- Kernel - mailweb.openeuler.org

[openEuler-5.10 1/9] Revert "audit: bugfix for infinite loop when flush the hold queue"
by Zheng Zengkai 17 Mar '22

17 Mar '22

From: Cui GaoSheng <cuigaosheng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186383 https://gitee.com/openeuler/kernel/issues/I4X1AI?from=project-issue CVE: NA -------------------------------- This reverts commit fcfdde9cfc503cfd191b7286f9c48077fb5bf420. Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/audit.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 21be62bc8205..2a38cbaf3ddb 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -732,8 +732,6 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, if (!sk) { if (err_hook) (*err_hook)(skb); - if (queue == &audit_hold_queue) - goto out; continue; } @@ -750,8 +748,6 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, (*err_hook)(skb); if (rc == -EAGAIN) rc = 0; - if (queue == &audit_hold_queue) - goto out; /* continue to drain the queue */ continue; } else @@ -763,7 +759,6 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, } } -out: return (rc >= 0 ? 0 : rc); } -- 2.20.1

1 8

[PATCH openEuler-5.10] arm/arm64: paravirt: Remove GPL from pv_ops export
by Zheng Zengkai 15 Mar '22

15 Mar '22

From: Zengruan Ye <yezengruan(a)huawei.com> virt inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4VZPC CVE: NA -------------------------------- Commit 63042c58affc ("KVM: arm64: Add interface to support vCPU preempted check") introduced paravirt spinlock operations, as pv_lock_ops was exported via EXPORT_SYMBOL(), while the pv_ops structure containing the pv lock operations is exported via EXPORT_SYMBOL_GPL(). Change that by using EXPORT_SYMBOL(pv_ops) for arm/arm64, as with the x86 architecture changes, the following: https://lore.kernel.org/all/20181029150116.25372-1-jgross@suse.com/T/#u Fixes: 63042c58affc ("KVM: arm64: Add interface to support vCPU preempted check") Signed-off-by: yezengruan <yezengruan(a)huawei.com> Reviewed-by: Keqian Zhu <zhukeqian1(a)huawei.com> Acked-by: Xie Xiuqi <xiexiuqi(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/arm/kernel/paravirt.c | 2 +- arch/arm64/kernel/paravirt.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm/kernel/paravirt.c b/arch/arm/kernel/paravirt.c index 4cfed91fe256..3c34f456e400 100644 --- a/arch/arm/kernel/paravirt.c +++ b/arch/arm/kernel/paravirt.c @@ -15,4 +15,4 @@ struct static_key paravirt_steal_enabled; struct static_key paravirt_steal_rq_enabled; struct paravirt_patch_template pv_ops; -EXPORT_SYMBOL_GPL(pv_ops); +EXPORT_SYMBOL(pv_ops); diff --git a/arch/arm64/kernel/paravirt.c b/arch/arm64/kernel/paravirt.c index 847b3c8b1218..ecbd2bf2e6fb 100644 --- a/arch/arm64/kernel/paravirt.c +++ b/arch/arm64/kernel/paravirt.c @@ -38,7 +38,7 @@ struct paravirt_patch_template pv_ops = { #endif .lock.vcpu_is_preempted = __native_vcpu_is_preempted, }; -EXPORT_SYMBOL_GPL(pv_ops); +EXPORT_SYMBOL(pv_ops); struct pv_time_stolen_time_region { struct pvclock_vcpu_stolen_time *kaddr; -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] crypto: pcrypt - Fix user-after-free on module unload
by Laibin Qiu 15 Mar '22

15 Mar '22

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from linux-4.19.102 commit 47ef5cb878817127bd3d54c3578bbbd3f7c2bf2c CVE: NA ------------------------------- [ Upstream commit 07bfd9bdf568a38d9440c607b72342036011f727 ] On module unload of pcrypt we must unregister the crypto algorithms first and then tear down the padata structure. As otherwise the crypto algorithms are still alive and can be used while the padata structure is being freed. Fixes: 5068c7a883d1 ("crypto: pcrypt - Add pcrypt crypto...") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- crypto/pcrypt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c index 00c7230acfed..4bf4bb5b1a8b 100644 --- a/crypto/pcrypt.c +++ b/crypto/pcrypt.c @@ -509,11 +509,12 @@ static int __init pcrypt_init(void) static void __exit pcrypt_exit(void) { + crypto_unregister_template(&pcrypt_tmpl); + pcrypt_fini_padata(&pencrypt); pcrypt_fini_padata(&pdecrypt); kset_unregister(pcrypt_kset); - crypto_unregister_template(&pcrypt_tmpl); } module_init(pcrypt_init); -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] lib/iov_iter: initialize "flags" in new pipe_buffer
by Laibin Qiu 14 Mar '22

