- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/4] net/nfc: fix use-after-free llcp_sock_bind/connect
by Yang Yingliang 26 May '21

26 May '21

From: Or Cohen <orcohen(a)paloaltonetworks.com> stable inclusion from linux-4.19.191 commit 48fba458fe54cc2a980a05c13e6c19b8b2cfb610 CVE: CVE-2021-23134 -------------------------------- commit c61760e6940dd4039a7f5e84a6afc9cdbf4d82b6 upstream. Commits 8a4cd82d ("nfc: fix refcount leak in llcp_sock_connect()") and c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()") fixed a refcount leak bug in bind/connect but introduced a use-after-free if the same local is assigned to 2 different sockets. This can be triggered by the following simple program: int sock1 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP ); int sock2 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP ); memset( &addr, 0, sizeof(struct sockaddr_nfc_llcp) ); addr.sa_family = AF_NFC; addr.nfc_protocol = NFC_PROTO_NFC_DEP; bind( sock1, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) ) bind( sock2, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) ) close(sock1); close(sock2); Fix this by assigning NULL to llcp_sock->local after calling nfc_llcp_local_put. This addresses CVE-2021-23134. Reported-by: Or Cohen <orcohen(a)paloaltonetworks.com> Reported-by: Nadav Markus <nmarkus(a)paloaltonetworks.com> Fixes: c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()") Signed-off-by: Or Cohen <orcohen(a)paloaltonetworks.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/nfc/llcp_sock.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c index bc269e83e1e55..59de4f54dd18c 100644 --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -121,12 +121,14 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) GFP_KERNEL); if (!llcp_sock->service_name) { nfc_llcp_local_put(llcp_sock->local); + llcp_sock->local = NULL; ret = -ENOMEM; goto put_dev; } llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock); if (llcp_sock->ssap == LLCP_SAP_MAX) { nfc_llcp_local_put(llcp_sock->local); + llcp_sock->local = NULL; kfree(llcp_sock->service_name); llcp_sock->service_name = NULL; ret = -EADDRINUSE; @@ -721,6 +723,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, llcp_sock->ssap = nfc_llcp_get_local_ssap(local); if (llcp_sock->ssap == LLCP_SAP_MAX) { nfc_llcp_local_put(llcp_sock->local); + llcp_sock->local = NULL; ret = -ENOMEM; goto put_dev; } @@ -759,6 +762,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, sock_unlink: nfc_llcp_put_ssap(local, llcp_sock->ssap); nfc_llcp_local_put(llcp_sock->local); + llcp_sock->local = NULL; nfc_llcp_sock_unlink(&local->connecting_sockets, sk); kfree(llcp_sock->service_name); -- 2.25.1

