- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/2] Input: joydev - prevent potential read overflow in ioctl
by Yang Yingliang 04 Aug '21

04 Aug '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from linux-4.19.178 commit 88438fdeeffe11dcb05c2dd0ddd22cb6e3f024b4 CVE: CVE-2021-3612 -------------------------------- commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream. The problem here is that "len" might be less than "joydev->nabs" so the loops which verfy abspam[i] and keypam[] might read beyond the buffer. Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda [dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP] Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/input/joydev.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c index 4c1e427dfabb9..7ef6e1c165e35 100644 --- a/drivers/input/joydev.c +++ b/drivers/input/joydev.c @@ -460,7 +460,7 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev, if (IS_ERR(abspam)) return PTR_ERR(abspam); - for (i = 0; i < joydev->nabs; i++) { + for (i = 0; i < len && i < joydev->nabs; i++) { if (abspam[i] > ABS_MAX) { retval = -EINVAL; goto out; @@ -484,6 +484,9 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, int i; int retval = 0; + if (len % sizeof(*keypam)) + return -EINVAL; + len = min(len, sizeof(joydev->keypam)); /* Validate the map. */ @@ -491,7 +494,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, if (IS_ERR(keypam)) return PTR_ERR(keypam); - for (i = 0; i < joydev->nkey; i++) { + for (i = 0; i < (len / 2) && i < joydev->nkey; i++) { if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) { retval = -EINVAL; goto out; -- 2.25.1

1 1

[PATCH kernel-4.19 1/5] Revert "modpost: explain why we can't use strsep"
by Yang Yingliang 04 Aug '21

04 Aug '21

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46847 CVE: NA ----------------------------------------------- This reverts commit bd34c7e237442f10576363ea3515da4aca39baf1. This series of patches could raise an issue on module built. When we build a module that contains .cpp source file, we could only build the corresponding object file by calling gcc emplicitly instead of using the kbuild framework supplied by kernel. As a consequence, the .cmd file that records the build command for the object file goes missing. This patches series treat that missing .cmd file as a fatal error and break the module build. Although linking a object file supplied by user into a module is informal, the user has already done that and we'd better not break it for compatibility. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- scripts/mod/modpost.c | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c index a6f25b67b1cf1..ed5e38df9a7dc 100644 --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c @@ -166,7 +166,6 @@ char *get_line(char **stringp) if (!orig || *orig == '\0') return NULL; - /* don't use strsep here, it is not available everywhere */ next = strchr(orig, '\n'); if (next) *next++ = '\0'; -- 2.25.1

1 4

[PATCH kernel-4.19] mm/slab: add naive detection of double free
by Yang Yingliang 03 Aug '21

