- drivers/pinctrl/devicetree.c | 25 +- drivers/pinctrl/intel/pinctrl-baytrail.c | 81 +++--- drivers/pinctrl/pinctrl-amd.c | 3 +- drivers/pinctrl/sh-pfc/pfc-sh7734.c | 4 +- drivers/platform/x86/hp-wmi.c | 2 +- drivers/platform/x86/pmc_atom.c | 8 + drivers/ptp/ptp_clock.c | 31 ++- drivers/ptp/ptp_private.h | 2 +- drivers/regulator/ab8500.c | 17 -- drivers/regulator/max8907-regulator.c | 15 +- drivers/s390/crypto/zcrypt_error.h | 2 + drivers/scsi/NCR5380.c | 6 +- drivers/scsi/atari_scsi.c | 6 +- drivers/scsi/csiostor/csio_lnode.c | 15 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +- drivers/scsi/iscsi_tcp.c | 8 + drivers/scsi/lpfc/lpfc_bsg.c | 15 +- drivers/scsi/lpfc/lpfc_els.c | 2 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 7 +- drivers/scsi/lpfc/lpfc_nportdisc.c | 4 +- drivers/scsi/lpfc/lpfc_nvme.c | 2 + drivers/scsi/lpfc/lpfc_sli.c | 15 +- drivers/scsi/mac_scsi.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_ctl.c | 3 +- drivers/scsi/pm8001/pm80xx_hwi.c | 2 + drivers/scsi/qedf/qedf_els.c | 16 +- drivers/scsi/qla2xxx/qla_init.c | 10 +- drivers/scsi/qla2xxx/qla_iocb.c | 6 +- drivers/scsi/qla2xxx/qla_isr.c | 4 - drivers/scsi/qla2xxx/qla_mbx.c | 3 +- drivers/scsi/qla2xxx/qla_nvme.c | 1 + drivers/scsi/qla2xxx/qla_target.c | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 1 - drivers/scsi/scsi_debug.c | 5 + drivers/scsi/scsi_trace.c | 11 +- drivers/scsi/sun3_scsi.c | 4 +- drivers/scsi/ufs/ufshcd.c | 21 +- drivers/soundwire/intel.c | 10 +- drivers/spi/spi-fsl-spi.c | 7 +- drivers/spi/spi-img-spfi.c | 2 + drivers/spi/spi-pxa2xx.c | 6 + drivers/spi/spi-sprd-adi.c | 3 + drivers/spi/spi-st-ssc4.c | 3 + drivers/spi/spi-tegra20-slink.c | 5 +- drivers/spi/spidev.c | 3 + drivers/staging/comedi/drivers/gsc_hpdi.c | 10 + drivers/staging/fbtft/fbtft-core.c | 2 +- drivers/staging/rtl8188eu/core/rtw_xmit.c | 4 +- drivers/staging/rtl8192u/r8192U_core.c | 17 +- drivers/target/iscsi/iscsi_target.c | 10 +- drivers/target/iscsi/iscsi_target_auth.c | 2 +- drivers/tty/hvc/hvc_vio.c | 16 +- drivers/tty/serial/atmel_serial.c | 43 ++-- drivers/tty/serial/msm_serial.c | 13 +- drivers/usb/core/devio.c | 15 +- drivers/usb/gadget/function/f_ecm.c | 6 +- drivers/usb/gadget/function/f_rndis.c | 1 + drivers/usb/host/ehci-q.c | 13 +- drivers/usb/host/xhci-pci.c | 2 +- drivers/usb/renesas_usbhs/common.h | 3 +- drivers/usb/renesas_usbhs/mod_gadget.c | 12 +- drivers/usb/usbip/usbip_common.c | 3 + drivers/usb/usbip/vhci_rx.c | 13 +- drivers/vhost/vsock.c | 4 +- drivers/watchdog/watchdog_dev.c | 70 +++--- drivers/xen/Kconfig | 3 +- drivers/xen/balloon.c | 3 +- fs/afs/dynroot.c | 3 + fs/afs/server.c | 21 +- fs/afs/super.c | 1 - fs/block_dev.c | 37 +-- fs/btrfs/async-thread.c | 56 ++++- fs/btrfs/ctree.c | 2 +- fs/btrfs/ctree.h | 2 +- fs/btrfs/disk-io.c | 2 +- fs/btrfs/extent-tree.c | 7 +- fs/btrfs/extent_io.c | 6 +- fs/btrfs/file-item.c | 7 +- fs/btrfs/inode.c | 12 +- fs/btrfs/ioctl.c | 10 +- fs/btrfs/reada.c | 10 +- fs/btrfs/relocation.c | 1 + fs/btrfs/scrub.c | 3 +- fs/btrfs/send.c | 6 - fs/btrfs/tests/free-space-tree-tests.c | 4 +- fs/btrfs/tests/qgroup-tests.c | 4 +- fs/btrfs/tree-log.c | 52 +++- fs/btrfs/uuid-tree.c | 2 + fs/compat_ioctl.c | 3 +- fs/ext4/inode.c | 12 +- fs/f2fs/f2fs.h | 23 +- fs/f2fs/inode.c | 6 +- fs/f2fs/namei.c | 15 +- fs/jbd2/commit.c | 4 +- fs/locks.c | 2 +- fs/nfsd/nfs4state.c | 15 +- fs/ocfs2/acl.c | 4 +- fs/pstore/ram.c | 11 + fs/quota/dquot.c | 29 ++- fs/ubifs/tnc_commit.c | 34 ++- fs/userfaultfd.c | 18 +- fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/scrub/common.h | 9 +- fs/xfs/xfs_log.c | 2 + include/drm/drm_dp_mst_helper.h | 2 +- include/linux/ahci_platform.h | 2 + include/linux/cpufreq.h | 11 - include/linux/dmaengine.h | 5 +- include/linux/hrtimer.h | 14 +- include/linux/ipmi_smi.h | 12 +- include/linux/libata.h | 1 + include/linux/libfdt_env.h | 3 + include/linux/miscdevice.h | 1 + include/linux/mod_devicetable.h | 4 +- include/linux/netdevice.h | 4 + include/linux/nvme-fc-driver.h | 4 + include/linux/posix-clock.h | 19 +- include/linux/quota.h | 2 +- include/linux/rculist_nulls.h | 37 +++ include/linux/regulator/ab8500.h | 1 - include/linux/sched/cpufreq.h | 3 + include/linux/skbuff.h | 6 +- include/net/dst.h | 15 +- include/net/dst_ops.h | 3 +- include/net/inet_hashtables.h | 12 +- include/net/neighbour.h | 2 +- include/net/sock.h | 5 + include/scsi/iscsi_proto.h | 1 + include/trace/events/wbt.h | 12 +- include/uapi/linux/cec-funcs.h | 6 +- kernel/bpf/stackmap.c | 7 +- kernel/cred.c | 6 +- kernel/dma/debug.c | 1 + kernel/exit.c | 12 +- kernel/power/snapshot.c | 9 +- kernel/sched/cpufreq.c | 18 ++ kernel/sched/cpufreq_schedutil.c | 8 +- kernel/sysctl.c | 2 +- kernel/taskstats.c | 30 ++- kernel/time/hrtimer.c | 11 +- kernel/time/posix-clock.c | 31 +-- kernel/trace/ftrace.c | 6 +- kernel/trace/trace.c | 10 +- kernel/trace/trace_events.c | 8 +- kernel/trace/trace_events_filter.c | 2 +- kernel/trace/trace_events_hist.c | 21 +- kernel/trace/trace_kprobe.c | 27 +- kernel/trace/tracing_map.c | 4 +- mm/migrate.c | 23 +- mm/mmap.c | 6 - mm/zsmalloc.c | 5 + net/bluetooth/hci_conn.c | 12 +- net/bluetooth/hci_core.c | 13 +- net/bluetooth/hci_request.c | 9 + net/bluetooth/l2cap_core.c | 4 +- net/bridge/br_netfilter_hooks.c | 3 + net/bridge/br_nf_core.c | 3 +- net/bridge/netfilter/ebtables.c | 33 ++- net/core/dev.c | 272 +++++++++++++++++---- net/core/neighbour.c | 4 +- net/core/sysctl_net_core.c | 2 + net/decnet/dn_route.c | 6 +- net/ethernet/eth.c | 7 +- net/ipv4/icmp.c | 11 +- net/ipv4/inet_connection_sock.c | 2 +- net/ipv4/inet_diag.c | 3 +- net/ipv4/inet_hashtables.c | 19 +- net/ipv4/inetpeer.c | 12 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ip_vti.c | 2 +- net/ipv4/route.c | 9 +- net/ipv4/tcp_ipv4.c | 7 +- net/ipv4/tcp_output.c | 11 + net/ipv4/udp.c | 2 +- net/ipv4/xfrm4_policy.c | 5 +- net/ipv6/inet6_connection_sock.c | 2 +- net/ipv6/inet6_hashtables.c | 3 +- net/ipv6/ip6_gre.c | 2 +- net/ipv6/ip6_tunnel.c | 4 +- net/ipv6/ip6_vti.c | 2 +- net/ipv6/route.c | 22 +- net/ipv6/sit.c | 2 +- net/ipv6/xfrm6_policy.c | 5 +- net/mac80211/status.c | 3 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_queue.c | 2 +- net/netfilter/nft_tproxy.c | 4 +- net/nfc/nci/uart.c | 2 +- net/rfkill/core.c | 9 +- net/rxrpc/peer_event.c | 3 + net/sctp/protocol.c | 5 + net/sctp/transport.c | 2 +- net/socket.c | 4 +- samples/pktgen/functions.sh | 17 +- scripts/kallsyms.c | 2 + security/apparmor/apparmorfs.c | 2 +- security/apparmor/domain.c | 82 ++++--- security/apparmor/label.c | 12 +- security/apparmor/policy.c | 4 +- sound/core/pcm_native.c | 4 + sound/core/timer.c | 10 + sound/firewire/motu/motu-proc.c | 2 +- sound/isa/cs423x/cs4236.c | 3 +- sound/pci/hda/hda_controller.c | 2 +- sound/pci/hda/patch_ca0132.c | 23 +- sound/pci/hda/patch_realtek.c | 61 ++++- sound/pci/ice1712/ice1724.c | 9 +- sound/soc/codecs/rt5677.c | 1 + sound/soc/codecs/wm2200.c | 5 + sound/soc/codecs/wm5100.c | 2 + sound/soc/codecs/wm8904.c | 1 + sound/soc/intel/boards/bytcr_rt5640.c | 10 +- .../soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 3 + sound/usb/card.h | 1 + sound/usb/pcm.c | 25 +- sound/usb/quirks-table.h | 3 +- sound/usb/quirks.c | 11 + sound/usb/usbaudio.h | 3 +- tools/lib/bpf/libbpf.c | 14 +- tools/lib/subcmd/Makefile | 4 +- tools/lib/traceevent/parse-filter.c | 9 +- tools/objtool/arch/x86/lib/x86-opcode-map.txt | 18 +- tools/perf/builtin-report.c | 7 + tools/perf/builtin-script.c | 2 +- tools/perf/pmu-events/jevents.c | 13 +- tools/perf/tests/bp_signal.c | 15 +- tools/perf/tests/task-exit.c | 1 + tools/perf/util/dwarf-aux.c | 80 ++++-- tools/perf/util/dwarf-aux.h | 3 + tools/perf/util/parse-events.c | 26 +- tools/perf/util/perf_regs.h | 2 +- tools/perf/util/probe-finder.c | 45 +++- .../cpupower/utils/idle_monitor/hsw_ext_idle.c | 1 - tools/testing/selftests/bpf/cgroup_helpers.c | 2 +- .../selftests/net/forwarding/router_bridge_vlan.sh | 2 +- tools/testing/selftests/net/rtnetlink.sh | 21 ++ tools/testing/selftests/rseq/param_test.c | 18 +- 445 files changed, 3473 insertions(+), 1466 deletions(-) -- 1.8.3