1 3

[PATCH kernel-4.19 000/418] backport linux-4.19.191
by Yang Yingliang 26 May '21

26 May '21

Adrian Hunter (1): mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based controllers Alexander Aring (1): fs: dlm: fix debugfs dump Alexander Lobakin (1): mtd: spinand: core: add missing MODULE_DEVICE_TABLE() Alexander Shishkin (2): intel_th: pci: Add Rocket Lake CPU support intel_th: pci: Add Alder Lake-M support Alexandru Elisei (1): KVM: arm64: Initialize VCPU mdcr_el2 before loading it Alexey Kardashevskiy (1): powerpc/iommu: Annotate nested lock for lockdep Andrew Scull (1): bug: Remove redundant condition check in report_bug Andy Shevchenko (5): usb: gadget: pch_udc: Revert d3cb25a12138 completely usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() usb: gadget: pch_udc: Check if driver is present before calling ->setup() usb: gadget: pch_udc: Check for DMA mapping error scripts: switch explicitly to Python 3 Anirudh Rayabharam (1): usb: gadget: dummy_hcd: fix gpf in gadget_setup Archie Pusaka (3): Bluetooth: verify AMP hci_chan before amp_destroy Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default Bluetooth: check for zapped sk before connecting Ard Biesheuvel (2): ARM: 9056/1: decompressor: fix BSS size calculation for LLVM ld.lld crypto: api - check for ERR pointers in crypto_destroy_tfm() Arnaldo Carvalho de Melo (1): perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars Arnd Bergmann (9): amdgpu: avoid incorrect %hu format string security: commoncap: fix -Wstringop-overread warning irqchip/gic-v3: Fix OF_BAD_ADDR error handling smp: Fix smp_call_function_single_async prototype x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes kgdb: fix gcc-11 warning on indentation usb: sl811-hcd: improve misleading indentation isdn: capi: fix mismatched prototypes PCI: thunder: Fix compile testing Artur Petrosyan (3): usb: dwc2: Fix session request interrupt handler usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. usb: dwc2: Fix hibernation between host and device modes. Arun Easi (1): scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() Athira Rajeev (1): powerpc/perf: Fix PMU constraint check for EBB events Avri Altman (2): mmc: block: Update ext_csd.cache_ctrl if it was written mmc: block: Issue a cache flush only when it's enabled Axel Rasmussen (1): userfaultfd: release page in error path to avoid BUG_ON Badhri Jagan Sridharan (1): usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS Bart Van Assche (3): scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() scsi: libfc: Fix a format specifier blk-mq: Swap two calls in blk_mq_exit_queue() Bence Csókás (1): i2c: Add I2C_AQ_NO_REP_START adapter quirk Benjamin Block (1): dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails Bill Wendling (1): arm64/vdso: Discard .note.gnu.property sections in vDSO Bjorn Andersson (2): soc: qcom: mdt_loader: Validate that p_filesz < p_memsz soc: qcom: mdt_loader: Detect truncated read of segments Bodo Stroesser (1): scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not found Brian King (1): scsi: ibmvfc: Fix invalid state machine BUG_ON() Chaitanya Kulkarni (1): scsi: target: pscsi: Fix warning in pscsi_complete_cmd() Chen Huang (1): powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration Chen Hui (1): clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE Chen Jun (1): posix-timers: Preserve return value in clock_adjtime32() Christoph Hellwig (11): modules: mark ref_module static modules: mark find_symbol static modules: mark each_symbol_section static modules: unexport __module_text_address modules: unexport __module_address modules: rename the licence field in struct symsearch to license modules: return licensing information from find_symbol modules: inherit TAINT_PROPRIETARY_MODULE md: split mddev_find md: factor out a mddev_find_locked helper from mddev_find nvme: do not try to reconfigure APST when the controller is not live Christophe JAILLET (3): usb: fotg210-hcd: Fix an error message ACPI: scan: Fix a memory leak in an error handling path xhci: Do not use GFP_KERNEL in (potentially) atomic context Christophe Leroy (1): powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add') Chunfeng Yun (3): arm64: dts: mt8173: fix property typo of 'phys' in dsi node usb: xhci-mtk: support quirk to disable usb2 lpm usb: core: hub: fix race condition about TRSMRCY of resume Claudio Imbrenda (2): KVM: s390: split kvm_s390_logical_to_effective KVM: s390: split kvm_s390_real_to_abs Colin Ian King (15): clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return drm/radeon: fix copy of uninitialized variable back to userspace memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] staging: rtl8192u: Fix potential infinite loop usb: gadget: r8a66597: Add missing null check on return from platform_get_resource media: vivid: fix assignment of dev->fbuf_out_flags media: m88rs6000t: avoid potential out-of-bounds reads on arrays clk: uniphier: Fix potential infinite loop liquidio: Fix unintented sign extension of a left shift of a u16 mt7601u: fix always true expression net: thunderx: Fix unintentional sign extension issue ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails net: davinci_emac: Fix incorrect masking of tx and rx error channel f2fs: fix a redundant call to f2fs_balance_fs if an error occurs iio: tsl2583: Fix division by a zero lux_val Cong Wang (1): smc: disallow TCP_ULP in smc_setsockopt() Dan Carpenter (9): ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() ovl: fix missing revert_creds() on error path mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() soc: aspeed: fix a ternary sign expansion bug HSI: core: fix resource leaks in hsi_add_client_from_dt() nfc: pn533: prevent potential memory corruption drm/i915/gvt: Fix error code in intel_gvt_init_device() bnxt_en: fix ternary sign extension bug in bnxt_show_temp() kfifo: fix ternary sign extension bugs Daniel Niv (1): media: media/saa7164: fix saa7164_encoder_register() memory leak bugs David Ward (2): ASoC: rt286: Generalize support for ALC3263 codec ASoC: rt286: Make RT286_SET_GPIO_* readable and writable Davide Caratti (1): openvswitch: fix stack OOB read while fragmenting IPv4 packets Dean Anderson (1): usb: gadget/function/f_fs string table fix for multiple languages Dinghao Liu (1): iio: proximity: pulsedlight: Fix rumtime PM imbalance on error Dmitry Baryshkov (1): PCI: Release OF node in pci_scan_device()'s error path Dmitry Osipenko (1): iio: gyro: mpu3050: Fix reported temperature value DooHyun Hwang (1): mmc: core: Do a power cycle when the CMD11 fails Eckhart Mohr (1): ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx Emmanuel Grumbach (1): mac80211: clear the beacon's CRC after channel switch Eric Dumazet (6): ip6_vti: proper dev_{hold|put} in ndo_[un]init methods netfilter: nftables: avoid overflows in nft_hash_buckets() ip6_gre: proper dev_{hold|put} in ndo_[un]init methods sit: proper dev_{hold|put} in ndo_[un]init methods ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods ipv6: remove extra dev_hold() for fallback tunnels Erwan Le Ray (2): serial: stm32: fix incorrect characters on console serial: stm32: fix tx_empty condition Ewan D. Milne (1): scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() Fabian Vogt (6): fotg210-udc: Fix DMA on EP0 for length > max packet size fotg210-udc: Fix EP0 IN requests bigger than two packets fotg210-udc: Remove a dubious condition leading to fotg210_done fotg210-udc: Mask GRP2 interrupts we don't handle fotg210-udc: Don't DMA more than the buffer can take fotg210-udc: Complete OUT requests on short packets Fabrice Gasnier (1): mfd: stm32-timers: Avoid clearing auto reload register Feilong Lin (1): ACPI / hotplug / PCI: Fix reference count leak in enable_slot() Felix Fietkau (1): net: ethernet: mtk_eth_soc: fix RX VLAN offload Felix Kuehling (1): drm/amdkfd: fix build error with AMD_IOMMU_V2=m Fengnan Chang (1): ext4: fix error code in ext4_commit_super Ferry Toth (1): usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield Filipe Manana (2): btrfs: fix metadata extent leak after failure to create subvolume btrfs: fix race when picking most recent mod log operation for an old root Finn Behrens (1): tweewide: Fix most Shebang lines Gao Xiang (1): erofs: add unsupported inode i_format check Geert Uytterhoeven (1): phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally Giovanni Cabiddu (1): crypto: qat - fix error path in adf_isr_resource_alloc() Greg Kroah-Hartman (2): kobject_uevent: remove warning in init_uevent_argv() Linux 4.19.191 Guchun Chen (1): drm/amdgpu: fix NULL pointer dereference Guochun Mao (1): ubifs: Only check replay with inode type to judge if inode linked Gustavo A. R. Silva (4): sctp: Fix out-of-bounds warning in sctp_process_asconf_param() ethtool: ioctl: Fix out-of-bounds warning in store_link_ksettings_for_user() wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join Hannes Reinecke (1): nvme: retrigger ANA log update if group descriptor isn't found Hans Verkuil (3): media: gspca/sq905.c: fix uninitialized variable media: vivid: update EDID media: gscpa/stv06xx: fix memory leak Hans de Goede (7): extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged misc: lis3lv02d: Fix false-positive WARN on various HP models ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 Harald Freudenberger (1): s390/archrandom: add parameter check for s390_arch_random_generate He Ying (1): firmware: qcom-scm: Fix QCOM_SCM configuration Heiko Carstens (1): KVM: s390: fix guarded storage control register handling Heinz Mauelshagen (1): dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload sequences Hemant Kumar (1): usb: gadget: Fix double free of device descriptor pointers Heming Zhao (1): md-cluster: fix use-after-free issue when removing rdev Hoang Le (1): tipc: convert dest node's address to network order Hui Wang (1): ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP Ido Schimmel (1): mlxsw: spectrum_mr: Update egress RIF list before route's action Ilya Lipnitskiy (3): MIPS: pci-mt7620: fix PLL lock check MIPS: pci-rt2880: fix slot 0 configuration MIPS: pci-legacy: stop using of_pci_range_to_resource Ingo Molnar (1): x86/platform/uv: Fix !KEXEC build failure James Smart (4): scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe scsi: lpfc: Fix pt2pt connection does not recover after LOGO scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic Jan Glauber (1): md: Fix missing unused status line of /proc/mdstat Jane Chu (1): mm/memory-failure: unnecessary amount of unmapping Jason Gunthorpe (1): vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer Jeff Layton (1): ceph: fix fscache invalidation Jeffrey Mitchell (1): ecryptfs: fix kernel panic with null dev_name Jerome Forissier (1): tee: optee: do not check memref size on return from Secure World Jia Zhou (1): ALSA: core: remove redundant spin_lock pair in snd_card_disconnect Jia-Ju Bai (2): rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data() kernel: kexec_file: fix error return code of kexec_calculate_store_digests() Joe Thornber (2): dm persistent data: packed struct should have an aligned() attribute too dm space map common: fix division bug in sm_ll_find_free_block() Johan Hovold (4): staging: greybus: uart: fix unprivileged TIOCCSERIAL USB: cdc-acm: fix unprivileged TIOCCSERIAL tty: actually undefine superseded ASYNC flags tty: fix return value for unsupported ioctls Johannes Berg (3): cfg80211: scan: drop entry from hidden_list on overflow mac80211: bail out if cipher schemes are invalid um: Mark all kernel symbols as local John Millikin (1): x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) Jonathan Cameron (1): iio:accel:adis16201: Fix wrong axis assignment that prevents loading Jonathan McDowell (1): net: stmmac: Set FIFO sizes for ipq806x Jonathon Reinhart (2): net: Only allow init netns to set default tcp cong to a restricted algo netfilter: conntrack: Make global sysctls readonly in non-init netns Jordan Niethe (1): powerpc/64s: Fix pte update for kernel memory on radix Josef Bacik (1): btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s Josh Poimboeuf (1): pinctrl: ingenic: Improve unreachable code generation Jouni Roivas (1): hfsplus: prevent corruption in shrinking truncate Julian Braha (1): media: drivers: media: pci: sta2x11: fix Kconfig dependency on GPIOLIB Kai Stuhlemmer (ebee Engineering) (1): mtd: rawnand: atmel: Update ecc_stats.corrected counter Kai-Heng Feng (1): drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected Kaixu Xia (1): cxgb4: Fix the -Wmisleading-indentation warning Kees Cook (2): drm/radeon: Fix off-by-one power_state index heap overwrite drm/radeon: Avoid power table parsing memory leaks Krzysztof Kozlowski (7): ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 ARM: dts: exynos: correct PMIC interrupt trigger level on Snow pinctrl: samsung: use 'int' for register masks in Exynos Kunihiko Hayashi (2): ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E Linus Torvalds (1): Fix misc new gcc warnings Lukasz Luba (1): thermal/core/fair share: Lock the thermal zone while looping over instances Lv Yunlong (10): ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer ALSA: sb: Fix two use after free in snd_sb_qsound_build mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init crypto: qat - Fix a double free in adf_create_ring drivers/block/null_blk/main: Fix a double free in null_init. mwl8k: Fix a double Free in mwl8k_probe_hw net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res net:nfc:digital: Fix a double free in digital_tg_recv_dep_req ethernet:enic: Fix a use after free bug in enic_hard_start_xmit Maciej W. Rozycki (5): FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR FDDI: defxx: Make MMIO the configuration default except for EISA MIPS: Reinstate