03 Aug '21

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v5.9-rc1 commit dabc3e291d56e3125113101bc6d53d1a1738294d category: bugfix bugzilla: 41100 CVE: NA ------------------------------------------------- Similar to commit ce6fa91b9363 ("mm/slub.c: add a naive detection of double free or corruption"), add a very cheap double-free check for SLAB under CONFIG_SLAB_FREELIST_HARDENED. With this added, the "SLAB_FREE_DOUBLE" LKDTM test passes under SLAB: lkdtm: Performing direct entry SLAB_FREE_DOUBLE lkdtm: Attempting double slab free ... ------------[ cut here ]------------ WARNING: CPU: 2 PID: 2193 at mm/slab.c:757 ___cache _free+0x325/0x390 [keescook(a)chromium.org: fix misplaced __free_one()] Link: http://lkml.kernel.org/r/202006261306.0D82A2B@keescook Link: https://lore.kernel.org/lkml/7ff248c7-d447-340c-a8e2-8c02972aca70@infradead… Signed-off-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: Randy Dunlap <rdunlap(a)infradead.org> [build tested] Cc: Roman Gushchin <guro(a)fb.com> Cc: Christoph Lameter <cl(a)linux.com> Cc: Alexander Popov <alex.popov(a)linux.com> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Vinayak Menon <vinmenon(a)codeaurora.org> Cc: Matthew Garrett <mjg59(a)google.com> Cc: Jann Horn <jannh(a)google.com> Cc: Vijayanand Jitta <vjitta(a)codeaurora.org> Link: http://lkml.kernel.org/r/20200625215548.389774-3-keescook@chromium.org Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Chen Wandun <chenwandun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/slab.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/mm/slab.c b/mm/slab.c index a818297ef5241..922bfeb94c803 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -630,6 +630,16 @@ static int transfer_objects(struct array_cache *to, return nr; } +/* &alien->lock must be held by alien callers. */ +static __always_inline void __free_one(struct array_cache *ac, void *objp) +{ + /* Avoid trivial double-free. */ + if (IS_ENABLED(CONFIG_SLAB_FREELIST_HARDENED) && + WARN_ON_ONCE(ac->avail > 0 && ac->entry[ac->avail - 1] == objp)) + return; + ac->entry[ac->avail++] = objp; +} + #ifndef CONFIG_NUMA #define drain_alien_cache(cachep, alien) do { } while (0) @@ -810,7 +820,7 @@ static int __cache_free_alien(struct kmem_cache *cachep, void *objp, STATS_INC_ACOVERFLOW(cachep); __drain_alien_cache(cachep, ac, page_node, &list); } - ac->entry[ac->avail++] = objp; + __free_one(ac, objp); spin_unlock(&alien->lock); slabs_destroy(cachep, &list); } else { @@ -3532,7 +3542,7 @@ void ___cache_free(struct kmem_cache *cachep, void *objp, } } - ac->entry[ac->avail++] = objp; + __free_one(ac, objp); } /** -- 2.25.1

1 0

[PATCH kernel-4.19 1/4] iommu/amd: Prevent NULL pointer dereference
by Yang Yingliang 03 Aug '21

03 Aug '21

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v5.10-rc1 commit 23357b61f8062a8a8c9c84c0252056cd6d849ec8 category: bugfix bugzilla: 43219 CVE: NA ------------------------------------------------ Dereferencing irq_data before checking it for NULL is suboptimal. Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Joerg Roedel <jroedel(a)suse.de> Conflicts: drivers/iommu/amd/iommu.c Signed-off-by: Chen Huang <chenhuang5(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/amd_iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c index 8148f240aac31..d7a288dd15667 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c @@ -4254,8 +4254,8 @@ static int irq_remapping_alloc(struct irq_domain *domain, unsigned int virq, for (i = 0; i < nr_irqs; i++) { irq_data = irq_domain_get_irq_data(domain, virq + i); - cfg = irqd_cfg(irq_data); - if (!irq_data || !cfg) { + cfg = irq_data ? irqd_cfg(irq_data) : NULL; + if (!cfg) { ret = -EINVAL; goto out_free_data; } -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS] cpuidle: fix return type err in haltpoll_switch_governor
by Yang Yingliang 03 Aug '21

03 Aug '21

From: Jiajun Chen <chenjiajun8(a)huawei.com> euleros inclusion category: bugfix bugzilla: NA CVE: NA --------------------------- while CONFIG_CPU_IDLE is disabled, the haltpoll_switch_governor function should not return int type result,which will cause build err. Fixes: 97c227885e0a ("cpuidle: fix container_of err in cpuidle_device and cpuidle_driver") Signed-off-by: Jiajun Chen <chenjiajun8(a)huawei.com> Reviewed-by: Keqian Zhu <zhukeqian1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/cpuidle.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h index e365f5dfe6e7d..9dd5a6b27b212 100644 --- a/include/linux/cpuidle.h +++ b/include/linux/cpuidle.h @@ -200,8 +200,7 @@ static inline u64 cpuidle_haltpoll_time(struct cpuidle_driver *drv, {return 0; } static inline int cpuidle_register_driver(struct cpuidle_driver *drv) {return -ENODEV; } -static inline void haltpoll_switch_governor(struct cpuidle_driver *drv) -{return -ENODEV; } +static inline void haltpoll_switch_governor(struct cpuidle_driver *drv) { } static inline struct cpuidle_driver *cpuidle_get_driver(void) {return NULL; } static inline struct cpuidle_driver *cpuidle_driver_ref(void) {return NULL; } static inline void cpuidle_driver_unref(void) {} -- 2.25.1