1 429

[PATCH] sock: fix potential memory leak in proto_register()
by Yang Yingliang 16 Jan '20

16 Jan '20

From: zhanglin <zhang.lin16(a)zte.com.cn> mainline inclusion from mainline-v5.3-rc7 commit b45ce32135d1c82a5bf12aa56957c3fd27956057 category: bugfix bugzilla: 20825 CVE: NA ------------------------------------- If protocols registered exceeded PROTO_INUSE_NR, prot will be added to proto_list, but no available bit left for prot in proto_inuse_idx. Changes since v2: * Propagate the error code properly Signed-off-by: zhanglin <zhang.lin16(a)zte.com.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: guodeqing <geffrey.guo(a)huawei.com> Reviewed-by: Wenan Mao <maowenan(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/core/sock.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/net/core/sock.c b/net/core/sock.c index f0b4657..910d0e0 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -3216,16 +3216,17 @@ static __init int net_inuse_init(void) core_initcall(net_inuse_init); -static void assign_proto_idx(struct proto *prot) +static int assign_proto_idx(struct proto *prot) { prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR); if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) { pr_err("PROTO_INUSE_NR exhausted\n"); - return; + return -ENOSPC; } set_bit(prot->inuse_idx, proto_inuse_idx); + return 0; } static void release_proto_idx(struct proto *prot) @@ -3234,8 +3235,9 @@ static void release_proto_idx(struct proto *prot) clear_bit(prot->inuse_idx, proto_inuse_idx); } #else -static inline void assign_proto_idx(struct proto *prot) +static inline int assign_proto_idx(struct proto *prot) { + return 0; } static inline void release_proto_idx(struct proto *prot) @@ -3284,6 +3286,8 @@ static int req_prot_init(const struct proto *prot) int proto_register(struct proto *prot, int alloc_slab) { + int ret = -ENOBUFS; + if (alloc_slab) { prot->slab = kmem_cache_create_usercopy(prot->name, prot->obj_size, 0, @@ -3320,20 +3324,27 @@ int proto_register(struct proto *prot, int alloc_slab) } mutex_lock(&proto_list_mutex); + ret = assign_proto_idx(prot); + if (ret) { + mutex_unlock(&proto_list_mutex); + goto out_free_timewait_sock_slab_name; + } list_add(&prot->node, &proto_list); - assign_proto_idx(prot); mutex_unlock(&proto_list_mutex); - return 0; + return ret; out_free_timewait_sock_slab_name: - kfree(prot->twsk_prot->twsk_slab_name); + if (alloc_slab && prot->twsk_prot) + kfree(prot->twsk_prot->twsk_slab_name); out_free_request_sock_slab: - req_prot_cleanup(prot->rsk_prot); + if (alloc_slab) { + req_prot_cleanup(prot->rsk_prot); - kmem_cache_destroy(prot->slab); - prot->slab = NULL; + kmem_cache_destroy(prot->slab); + prot->slab = NULL; + } out: - return -ENOBUFS; + return ret; } EXPORT_SYMBOL(proto_register); -- 1.8.3

1 0

2024

2023

2022

2021

2020

2019

Kernel