14 Mar '22

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v5.17-rc6 commit 9d2231c5d74e13b2a0546fee6737ee4446017903 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4X1GI?from=project-issue CVE: NA -------------------------------- The functions copy_page_to_iter_pipe() and push_pipe() can both allocate a new pipe_buffer, but the "flags" member initializer is missing. Fixes: 241699cd72a8 ("new iov_iter flavour: pipe-backed") To: Alexander Viro <viro(a)zeniv.linux.org.uk> To: linux-fsdevel(a)vger.kernel.org To: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- lib/iov_iter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 25668139fc1f..b80320956caf 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -506,6 +506,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by return 0; pipe->nrbufs++; buf->ops = &page_cache_pipe_buf_ops; + buf->flags = 0; get_page(buf->page = page); buf->offset = offset; buf->len = bytes; @@ -630,6 +631,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size, break; pipe->nrbufs++; pipe->bufs[idx].ops = &default_pipe_buf_ops; + pipe->bufs[idx].flags = 0; pipe->bufs[idx].page = page; pipe->bufs[idx].offset = 0; if (left <= PAGE_SIZE) { -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS 0/3] bugfix for memory reliable
by Laibin Qiu 14 Mar '22

14 Mar '22

fix zoneref mapping problem and disable memory reliable if kdump is in progress. Reliable memory used by shmem will be accurate if swap is enabled. Changelog since v1: - update ac->preferred_zoneref - add patch on shmem in reliable_fb_find_zone Ma Wupeng (3): mm: disable memory reliable when kdump is in progress mm: fix zoneref mapping problem in memory reliable mm: Count reliable shmem used based on NR_SHMEM mm/filemap.c | 5 ++++- mm/khugepaged.c | 2 ++ mm/mem_reliable.c | 6 ++++++ mm/migrate.c | 5 +++++ mm/page_alloc.c | 25 ++++++++++++------------- mm/shmem.c | 7 ++----- 6 files changed, 31 insertions(+), 19 deletions(-) -- 2.22.0

1 3

[PATCH openEuler-1.0-LTS 1/2] mm: fix unable to use reliable memory in page cache
by Laibin Qiu 14 Mar '22