platform `__div64_32' handler MIPS: Avoid DIVU in `__div64_32' is result would be zero MIPS: Avoid handcoded DIVU in `__div64_32' altogether Maciej Żenczykowski (1): net: fix nla_strcmp to handle more then one trailing null character Magnus Karlsson (1): xsk: Simplify detection of empty and full rings Mahesh Salgaonkar (1): powerpc/eeh: Fix EEH handling for hugepages in ioremap space. Manivannan Sadhasivam (3): mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() mtd: rawnand: qcom: Return actual error code instead of -ENODEV ARM: 9075/1: kernel: Fix interrupted SMC calls Marc Zyngier (1): ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure Marcel Hamer (1): usb: dwc3: omap: improve extcon initialization Marek Behún (3): arm64: dts: marvell: armada-37xx: add syscon compatible to NB clk node cpufreq: armada-37xx: Fix setting TBG parent for load levels clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock Marek Vasut (1): rsi: Use resume_noirq for SDIO Marijn Suijten (1): drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal Mark Langsdorf (2): ACPI: custom_method: fix potential use-after-free issue ACPI: custom_method: fix a possible memory leak Masami Hiramatsu (1): x86/kprobes: Fix to check non boostable prefixes correctly Mathias Nyman (2): xhci: check control context is valid before dereferencing it. xhci: fix potential array out of bounds with several interrupters Matthias Schiffer (1): power: supply: bq27xxx: fix power_avg for newer ICs Maxim Mikityanskiy (1): HID: plantronics: Workaround for double volume key presses Maximilian Luz (1): usb: xhci: Increase timeout for HC halt Meng Li (1): regmap: set debugfs_name to NULL after it is freed Miaohe Lin (3): khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate() mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() ksm: fix potential missing rmap_item for stable_node Michael Ellerman (3): powerpc/pseries: Stop calling printk in rtas_stop_self() powerpc/64s: Fix crashes when toggling stf barrier powerpc/64s: Fix crashes when toggling entry flush barrier Michael Kelley (1): Drivers: hv: vmbus: Increase wait time for VMbus unload Michael Walle (1): mtd: require write permissions for locking and badblock ioctls Mihai Moldovan (1): kconfig: nconf: stop endless search loops Miklos Szeredi (1): cuse: prevent clone Muhammad Usama Anjum (1): media: em28xx: fix memory leak Nathan Chancellor (5): ACPI: CPPC: Replace cppc_attr with kobj_attribute x86/events/amd/iommu: Fix sysfs type mismatch powerpc/prom: Mark identical_pvr_fixup as __init scripts/recordmcount.pl: Fix RISC-V regex for clang riscv: Workaround mcount name prior to clang-13 Nikola Livic (1): pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() Nikolay Aleksandrov (1): net: bridge: when suppression is enabled exclude RARP packets Nobuhiro Iwamatsu (1): rtc: ds1307: Fix wday settings for rx8130 Odin Ugedal (1): sched/fair: Fix unfairness caused by missing load decay Olga Kornievskaia (1): NFSv4.2 fix handling of sr_eof in SEEK's reply Oliver Neukum (1): cdc-wdm: untangle a circular dependency between callback and softint Or Cohen (1): net/nfc: fix use-after-free llcp_sock_bind/connect Otavio Pontes (1): x86/microcode: Check for offline CPUs before requesting new microcode Pablo Neira Ayuso (2): netfilter: xt_SECMARK: add new revision to fix structure layout netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check Pali Rohár (6): cpufreq: armada-37xx: Fix the AVS value for load L1 clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0 cpufreq: armada-37xx: Fix driver cleanup when registration failed cpufreq: armada-37xx: Fix determining base CPU frequency PCI: iproc: Fix return value of iproc_msi_irq_domain_alloc() Pan Bian (1): bus: qcom: Put child node before return Paul Aurich (1): cifs: Return correct error code from smb2_get_enc_key Paul Clements (1): md/raid1: properly indicate failure when ending a failed write request Pavel Machek (1): intel_th: Consistency and off-by-one fix Pavel Skripkin (2): media: dvb-usb: fix memory leak in dvb_usb_adapter_init tty: fix memory leak in vc_deallocate Pawel Laszczak (1): usb: gadget: uvc: add bInterval checking for HS mode Paweł Chmiel (1): clk: exynos7: Mark aclk_fsys1_200 as critical Peilin Ye (1): media: dvbdev: Fix memory leak in dvb_media_device_free() Phil Elwell (1): usb: dwc2: Fix gadget DMA unmap direction Phillip Lougher (1): squashfs: fix divide error in calculate_skip() Phillip Potter (2): fbdev: zero-fill colormap in fbcmap.c net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb Pierre-Louis Bossart (1): ASoC: samsung: tm2_wm5110: check of of_parse return value Ping-Ke Shih (1): rtlwifi: 8821ae: upgrade PHY and RF parameters Quentin Perret (2): Revert "of/fdt: Make sure no-map does not remove already reserved regions" Revert "fdt: Properly handle "no-map" field in the memory region" Quinn Tran (1): scsi: qla2xxx: Fix use after free in bsg Rafael J. Wysocki (1): PCI: PM: Do not read power state in pci_enable_device_flags() Rander Wang (1): soundwire: stream: fix memory leak in stream config error path Randy Dunlap (1): powerpc: iommu: fix build when neither PCI or IBMVIO is set Robin Murphy (1): perf/arm_pmu_platform: Fix error handling Ruslan Bilovol (1): usb: gadget: f_uac1: validate input parameters Salil Mehta (1): net: hns3: Limiting the scope of vector_ring_chain variable Sandeep Singh (1): xhci: Add reset resume quirk for AMD xhci controller. Sean Christopherson (1): x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported Sean Young (1): media: ite-cir: check for receive overflow Sergei Trofimovich (1): ia64: module: fix symbolizer crash on fdescr Sergey Shtylyov (12): pata_arasan_cf: fix IRQ check pata_ipx4xx_cf: fix IRQ check sata_mv: add IRQ checks ata: libahci_platform: fix IRQ check scsi: jazz_esp: Add IRQ check scsi: sun3x_esp: Add IRQ check scsi: sni_53c710: Add IRQ check i2c: cadence: add IRQ check i2c: emev2: add IRQ check i2c: jz4780: add IRQ check i2c: sh7760: add IRQ check i2c: sh7760: fix IRQ error path Seunghui Lee (1): mmc: core: Set read only for SD cards with permanent write protect bit Shengjiu Wang (1): ASoC: ak5558: correct reset polarity Shuah Khan (1): ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock Sindhu Devale (1): RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails Srikar Dronamraju (1): powerpc/smp: Set numa node before updating mask Srinivas Kandagatla (1): soundwire: bus: Fix device found flag correctly Stefan Berger (1): tpm: vtpm_proxy: Avoid reading host log when using a virtual device Stefano Garzarella (1): vsock/vmci: log once the failed queue pair allocation Steffen Dirkwinkel (1): platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table Steven Rostedt (VMware) (3): ftrace: Handle commands when closing set_ftrace_filter file tracing: Map all PIDs to command lines tracing: Restructure trace_clock_global() to never block Sudhakar Panneerselvam (1): md/bitmap: wait for external bitmap writes to complete during tear down Taehee Yoo (1): hsr: use netdev_err() instead of WARN_ONCE() Takashi Iwai (12): ALSA: hda/conexant: Re-order CX5066 quirk table entries ALSA: usb-audio: Explicitly set up the clock selector ALSA: usb-audio: More constifications ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries ALSA: hda/realtek: Re-order ALC269 HP quirk table entries ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls Tao Ren (1): usb: gadget: aspeed: fix dma map failure Tetsuo Handa (4): misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct misc: vmw_vmci: explicitly initialize vmci_datagram payload ttyprintk: Add TTY hangup callback. Bluetooth: initialize skb_queue_head at l2cap_chan_create() Thinh Nguyen (2): usb: xhci: Fix port minor revision usb: dwc3: gadget: Fix START_TRANSFER link state check Thomas Gleixner (2): Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") KVM: x86: Cancel pvclock_gtod_work on module removal Timo Gurr (1): ALSA: usb-audio: Add dB range mapping for Sennheiser Communications Headset PC 8 Toke Høiland-Jørgensen (1): ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices Tong Zhang (5): crypto: qat - don't release uninitialized resources crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init ALSA: hdsp: don't disable if not enabled ALSA: hdspm: don't disable if not enabled ALSA: rme9652: don't disable if not enabled Tony Ambardar (1): powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h Trond Myklebust (4): NFS: Don't discard pNFS layout segments that are marked for return NFSv4: Don't discard segments marked for return in _pnfs_return_layout() NFSv4.2: Always flush out writes in nfs42_proc_fallocate() NFS: Deal correctly with attribute generation counter overflow Tudor Ambarus (1): spi: spi-ti-qspi: Free DMA resources Tyrel Datwyler (1): powerpc/pseries: extract host bridge from pci_bus prior to bus removal Vasily Gorbik (1): s390/disassembler: increase ebpf disasm buffer size Vineet Gupta (1): ARC: entry: fix off-by-one error in syscall number validation Vitaly Kuznetsov (1): genirq/matrix: Prevent allocation counter corruption Waiman Long (1): sched/debug: Fix cgroup_path[] serialization Wang Wensheng (3): IB/hfi1: Fix error return code in parse_platform_config() RDMA/srpt: Fix error return code in srpt_cm_req_recv() mm/sparse: add the missing sparse_buffer_fini() in error branch Wei Yongjun (2): spi: dln2: Fix reference leak to master spi: omap-100k: Fix reference leak to master Wesley Cheng (2): usb: dwc3: gadget: Ignore EP queue requests during bus reset usb: dwc3: gadget: Return success always for kick transfer in ep queue William A. Kennington III (1): spi: Fix use-after-free with devm_spi_alloc_* Wolfram Sang (1): i2c: bail out early when RDWR parameters are wrong Xie He (1): net: lapbether: Prevent racing when checking whether the netif is running Xin Long (4): Revert "net/sctp: fix race condition in sctp_destroy_sock" sctp: delay auto_asconf init until binding the first addr sctp: do asoc update earlier in sctp_sf_do_dupcook_a sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b Yang Yang (1): jffs2: check the validity of dstlen in jffs2_zlib_compress() Yang Yingliang (10): phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() media: tc358743: fix possible use-after-free in tc358743_remove() media: adv7604: fix possible use-after-free in adv76xx_remove() media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() media: i2c: adv7842: fix possible use-after-free in adv7842_remove() USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() media: omap4iss: return error code when omap4iss_get() failed PCI: endpoint: Fix missing destroy_workqueue() Yannick Vignon (1): net: stmmac: Do not enable RX FIFO overflow interrupts Yaqi Chen (1): samples/bpf: Fix broken tracex1 due to kprobe argument change Ye Bin (1): usbip: vudc: fix missing unlock on error in usbip_sockfd_store() Yonghong Song (1): selftests: Set CC to clang in lib.mk if LLVM is set Yunjian Wang (1): i40e: Fix use-after-free in i40e_client_subtask() Zhao Heming (1): md: md_open returns -EBUSY when entering racing area Zhen Lei (2): tpm: fix error return code in tpm2_get_cc_attrs_tbl() ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook Zqiang (1): lib: stackdepot: turn depot_lock spinlock to raw_spinlock dongjian (1): power: supply: Use IRQF_ONESHOT karthik alapati (1): staging: wimax/i2400m: fix byte-order issue lizhe (1): jffs2: Fix kasan slab-out-of-bounds problem louis.wang (1): ARM: 9066/1: ftrace: pause/unpause function graph tracer in cpu_suspend() shaoyunl (1): drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f yangerkun (1): block: reexpand iov_iter after read/write Álvaro Fernández Rojas (1): mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC Documentation/sphinx/parse-headers.pl | 2 +- Documentation/target/tcm_mod_builder.py | 2 +- Documentation/trace/postprocess/decode_msr.py | 2 +- .../trace-pagealloc-postprocess.pl | 2 +- .../postprocess/trace-vmscan-postprocess.pl | 2 +- Makefile | 2 +- arch/arc/kernel/entry.S | 4 +- arch/arm/boot/compressed/Makefile | 4 +- arch/arm/boot/dts/exynos4412-midas.dtsi | 6 +- .../boot/dts/exynos4412-odroid-common.dtsi | 2 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 2 +- arch/arm/boot/dts/exynos5250-snow-common.dtsi | 2 +- arch/arm/boot/dts/uniphier-pxs2.dtsi | 2 +- arch/arm/include/asm/kvm_host.h | 1 + arch/arm/kernel/asm-offsets.c | 3 + arch/arm/kernel/hw_breakpoint.c | 2 +- arch/arm/kernel/smccc-call.S | 11 +- arch/arm/kernel/suspend.c | 19 +- arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 3 +- arch/arm64/boot/dts/mediatek/mt8173.dtsi | 2 +- .../boot/dts/socionext/uniphier-ld20.dtsi | 2 +- .../boot/dts/socionext/uniphier-pxs3.dtsi | 4 +- arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kernel/vdso/vdso.lds.S | 8 +- arch/arm64/kvm/debug.c | 88 ++- arch/ia64/include/asm/module.h | 6 +- arch/ia64/kernel/module.c | 29 +- arch/ia64/scripts/unwcheck.py | 2 +- arch/mips/include/asm/div64.h | 55 +- arch/mips/pci/pci-legacy.c | 9 +- arch/mips/pci/pci-mt7620.c | 5 +- arch/mips/pci/pci-rt2880.c | 37 +- arch/powerpc/Kconfig | 2 +- arch/powerpc/Kconfig.debug | 1 + arch/powerpc/include/asm/book3s/64/radix.h | 6 +- arch/powerpc/include/uapi/asm/errno.h | 1 + arch/powerpc/kernel/eeh.c | 11 +- arch/powerpc/kernel/iommu.c | 4 +- arch/powerpc/kernel/prom.c | 2 +- arch/powerpc/kernel/smp.c | 6 +- arch/powerpc/lib/feature-fixups.c | 35 +- arch/powerpc/mm/pgtable-radix.c | 4 +- arch/powerpc/perf/isa207-common.c | 4 +- arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +- arch/powerpc/platforms/pseries/hotplug-cpu.c | 3 - arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +- arch/riscv/include/asm/ftrace.h | 14 +- arch/riscv/kernel/mcount.S | 10 +- arch/s390/crypto/arch_random.c | 4 + arch/s390/kernel/dis.c | 2 +- arch/s390/kvm/gaccess.h | 54 +- arch/s390/kvm/kvm-s390.c | 4 +- arch/um/kernel/dyn.lds.S | 6 + arch/um/kernel/uml.lds.S | 6 + arch/x86/Kconfig | 1 + arch/x86/Makefile | 1 + arch/x86/entry/vdso/vma.c | 2 +- arch/x86/events/amd/iommu.c | 6 +- arch/x86/kernel/cpu/microcode/core.c | 8 +- arch/x86/kernel/kprobes/core.c | 17 +- arch/x86/kvm/x86.c | 1 + arch/x86/lib/msr-smp.c | 4 +- block/blk-mq.c | 6 +- crypto/api.c | 2 +- drivers/acpi/arm64/gtdt.c | 10 +- drivers/acpi/cppc_acpi.c | 14 +- drivers/acpi/custom_method.c | 4 +- drivers/acpi/scan.c | 1 + drivers/ata/libahci_platform.c | 4 +- drivers/ata/pata_arasan_cf.c | 15 +- drivers/ata/pata_ixp4xx_cf.c | 6 +- drivers/ata/sata_mv.c | 4 + drivers/base/regmap/regmap-debugfs.c | 1 + drivers/block/null_blk_zoned.c | 1 + drivers/bus/qcom-ebi2.c | 4 +- drivers/char/tpm/eventlog/common.c | 3 + drivers/char/tpm/tpm2-cmd.c | 1 + drivers/char/ttyprintk.c | 11 + drivers/clk/mvebu/armada-37xx-periph.c | 83 +-- drivers/clk/qcom/a53-pll.c | 1 + drivers/clk/samsung/clk-exynos7.c | 7 +- drivers/clk/socfpga/clk-gate-a10.c | 1 + drivers/clk/uniphier/clk-uniphier-mux.c | 4 +- drivers/cpufreq/armada-37xx-cpufreq.c | 76 ++- drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 +- drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 +- drivers/crypto/qat/qat_common/adf_isr.c | 29 +- drivers/crypto/qat/qat_common/adf_transport.c | 1 + drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +- drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 +- drivers/extcon/extcon-arizona.c | 17 +- drivers/firmware/Kconfig | 1 + drivers/gpio/gpiolib-acpi.c | 14 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_iommu.c | 6 + drivers/gpu/drm/amd/amdkfd/kfd_iommu.h | 9 +- drivers/gpu/drm/i915/gvt/gvt.c | 8 +- drivers/gpu/drm/i915/intel_pm.c | 2 +- .../gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c | 10 +- drivers/gpu/drm/radeon/radeon.h | 1 + drivers/gpu/drm/radeon/radeon_atombios.c | 26 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/radeon/radeon_pm.c | 8 + drivers/gpu/drm/radeon/si_dpm.c | 3 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-plantronics.c | 60 ++- drivers/hsi/hsi_core.c | 3 +- drivers/hv/channel_mgmt.c | 30 +- drivers/hwtracing/intel_th/gth.c | 4 +- drivers/hwtracing/intel_th/pci.c | 10 + drivers/i2c/busses/i2c-cadence.c | 5 +- drivers/i2c/busses/i2c-emev2.c | 5 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/i2c/busses/i2c-sh7760.c | 5 +- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/accel/adis16201.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 13 +- drivers/iio/light/tsl2583.c | 8 + .../iio/proximity/pulsedlight-lidar-lite-v2.c | 1 + drivers/infiniband/hw/bnxt_re/qplib_res.c | 1 + drivers/infiniband/hw/hfi1/firmware.c | 1 + drivers/infiniband/hw/i40iw/i40iw_pble.c | 6 +- drivers/infiniband/ulp/srpt/ib_srpt.c | 1 + drivers/input/touchscreen/elants_i2c.c | 44 +- drivers/input/touchscreen/silead.c | 44 +- drivers/irqchip/irq-gic-v3-mbi.c | 2 +- drivers/isdn/capi/kcapi.c | 4 +- drivers/md/dm-raid.c | 34 +- drivers/md/dm-rq.c | 2 + drivers/md/md-bitmap.c | 2 + drivers/md/md.c | 73 ++- .../md/persistent-data/dm-btree-internal.h | 4 +- .../md/persistent-data/dm-space-map-common.c | 2 + .../md/persistent-data/dm-space-map-common.h | 8 +- drivers/md/raid1.c | 2 + drivers/media/dvb-core/dvbdev.c | 1 + drivers/media/i2c/adv7511-v4l2.c | 2 +- drivers/media/i2c/adv7604.c | 2 +- drivers/media/i2c/adv7842.c | 2 +- drivers/media/i2c/tc358743.c | 2 +- drivers/media/pci/saa7164/saa7164-encoder.c | 20 +- drivers/media/pci/sta2x11/Kconfig | 1 + drivers/media/platform/vivid/vivid-core.c | 6 +- drivers/media/platform/vivid/vivid-vid-out.c | 2 +- drivers/media/rc/ite-cir.c | 8 +- drivers/media/tuners/m88rs6000t.c | 6 +- drivers/media/usb/dvb-usb/dvb-usb-init.c | 20 +- drivers/media/usb/dvb-usb/dvb-usb.h | 2 +- drivers/media/usb/em28xx/em28xx-dvb.c | 1 + drivers/media/usb/gspca/gspca.c | 2 + drivers/media/usb/gspca/gspca.h | 1 + drivers/media/usb/gspca/sq905.c | 2 +- drivers/media/usb/gspca/stv06xx/stv06xx.c | 9 + drivers/memory/omap-gpmc.c | 7 +- drivers/mfd/stm32-timers.c | 7 +- drivers/misc/aspeed-lpc-snoop.c | 4 +- drivers/misc/kgdbts.c | 26 +- drivers/misc/lis3lv02d/lis3lv02d.c | 21 +- drivers/misc/vmw_vmci/vmci_doorbell.c | 2 +- drivers/misc/vmw_vmci/vmci_guest.c | 2 +- drivers/mmc/core/block.c | 16 + drivers/mmc/core/core.c | 2 +- drivers/mmc/core/core.h | 9 + drivers/mmc/core/mmc.c | 7 + drivers/mmc/core/mmc_ops.c | 4 +- drivers/mmc/core/sd.c | 6 + drivers/mmc/host/sdhci-pci-core.c | 27 + drivers/mtd/mtdchar.c | 8 +- drivers/mtd/mtdcore.c | 3 + drivers/mtd/nand/raw/atmel/nand-controller.c | 6 +- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 + drivers/mtd/nand/raw/fsmc_nand.c | 2 + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +- drivers/mtd/nand/raw/qcom_nandc.c | 7 +- drivers/mtd/nand/spi/core.c | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- .../ethernet/cavium/liquidio/cn23xx_pf_regs.h | 2 +- .../ethernet/cavium/thunder/nicvf_queues.c | 2 +- .../ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 2 +- drivers/net/ethernet/cisco/enic/enic_main.c | 7 +- .../net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +- drivers/net/ethernet/intel/i40e/i40e_client.c | 1 + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 + .../net/ethernet/mellanox/mlxsw/spectrum_mr.c | 30 +- drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +- .../ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac4_dma.c | 7 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 14 +- drivers/net/ethernet/ti/davinci_emac.c | 4 +- drivers/net/fddi/Kconfig | 15 +- drivers/net/fddi/defxx.c | 47 +- drivers/net/geneve.c | 4 +- drivers/net/wan/lapbether.c | 32 +- drivers/net/wimax/i2400m/op-rfkill.c | 2 +- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +- drivers/net/wireless/ath/ath9k/hw.c | 2 +- .../net/wireless/intel/ipw2x00/libipw_wx.c | 6 +- drivers/net/wireless/marvell/mwl8k.c | 1 + .../net/wireless/mediatek/mt7601u/eeprom.c | 2 +- .../realtek/rtlwifi/rtl8821ae/table.c | 500 +++++++++++++----- drivers/net/wireless/rsi/rsi_91x_sdio.c | 2 +- drivers/net/wireless/wl3501.h | 47 +- drivers/net/wireless/wl3501_cs.c | 54 +- drivers/nfc/pn533/pn533.c | 3 + drivers/nvme/host/core.c | 3 +- drivers/nvme/host/multipath.c | 4 + drivers/of/fdt.c | 12 +- drivers/pci/controller/pci-thunder-ecam.c | 2 +- drivers/pci/controller/pci-thunder-pem.c | 13 +- drivers/pci/controller/pcie-iproc-msi.c | 2 +- drivers/pci/endpoint/functions/pci-epf-test.c | 3 + drivers/pci/hotplug/acpiphp_glue.c | 1 + drivers/pci/pci.c | 16 +- drivers/pci/pci.h | 6 + drivers/pci/probe.c | 1 + drivers/perf/arm_pmu_platform.c | 2 +- drivers/phy/marvell/Kconfig | 4 +- drivers/phy/ti/phy-twl4030-usb.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 3 +- drivers/pinctrl/samsung/pinctrl-exynos.c | 10 +- drivers/platform/x86/pmc_atom.c | 28 +- drivers/power/supply/bq27xxx_battery.c | 51 +- drivers/power/supply/generic-adc-battery.c | 2 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/pm2301_charger.c | 2 +- drivers/power/supply/s3c_adc_battery.c | 2 +- drivers/power/supply/tps65090-charger.c | 2 +- drivers/power/supply/tps65217_charger.c | 2 +- drivers/rpmsg/qcom_glink_native.c | 1 + drivers/rtc/rtc-ds1307.c | 12 +- drivers/scsi/device_handler/scsi_dh_alua.c | 5 +- drivers/scsi/ibmvscsi/ibmvfc.c | 57 +- drivers/scsi/jazz_esp.c | 4 +- drivers/scsi/libfc/fc_lport.c | 2 +- drivers/scsi/lpfc/lpfc_crtn.h | 3 - drivers/scsi/lpfc/lpfc_hw4.h | 174 +----- drivers/scsi/lpfc/lpfc_init.c | 103 +--- drivers/scsi/lpfc/lpfc_mbox.c | 36 -- drivers/scsi/lpfc/lpfc_nportdisc.c | 11 +- drivers/scsi/lpfc/lpfc_nvmet.c | 1 - drivers/scsi/lpfc/lpfc_sli.c | 1 - drivers/scsi/qla2xxx/qla_attr.c | 8 +- drivers/scsi/qla2xxx/qla_bsg.c | 3 +- drivers/scsi/qla2xxx/qla_os.c | 7 - drivers/scsi/sni_53c710.c | 5 +- drivers/scsi/sun3x_esp.c | 4 +- drivers/soc/qcom/mdt_loader.c | 17 + drivers/soundwire/bus.c | 3 +- drivers/soundwire/stream.c | 10 +- drivers/spi/spi-dln2.c | 2 +- drivers/spi/spi-omap-100k.c | 6 +- drivers/spi/spi-ti-qspi.c | 20 +- drivers/spi/spi.c | 9 +- drivers/staging/erofs/erofs_fs.h | 3 + drivers/staging/erofs/inode.c | 6 + drivers/staging/greybus/uart.c | 2 - drivers/staging/media/omap4iss/iss.c | 4 +- drivers/staging/rtl8192u/r8192U_core.c | 2 +- drivers/target/target_core_pscsi.c | 3 +- drivers/target/target_core_user.c | 4 +- drivers/tee/optee/core.c | 10 - drivers/thermal/fair_share.c | 4 + drivers/tty/serial/stm32-usart.c | 17 +- drivers/tty/serial/stm32-usart.h | 3 - drivers/tty/tty_io.c | 8 +- drivers/tty/vt/vt.c | 1 + drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-wdm.c | 30 +- drivers/usb/core/hub.c | 6 +- drivers/usb/dwc2/core.h | 2 + drivers/usb/dwc2/core_intr.c | 162 +++--- drivers/usb/dwc2/gadget.c | 3 +- drivers/usb/dwc2/hcd.c | 10 +- drivers/usb/dwc3/dwc3-omap.c | 5 + drivers/usb/dwc3/dwc3-pci.c | 1 + drivers/usb/dwc3/gadget.c | 26 +- drivers/usb/gadget/config.c | 4 + drivers/usb/gadget/function/f_fs.c | 3 +- drivers/usb/gadget/function/f_uac1.c | 43 ++ drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/udc/aspeed-vhub/core.c | 3 +- drivers/usb/gadget/udc/aspeed-vhub/epn.c | 2 +- drivers/usb/gadget/udc/dummy_hcd.c | 23 +- drivers/usb/gadget/udc/fotg210-udc.c | 26 +- drivers/usb/gadget/udc/pch_udc.c | 49 +- drivers/usb/gadget/udc/r8a66597-udc.c | 2 + drivers/usb/gadget/udc/snps_udc_plat.c | 4 +- drivers/usb/host/fotg210-hcd.c | 4 +- drivers/usb/host/sl811-hcd.c | 9 +- drivers/usb/host/xhci-ext-caps.h | 5 +- drivers/usb/host/xhci-mem.c | 9 + drivers/usb/host/xhci-mtk.c | 3 + drivers/usb/host/xhci-mtk.h | 1 + drivers/usb/host/xhci-pci.c | 4 +- drivers/usb/host/xhci.c | 20 +- drivers/usb/typec/tcpci.c | 21 +- drivers/usb/usbip/vudc_sysfs.c | 2 + drivers/vfio/mdev/mdev_sysfs.c | 2 +- drivers/video/fbdev/core/fbcmap.c | 8 +- fs/block_dev.c | 20 +- fs/btrfs/ctree.c | 20 + fs/btrfs/ioctl.c | 18 +- fs/btrfs/relocation.c | 6 +- fs/ceph/caps.c | 1 + fs/ceph/inode.c | 1 + fs/cifs/smb2ops.c | 2 +- fs/dlm/debug_fs.c | 1 + fs/ecryptfs/main.c | 6 + fs/ext4/super.c | 6 +- fs/f2fs/inline.c | 3 +- fs/fuse/cuse.c | 2 + fs/hfsplus/extents.c | 7 +- fs/jffs2/compr_rtime.c | 3 + fs/jffs2/scan.c | 2 +- fs/nfs/flexfilelayout/flexfilelayout.c | 2 +- fs/nfs/inode.c | 8 +- fs/nfs/nfs42proc.c | 21 +- fs/nfs/pnfs.c | 7 +- fs/overlayfs/copy_up.c | 3 +- fs/squashfs/file.c | 6 +- fs/ubifs/replay.c | 3 +- include/crypto/acompress.h | 2 + include/crypto/aead.h | 2 + include/crypto/akcipher.h | 2 + include/crypto/hash.h | 4 + include/crypto/kpp.h | 2 + include/crypto/rng.h | 2 + include/crypto/skcipher.h | 2 + include/linux/hid.h | 2 + include/linux/i2c.h | 2 + include/linux/module.h | 26 +- include/linux/power/bq27xxx_battery.h | 1 - include/linux/smp.h | 2 +- include/linux/spi/spi.h | 3 + include/linux/tty_driver.h | 2 +- include/net/bluetooth/hci_core.h | 1 + include/scsi/libfcoe.h | 2 +- include/uapi/linux/netfilter/xt_SECMARK.h | 6 + include/uapi/linux/tty_flags.h | 4 +- kernel/futex.c | 3 +- kernel/irq/matrix.c | 4 +- kernel/kexec_file.c | 4 +- kernel/module.c | 61 ++- kernel/sched/debug.c | 42 +- kernel/sched/fair.c | 12 +- kernel/smp.c | 10 +- kernel/time/posix-timers.c | 4 +- kernel/trace/ftrace.c | 5 +- kernel/trace/trace.c | 41 +- kernel/trace/trace_clock.c | 44 +- kernel/up.c | 2 +- lib/bug.c | 33 +- lib/kobject_uevent.c | 9 +- lib/nlattr.c | 2 +- lib/stackdepot.c | 6 +- mm/hugetlb.c | 11 +- mm/khugepaged.c | 18 +- mm/ksm.c | 1 + mm/memory-failure.c | 2 +- mm/shmem.c | 12 +- mm/sparse.c | 1 + net/bluetooth/ecdh_helper.h | 2 +- net/bluetooth/hci_event.c | 3 +- net/bluetooth/l2cap_core.c | 4 + net/bluetooth/l2cap_sock.c | 8 + net/bridge/br_arp_nd_proxy.c | 4 +- net/core/ethtool.c | 2 +- net/hsr/hsr_framereg.c | 3 +- net/ipv4/tcp_cong.c | 4 + net/ipv6/ip6_gre.c | 7 +- net/ipv6/ip6_tunnel.c | 3 +- net/ipv6/ip6_vti.c | 3 +- net/ipv6/sit.c | 5 +- net/mac80211/main.c | 7 +- net/mac80211/mlme.c | 5 + net/netfilter/nf_conntrack_standalone.c | 5 +- net/netfilter/nfnetlink_osf.c | 2 + net/netfilter/nft_set_hash.c | 10 +- net/netfilter/xt_SECMARK.c | 88 ++- net/nfc/digital_dep.c | 2 + net/nfc/llcp_sock.c | 4 + net/openvswitch/actions.c | 8 +- net/sctp/sm_make_chunk.c | 2 +- net/sctp/sm_statefuns.c | 28 +- net/sctp/socket.c | 38 +- net/smc/af_smc.c | 4 +- net/tipc/netlink_compat.c | 2 +- net/vmw_vsock/vmci_transport.c | 3 +- net/wireless/scan.c | 2 + net/xdp/xsk_queue.h | 7 +- samples/bpf/tracex1_kern.c | 4 +- samples/kfifo/bytestream-example.c | 8 +- samples/kfifo/inttype-example.c | 8 +- samples/kfifo/record-example.c | 8 +- scripts/bloat-o-meter | 2 +- scripts/config | 2 +- scripts/diffconfig | 2 +- scripts/kconfig/nconf.c | 2 +- scripts/recordmcount.pl | 2 +- scripts/split-man.pl | 2 +- security/commoncap.c | 2 +- sound/core/init.c | 2 - sound/isa/sb/emu8000.c | 4 +- sound/isa/sb/sb16_csp.c | 8 +- sound/pci/hda/hda_generic.c | 16 +- sound/pci/hda/patch_conexant.c | 14 +- sound/pci/hda/patch_realtek.c | 89 ++-- sound/pci/rme9652/hdsp.c | 3 +- sound/pci/rme9652/hdspm.c | 3 +- sound/pci/rme9652/rme9652.c | 3 +- sound/soc/codecs/ak5558.c | 4 +- sound/soc/codecs/rt286.c | 23 +- sound/soc/intel/boards/bytcr_rt5640.c | 20 + sound/soc/samsung/tm2_wm5110.c | 2 +- sound/usb/card.c | 14 +- sound/usb/clock.c | 18 +- sound/usb/midi.c | 2 +- sound/usb/mixer.c | 60 +-- sound/usb/mixer_maps.c | 68 ++- sound/usb/mixer_quirks.c | 6 +- sound/usb/mixer_scarlett.c | 14 +- sound/usb/proc.c | 2 +- sound/usb/quirks.c | 16 +- sound/usb/stream.c | 4 +- sound/usb/usbaudio.h | 2 + sound/usb/validate.c | 4 +- tools/perf/python/tracepoint.py | 2 +- tools/perf/util/symbol_fprintf.c | 2 +- tools/testing/ktest/compare-ktest-sample.pl | 2 +- tools/testing/selftests/bpf/test_offload.py | 2 +- tools/testing/selftests/lib.mk | 4 + .../testing/selftests/tc-testing/tdc_batch.py | 2 +- virt/kvm/arm/arm.c | 2 + 437 files changed, 3166 insertions(+), 1786 deletions(-) -- 2.25.1

