1. 15 Apr, 2022 11 commits
    • Andrew Morton's avatar
      revert "fs/binfmt_elf: fix PT_LOAD p_align values for loaders" · 354e923d
      Andrew Morton authored
      Commit 925346c1 ("fs/binfmt_elf: fix PT_LOAD p_align values for
      loaders") was an attempt to fix regressions due to 9630f0d6
      ("fs/binfmt_elf: use PT_LOAD p_align values for static PIE").
      
      But regressionss continue to be reported:
      
        https://lore.kernel.org/lkml/cb5b81bd-9882-e5dc-cd22-54bdbaaefbbc@leemhuis.info/
        https://bugzilla.kernel.org/show_bug.cgi?id=215720
        https://lkml.kernel.org/r/b685f3d0-da34-531d-1aa9-479accd3e21b@leemhuis.info
      
      This patch reverts the fix, so the original can also be reverted.
      
      Fixes: 925346c1 ("fs/binfmt_elf: fix PT_LOAD p_align values for loaders")
      Cc: H.J. Lu <hjl.tools@gmail.com>
      Cc: Chris Kennelly <ckennelly@google.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Alexey Dobriyan <adobriyan@gmail.com>
      Cc: Song Liu <songliubraving@fb.com>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Ian Rogers <irogers@google.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Suren Baghdasaryan <surenb@google.com>
      Cc: Sandeep Patil <sspatil@google.com>
      Cc: Fangrui Song <maskray@google.com>
      Cc: Nick Desaulniers <ndesaulniers@google.com>
      Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Mike Kravetz <mike.kravetz@oracle.com>
      Cc: Shuah Khan <shuah@kernel.org>
      Cc: Thorsten Leemhuis <regressions@leemhuis.info>
      Cc: Mike Rapoport <rppt@kernel.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      354e923d
    • Mike Kravetz's avatar
      hugetlb: do not demote poisoned hugetlb pages · 5a317412
      Mike Kravetz authored
      It is possible for poisoned hugetlb pages to reside on the free lists.
      The huge page allocation routines which dequeue entries from the free
      lists make a point of avoiding poisoned pages.  There is no such check
      and avoidance in the demote code path.
      
      If a hugetlb page on the is on a free list, poison will only be set in
      the head page rather then the page with the actual error.  If such a
      page is demoted, then the poison flag may follow the wrong page.  A page
      without error could have poison set, and a page with poison could not
      have the flag set.
      
      Check for poison before attempting to demote a hugetlb page.  Also,
      return -EBUSY to the caller if only poisoned pages are on the free list.
      
      Link: https://lkml.kernel.org/r/20220307215707.50916-1-mike.kravetz@oracle.com
      Fixes: 8531fc6f ("hugetlb: add hugetlb demote page support")
      Signed-off-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Reviewed-by: default avatarNaoya Horiguchi <naoya.horiguchi@nec.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5a317412
    • Charan Teja Kalla's avatar
      mm: compaction: fix compiler warning when CONFIG_COMPACTION=n · 31ca72fa
      Charan Teja Kalla authored
      The below warning is reported when CONFIG_COMPACTION=n:
      
         mm/compaction.c:56:27: warning: 'HPAGE_FRAG_CHECK_INTERVAL_MSEC' defined but not used [-Wunused-const-variable=]
            56 | static const unsigned int HPAGE_FRAG_CHECK_INTERVAL_MSEC = 500;
               |                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Fix it by moving 'HPAGE_FRAG_CHECK_INTERVAL_MSEC' under
      CONFIG_COMPACTION defconfig.
      
      Also since this is just a 'static const int' type, use #define for it.
      
      Link: https://lkml.kernel.org/r/1647608518-20924-1-git-send-email-quic_charante@quicinc.comSigned-off-by: default avatarCharan Teja Kalla <quic_charante@quicinc.com>
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Cc: Nitin Gupta <nigupta@nvidia.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      31ca72fa
    • Minchan Kim's avatar
      mm: fix unexpected zeroed page mapping with zram swap · e914d8f0
      Minchan Kim authored
      Two processes under CLONE_VM cloning, user process can be corrupted by
      seeing zeroed page unexpectedly.
      