14 Mar '22

From: Chen Wandun <chenwandun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA ---------------------------------------------- It is inaccurate when accumulate percpu variable without lock, it will result in pagecache_reliable_pages to be negative in sometime, and will prevent pagecache using reliable memory. For more accurate statistic, replace percpu variable by percpu_counter. The additional percpu_counter will be access in alloc_pages, the init of these two percpu_conter is too late in late_initcall, allocations that use alloc_pages should have to check if the two counter has been inited, that will introduce latency, in order to sovle this, init the two percpu_counter in advance. Signed-off-by: Chen Wandun <chenwandun(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- include/linux/mem_reliable.h | 17 +++++----- mm/mem_reliable.c | 62 ++++++++++++++++++------------------ mm/page_alloc.c | 5 +++ 3 files changed, 45 insertions(+), 39 deletions(-) diff --git a/include/linux/mem_reliable.h b/include/linux/mem_reliable.h index ba5d41edbc44..c4f954340ea7 100644 --- a/include/linux/mem_reliable.h +++ b/include/linux/mem_reliable.h @@ -21,8 +21,9 @@ extern bool shmem_reliable; extern struct percpu_counter reliable_shmem_used_nr_page; extern bool pagecache_use_reliable_mem; DECLARE_PER_CPU(long, nr_reliable_buddy_pages); -DECLARE_PER_CPU(long, pagecache_reliable_pages); -DECLARE_PER_CPU(long, anon_reliable_pages); + +extern struct percpu_counter pagecache_reliable_pages; +extern struct percpu_counter anon_reliable_pages; extern unsigned long nr_reliable_reserve_pages __read_mostly; extern long shmem_reliable_nr_page __read_mostly; @@ -43,6 +44,7 @@ extern void reliable_lru_add(enum lru_list lru, struct page *page, extern void page_cache_prepare_alloc(gfp_t *gfp); extern void reliable_lru_add_batch(int zid, enum lru_list lru, int val); +extern bool mem_reliable_counter_initialized(void); static inline bool mem_reliable_is_enabled(void) { @@ -81,13 +83,10 @@ static inline void reliable_page_counter(struct page *page, static inline bool reliable_mem_limit_check(unsigned long nr_page) { - int cpu; - long num = 0; + s64 num; - for_each_possible_cpu(cpu) { - num += per_cpu(pagecache_reliable_pages, cpu); - num += per_cpu(anon_reliable_pages, cpu); - } + num = percpu_counter_read_positive(&pagecache_reliable_pages); + num += percpu_counter_read_positive(&anon_reliable_pages); return num + nr_page <= task_reliable_limit / PAGE_SIZE; } @@ -184,6 +183,8 @@ static inline void reliable_lru_add(enum lru_list lru, static inline void page_cache_prepare_alloc(gfp_t *gfp) {} static inline void reliable_lru_add_batch(int zid, enum lru_list lru, int val) {} + +static inline bool mem_reliable_counter_initialized(void) { return false; } #endif #endif diff --git a/mm/mem_reliable.c b/mm/mem_reliable.c index 62df78657ff9..033af716610f 100644 --- a/mm/mem_reliable.c +++ b/mm/mem_reliable.c @@ -34,12 +34,18 @@ unsigned long nr_reliable_reserve_pages = MEM_RELIABLE_RESERVE_MIN / PAGE_SIZE; long shmem_reliable_nr_page = LONG_MAX; bool pagecache_use_reliable_mem __read_mostly = true; -DEFINE_PER_CPU(long, pagecache_reliable_pages); -DEFINE_PER_CPU(long, anon_reliable_pages); +struct percpu_counter pagecache_reliable_pages; +struct percpu_counter anon_reliable_pages; static unsigned long zero; static unsigned long reliable_pagecache_max_bytes = ULONG_MAX; +bool mem_reliable_counter_initialized(void) +{ + return likely(percpu_counter_initialized(&pagecache_reliable_pages)) && + likely((percpu_counter_initialized(&anon_reliable_pages))); +} + bool mem_reliable_status(void) { return mem_reliable_is_enabled(); @@ -66,9 +72,9 @@ void reliable_lru_add_batch(int zid, enum lru_list lru, int val) if (zid < ZONE_MOVABLE && zid >= 0) { if (is_file_lru(lru)) - this_cpu_add(pagecache_reliable_pages, val); + percpu_counter_add(&pagecache_reliable_pages, val); else if (is_anon_lru(lru)) - this_cpu_add(anon_reliable_pages, val); + percpu_counter_add(&anon_reliable_pages, val); } } @@ -78,14 +84,14 @@ void reliable_lru_add(enum lru_list lru, struct page *page, int val) return; if (is_file_lru(lru)) - this_cpu_add(pagecache_reliable_pages, val); + percpu_counter_add(&pagecache_reliable_pages, val); else if (is_anon_lru(lru)) - this_cpu_add(anon_reliable_pages, val); + percpu_counter_add(&anon_reliable_pages, val); else if (lru == LRU_UNEVICTABLE) { if (PageAnon(page)) - this_cpu_add(anon_reliable_pages, val); + percpu_counter_add(&anon_reliable_pages, val); else - this_cpu_add(pagecache_reliable_pages, val); + percpu_counter_add(&pagecache_reliable_pages, val); } } @@ -188,21 +194,20 @@ static void show_val_kb(struct seq_file *m, const char *s, unsigned long num) void reliable_report_meminfo(struct seq_file *m) { bool pagecache_enabled = pagecache_reliable_is_enabled(); - long nr_pagecache_pages = 0; - long nr_anon_pages = 0; + s64 nr_pagecache_pages = 0; + s64 nr_anon_pages = 0; long nr_buddy_pages = 0; int cpu; if (!mem_reliable_is_enabled()) return; - for_each_possible_cpu(cpu) { + for_each_possible_cpu(cpu) nr_buddy_pages += per_cpu(nr_reliable_buddy_pages, cpu); - nr_anon_pages += per_cpu(anon_reliable_pages, cpu); - if (pagecache_enabled) - nr_pagecache_pages += - per_cpu(pagecache_reliable_pages, cpu); - } + + nr_anon_pages = percpu_counter_sum_positive(&anon_reliable_pages); + if (pagecache_enabled) + nr_pagecache_pages = percpu_counter_sum_positive(&pagecache_reliable_pages); show_val_kb(m, "ReliableTotal: ", total_reliable_mem_sz() >> PAGE_SHIFT); @@ -445,8 +450,7 @@ static struct ctl_table reliable_dir_table[] = { void page_cache_prepare_alloc(gfp_t *gfp) { - long nr_reliable = 0; - int cpu; + s64 nr_reliable = 0; if (!mem_reliable_is_enabled()) return; @@ -454,11 +458,7 @@ void page_cache_prepare_alloc(gfp_t *gfp) if (!pagecache_reliable_is_enabled()) goto no_reliable; - for_each_possible_cpu(cpu) - nr_reliable += this_cpu_read(pagecache_reliable_pages); - - if (nr_reliable < 0) - goto no_reliable; + nr_reliable = percpu_counter_read_positive(&pagecache_reliable_pages); if (nr_reliable > reliable_pagecache_max_bytes >> PAGE_SHIFT) goto no_reliable; @@ -480,9 +480,12 @@ static int __init reliable_sysctl_init(void) return -1; } + percpu_counter_init(&pagecache_reliable_pages, 0, GFP_KERNEL); + percpu_counter_init(&anon_reliable_pages, 0, GFP_KERNEL); + return 0; } -late_initcall(reliable_sysctl_init); +arch_initcall(reliable_sysctl_init); #else static void mem_reliable_ctrl_bit_disabled(int idx) {} #endif @@ -515,21 +518,18 @@ static void mem_reliable_feature_disable(int idx) void reliable_show_mem_info(void) { - int cpu; - long num = 0; + s64 num = 0; if (!mem_reliable_is_enabled()) return; - for_each_possible_cpu(cpu) { - num += per_cpu(anon_reliable_pages, cpu); - num += per_cpu(pagecache_reliable_pages, cpu); - } + num += percpu_counter_sum_positive(&anon_reliable_pages); + num += percpu_counter_sum_positive(&pagecache_reliable_pages); pr_info("ReliableTotal: %lu kB", total_reliable_mem_sz() >> 10); pr_info("ReliableUsed: %lu kB", used_reliable_mem_sz() >> 10); pr_info("task_reliable_limit: %lu kB", task_reliable_limit >> 10); - pr_info("reliable_user_used: %ld kB", num << (PAGE_SHIFT - 10)); + pr_info("reliable_user_used: %lld kB", num << (PAGE_SHIFT - 10)); } void mem_reliable_out_of_memory(gfp_t gfp_mask, unsigned int order, diff --git a/mm/page_alloc.c b/mm/page_alloc.c index fd4354d9ebad..dab62d1d3a6e 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4674,6 +4674,11 @@ static inline bool prepare_before_alloc(gfp_t *gfp_mask, unsigned int order) * allocation trigger task_reliable_limit */ if (is_global_init(current)) { + if (!mem_reliable_counter_initialized()) { + *gfp_mask |= ___GFP_RELIABILITY; + return true; + } + if (reliable_mem_limit_check(1 << order) && mem_reliable_watermark_ok(1 << order)) *gfp_mask |= ___GFP_RELIABILITY; -- 2.22.0