1 413

[PATCH kernel-4.19 1/2] x86/apic/vector: Force interupt handler invocation to irq context
by Yang Yingliang 26 May '21

26 May '21

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-5.7 commit 008f1d60fe25810d4554916744b0975d76601b64 category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- Sathyanarayanan reported that the PCI-E AER error injection mechanism can result in a NULL pointer dereference in apic_ack_edge(): BUG: unable to handle kernel NULL pointer dereference at 0000000000000078 RIP: 0010:apic_ack_edge+0x1e/0x40 Call Trace: handle_edge_irq+0x7d/0x1e0 generic_handle_irq+0x27/0x30 aer_inject_write+0x53a/0x720 It crashes in irq_complete_move() which dereferences get_irq_regs() which is obviously NULL when this is called from non interrupt context. Of course the pointer could be checked, but that just papers over the real issue. Invoking the low level interrupt handling mechanism from random code can wreckage the fragile interrupt affinity mechanism of x86 as interrupts can only be moved in interrupt context or with special care when a CPU goes offline and the move has to be enforced. In the best case this triggers the warning in the MSI affinity setter, but if the call happens on the correct CPU it just corrupts state and might prevent further interrupt delivery for the affected device. Mark the APIC interrupts as unsuitable for being invoked in random contexts. This prevents the AER injection from proliferating the wreckage, but that's less broken than the current state of affairs and more correct than just papering over the problem by sprinkling random checks all over the place and silently corrupting state. Reported-by: sathyanarayanan.kuppuswamy(a)linux.intel.com Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lkml.kernel.org/r/20200306130623.684591280@linutronix.de Signed-off-by: Liao Chang <liaochang1(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/kernel/apic/vector.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c index a2a17704adc84..2114291badcdc 100644 --- a/arch/x86/kernel/apic/vector.c +++ b/arch/x86/kernel/apic/vector.c @@ -560,6 +560,12 @@ static int x86_vector_alloc_irqs(struct irq_domain *domain, unsigned int virq, irqd->chip_data = apicd; irqd->hwirq = virq + i; irqd_set_single_target(irqd); + /* + * Prevent that any of these interrupts is invoked in + * non interrupt context via e.g. generic_handle_irq() + * as that can corrupt the affinity move state. + */ + irqd_set_handle_enforce_irqctx(irqd); /* Don't invoke affinity setter on deactivated interrupts */ irqd_set_affinity_on_activate(irqd); -- 2.25.1

1 1

[PATCH kernel-4.19 01/15] x86/cpufeatures: Enumerate the new AVX512 BFLOAT16 instructions
by Yang Yingliang 26 May '21

26 May '21

From: Fenghua Yu <fenghua.yu(a)intel.com> mainline inclusion from mainline-v5.3-rc1 commit b302e4b176d00e1cbc80148c5d0aee36751f7480 category: feature bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=44 CVE: NA ----------------------------------------------- AVX512 BFLOAT16 instructions support 16-bit BFLOAT16 floating-point format (BF16) for deep learning optimization. BF16 is a short version of 32-bit single-precision floating-point format (FP32) and has several advantages over 16-bit half-precision floating-point format (FP16). BF16 keeps FP32 accumulation after multiplication without loss of precision, offers more than enough range for deep learning training tasks, and doesn't need to handle hardware exception. AVX512 BFLOAT16 instructions are enumerated in CPUID.7.1:EAX[bit 5] AVX512_BF16. CPUID.7.1:EAX contains only feature bits. Reuse the currently empty word 12 as a pure features word to hold the feature bits including AVX512_BF16. Detailed information of the CPUID bit and AVX512 BFLOAT16 instructions can be found in the latest Intel Architecture Instruction Set Extensions and Future Features Programming Reference. [ bp: Check CPUID(7) subleaf validity before accessing subleaf 1. ] Signed-off-by: Fenghua Yu <fenghua.yu(a)intel.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Cc: "Chang S. Bae" <chang.seok.bae(a)intel.com> Cc: Frederic Weisbecker <frederic(a)kernel.org> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Jann Horn <jannh(a)google.com> Cc: Masahiro Yamada <yamada.masahiro(a)socionext.com> Cc: Michael Ellerman <mpe(a)ellerman.id.au> Cc: Nadav Amit <namit(a)vmware.com> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Cc: Pavel Tatashin <pasha.tatashin(a)oracle.com> Cc: Peter Feiner <pfeiner(a)google.com> Cc: Radim Krcmar <rkrcmar(a)redhat.com> Cc: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> Cc: "Ravi V Shankar" <ravi.v.shankar(a)intel.com> Cc: Robert Hoo <robert.hu(a)linux.intel.com> Cc: "Sean J Christopherson" <sean.j.christopherson(a)intel.com> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Thomas Lendacky <Thomas.Lendacky(a)amd.com> Cc: x86 <x86(a)kernel.org> Link: https://lkml.kernel.org/r/1560794416-217638-3-git-send-email-fenghua.yu@int… Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/include/asm/cpufeature.h | 2 +- arch/x86/include/asm/cpufeatures.h | 3 +++ arch/x86/kernel/cpu/common.c | 6 ++++++ arch/x86/kernel/cpu/cpuid-deps.c | 1 + 4 files changed, 11 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h index 68889ace9c4c6..4ce54074eea57 100644 --- a/arch/x86/include/asm/cpufeature.h +++ b/arch/x86/include/asm/cpufeature.h @@ -23,7 +23,7 @@ enum cpuid_leafs CPUID_7_0_EBX, CPUID_D_1_EAX, CPUID_LNX_4, - CPUID_DUMMY, + CPUID_7_1_EAX, CPUID_8000_0008_EBX, CPUID_6_EAX, CPUID_8000_000A_EDX, diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h index 48535113efa68..b40125de2770e 100644 --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -305,6 +305,9 @@ #define X86_FEATURE_FENCE_SWAPGS_USER (11*32+ 4) /* "" LFENCE in user entry SWAPGS path */ #define X86_FEATURE_FENCE_SWAPGS_KERNEL (11*32+ 5) /* "" LFENCE in kernel entry SWAPGS path */ +/* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ +#define X86_FEATURE_AVX512_BF16 (12*32+ 5) /* AVX512 BFLOAT16 instructions */ + /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */ #define X86_FEATURE_CLZERO (13*32+ 0) /* CLZERO instruction */ #define X86_FEATURE_IRPERF (13*32+ 1) /* Instructions Retired Count */ diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 1d83e5f7c5a89..6e52e5a706e0b 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -854,6 +854,12 @@ void get_cpu_cap(struct cpuinfo_x86 *c) c->x86_capability[CPUID_7_0_EBX] = ebx; c->x86_capability[CPUID_7_ECX] = ecx; c->x86_capability[CPUID_7_EDX] = edx; + + /* Check valid sub-leaf index before accessing it */ + if (eax >= 1) { + cpuid_count(0x00000007, 1, &eax, &ebx, &ecx, &edx); + c->x86_capability[CPUID_7_1_EAX] = eax; + } } /* Extended state features: level 0x0000000d */ diff --git a/arch/x86/kernel/cpu/cpuid-deps.c b/arch/x86/kernel/cpu/cpuid-deps.c index fa07a224e7b98..a444028d81453 100644 --- a/arch/x86/kernel/cpu/cpuid-deps.c +++ b/arch/x86/kernel/cpu/cpuid-deps.c @@ -62,6 +62,7 @@ static const struct cpuid_dep cpuid_deps[] = { { X86_FEATURE_CQM_OCCUP_LLC, X86_FEATURE_CQM_LLC }, { X86_FEATURE_CQM_MBM_TOTAL, X86_FEATURE_CQM_LLC }, { X86_FEATURE_CQM_MBM_LOCAL, X86_FEATURE_CQM_LLC }, + { X86_FEATURE_AVX512_BF16, X86_FEATURE_AVX512VL }, {} }; -- 2.25.1

1 14

[PATCH kernel-4.19 1/7] genirq: Add protection against unsafe usage of generic_handle_irq()
by Yang Yingliang 26 May '21

26 May '21

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-5.7 commit c16816acd08697b02a53f56f8936497a9f6f6e7a category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- In general calling generic_handle_irq() with interrupts disabled from non interrupt context is harmless. For some interrupt controllers like the x86 trainwrecks this is outright dangerous as it might corrupt state if an interrupt affinity change is pending. Add infrastructure which allows to mark interrupts as unsafe and catch such usage in generic_handle_irq(). Reported-by: sathyanarayanan.kuppuswamy(a)linux.intel.com Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: Marc Zyngier <maz(a)kernel.org> Link: https://lkml.kernel.org/r/20200306130623.590923677@linutronix.de Signed-off-by: Liao Chang <liaochang1(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/irq.h | 13 +++++++++++++ kernel/irq/internals.h | 8 ++++++++ kernel/irq/irqdesc.c | 6 ++++++ kernel/irq/resend.c | 5 +++-- 4 files changed, 30 insertions(+), 2 deletions(-) diff --git a/include/linux/irq.h b/include/linux/irq.h index 014d5804c1b59..ca367d98a991e 100644 --- a/include/linux/irq.h +++ b/include/linux/irq.h @@ -210,6 +210,8 @@ struct irq_data { * IRQD_CAN_RESERVE - Can use reservation mode * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change * required + * IRQD_HANDLE_ENFORCE_IRQCTX - Enforce that handle_irq_*() is only invoked + * from actual interrupt context. * IRQD_AFFINITY_ON_ACTIVATE - Affinity is set on activation. Don't call * irq_chip::irq_set_affinity() when deactivated. */ @@ -235,6 +237,7 @@ enum { IRQD_DEFAULT_TRIGGER_SET = (1 << 25), IRQD_CAN_RESERVE = (1 << 26), IRQD_MSI_NOMASK_QUIRK = (1 << 27), + IRQD_HANDLE_ENFORCE_IRQCTX = (1 << 28), IRQD_AFFINITY_ON_ACTIVATE = (1 << 29), }; @@ -305,6 +308,16 @@ static inline bool irqd_is_single_target(struct irq_data *d) return __irqd_to_state(d) & IRQD_SINGLE_TARGET; } +static inline void irqd_set_handle_enforce_irqctx(struct irq_data *d) +{ + __irqd_to_state(d) |= IRQD_HANDLE_ENFORCE_IRQCTX; +} + +static inline bool irqd_is_handle_enforce_irqctx(struct irq_data *d) +{ + return __irqd_to_state(d) & IRQD_HANDLE_ENFORCE_IRQCTX; +} + static inline bool irqd_is_wakeup_set(struct irq_data *d) { return __irqd_to_state(d) & IRQD_WAKEUP_STATE; diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h index ed4843df6220c..207bac6ad4c30 100644 --- a/kernel/irq/internals.h +++ b/kernel/irq/internals.h @@ -422,6 +422,10 @@ static inline struct cpumask *irq_desc_get_pending_mask(struct irq_desc *desc) { return desc->pending_mask; } +static inline bool handle_enforce_irqctx(struct irq_data *data) +{ + return irqd_is_handle_enforce_irqctx(data); +} bool irq_fixup_move_pending(struct irq_desc *desc, bool force_clear); #else /* CONFIG_GENERIC_PENDING_IRQ */ static inline bool irq_can_move_pcntxt(struct irq_data *data) @@ -448,6 +452,10 @@ static inline bool irq_fixup_move_pending(struct irq_desc *desc, bool fclear) { return false; } +static inline bool handle_enforce_irqctx(struct irq_data *data) +{ + return false; +} #endif /* !CONFIG_GENERIC_PENDING_IRQ */ #if !defined(CONFIG_IRQ_DOMAIN) || !defined(CONFIG_IRQ_DOMAIN_HIERARCHY) diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c index dc4549fc71f95..ffdf02b01d816 100644 --- a/kernel/irq/irqdesc.c +++ b/kernel/irq/irqdesc.c @@ -633,9 +633,15 @@ void irq_init_desc(unsigned int irq) int generic_handle_irq(unsigned int irq) { struct irq_desc *desc = irq_to_desc(irq); + struct irq_data *data; if (!desc) return -EINVAL; + + data = irq_desc_get_irq_data(desc); + if (WARN_ON_ONCE(!in_irq() && handle_enforce_irqctx(data))) + return -EPERM; + generic_handle_irq_desc(desc); return 0; } diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c index 98c04ca5fa43d..5064b13b80d60 100644 --- a/kernel/irq/resend.c +++ b/kernel/irq/resend.c @@ -72,8 +72,9 @@ void check_irq_resend(struct irq_desc *desc) desc->istate &= ~IRQS_PENDING; desc->istate |= IRQS_REPLAY; - if (!desc->irq_data.chip->irq_retrigger || - !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) { + if ((!desc->irq_data.chip->irq_retrigger || + !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) && + !handle_enforce_irqctx(&desc->irq_data)) { #ifdef CONFIG_HARDIRQS_SW_RESEND unsigned int irq = irq_desc_get_irq(desc); -- 2.25.1