            CPU A                        CPU B
      
        do_swap_page                do_swap_page
        SWP_SYNCHRONOUS_IO path     SWP_SYNCHRONOUS_IO path
        swap_readpage valid data
          swap_slot_free_notify
            delete zram entry
                                    swap_readpage zeroed(invalid) data
                                    pte_lock
                                    map the *zero data* to userspace
                                    pte_unlock
        pte_lock
        if (!pte_same)
          goto out_nomap;
        pte_unlock
        return and next refault will
        read zeroed data
      
      The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't
      increase the refcount of swap slot at copy_mm so it couldn't catch up
      whether it's safe or not to discard data from backing device.  In the
      case, only the lock it could rely on to synchronize swap slot freeing is
      page table lock.  Thus, this patch gets rid of the swap_slot_free_notify
      function.  With this patch, CPU A will see correct data.
      
            CPU A                        CPU B
      
        do_swap_page                do_swap_page
        SWP_SYNCHRONOUS_IO path     SWP_SYNCHRONOUS_IO path
                                    swap_readpage original data
                                    pte_lock
                                    map the original data
                                    swap_free
                                      swap_range_free
                                        bd_disk->fops->swap_slot_free_notify
        swap_readpage read zeroed data
                                    pte_unlock
        pte_lock
        if (!pte_same)
          goto out_nomap;
        pte_unlock
        return
        on next refault will see mapped data by CPU B
      
      The concern of the patch would increase memory consumption since it
      could keep wasted memory with compressed form in zram as well as
      uncompressed form in address space.  However, most of cases of zram uses
      no readahead and do_swap_page is followed by swap_free so it will free
      the compressed form from in zram quickly.
      
      Link: https://lkml.kernel.org/r/YjTVVxIAsnKAXjTd@google.com
      Fixes: 0bcac06f ("mm, swap: skip swapcache for swapin of synchronous device")
      Reported-by: default avatarIvan Babrou <ivan@cloudflare.com>
      Tested-by: default avatarIvan Babrou <ivan@cloudflare.com>
      Signed-off-by: default avatarMinchan Kim <minchan@kernel.org>
      Cc: Nitin Gupta <ngupta@vflare.org>
      Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: David Hildenbrand <david@redhat.com>
      Cc: <stable@vger.kernel.org>	[4.14+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e914d8f0
    • Juergen Gross's avatar
      mm, page_alloc: fix build_zonerefs_node() · e553f62f
      Juergen Gross authored
      Since commit 6aa303de ("mm, vmscan: only allocate and reclaim from
      zones with pages managed by the buddy allocator") only zones with free
      memory are included in a built zonelist.  This is problematic when e.g.
      all memory of a zone has been ballooned out when zonelists are being
      rebuilt.
      
      The decision whether to rebuild the zonelists when onlining new memory
      is done based on populated_zone() returning 0 for the zone the memory
      will be added to.  The new zone is added to the zonelists only, if it
      has free memory pages (managed_zone() returns a non-zero value) after
      the memory has been onlined.  This implies, that onlining memory will
      always free the added pages to the allocator immediately, but this is
      not true in all cases: when e.g. running as a Xen guest the onlined new
      memory will be added only to the ballooned memory list, it will be freed
      only when the guest is being ballooned up afterwards.
      
      Another problem with using managed_zone() for the decision whether a
      zone is being added to the zonelists is, that a zone with all memory
      used will in fact be removed from all zonelists in case the zonelists
      happen to be rebuilt.
      
      Use populated_zone() when building a zonelist as it has been done before
      that commit.
      
      There was a report that QubesOS (based on Xen) is hitting this problem.
      Xen has switched to use the zone device functionality in kernel 5.9 and
      QubesOS wants to use memory hotplugging for guests in order to be able
      to start a guest with minimal memory and expand it as needed.  This was
      the report leading to the patch.
      