1 0

[openEuler-21.09 01/44] ACPI: APEI: fix synchronous external aborts in user-mode
by Zheng Zengkai 03 Aug '21

03 Aug '21

From: Xiaofei Tan <tanxiaofei(a)huawei.com> mainline inclusion from mainline-v5.14-rc1 commit ccb5ecdc2ddeaff744ee075b54cdff8a689e8fa7 category: bugfix bugzilla: 168583 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- Before commit 8fcc4ae6faf8 ("arm64: acpi: Make apei_claim_sea() synchronise with APEI's irq work"), do_sea() would unconditionally signal the affected task from the arch code. Since that change, the GHES driver sends the signals. This exposes a problem as errors the GHES driver doesn't understand or doesn't handle effectively are silently ignored. It will cause the errors get taken again, and circulate endlessly. User-space task get stuck in this loop. Existing firmware on Kunpeng9xx systems reports cache errors with the 'ARM Processor Error' CPER records. Do memory failure handling for ARM Processor Error Section just like for Memory Error Section. Fixes: 8fcc4ae6faf8 ("arm64: acpi: Make apei_claim_sea() synchronise with APEI's irq work") Signed-off-by: Xiaofei Tan <tanxiaofei(a)huawei.com> Reviewed-by: James Morse <james.morse(a)arm.com> [ rjw: Subject edit ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Yunsheng Lin <linyunsheng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/acpi/apei/ghes.c | 81 +++++++++++++++++++++++++++++++--------- 1 file changed, 64 insertions(+), 17 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index fce7ade2aba9..0c8330ed1ffd 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -441,28 +441,35 @@ static void ghes_kick_task_work(struct callback_head *head) gen_pool_free(ghes_estatus_pool, (unsigned long)estatus_node, node_len); } -static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, - int sev) +static bool ghes_do_memory_failure(u64 physical_addr, int flags) { unsigned long pfn; - int flags = -1; - int sec_sev = ghes_severity(gdata->error_severity); - struct cper_sec_mem_err *mem_err = acpi_hest_get_payload(gdata); if (!IS_ENABLED(CONFIG_ACPI_APEI_MEMORY_FAILURE)) return false; - if (!(mem_err->validation_bits & CPER_MEM_VALID_PA)) - return false; - - pfn = mem_err->physical_addr >> PAGE_SHIFT; + pfn = PHYS_PFN(physical_addr); if (!pfn_valid(pfn)) { pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid address in generic error data: %#llx\n", - mem_err->physical_addr); + physical_addr); return false; } + memory_failure_queue(pfn, flags); + return true; +} + +static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, + int sev) +{ + int flags = -1; + int sec_sev = ghes_severity(gdata->error_severity); + struct cper_sec_mem_err *mem_err = acpi_hest_get_payload(gdata); + + if (!(mem_err->validation_bits & CPER_MEM_VALID_PA)) + return false; + /* iff following two events can be handled properly by now */ if (sec_sev == GHES_SEV_CORRECTED && (gdata->flags & CPER_SEC_ERROR_THRESHOLD_EXCEEDED)) @@ -470,14 +477,56 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, if (sev == GHES_SEV_RECOVERABLE && sec_sev == GHES_SEV_RECOVERABLE) flags = 0; - if (flags != -1) { - memory_failure_queue(pfn, flags); - return true; - } + if (flags != -1) + return ghes_do_memory_failure(mem_err->physical_addr, flags); return false; } +static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, int sev) +{ + struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); + bool queued = false; + int sec_sev, i; + char *p; + + log_arm_hw_error(err); + + sec_sev = ghes_severity(gdata->error_severity); + if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) + return false; + + p = (char *)(err + 1); + for (i = 0; i < err->err_info_num; i++) { + struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; + bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); + bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); + const char *error_type = "unknown error"; + + /* + * The field (err_info->error_info & BIT(26)) is fixed to set to + * 1 in some old firmware of HiSilicon Kunpeng920. We assume that + * firmware won't mix corrected errors in an uncorrected section, + * and don't filter out 'corrected' error here. + */ + if (is_cache && has_pa) { + queued = ghes_do_memory_failure(err_info->physical_fault_addr, 0); + p += err_info->length; + continue; + } + + if (err_info->type < ARRAY_SIZE(cper_proc_error_type_strs)) + error_type = cper_proc_error_type_strs[err_info->type]; + + pr_warn_ratelimited(FW_WARN GHES_PFX + "Unhandled processor error type: %s\n", + error_type); + p += err_info->length; + } + + return queued; +} + /* * PCIe AER errors need to be sent to the AER driver for reporting and * recovery. The GHES severities map to the following AER severities and @@ -605,9 +654,7 @@ static bool ghes_do_proc(struct ghes *ghes, ghes_handle_aer(gdata); } else if (guid_equal(sec_type, &CPER_SEC_PROC_ARM)) { - struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); - - log_arm_hw_error(err); + queued = ghes_handle_arm_hw_error(gdata, sev); } else { void *err = acpi_hest_get_payload(gdata); -- 2.20.1