1 6

Re: Fwd: 网迅万兆网卡驱动合入openeuler-4.19内核申请
by Xie XiuQi 25 May '21

25 May '21

On 2021/5/21 9:27, zhenpengzheng(a)net-swift.com wrote: > 谢工， > > 您好，我最近忙另外的项目，没有协调到鲲鹏平台，刚跟测试协商，等他们用完了借给我，预计要下周了，如果改完了我提个patch给您。好的。另外，如果你协调到环境，建议也一起把驱动提交到 openEuler 5.10 版本。 5.10 版本是 openEuler 下一个长期维护版本。 > > regards, > zhenpeng > > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > > **************************************************************** > > 郑振鹏(zheng zhenpeng) > > 北京网迅科技有限公司杭州分公司软件工程师 > > 浙江省杭州市西湖区文三路478号华星时代广场A座507室 310013 > > Beijing WangXun Technology Co., Ltd. Software Engineer. > > Room A507, HuaXing Times Square, No.478 West Wensan Road. > > West Lake District, Hangzhou City, 310013 ZHEJIANG, P.R.CHINA. > > > > Office: +86(0571)89807901-8014 > > Mobile: +86-13656681762 > > E-Mail: z <mailto:jianwang@trustnetic.com>henpengzheng(a)net-swift.com > > **************************************************************** > > > *发件人：* Xie XiuQi <mailto:xiexiuqi@huawei.com> > *发送时间：* 2021-05-19 21:36 > *收件人：* zhenpengzheng(a)net-swift.com <mailto:zhenpengzheng@net-swift.com> > *抄送：* Leizhen (ThunderTown) <mailto:thunder.leizhen@huawei.com>; liuyuan36 <mailto:liuyuan36@huawei.com>; Cheng Jian <mailto:cj.chengjian@huawei.com>; Libin (Huawei) <mailto:huawei.libin@huawei.com>; Yang Yingliang <mailto:yangyingliang@huawei.com>; Dukaitian, Intelligent Computing, <mailto:dukaitian@huawei.com>; " neil.yao"@huawei.com <mailto:@huawei.com>; neil.yao(a)huawei.com <mailto:neil.yao@huawei.com>; kernel\" <mailto:kernel@openeuler.org> > *主题：* Re: Fwd: 网迅万兆网卡驱动合入openeuler-4.19内核申请 > Hi zhenpeng, > > > On 2021/3/8 11:12, zhenpengzheng(a)net-swift.com wrote: > > > 适用arm64，但这份驱动我只在x86指令集的机器上测试过，我先改好，稍后安排ARM的适配测试。 > > 问下，网讯网卡驱动，之前说 ARM64 环境上会做测试，现在怎么样了， > ARM64 上可以 enable 了吗？ > > 谢谢 > > On 2021/3/25 22:12, Xie XiuQi wrote: > > Hi, > > > > On 2021/3/25 9:43, zhenpengzheng(a)net-swift.com wrote: > >> > >> to Leizhen, > >> > >> have these two patches been merged into kernel-4.19 and openEuler-1.0-LTS branches? > > > > This patch is in my queue and under testing, which would be merged before April 15. > > > > Thanks. > > > >> > >> regards, > >> zhenpeng > >> > >> > >> > >> > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > >> > >> **************************************************************** > >> > >> 郑振鹏(zheng zhenpeng) > >> > >> 北京网迅科技有限公司杭州分公司软件工程师 > >> > >> 浙江省杭州市西湖区文三路478号华星时代广场A座507室 310013 > >> > >> Beijing WangXun Technology Co., Ltd. Software Engineer. > >> > >> Room A507, HuaXing Times Square, No.478 West Wensan Road. > >> > >> West Lake District, Hangzhou City, 310013 ZHEJIANG, P.R.CHINA. > >> > >> > >> > >> Office: +86(0571)89807901-8014 > >> > >> Mobile: +86-13656681762 > >> > >> E-Mail: z <mailto:jianwang@trustnetic.com>henpengzheng(a)net-swift.com > >> > >> **************************************************************** > >> > >> > >> *发件人：* Xie XiuQi <mailto:xiexiuqi@huawei.com> > >> *发送时间：* 2021-03-12 16:22 > >> *收件人：* zhenpengzheng(a)net-swift.com <mailto:zhenpengzheng@net-swift.com>; Leizhen (ThunderTown) <mailto:thunder.leizhen@huawei.com> > >> *抄送：* liuyuan36 <mailto:liuyuan36@huawei.com>; Cheng Jian <mailto:cj.chengjian@huawei.com>; Libin (Huawei) <mailto:huawei.libin@huawei.com>; Yang Yingliang <mailto:yangyingliang@huawei.com>; Dukaitian (Dukaitian, Intelligent Computing R&D) <mailto:dukaitian@huawei.com>; neil.yao(a)huawei.com <mailto:neil.yao@huawei.com>; kernel(a)openeuler.org <mailto:kernel@openeuler.org> > >> *主题：* Re: Fwd: 网迅万兆网卡驱动合入openeuler-4.19内核申请 > >> For this series, > >> Acked-by: Xie XiuQi <xiexiuqi(a)huawei.com> > >> > >> @Leizhen, > >> > >> Please help to apply this two patches to kernel-4.19 & openEuler-1.0-LTS branches. > >> Thanks. > >> > >> On 2021/3/9 19:13, zhenpengzheng(a)net-swift.com wrote: > >> > to谢工， > >> > 已清理所有提交文件中“huawei” “intel” “HiNIC”等字样与本次提交无关的注释。 > >> > > >> > toLei工， > >> > 已删除所有提交文件末尾空行。 > >> > > >> > 谢谢大家的意见，附件为改动后最新的patch。 > >> > > >> > 振鹏 > >> > > >> > > >> > > >> > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > >> > > >> > **************************************************************** > >> > > >> > 郑振鹏(zheng zhenpeng) > >> > > >> > 北京网迅科技有限公司杭州分公司软件工程师 > >> > > >> > 浙江省杭州市西湖区文三路478号华星时代广场A座507室 310013 > >> > > >> > Beijing WangXun Technology Co., Ltd. Software Engineer. > >> > > >> > Room A507, HuaXing Times Square, No.478 West Wensan Road. > >> > > >> > West Lake District, Hangzhou City, 310013 ZHEJIANG, P.R.CHINA. > >> > > >> > > >> > > >> > Office: +86(0571)89807901-8014 > >> > > >> > Mobile: +86-13656681762 > >> > > >> > E-Mail: z <mailto:jianwang@trustnetic.com>henpengzheng(a)net-swift.com > >> > > >> > **************************************************************** > >> > > >> > > >> > *发件人：* Leizhen (ThunderTown) <mailto:thunder.leizhen@huawei.com> > >> > *发送时间：* 2021-03-09 17:59 > >> > *收件人：* zhenpengzheng(a)net-swift.com <mailto:zhenpengzheng@net-swift.com>; Xie XiuQi <mailto:xiexiuqi@huawei.com> > >> > *抄送：* liuyuan36 <mailto:liuyuan36@huawei.com>; Cheng Jian <mailto:cj.chengjian@huawei.com>; Libin (Huawei) <mailto:huawei.libin@huawei.com>; Yang Yingliang <mailto:yangyingliang@huawei.com>; Dukaitian (Dukaitian, Intelligent Computing R&D) <mailto:dukaitian@huawei.com>; neil.yao(a)huawei.com <mailto:neil.yao@huawei.com> > >> > *主题：* Re: Fwd: 网迅万兆网卡驱动合入openeuler-4.19内核申请 > >> > > >> > > >> > On 2021/3/9 16:38, zhenpengzheng(a)net-swift.com wrote: > >> > > 谢工，lei工 > >> > > 您好，附件是我按照社区要求整改的patch，第一份较大的patch是不包含openeuler_config(x86)文件修改的驱动主代码，第二份patch仅含openeuler_config(x86)文件修改，arm的配置暂未修改，后续我尽快测完再发patch开启arm配置。 > >> > > > >> > > 针对社区反馈的问题1，我查过patch中确实存在一处告警所说明的违规（即指向patch90行那处），其余违规处对照后未发现异常，我检查过代码本身应无段尾出现空白的情况，不知道如何进一步确认patch是否合规，请在邮件中告知，谢谢。 > >> > drivers/net/ethernet/netswift/txgbe/txgbe_bp.h > >> > drivers/net/ethernet/netswift/txgbe/txgbe_ethtool.c > >> > drivers/net/ethernet/netswift/txgbe/txgbe_hw.c > >> > drivers/net/ethernet/netswift/txgbe/txgbe_lib.c > >> > drivers/net/ethernet/netswift/txgbe/txgbe_main.c > >> > drivers/net/ethernet/netswift/txgbe/txgbe_mtd.c > >> > drivers/net/ethernet/netswift/txgbe/txgbe_mtd.h > >> > > >> > 这个告警是文件末尾有空行。每个文件打开一下，shift+G到末尾check下就好了。 > >> > > >> > > > >> > > 振鹏 > >> > > > >> > > > >> > > > >> > > > >> > > >> > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > >> > > > >> > > **************************************************************** > >> > > > >> > > 郑振鹏(zheng zhenpeng) > >> > > > >> > > 北京网迅科技有限公司杭州分公司软件工程师 > >> > > > >> > > 浙江省杭州市西湖区文三路478号华星时代广场A座507室 310013 > >> > > > >> > > Beijing WangXun Technology Co., Ltd. Software Engineer. > >> > > > >> > > Room A507, HuaXing Times Square, No.478 West Wensan Road. > >> > > > >> > > West Lake District, Hangzhou City, 310013 ZHEJIANG, P.R.CHINA. > >> > > > >> > > > >> > > > >> > > Office: +86(0571)89807901-8014 > >> > > > >> > > Mobile: +86-13656681762 > >> > > > >> > > E-Mail: z <mailto:jianwang@trustnetic.com>henpengzheng(a)net-swift.com > >> > > > >> > > **************************************************************** > >> > > > >> > > > >> > > *发件人：* Xie XiuQi <mailto:xiexiuqi@huawei.com> > >> > > *发送时间：* 2021-03-08 16:29 > >> > > *收件人：* zhenpengzheng(a)net-swift.com <mailto:zhenpengzheng@net-swift.com>; Leizhen (ThunderTown) <mailto:thunder.leizhen@huawei.com> > >> > > *抄送：* liuyuan36 <mailto:liuyuan36@huawei.com>; Cheng Jian <mailto:cj.chengjian@huawei.com>; Libin (Huawei) <mailto:huawei.libin@huawei.com>; Yang Yingliang <mailto:yangyingliang@huawei.com>; Dukaitian (Dukaitian, Intelligent Computing R&D) <mailto:dukaitian@huawei.com>; neil.yao(a)huawei.com <mailto:neil.yao@huawei.com> > >> > > *主题：* Re: Fwd: 网迅万兆网卡驱动合入openeuler-4.19内核申请 > >> > > Hi， > >> > > > >> > > On 2021/3/8 11:12, zhenpengzheng(a)net-swift.com wrote: > >> > > > 适用arm64，但这份驱动我只在x86指令集的机器上测试过，我先改好，稍后安排ARM的适配测试。 > >> > > > >> > > 好的，在 x86 上测试过，就先在 x86 上 enable 吧。 > >> > > ARM64 的测试过之后，可以再 enable。 > >> > > > >> > > > > >> > > > > >> > > > >> > > >> > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > >> > > > > >> > > > **************************************************************** > >> > > > > >> > > > 郑振鹏(zheng zhenpeng) > >> > > > > >> > > > 北京网迅科技有限公司杭州分公司软件工程师 > >> > > > > >> > > > 浙江省杭州市西湖区文三路478号华星时代广场A座507室 310013 > >> > > > > >> > > > Beijing WangXun Technology Co., Ltd. Software Engineer. > >> > > > > >> > > > Room A507, HuaXing Times Square, No.478 West Wensan Road. > >> > > > > >> > > > West Lake District, Hangzhou City, 310013 ZHEJIANG, P.R.CHINA. > >> > > > > >> > > > > >> > > > > >> > > > Office: +86(0571)89807901-8014 > >> > > > > >> > > > Mobile: +86-13656681762 > >> > > > > >> > > > E-Mail: z <mailto:jianwang@trustnetic.com>henpengzheng(a)net-swift.com > >> > > > > >> > > > **************************************************************** > >> > > > > >> > > > > >> > > > *发件人：* Xie XiuQi <mailto:xiexiuqi@huawei.com> > >> > > > *发送时间：* 2021-03-08 10:30 > >> > > > *收件人：* zhenpengzheng(a)net-swift.com <mailto:zhenpengzheng@net-swift.com>; Leizhen (ThunderTown) <mailto:thunder.leizhen@huawei.com> > >> > > > *抄送：* liuyuan36 <mailto:liuyuan36@huawei.com>; Cheng Jian <mailto:cj.chengjian@huawei.com>; Libin (Huawei) <mailto:huawei.libin@huawei.com>; Yang Yingliang <mailto:yangyingliang@huawei.com>; Dukaitian (Dukaitian, Intelligent Computing R&D) <mailto:dukaitian@huawei.com>; neil.yao(a)huawei.com <mailto:neil.yao@huawei.com> > >> > > > *主题：* Re: Fwd: 网迅万兆网卡驱动合入openeuler-4.19内核申请 > >> > > > Hi, > >> > > > > >> > > > 网讯网卡驱动在 arm64 上也是适用的吧？ > >> > > > 是的话，arm64 的config，也打开吧。 > >> > > > > >> > > > arch/arm64/configs/openeuler_defconfig > >> > > > > >> > > > > >> > > > > >> > > > On 2021/3/8 9:42, zhenpengzheng(a)net-swift.com wrote: > >> > > > > 好的，对于问题2，我分割成两个patch再发一次，谢谢。 > >> > > > > > >> > > > > > >> > > > > >> > > > >> > > >> > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > >> > > > > > >> > > > > **************************************************************** > >> > > > > > >> > > > > 郑振鹏(zheng zhenpeng) > >> > > > > > >> > > > > 北京网迅科技有限公司杭州分公司软件工程师 > >> > > > > > >> > > > > 浙江省杭州市西湖区文三路478号华星时代广场A座507室 310013 > >> > > > > > >> > > > > Beijing WangXun Technology Co., Ltd. Software Engineer. > >> > > > > > >> > > > > Room A507, HuaXing Times Square, No.478 West Wensan Road. > >> > > > > > >> > > > > West Lake District, Hangzhou City, 310013 ZHEJIANG, P.R.CHINA. > >> > > > > > >> > > > > > >> > > > > > >> > > > > Office: +86(0571)89807901-8014 > >> > > > > > >> > > > > Mobile: +86-13656681762 > >> > > > > > >> > > > > E-Mail: z <mailto:jianwang@trustnetic.com>henpengzheng(a)net-swift.com > >> > > > > > >> > > > > **************************************************************** > >> > > > > > >> > > > > > >> > > > > *发件人：* Leizhen (ThunderTown) <mailto:thunder.leizhen@huawei.com> > >> > > > > *发送时间：* 2021-03-06 15:05 > >> > > > > *收件人：* Xie XiuQi <mailto:xiexiuqi@huawei.com>; 郑振鹏 <mailto:zhenpengzheng@net-swift.com> > >> > > > > *抄送：* Liuyuan (Compatibility, Cloud Infrastructure Service Product Dept.) <mailto:liuyuan36@huawei.com>; Cheng Jian <mailto:cj.chengjian@huawei.com>; Libin (Huawei) <mailto:huawei.libin@huawei.com>; Yang Yingliang <mailto:yangyingliang@huawei.com>; Dukaitian (Dukaitian, Intelligent Computing R&D) <mailto:dukaitian@huawei.com>; neil.yao(a)huawei.com <mailto:neil.yao@huawei.com> > >> > > > > *主题：* Re: Fwd: 网迅万兆网卡驱动合入openeuler-4.19内核申请 > >> > > > > Hi 振鹏， > >> > > > > 我review了一下补丁，有几个地方需要改进下： > >> > > > > > >> > > > > 1. git am补丁的时候会报几个warning，需要消除一下； > >> > > > > git am 0001-add-WangXun-XGIG-NIC-driver-for-EulerOS.patch > >>�� > > > > Applying: add WangXun XGIG NIC driver for EulerOS > >> > > > > .git/rebase-apply/patch:90: new blank line at EOF. > >> > > > > + > >> > > > > .git/rebase-apply/patch:2331: new blank line at EOF. > >> > > > > + > >> > > > > .git/rebase-apply/patch:5755: new blank line at EOF. > >> > > > > + > >> > > > > .git/rebase-apply/patch:12891: new blank line at EOF. > >> > > > > + > >> > > > > .git/rebase-apply/patch:14134: new blank line at EOF. > >> > > > > + > >> > > > > warning: squelched 3 whitespace errors > >> > > > > warning: 8 lines add whitespace errors. > >> > > > > 2. 对arch/x86/configs/openeuler_defconfig文件的修改，最好能拆分到一个独立的补丁中去。 > >> > > > > 3. txgbe_bp.c没有添加版权声明。 > >> > > > > 4. 其它#if 0、//注释掉的代码，最好能清掉。 > >> > > > > > >> > > > > > >> > > > > > >> > > > > On 2021/3/1 16:32, Xie XiuQi wrote: > >> > > > > > Hi 振鹏， > >> > > > > > > >> > > > > > Thanks for your patch, we'll review this patch, and give a feedback soon. > >> > > > > > > >> > > > > > --- > >> > > > > > Thanks, > >> > > > > > Xie XiuQi > >> > > > > > > >> > > > > > > >> > > > > > -------- Forwarded Message -------- > >> > > > > > Subject: 网迅万兆网卡驱动合入openeuler-4.19内核申请 > >> > > > > > Date: Mon, 1 Mar 2021 15:41:09 +0800 > >> > > > > > From: zhenpengzheng(a)net-swift.com <zhenpengzheng(a)net-swift.com> > >> > > > > > To: xiexiuqi <xiexiuqi(a)huawei.com>, liuyuan36 <liuyuan36(a)huawei.com> > >> > > > > > > >> > > > > > > >> > > > > > > >> > > > > > > >> > > > > > 谢工，刘工： > >> > > > > > > >> > > > > > 您好，我已准备好patch，见附件，patch已按照社区要求做checkpatch，报告的错误已消除，commit信息已更新。 > >> > > > > > > >> > > > > > 振鹏 > >> > > > > > > >> > > > > > > >> > > > > > >> > > > > >> > > > >> > > >> > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ > >> > > > > > > >> > > > > > **************************************************************** > >> > > > > > > >> > > > > > 郑振鹏(zheng zhenpeng) > >> > > > > > > >> > > > > > 北京网迅科技有限公司杭州分公司软件工程师 > >> > > > > > > >> > > > > > 浙江省杭州市西湖区文三路478号华星时代广场A座507室 310013 > >> > > > > > > >> > > > > > Beijing WangXun Technology Co., Ltd. Software Engineer. > >> > > > > > > >> > > > > > Room A507, HuaXing Times Square, No.478 West Wensan Road. > >> > > > > > > >> > > > > > West Lake District, Hangzhou City, 310013 ZHEJIANG, P.R.CHINA. > >> > > > > > > >> > > > > > > >> > > > > > > >> > > > > > Office: +86(0571)89807901-8014 > >> > > > > > > >> > > > > > Mobile: +86-13656681762 > >> > > > > > > >> > > > > > E-Mail: z <mailto:jianwang@trustnetic.com>henpengzheng(a)net-swift.com > >> > > > > > > >> > > > > > **************************************************************** > >> > > > > > > >> > > > > > >> > > > > >> > > > >> > > >> > > _______________________________________________ > > Kernel mailing list -- kernel(a)openeuler.org > > To unsubscribe send an email to kernel-leave(a)openeuler.org > > >