1 1

openEuler kernel 双周例会&技术分享
by openEuler conference 14 Mar '22

14 Mar '22

您好！ Kernel SIG 邀请您参加 2022-03-18 14:00 召开的ZOOM会议(自动录制) 会议主题：openEuler kernel 双周例会&技术分享会议内容： openEuler kernel 技术分享：内核中断子系统介绍会议链接：https://us06web.zoom.us/j/82640076508?pwd=MktwWWxWR3ZqNFF4SlgwdGhwNlNDZz09 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference(auto recording) will be held at 2022-03-18 14:00, The subject of the conference is openEuler kernel 双周例会&技术分享, Summary: openEuler kernel 技术分享：内核中断子系统介绍 You can join the meeting at https://us06web.zoom.us/j/82640076508?pwd=MktwWWxWR3ZqNFF4SlgwdGhwNlNDZz09. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
by Laibin Qiu 14 Mar '22

14 Mar '22

From: Jordy Zomer <jordy(a)pwning.systems> mainline inclusion from mainline-v5.17-rc1 commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 category: bugfix bugzilla: 186393 CVE: CVE-2022-26490 ------------------------------------------------- It appears that there are some buffer overflows in EVT_TRANSACTION. This happens because the length parameters that are passed to memcpy come directly from skb->data and are not guarded in any way. Signed-off-by: Jordy Zomer <jordy(a)pwning.systems> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Huang Guobin <huangguobin4(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/nfc/st21nfca/se.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c index fd967a38a94a..ced3c20d6453 100644 --- a/drivers/nfc/st21nfca/se.c +++ b/drivers/nfc/st21nfca/se.c @@ -332,6 +332,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, return -ENOMEM; transaction->aid_len = skb->data[1]; + + /* Checking if the length of the AID is valid */ + if (transaction->aid_len > sizeof(transaction->aid)) + return -EINVAL; + memcpy(transaction->aid, &skb->data[2], transaction->aid_len); @@ -341,6 +346,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, return -EPROTO; transaction->params_len = skb->data[transaction->aid_len + 3]; + + /* Total size is allocated (skb->len - 2) minus fixed array members */ + if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction))) + return -EINVAL; + memcpy(transaction->params, skb->data + transaction->aid_len + 4, transaction->params_len); -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS 00/55] linux stable inclusion
by Laibin Qiu 14 Mar '22