1 43

【Meeting Notice】openEuler kernel 技术分享第九期 & 双周例会 Time: 2021-08-06 14:00-18:00
by Meeting Book 03 Aug '21

03 Aug '21

1 0

[PATCH openEuler-1.0-LTS 0/2] prefetch bugfix
by Cheng Jian 02 Aug '21

02 Aug '21

prefetch bugfix Li Ruilin (2): bcache: do not collect data insert info created by write_moving bcache: always record start time of a sample drivers/md/bcache/request.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) -- 2.25.1

1 2

[PATCH kernel-4.19 01/10] tcp_comp: add Kconfig for tcp payload compression
by Yang Yingliang 02 Aug '21

02 Aug '21

From: Wei Yongjun <weiyongjun1(a)huawei.com> hulk inclusion category: feature bugzilla: NA CVE: NA ------------------------------------------------- Add config item CONFIG_TCP_COMP for tcp payload compression. This allows payload compression handling of the TCP protocol to be done in-kernel. This patch only adds the CONFIG_TCP_COMP config, tcp compression capability is implemented later. Signed-off-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/ipv4/Kconfig | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig index 2e12f848203a4..883a638648e1f 100644 --- a/net/ipv4/Kconfig +++ b/net/ipv4/Kconfig @@ -754,3 +754,11 @@ config TCP_MD5SIG on the Internet. If unsure, say N. + +config TCP_COMP + bool "TCP: Transport Layer Compression support" + ---help--- + Enable kernel payload compression support for TCP protocol. This allows + payload compression handling of the TCP protocol to be done in-kernel. + + If unsure, say Y. -- 2.25.1

1 9

[PATCH openEuler-1.0-LTS 000/109] backport patches from linux-4.19
by Yang Yingliang 02 Aug '21