1 0

[PATCH kernel-4.19 1/2] NFSv4.1: Don't rebind to the same source port when reconnecting to the server
by Yang Yingliang 25 May '21

25 May '21

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v5.5-rc1 commit e6237b6feb37582fbd6bd7a8336d1256a6b4b4f9 category: bugfix bugzilla: NA CVE: NA -------------------------------- NFSv2, v3 and NFSv4 servers often have duplicate replay caches that look at the source port when deciding whether or not an RPC call is a replay of a previous call. This requires clients to perform strange TCP gymnastics in order to ensure that when they reconnect to the server, they bind to the same source port. NFSv4.1 and NFSv4.2 have sessions that provide proper replay semantics, that do not look at the source port of the connection. This patch therefore ensures they can ignore the rebind requirement. Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/lockd/host.c fs/nfs/client.c fs/nfs/nfs4client.c include/linux/nfs_fs_sb.h include/linux/sunrpc/clnt.h Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/lockd/host.c | 3 ++- fs/nfs/client.c | 3 +++ fs/nfs/nfs4client.c | 3 +++ include/linux/nfs_fs_sb.h | 1 + include/linux/sunrpc/clnt.h | 1 + include/linux/sunrpc/xprt.h | 3 ++- net/sunrpc/clnt.c | 7 ++++++- net/sunrpc/xprtsock.c | 2 +- 8 files changed, 19 insertions(+), 4 deletions(-) diff --git a/fs/lockd/host.c b/fs/lockd/host.c index 3f6ba0cd2bd9c..6d58f53555893 100644 --- a/fs/lockd/host.c +++ b/fs/lockd/host.c @@ -452,7 +452,8 @@ nlm_bind_host(struct nlm_host *host) .version = host->h_version, .authflavor = RPC_AUTH_UNIX, .flags = (RPC_CLNT_CREATE_NOPING | - RPC_CLNT_CREATE_AUTOBIND), + RPC_CLNT_CREATE_AUTOBIND | + RPC_CLNT_CREATE_REUSEPORT), }; /* diff --git a/fs/nfs/client.c b/fs/nfs/client.c index 07c5ddd5d6d50..d25230de31364 100644 --- a/fs/nfs/client.c +++ b/fs/nfs/client.c @@ -522,6 +522,8 @@ int nfs_create_rpc_client(struct nfs_client *clp, args.flags |= RPC_CLNT_CREATE_NONPRIVPORT; if (test_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags)) args.flags |= RPC_CLNT_CREATE_INFINITE_SLOTS; + if (test_bit(NFS_CS_REUSEPORT, &clp->cl_flags)) + args.flags |= RPC_CLNT_CREATE_REUSEPORT; if (!IS_ERR(clp->cl_rpcclient)) return 0; @@ -663,6 +665,7 @@ static int nfs_init_server(struct nfs_server *server, .proto = data->nfs_server.protocol, .net = data->net, .timeparms = &timeparms, + .init_flags = (1UL << NFS_CS_REUSEPORT), }; struct nfs_client *clp; int error; diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c index faaabbedc891d..48a1892f05854 100644 --- a/fs/nfs/nfs4client.c +++ b/fs/nfs/nfs4client.c @@ -872,6 +872,9 @@ static int nfs4_set_client(struct nfs_server *server, }; struct nfs_client *clp; + if (minorversion == 0) + __set_bit(NFS_CS_REUSEPORT, &cl_init.init_flags); + if (server->flags & NFS_MOUNT_NORESVPORT) set_bit(NFS_CS_NORESVPORT, &cl_init.init_flags); if (server->options & NFS_OPTION_MIGRATION) diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h index bf39d9c92201f..7023ae64e3d7c 100644 --- a/include/linux/nfs_fs_sb.h +++ b/include/linux/nfs_fs_sb.h @@ -45,6 +45,7 @@ struct nfs_client { #define NFS_CS_INFINITE_SLOTS 3 /* - don't limit TCP slots */ #define NFS_CS_NO_RETRANS_TIMEOUT 4 /* - Disable retransmit timeouts */ #define NFS_CS_TSM_POSSIBLE 5 /* - Maybe state migration */ +#define NFS_CS_REUSEPORT 8 /* - reuse src port on reconnect */ struct sockaddr_storage cl_addr; /* server identifier */ size_t cl_addrlen; char * cl_hostname; /* hostname of server */ diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h index 73d5c4a870fae..60b6489e5ac1b 100644 --- a/include/linux/sunrpc/clnt.h +++ b/include/linux/sunrpc/clnt.h @@ -143,6 +143,7 @@ struct rpc_add_xprt_test { #define RPC_CLNT_CREATE_INFINITE_SLOTS (1UL << 7) #define RPC_CLNT_CREATE_NO_IDLE_TIMEOUT (1UL << 8) #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9) +#define RPC_CLNT_CREATE_REUSEPORT (1UL << 11) struct rpc_clnt *rpc_create(struct rpc_create_args *args); struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *, diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h index 69fed13e633b7..36a944dda1957 100644 --- a/include/linux/sunrpc/xprt.h +++ b/include/linux/sunrpc/xprt.h @@ -200,7 +200,8 @@ struct rpc_xprt { unsigned int min_reqs; /* min number of slots */ unsigned int num_reqs; /* total slots */ unsigned long state; /* transport state */ - unsigned char resvport : 1; /* use a reserved port */ + unsigned char resvport : 1, /* use a reserved port */ + reuseport : 1; /* reuse port on reconnect */ atomic_t swapper; /* we're swapping over this transport */ unsigned int bind_index; /* bind function index */ diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c index 227bf32f2476b..9ac94c774335e 100644 --- a/net/sunrpc/clnt.c +++ b/net/sunrpc/clnt.c @@ -583,6 +583,9 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args) xprt->resvport = 1; if (args->flags & RPC_CLNT_CREATE_NONPRIVPORT) xprt->resvport = 0; + xprt->reuseport = 0; + if (args->flags & RPC_CLNT_CREATE_REUSEPORT) + xprt->reuseport = 1; return rpc_create_xprt(args, xprt); } @@ -2730,7 +2733,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *clnt, struct rpc_xprt *xprt; unsigned long connect_timeout; unsigned long reconnect_timeout; - unsigned char resvport; + unsigned char resvport, reuseport; int ret = 0; rcu_read_lock(); @@ -2742,6 +2745,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *clnt, return -EAGAIN; } resvport = xprt->resvport; + reuseport = xprt->reuseport; connect_timeout = xprt->connect_timeout; reconnect_timeout = xprt->max_reconnect_timeout; rcu_read_unlock(); @@ -2752,6 +2756,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *clnt, goto out_put_switch; } xprt->resvport = resvport; + xprt->reuseport = reuseport; if (xprt->ops->set_connect_timeout != NULL) xprt->ops->set_connect_timeout(xprt, connect_timeout, diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 60ebb402ba61f..f93d386ae9232 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -1839,7 +1839,7 @@ static void xs_set_port(struct rpc_xprt *xprt, unsigned short port) static void xs_set_srcport(struct sock_xprt *transport, struct socket *sock) { - if (transport->srcport == 0) + if (transport->srcport == 0 && transport->xprt.reuseport) transport->srcport = xs_sock_getport(sock); } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/5] genirq: Add protection against unsafe usage of generic_handle_irq()
by Yang Yingliang 24 May '21