14 Mar '22

form Linux 4.19.222 to Linux 4.19.227. some patch with conflicts haven't inclusion yet: 8a8908cb82568 fuse: fix live lock in fuse_iget() 1e1bb4933f1fa fuse: fix bad inode bd6e97e2b6f59 veth: Do not record rx queue hint in veth_xmit 1c3564fca0e7b xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate f9dfa44be0fb5 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() 9c6159ee8fc9d net: accept UFOv6 packages in virtio_net_hdr_to_skb 57f93eaff49df block, bfq: fix use after free in bfq_bfqq_expire 99ada24490c34 block, bfq: fix queue removal from weights tree 7d0efcc69c75a block, bfq: fix decrement of num_active_groups e867d620470af block, bfq: fix asymmetric scenarios detection e4cd53c650bef block, bfq: improve asymmetric scenarios detection they will be sent with fixed conflicts by the analyser. Andrew Cooper (1): x86/pkey: Fix undefined behaviour with PKRU_WD_BIT Andrey Ryabinin (1): cputime, cpuacct: Include guest time in user time in cpuacct.stat Antoine Tenart (1): net-sysfs: update the queue counts in the unregistration path Antony Antony (2): xfrm: interface with if_id 0 should return error xfrm: state and policy should fail if XFRMA_IF_ID 0 Arnd Bergmann (1): dmaengine: pxa/mmp: stop referencing config->slave_id Bart Van Assche (1): scsi: ufs: Fix race conditions related to driver data Chen Jun (1): tpm: add request_locality before write TPM_INT_ENABLE Chengfeng Ye (1): crypto: qce - fix uaf on qce_ahash_register_one Christoph Hellwig (1): scsi: sr: Don't use GFP_DMA Coco Li (1): udp: using datalen to cap ipv6 udp max gso segments David Ahern (4): ipv6: Check attribute length for RTA_GATEWAY in multipath route ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route ipv6: Continue processing multipath route even if gateway attribute is invalid ipv6: Do cleanup if attribute validation fails in multipath route Doyle, Patrick (1): mtd: nand: bbt: Fix corner case in bad block table handling Eric Dumazet (3): xfrm: fix a small bug in xfrm_sa_len() af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress netns: add schedule point in ops_exit_list() Fernando Fernandez Mancera (1): bonding: fix ad_actor_system option setting to default Florian Westphal (1): netfilter: bridge: add support for pppoe filtering Gang Li (1): shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode Hector Martin (1): iommu/io-pgtable-arm: Fix table descriptor paddr formatting Jan Kara (4): ext4: avoid trim error on fs with small groups ext4: make sure to reset inode lockdep class when quota enabling fails ext4: make sure quota gets properly shutdown on error select: Fix indefinitely sleeping task in poll_schedule_timeout() Joe Thornber (2): dm btree: add a defensive bounds check to insert_at() dm space map common: add bounds check to sm_ll_lookup_bitmap() Kyeong Yoo (1): jffs2: GC deadlock reading a page that is used in jffs2_write_begin() Li Hua (1): sched/rt: Try to restart rt period timer when rt runtime exceeded Lino Sanfilippo (1): serial: amba-pl011: do not request memory region twice Lixiaokeng (1): scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() Lizhi Hou (1): tty: serial: uartlite: allow 64 bit address Lukas Wunner (1): serial: Fix incorrect rs485 polarity on uart open Luís Henriques (1): ext4: set csum seed in tmp inode while migrating to extents Marek Vasut (1): crypto: stm32/crc32 - Fix kernel BUG triggered in probe() Muchun Song (1): net: fix use-after-free in tw_timer_handler Naveen N. Rao (2): tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() tracing: Tag trace_percpu_buffer as a percpu pointer Nicolas Toromanoff (1): crypto: stm32/cryp - fix double pm exit Paolo Abeni (1): bpf: Do not WARN in bpf_warn_invalid_xdp_action() Pavel Skripkin (1): net: mcs7830: handle usb read errors properly Rafael J. Wysocki (2): ACPICA: Utilities: Avoid deleting the same object twice in a row ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() Suresh Kumar (1): net: bonding: debug: avoid printing debug logs when bond is not notifying peers Thadeu Lima de Souza Cascardo (2): ipmi: bail out if init_srcu_struct fails ipmi: fix initialization when workqueue allocation fails Theodore Ts'o (1): ext4: don't use the orphan list when migrating an inode Thomas Gleixner (1): can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet Tom Rix (1): selinux: initialize proto variable in selinux_ip_postroute_compat() Willem de Bruijn (1): net: skip virtio_net_hdr_set_proto if protocol already set William Zhao (1): ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate Wu Bo (1): ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module Xin Xiong (1): netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() Documentation/networking/bonding.txt | 11 +- arch/x86/include/asm/pgtable.h | 4 +- drivers/acpi/acpica/exoparg1.c | 3 +- drivers/acpi/acpica/utdelete.c | 1 + drivers/char/ipmi/ipmi_msghandler.c | 21 ++- drivers/char/tpm/tpm_tis_core.c | 8 + drivers/crypto/qce/sha.c | 2 +- drivers/crypto/stm32/stm32-cryp.c | 2 - drivers/crypto/stm32/stm32_crc32.c | 4 +- drivers/dma/mmp_pdma.c | 6 - drivers/dma/pxa_dma.c | 7 - drivers/iommu/io-pgtable-arm.c | 9 +- drivers/md/persistent-data/dm-btree.c | 8 +- .../md/persistent-data/dm-space-map-common.c | 5 + drivers/mtd/nand/bbt.c | 2 +- drivers/net/bonding/bond_main.c | 6 +- drivers/net/bonding/bond_options.c | 2 +- drivers/net/usb/mcs7830.c | 12 +- drivers/scsi/libiscsi.c | 6 +- drivers/scsi/sr.c | 2 +- drivers/scsi/sr_vendor.c | 4 +- drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 - drivers/scsi/ufs/ufshcd-pltfrm.c | 2 - drivers/scsi/ufs/ufshcd.c | 7 + drivers/tty/serial/amba-pl011.c | 27 +-- drivers/tty/serial/serial_core.c | 4 +- drivers/tty/serial/uartlite.c | 2 +- fs/ext4/ioctl.c | 2 - fs/ext4/mballoc.c | 8 + fs/ext4/migrate.c | 23 ++- fs/ext4/super.c | 23 ++- fs/jffs2/file.c | 40 +++-- fs/select.c | 63 +++---- include/linux/virtio_net.h | 3 + kernel/sched/cputime.c | 4 +- kernel/sched/rt.c | 23 ++- kernel/trace/trace.c | 6 +- mm/shmem.c | 37 +++-- net/bridge/br_netfilter_hooks.c | 7 +- net/can/bcm.c | 156 ++++++------------ net/core/filter.c | 6 +- net/core/net-sysfs.c | 3 + net/core/net_namespace.c | 4 +- net/ipv4/af_inet.c | 10 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +- net/ipv6/ip6_vti.c | 2 + net/ipv6/route.c | 28 +++- net/ipv6/udp.c | 2 +- net/unix/garbage.c | 14 +- net/unix/scm.c | 6 +- net/xfrm/xfrm_interface.c | 14 +- net/xfrm/xfrm_user.c | 23 ++- security/selinux/hooks.c | 2 +- 53 files changed, 375 insertions(+), 307 deletions(-) -- 2.22.0

1 55

subscribe
by chinayanlei2002 12 Mar '22

12 Mar '22

1 0