02 Aug '21

Al Viro (1): iov_iter_fault_in_readable() should do nothing in xarray case Alex Shi (1): mm: add VM_WARN_ON_ONCE_PAGE() macro Alex Williamson (1): vfio/pci: Handle concurrent vma faults Alexander Ovechkin (1): net: send SYNACK packet with accepted fwmark Anirudh Rayabharam (1): ext4: fix kernel infoleak via ext4_extent_header Casey Chen (1): nvme-pci: do not call nvme_dev_remove_admin from nvme_remove Dan Carpenter (1): scsi: scsi_dh_alua: Fix signedness bug in alua_rtpg() Dimitri John Ledkov (1): lib/decompress_unlz4.c: correctly handle zero-padding around initrds. Dmitry Bogdanov (1): scsi: target: Fix protect handling in WRITE SAME(32) Dmitry Torokhov (1): i2c: core: Disable client irq on reboot/shutdown Eric Dumazet (8): pkt_sched: sch_qfq: fix qfq_change_class() error path vxlan: add missing rcu_read_lock() in neigh_reduce() ipv6: exthdrs: do not blindly use init_net ipv6: fix out-of-bound access in ip6_parse_tlv() tcp: annotate data races around tp->mtu_info ipv6: tcp: drop silly ICMPv6 packet too big messages udp: annotate data races around unix_sk(sk)->gso_size net/tcp_fastopen: fix data races around tfo_active_disable_stamp Gabriel Krisman Bertazi (1): dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath Gao Xiang (1): nfs: fix acl memory leak of posix_acl_create() Hangbin Liu (1): net: ip_tunnel: fix mtu calculation for ETHER tunnel devices Hannes Reinecke (1): scsi: scsi_dh_alua: Check for negative result value Haoran Luo (1): tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. Hugh Dickins (16): mm/thp: fix __split_huge_pmd_locked() on shmem migration entry mm/thp: make is_huge_zero_pmd() safe and quicker mm/thp: try_to_unmap() use TTU_SYNC for safe splitting mm/thp: fix vma_address() if virtual address below file offset mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page() mm: page_vma_mapped_walk(): use page for pvmw->page mm: page_vma_mapped_walk(): settle PageHuge on entry mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block mm: page_vma_mapped_walk(): crossing page table boundary mm: page_vma_mapped_walk(): add a level of indentation mm: page_vma_mapped_walk(): use goto instead of while (1) mm: page_vma_mapped_walk(): get vma_address_end() earlier mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk() mm, futex: fix shared futex pgoff on shmem huge page Jakub Kicinski (1): net: ip: avoid OOM kills with large UDP sends over loopback Jason Ekstrand (1): dma-buf/sync_file: Don't leak fences on merge failure Jason Gunthorpe (1): vfio-pci: Use io_remap_pfn_range() for PCI IO memory Javed Hasan (1): scsi: libfc: Fix array index out of bound exception Joe Thornber (1): dm space maps: don't reset space map allocation cursor when committing Jue Wang (1): mm/thp: fix page_address_in_vma() on file THP tails Krzysztof Wilczyński (2): ACPI: sysfs: Fix a buffer overrun problem with description_show() PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun Liu Shixin (1): netlabel: Fix memory leak in netlbl_mgmt_add_common Longpeng(Mike) (1): vsock: notify server to shutdown when client has pending signal Maciej Żenczykowski (1): bpf: Do not change gso_size during bpf_skb_change_proto() ManYi Li (1): scsi: sr: Return appropriate error code when disk is ejected Marcelo Henrique Cerri (1): proc: Avoid mixing integer types in mem_rw() Mario Limonciello (1): ACPI: processor idle: Fix up C-state latency if not ordered Miao Wang (1): net/ipv4: swap flow ports when validating source Miaohe Lin (3): mm/rmap: remove unneeded semicolon in