24 May '21

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-5.7 commit c16816acd08697b02a53f56f8936497a9f6f6e7a category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- In general calling generic_handle_irq() with interrupts disabled from non interrupt context is harmless. For some interrupt controllers like the x86 trainwrecks this is outright dangerous as it might corrupt state if an interrupt affinity change is pending. Add infrastructure which allows to mark interrupts as unsafe and catch such usage in generic_handle_irq(). Reported-by: sathyanarayanan.kuppuswamy(a)linux.intel.com Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: Marc Zyngier <maz(a)kernel.org> Link: https://lkml.kernel.org/r/20200306130623.590923677@linutronix.de Signed-off-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/irq.h | 13 +++++++++++++ kernel/irq/internals.h | 8 ++++++++ kernel/irq/irqdesc.c | 6 ++++++ kernel/irq/resend.c | 5 +++-- 4 files changed, 30 insertions(+), 2 deletions(-) diff --git a/include/linux/irq.h b/include/linux/irq.h index 014d5804c1b59..ca367d98a991e 100644 --- a/include/linux/irq.h +++ b/include/linux/irq.h @@ -210,6 +210,8 @@ struct irq_data { * IRQD_CAN_RESERVE - Can use reservation mode * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change * required + * IRQD_HANDLE_ENFORCE_IRQCTX - Enforce that handle_irq_*() is only invoked + * from actual interrupt context. * IRQD_AFFINITY_ON_ACTIVATE - Affinity is set on activation. Don't call * irq_chip::irq_set_affinity() when deactivated. */ @@ -235,6 +237,7 @@ enum { IRQD_DEFAULT_TRIGGER_SET = (1 << 25), IRQD_CAN_RESERVE = (1 << 26), IRQD_MSI_NOMASK_QUIRK = (1 << 27), + IRQD_HANDLE_ENFORCE_IRQCTX = (1 << 28), IRQD_AFFINITY_ON_ACTIVATE = (1 << 29), }; @@ -305,6 +308,16 @@ static inline bool irqd_is_single_target(struct irq_data *d) return __irqd_to_state(d) & IRQD_SINGLE_TARGET; } +static inline void irqd_set_handle_enforce_irqctx(struct irq_data *d) +{ + __irqd_to_state(d) |= IRQD_HANDLE_ENFORCE_IRQCTX; +} + +static inline bool irqd_is_handle_enforce_irqctx(struct irq_data *d) +{ + return __irqd_to_state(d) & IRQD_HANDLE_ENFORCE_IRQCTX; +} + static inline bool irqd_is_wakeup_set(struct irq_data *d) { return __irqd_to_state(d) & IRQD_WAKEUP_STATE; diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h index ed4843df6220c..207bac6ad4c30 100644 --- a/kernel/irq/internals.h +++ b/kernel/irq/internals.h @@ -422,6 +422,10 @@ static inline struct cpumask *irq_desc_get_pending_mask(struct irq_desc *desc) { return desc->pending_mask; } +static inline bool handle_enforce_irqctx(struct irq_data *data) +{ + return irqd_is_handle_enforce_irqctx(data); +} bool irq_fixup_move_pending(struct irq_desc *desc, bool force_clear); #else /* CONFIG_GENERIC_PENDING_IRQ */ static inline bool irq_can_move_pcntxt(struct irq_data *data) @@ -448,6 +452,10 @@ static inline bool irq_fixup_move_pending(struct irq_desc *desc, bool fclear) { return false; } +static inline bool handle_enforce_irqctx(struct irq_data *data) +{ + return false; +} #endif /* !CONFIG_GENERIC_PENDING_IRQ */ #if !defined(CONFIG_IRQ_DOMAIN) || !defined(CONFIG_IRQ_DOMAIN_HIERARCHY) diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c index dc4549fc71f95..ffdf02b01d816 100644 --- a/kernel/irq/irqdesc.c +++ b/kernel/irq/irqdesc.c @@ -633,9 +633,15 @@ void irq_init_desc(unsigned int irq) int generic_handle_irq(unsigned int irq) { struct irq_desc *desc = irq_to_desc(irq); + struct irq_data *data; if (!desc) return -EINVAL; + + data = irq_desc_get_irq_data(desc); + if (WARN_ON_ONCE(!in_irq() && handle_enforce_irqctx(data))) + return -EPERM; + generic_handle_irq_desc(desc); return 0; } diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c index 98c04ca5fa43d..5064b13b80d60 100644 --- a/kernel/irq/resend.c +++ b/kernel/irq/resend.c @@ -72,8 +72,9 @@ void check_irq_resend(struct irq_desc *desc) desc->istate &= ~IRQS_PENDING; desc->istate |= IRQS_REPLAY; - if (!desc->irq_data.chip->irq_retrigger || - !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) { + if ((!desc->irq_data.chip->irq_retrigger || + !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) && + !handle_enforce_irqctx(&desc->irq_data)) { #ifdef CONFIG_HARDIRQS_SW_RESEND unsigned int irq = irq_desc_get_irq(desc); -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 1/5] genirq: Add protection against unsafe usage of generic_handle_irq()
by Yang Yingliang 24 May '21

24 May '21

From: Liao Chang <liaochang1(a)huawei.com> mainline inclusion from mainline-5.7 commit c16816acd08697b02a53f56f8936497a9f6f6e7a category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- In general calling generic_handle_irq() with interrupts disabled from non interrupt context is harmless. For some interrupt controllers like the x86 trainwrecks this is outright dangerous as it might corrupt state if an interrupt affinity change is pending. Add infrastructure which allows to mark interrupts as unsafe and catch such usage in generic_handle_irq(). Reported-by: sathyanarayanan.kuppuswamy(a)linux.intel.com Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: Marc Zyngier <maz(a)kernel.org> Link: https://lkml.kernel.org/r/20200306130623.590923677@linutronix.de Signed-off-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/irq.h | 13 +++++++++++++ kernel/irq/internals.h | 8 ++++++++ kernel/irq/irqdesc.c | 6 ++++++ kernel/irq/resend.c | 5 +++-- 4 files changed, 30 insertions(+), 2 deletions(-) diff --git a/include/linux/irq.h b/include/linux/irq.h index 014d5804c1b59..ca367d98a991e 100644 --- a/include/linux/irq.h +++ b/include/linux/irq.h @@ -210,6 +210,8 @@ struct irq_data { * IRQD_CAN_RESERVE - Can use reservation mode * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change * required + * IRQD_HANDLE_ENFORCE_IRQCTX - Enforce that handle_irq_*() is only invoked + * from actual interrupt context. * IRQD_AFFINITY_ON_ACTIVATE - Affinity is set on activation. Don't call * irq_chip::irq_set_affinity() when deactivated. */ @@ -235,6 +237,7 @@ enum { IRQD_DEFAULT_TRIGGER_SET = (1 << 25), IRQD_CAN_RESERVE = (1 << 26), IRQD_MSI_NOMASK_QUIRK = (1 << 27), + IRQD_HANDLE_ENFORCE_IRQCTX = (1 << 28), IRQD_AFFINITY_ON_ACTIVATE = (1 << 29), }; @@ -305,6 +308,16 @@ static inline bool irqd_is_single_target(struct irq_data *d) return __irqd_to_state(d) & IRQD_SINGLE_TARGET; } +static inline void irqd_set_handle_enforce_irqctx(struct irq_data *d) +{ + __irqd_to_state(d) |= IRQD_HANDLE_ENFORCE_IRQCTX; +} + +static inline bool irqd_is_handle_enforce_irqctx(struct irq_data *d) +{ + return __irqd_to_state(d) & IRQD_HANDLE_ENFORCE_IRQCTX; +} + static inline bool irqd_is_wakeup_set(struct irq_data *d) { return __irqd_to_state(d) & IRQD_WAKEUP_STATE; diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h index ed4843df6220c..207bac6ad4c30 100644 --- a/kernel/irq/internals.h +++ b/kernel/irq/internals.h @@ -422,6 +422,10 @@ static inline struct cpumask *irq_desc_get_pending_mask(struct irq_desc *desc) { return desc->pending_mask; } +static inline bool handle_enforce_irqctx(struct irq_data *data) +{ + return irqd_is_handle_enforce_irqctx(data); +} bool irq_fixup_move_pending(struct irq_desc *desc, bool force_clear); #else /* CONFIG_GENERIC_PENDING_IRQ */ static inline bool irq_can_move_pcntxt(struct irq_data *data) @@ -448,6 +452,10 @@ static inline bool irq_fixup_move_pending(struct irq_desc *desc, bool fclear) { return false; } +static inline bool handle_enforce_irqctx(struct irq_data *data) +{ + return false; +} #endif /* !CONFIG_GENERIC_PENDING_IRQ */ #if !defined(CONFIG_IRQ_DOMAIN) || !defined(CONFIG_IRQ_DOMAIN_HIERARCHY) diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c index dc4549fc71f95..ffdf02b01d816 100644 --- a/kernel/irq/irqdesc.c +++ b/kernel/irq/irqdesc.c @@ -633,9 +633,15 @@ void irq_init_desc(unsigned int irq) int generic_handle_irq(unsigned int irq) { struct irq_desc *desc = irq_to_desc(irq); + struct irq_data *data; if (!desc) return -EINVAL; + + data = irq_desc_get_irq_data(desc); + if (WARN_ON_ONCE(!in_irq() && handle_enforce_irqctx(data))) + return -EPERM; + generic_handle_irq_desc(desc); return 0; } diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c index 98c04ca5fa43d..5064b13b80d60 100644 --- a/kernel/irq/resend.c +++ b/kernel/irq/resend.c @@ -72,8 +72,9 @@ void check_irq_resend(struct irq_desc *desc) desc->istate &= ~IRQS_PENDING; desc->istate |= IRQS_REPLAY; - if (!desc->irq_data.chip->irq_retrigger || - !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) { + if ((!desc->irq_data.chip->irq_retrigger || + !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) && + !handle_enforce_irqctx(&desc->irq_data)) { #ifdef CONFIG_HARDIRQS_SW_RESEND unsigned int irq = irq_desc_get_irq(desc); -- 2.25.1

1 4

[PATCH openEuler-1.0-LTS 1/3] jbd2: remove the out label in __jbd2_journal_remove_checkpoint()
by Yang Yingliang 24 May '21

24 May '21

From: Zhang Yi <yi.zhang(a)huawei.com> hulk inclusion category: bugfix bugzilla: 50788 CVE: NA --------------------------- The 'out' lable just return the 'ret' value and seems not required, so remove this label and switch to return appropriate value immediately. This patch also do some minor cleanup, no logical change. Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/jbd2/checkpoint.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index 96bf33986d030..61de87fbf5ec3 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -562,13 +562,13 @@ int __jbd2_journal_remove_checkpoint(struct journal_head *jh) struct transaction_chp_stats_s *stats; transaction_t *transaction; journal_t *journal; - int ret = 0; JBUFFER_TRACE(jh, "entry"); - if ((transaction = jh->b_cp_transaction) == NULL) { + transaction = jh->b_cp_transaction; + if (!transaction) { JBUFFER_TRACE(jh, "not on transaction"); - goto out; + return 0; } journal = transaction->t_journal; @@ -577,9 +577,9 @@ int __jbd2_journal_remove_checkpoint(struct journal_head *jh) jh->b_cp_transaction = NULL; jbd2_journal_put_journal_head(jh); - if (transaction->t_checkpoint_list != NULL || - transaction->t_checkpoint_io_list != NULL) - goto out; + /* Is this transaction empty? */ + if (transaction->t_checkpoint_list || transaction->t_checkpoint_io_list) + return 0; /* * There is one special case to worry about: if we have just pulled the @@ -591,10 +591,12 @@ int __jbd2_journal_remove_checkpoint(struct journal_head *jh) * See the comment at the end of jbd2_journal_commit_transaction(). */ if (transaction->t_state != T_FINISHED) - goto out; + return 0; - /* OK, that was the last buffer for the transaction: we can now - safely remove this transaction from the log */ + /* + * OK, that was the last buffer for the transaction, we can now + * safely remove this transaction from the log. + */ stats = &transaction->t_chp_stats; if (stats->cs_chp_time) stats->cs_chp_time = jbd2_time_diff(stats->cs_chp_time, @@ -604,9 +606,7 @@ int __jbd2_journal_remove_checkpoint(struct journal_head *jh) __jbd2_journal_drop_transaction(journal, transaction); jbd2_journal_free_transaction(transaction); - ret = 1; -out: - return ret; + return 1; } /* -- 2.25.1

1 2