      Link: https://lkml.kernel.org/r/20220407120637.9035-1-jgross@suse.com
      Fixes: 6aa303de ("mm, vmscan: only allocate and reclaim from zones with pages managed by the buddy allocator")
      Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
      Reported-by: default avatarMarek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Acked-by: default avatarDavid Hildenbrand <david@redhat.com>
      Cc: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
      Reviewed-by: default avatarWei Yang <richard.weiyang@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e553f62f
    • Marco Elver's avatar
      mm, kfence: support kmem_dump_obj() for KFENCE objects · 2dfe63e6
      Marco Elver authored
      Calling kmem_obj_info() via kmem_dump_obj() on KFENCE objects has been
      producing garbage data due to the object not actually being maintained
      by SLAB or SLUB.
      
      Fix this by implementing __kfence_obj_info() that copies relevant
      information to struct kmem_obj_info when the object was allocated by
      KFENCE; this is called by a common kmem_obj_info(), which also calls the
      slab/slub/slob specific variant now called __kmem_obj_info().
      
      For completeness, kmem_dump_obj() now displays if the object was
      allocated by KFENCE.
      
      Link: https://lore.kernel.org/all/20220323090520.GG16885@xsang-OptiPlex-9020/
      Link: https://lkml.kernel.org/r/20220406131558.3558585-1-elver@google.com
      Fixes: b89fb5ef ("mm, kfence: insert KFENCE hooks for SLUB")
      Fixes: d3fb45f3 ("mm, kfence: insert KFENCE hooks for SLAB")
      Signed-off-by: default avatarMarco Elver <elver@google.com>
      Reviewed-by: default avatarHyeonggon Yoo <42.hyeyoo@gmail.com>
      Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
      Acked-by: Vlastimil Babka <vbabka@suse.cz>	[slab]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2dfe63e6
    • Vincenzo Frascino's avatar
      kasan: fix hw tags enablement when KUNIT tests are disabled · b1add418
      Vincenzo Frascino authored
      Kasan enables hw tags via kasan_enable_tagging() which based on the mode
      passed via kernel command line selects the correct hw backend.
      kasan_enable_tagging() is meant to be invoked indirectly via the cpu
      features framework of the architectures that support these backends.
      Currently the invocation of this function is guarded by
      CONFIG_KASAN_KUNIT_TEST which allows the enablement of the correct backend
      only when KUNIT tests are enabled in the kernel.
      
      This inconsistency was introduced in commit:
      
        ed6d7444 ("kasan: test: support async (again) and asymm modes for HW_TAGS")
      
      ... and prevents to enable MTE on arm64 when KUNIT tests for kasan hw_tags are
      disabled.
      
      Fix the issue making sure that the CONFIG_KASAN_KUNIT_TEST guard does not
      prevent the correct invocation of kasan_enable_tagging().
      
      Link: https://lkml.kernel.org/r/20220408124323.10028-1-vincenzo.frascino@arm.com
      Fixes: ed6d7444 ("kasan: test: support async (again) and asymm modes for HW_TAGS")
      Signed-off-by: default avatarVincenzo Frascino <vincenzo.frascino@arm.com>
      Reviewed-by: default avatarAndrey Konovalov <andreyknvl@gmail.com>
      Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
      Cc: Alexander Potapenko <glider@google.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b1add418
    • Zqiang's avatar
      irq_work: use kasan_record_aux_stack_noalloc() record callstack · 25934fcf
      Zqiang authored
      On PREEMPT_RT kernel and KASAN is enabled.  the kasan_record_aux_stack()
      may call alloc_pages(), and the rt-spinlock will be acquired, if currently
      in atomic context, will trigger warning:
      
        BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
        in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 239, name: bootlogd
        Preemption disabled at:
        [<ffffffffbab1a531>] rt_mutex_slowunlock+0xa1/0x4e0
        CPU: 3 PID: 239 Comm: bootlogd Tainted: G        W 5.17.1-rt17-yocto-preempt-rt+ #105
        Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
        Call Trace:
           __might_resched.cold+0x13b/0x173
           rt_spin_lock+0x5b/0xf0
           get_page_from_freelist+0x20c/0x1610
           __alloc_pages+0x25e/0x5e0
           __stack_depot_save+0x3c0/0x4a0
           kasan_save_stack+0x3a/0x50
           __kasan_record_aux_stack+0xb6/0xc0
           kasan_record_aux_stack+0xe/0x10
           irq_work_queue_on+0x6a/0x1c0
           pull_rt_task+0x631/0x6b0
           do_balance_callbacks+0x56/0x80
           __balance_callbacks+0x63/0x90
           rt_mutex_setprio+0x349/0x880
           rt_mutex_slowunlock+0x22a/0x4e0
           rt_spin_unlock+0x49/0x80
           uart_write+0x186/0x2b0
           do_output_char+0x2e9/0x3a0
           n_tty_write+0x306/0x800
           file_tty_write.isra.0+0x2af/0x450
           tty_write+0x22/0x30
           new_sync_write+0x27c/0x3a0
           vfs_write+0x3f7/0x5d0
           ksys_write+0xd9/0x180
           __x64_sys_write+0x43/0x50
           do_syscall_64+0x44/0x90
           entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Fix it by using kasan_record_aux_stack_noalloc() to avoid the call to
      alloc_pages().
      
      Link: https://lkml.kernel.org/r/20220402142555.2699582-1-qiang1.zhang@intel.comSigned-off-by: default avatarZqiang <qiang1.zhang@intel.com>
      Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
      Cc: Alexander Potapenko <glider@google.com>
      Cc: Andrey Konovalov <andreyknvl@gmail.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      25934fcf
    • Axel Rasmussen's avatar
      mm/secretmem: fix panic when growing a memfd_secret · f9b141f9
      Axel Rasmussen authored
      When one tries to grow an existing memfd_secret with ftruncate, one gets
      a panic [1].  For example, doing the following reliably induces the
      panic:
      
          fd = memfd_secret();
      
          ftruncate(fd, 10);
          ptr = mmap(NULL, 10, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
          strcpy(ptr, "123456789");
      
          munmap(ptr, 10);
          ftruncate(fd, 20);
      
      The basic reason for this is, when we grow with ftruncate, we call down
      into simple_setattr, and then truncate_inode_pages_range, and eventually
      we try to zero part of the memory.  The normal truncation code does this
      via the direct map (i.e., it calls page_address() and hands that to
      memset()).
      
      For memfd_secret though, we specifically don't map our pages via the
      direct map (i.e.  we call set_direct_map_invalid_noflush() on every
      fault).  So the address returned by page_address() isn't useful, and
      when we try to memset() with it we panic.
      
      This patch avoids the panic by implementing a custom setattr for
      memfd_secret, which detects resizes specifically (setting the size for
      the first time works just fine, since there are no existing pages to try
      to zero), and rejects them with EINVAL.
      
      One could argue growing should be supported, but I think that will
      require a significantly more lengthy change.  So, I propose a minimal
      fix for the benefit of stable kernels, and then perhaps to extend
      memfd_secret to support growing in a separate patch.
      
      [1]:
      