page_not_mapped() mm/rmap: use page_not_mapped in try_to_unmap() mm/huge_memory.c: don't discard hugepage if other processes are mapping it Michael S. Tsirkin (1): virtio_net: move tx vq operation under tx queue lock Mike Christie (4): scsi: iscsi: Add iscsi_cls_conn refcount helpers scsi: iscsi: Fix shost->max_id use scsi: qedi: Fix null ref during abort handling scsi: iscsi: Fix iface sysfs attr detection Miklos Szeredi (1): fuse: check connected before queueing on fpq->io Mikulas Patocka (3): dm writecache: fix data corruption when reloading the target dm writecache: return the exact table values that were set dm writecache: fix writing beyond end of underlying device when shrinking Mimi Zohar (1): evm: fix writing <securityfs>/evm overflow Muchun Song (1): writeback: fix obtain a reference to a freeing memcg css Nicolas Dichtel (1): ipv6: fix 'disable_policy' for fwd packets Nikolay Aleksandrov (1): net: bridge: multicast: fix PIM hello router port marking race Odin Ugedal (1): sched/fair: Fix CFS bandwidth hrtimer expiry type Pablo Neira Ayuso (3): netfilter: nft_exthdr: check for IPv6 packet before further processing netfilter: nft_osf: check for TCP packet before further processing netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols Pan Dong (1): ext4: fix avefreec in find_group_orlov Peilin Ye (1): net/sched: act_skbmod: Skip non-Ethernet packets Petr Mladek (2): kthread_worker: split code for canceling the delayed work timer kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() Petr Pavlu (1): ipmi/watchdog: Stop watchdog timer when the current action is 'none' Quat Le (1): scsi: core: Retry I/O for Notify (Enable Spinup) Required error Richard Fitzgerald (1): lib: vsprintf: Fix handling of number field widths in vsscanf Roberto Sassu (2): evm: Execute evm_inode_init_security() only when an HMAC key is loaded evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded Steffen Klassert (1): xfrm: Fix error reporting in xfrm_state_construct. Stephen Brennan (1): ext4: use ext4_grp_locked_error in mb_find_extent Steven Rostedt (VMware) (1): tracing: Do not reference char * as a string in histograms Sunwook Eom (1): dm verity fec: fix hash block number in verity_fec_decode Taehee Yoo (1): net: validate lwtstate->data before returning from skb_tunnel_info() Thomas Gleixner (1): x86/fpu: Limit xstate copy size in xstateregs_set() Trond Myklebust (3): NFS: nfs_find_open_context() may only select open files NFSv4: Initialise connection to the server in nfs4_alloc_client() NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times Tyrel Datwyler (1): scsi: core: Fix bad pointer dereference when ehandler kthread is invalid Vasily Averin (1): netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo Willy Tarreau (1): ipv6: use prandom_u32() for ID generation Wolfgang Bumiller (1): net: bridge: sync fdb to new unicast-filtering ports Xianting Tian (1): virtio_net: Remove BUG() to avoid machine dead Xie Yongji (3): virtio-blk: Fix memory leak among suspend/resume procedure virtio_net: Fix error handling in virtnet_restore() virtio_console: Assure used length from device is limited Xin Long (1): sctp: update active_key for asoc when old key is being replaced Yajun Deng (1): net: sched: cls_api: Fix the the wrong parameter Yang Shi (1): mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split Yang Yingliang (1): ext4: return error code when ext4_fill_flex_info() fails Yun Zhou (2): seq_buf: Make trace_seq_putmem_hex() support data longer than 8 seq_buf: Fix overflow in