        BUG: unable to handle page fault for address: ffffa0a889277028
        #PF: supervisor write access in kernel mode
        #PF: error_code(0x0002) - not-present page
        PGD afa01067 P4D afa01067 PUD 83f909067 PMD 83f8bf067 PTE 800ffffef6d88060
        Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI
        CPU: 0 PID: 281 Comm: repro Not tainted 5.17.0-dbg-DEV #1
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
        RIP: 0010:memset_erms+0x9/0x10
        Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 <f3> aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01
        RSP: 0018:ffffb932c09afbf0 EFLAGS: 00010246
        RAX: 0000000000000000 RBX: ffffda63c4249dc0 RCX: 0000000000000fd8
        RDX: 0000000000000fd8 RSI: 0000000000000000 RDI: ffffa0a889277028
        RBP: ffffb932c09afc00 R08: 0000000000001000 R09: ffffa0a889277028
        R10: 0000000000020023 R11: 0000000000000000 R12: ffffda63c4249dc0
        R13: ffffa0a890d70d98 R14: 0000000000000028 R15: 0000000000000fd8
        FS:  00007f7294899580(0000) GS:ffffa0af9bc00000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: ffffa0a889277028 CR3: 0000000107ef6006 CR4: 0000000000370ef0
        DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
        DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
        Call Trace:
         ? zero_user_segments+0x82/0x190
         truncate_inode_partial_folio+0xd4/0x2a0
         truncate_inode_pages_range+0x380/0x830
         truncate_setsize+0x63/0x80
         simple_setattr+0x37/0x60
         notify_change+0x3d8/0x4d0
         do_sys_ftruncate+0x162/0x1d0
         __x64_sys_ftruncate+0x1c/0x20
         do_syscall_64+0x44/0xa0
         entry_SYSCALL_64_after_hwframe+0x44/0xae
        Modules linked in: xhci_pci xhci_hcd virtio_net net_failover failover virtio_blk virtio_balloon uhci_hcd ohci_pci ohci_hcd evdev ehci_pci ehci_hcd 9pnet_virtio 9p netfs 9pnet
        CR2: ffffa0a889277028
      
      [lkp@intel.com: secretmem_iops can be static]
      Signed-off-by: default avatarkernel test robot <lkp@intel.com>
      [axelrasmussen@google.com: return EINVAL]
      
      Link: https://lkml.kernel.org/r/20220324210909.1843814-1-axelrasmussen@google.com
      Link: https://lkml.kernel.org/r/20220412193023.279320-1-axelrasmussen@google.comSigned-off-by: default avatarAxel Rasmussen <axelrasmussen@google.com>
      Cc: Mike Rapoport <rppt@kernel.org>
      Cc: Matthew Wilcox <willy@infradead.org>
      Cc: <stable@vger.kernel.org>
      Cc: kernel test robot <lkp@intel.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f9b141f9
    • Hugh Dickins's avatar
      tmpfs: fix regressions from wider use of ZERO_PAGE · 1bdec44b
      Hugh Dickins authored
      Chuck Lever reported fsx-based xfstests generic 075 091 112 127 failing
      when 5.18-rc1 NFS server exports tmpfs: bisected to recent tmpfs change.
      
      Whilst nfsd_splice_action() does contain some questionable handling of
      repeated pages, and Chuck was able to work around there, history from
      Mark Hemment makes clear that there might be similar dangers elsewhere:
      it was not a good idea for me to pass ZERO_PAGE down to unknown actors.
      
      Revert shmem_file_read_iter() to using ZERO_PAGE for holes only when
      iter_is_iovec(); in other cases, use the more natural iov_iter_zero()
      instead of copy_page_to_iter().
      
      We would use iov_iter_zero() throughout, but the x86 clear_user() is not
      nearly so well optimized as copy to user (dd of 1T sparse tmpfs file
      takes 57 seconds rather than 44 seconds).
      
      And now pagecache_init() does not need to SetPageUptodate(ZERO_PAGE(0)):
      which had caused boot failure on arm noMMU STM32F7 and STM32H7 boards
      