seq_buf_putmem_hex() Zhang Yi (2): ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit ext4: remove check for zero nr_to_scan in ext4_es_scan() Zhihao Cheng (1): nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING Documentation/ABI/testing/evm | 26 ++- arch/x86/kernel/fpu/regset.c | 2 +- drivers/acpi/device_sysfs.c | 2 +- drivers/acpi/processor_idle.c | 40 +++++ drivers/block/virtio_blk.c | 2 + drivers/char/ipmi/ipmi_watchdog.c | 22 +-- drivers/char/virtio_console.c | 4 +- drivers/dma-buf/sync_file.c | 13 +- drivers/i2c/i2c-core-base.c | 3 + drivers/md/dm-mpath.c | 6 +- drivers/md/dm-verity-fec.c | 2 +- drivers/md/dm-writecache.c | 102 +++++++---- .../md/persistent-data/dm-space-map-disk.c | 9 +- .../persistent-data/dm-space-map-metadata.c | 9 +- drivers/net/virtio_net.c | 29 +++- drivers/net/vxlan.c | 2 + drivers/nvme/host/pci.c | 5 +- drivers/pci/pci-label.c | 2 +- drivers/scsi/be2iscsi/be_main.c | 4 +- drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 +- drivers/scsi/cxgbi/libcxgbi.c | 4 +- drivers/scsi/device_handler/scsi_dh_alua.c | 11 +- drivers/scsi/hosts.c | 1 + drivers/scsi/libfc/fc_rport.c | 13 +- drivers/scsi/libiscsi.c | 7 +- drivers/scsi/qedi/qedi_fw.c | 2 +- drivers/scsi/qedi/qedi_main.c | 2 +- drivers/scsi/scsi_lib.c | 1 + drivers/scsi/scsi_transport_iscsi.c | 102 +++++------ drivers/scsi/sr.c | 2 + drivers/target/target_core_sbc.c | 35 ++-- drivers/vfio/pci/vfio_pci.c | 31 +++- fs/ext4/extents.c | 3 + fs/ext4/extents_status.c | 4 +- fs/ext4/ialloc.c | 11 +- fs/ext4/mballoc.c | 9 +- fs/ext4/super.c | 1 + fs/fs-writeback.c | 9 +- fs/fuse/dev.c | 9 + fs/nfs/inode.c | 4 + fs/nfs/nfs3proc.c | 4 +- fs/nfs/nfs4client.c | 82 ++++----- fs/nfs/pnfs_nfs.c | 52 +++--- fs/proc/base.c | 2 +- include/linux/huge_mm.h | 8 +- include/linux/hugetlb.h | 16 -- include/linux/mm.h | 3 + include/linux/mmdebug.h | 13 ++ include/linux/nfs_fs.h | 1 + include/linux/pagemap.h | 13 +- include/linux/rmap.h | 3 +- include/net/dst_metadata.h | 4 +- include/scsi/scsi_transport_iscsi.h | 2 + kernel/futex.c | 2 +- kernel/kthread.c | 77 ++++++--- kernel/sched/fair.c | 4 +- kernel/trace/ring_buffer.c | 28 ++- kernel/trace/trace_events_hist.c | 6 +- lib/decompress_unlz4.c | 8 + lib/iov_iter.c | 2 +- lib/kstrtox.c | 13 +- lib/kstrtox.h | 2 + lib/seq_buf.c | 8 +- lib/vsprintf.c | 82 +++++---- mm/huge_memory.c | 58 ++++--- mm/hugetlb.c | 5 +- mm/internal.h | 53 ++++-- mm/memory.c | 41 +++++ mm/page_vma_mapped.c | 160 +++++++++++------- mm/pgtable-generic.c | 4 +- mm/rmap.c | 48 +++--- mm/truncate.c | 43 +++-- net/bridge/br_if.c | 17 +- net/bridge/br_multicast.c | 2 + net/core/filter.c | 4 - net/ipv4/fib_frontend.c | 2 + net/ipv4/ip_output.c | 32 ++-- net/ipv4/ip_tunnel.c | 22 ++- net/ipv4/tcp_fastopen.c | 19 ++- net/ipv4/tcp_ipv4.c | 4 +- net/ipv4/tcp_output.c | 1 + net/ipv4/udp.c | 6 +- net/ipv6/exthdrs.c | 31 ++-- net/ipv6/ip6_output.c | 36 ++-- net/ipv6/output_core.c | 28 +-- net/ipv6/tcp_ipv6.c | 22 ++- net/ipv6/udp.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 3 + net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_osf.c | 5 + net/netfilter/nft_tproxy.c | 9 +- net/netlabel/netlabel_mgmt.c | 19 ++- net/sched/act_skbmod.c | 12 +- net/sched/cls_api.c | 2 +- net/sched/sch_qfq.c | 8 +- net/sctp/auth.c | 2 + net/vmw_vsock/af_vsock.c | 2 +- net/xfrm/xfrm_user.c | 28 +-- security/integrity/evm/evm_main.c | 2 +- security/integrity/evm/evm_secfs.c | 13 +- 100 files changed, 1092 insertions(+), 638 deletions(-) -- 2.25.1

1 109

2025

2024

2023

2022

2021

2020

2019

Kernel