      Link: https://lkml.kernel.org/r/9a978571-8648-e830-5735-1f4748ce2e30@google.com
      Fixes: 56a8c8eb ("tmpfs: do not allocate pages on read")
      Signed-off-by: default avatarHugh Dickins <hughd@google.com>
      Reported-by: default avatarPatrice CHOTARD <patrice.chotard@foss.st.com>
      Reported-by: default avatarChuck Lever III <chuck.lever@oracle.com>
      Tested-by: default avatarChuck Lever III <chuck.lever@oracle.com>
      Cc: Mark Hemment <markhemm@googlemail.com>
      Cc: Patrice CHOTARD <patrice.chotard@foss.st.com>
      Cc: Mikulas Patocka <mpatocka@redhat.com>
      Cc: Lukas Czerner <lczerner@redhat.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: "Darrick J. Wong" <djwong@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1bdec44b
    • Joe Perches's avatar
      MAINTAINERS: Broadcom internal lists aren't maintainers · 7fbd166a
      Joe Perches authored
      Convert the broadcom internal list M: and L: entries to R: as exploder
      email addresses are neither maintainers nor mailing lists.
      
      Reorder the entries as necessary.
      
      Link: https://lkml.kernel.org/r/04eb301f5b3adbefdd78e76657eff0acb3e3d87f.camel@perches.comSigned-off-by: default avatarJoe Perches <joe@perches.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7fbd166a
  2. 14 Apr, 2022 9 commits
    • Linus Torvalds's avatar
      Merge tag 's390-5.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 115acbb5
      Linus Torvalds authored
      Pull s390 fixes from Heiko Carstens:
      
       - Convert current_stack_pointer to a register alias like it is assumed
         if ARCH_HAS_CURRENT_STACK_POINTER is selected. The existing
         implementation as a function breaks CONFIG_HARDENED_USERCOPY
         sanity-checks
      
       - Get rid of -Warray-bounds warning within kexec code
      
       - Add minimal IBM z16 support by reporting a proper elf platform, and
         adding compile options
      
       - Update defconfigs
      
      * tag 's390-5.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390: enable CONFIG_HARDENED_USERCOPY in debug_defconfig
        s390: current_stack_pointer shouldn't be a function
        s390: update defconfigs
        s390/kexec: silence -Warray-bounds warning
        s390: allow to compile with z16 optimizations
        s390: add z16 elf platform
      115acbb5
    • Linus Torvalds's avatar
      Merge tag 'net-5.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · d20339fa
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from wireless and netfilter.
      
        Current release - regressions:
      
         - smc: fix af_ops of child socket pointing to released memory
      
         - wifi: ath9k: fix usage of driver-private space in tx_info
      
        Previous releases - regressions:
      
         - ipv6: fix panic when forwarding a pkt with no in6 dev
      
         - sctp: use the correct skb for security_sctp_assoc_request
      
         - smc: fix NULL pointer dereference in smc_pnet_find_ib()
      
         - sched: fix initialization order when updating chain 0 head
      
         - phy: don't defer probe forever if PHY IRQ provider is missing
      
         - dsa: revert "net: dsa: setup master before ports"
      
         - dsa: felix: fix tagging protocol changes with multiple CPU ports
      
         - eth: ice:
            - fix use-after-free when freeing @rx_cpu_rmap
            - revert "iavf: fix deadlock occurrence during resetting VF
              interface"
      
         - eth: lan966x: stop processing the MAC entry is port is wrong
      
        Previous releases - always broken:
      
         - sched:
            - flower: fix parsing of ethertype following VLAN header
            - taprio: check if socket flags are valid
      
         - nfc: add flush_workqueue to prevent uaf
      
         - veth: ensure eth header is in skb's linear part
      
         - eth: stmmac: fix altr_tse_pcs function when using a fixed-link
      
         - eth: macb: restart tx only if queue pointer is lagging
      
         - eth: macvlan: fix leaking skb in source mode with nodst option"
      
      * tag 'net-5.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (52 commits)
        net: bcmgenet: Revert "Use stronger register read/writes to assure ordering"
        rtnetlink: Fix handling of disabled L3 stats in RTM_GETSTATS replies
        net: dsa: felix: fix tagging protocol changes with multiple CPU ports
        tun: annotate access to queue->trans_start
        nfc: nci: add flush_workqueue to prevent uaf
        net: dsa: realtek: don't parse compatible string for RTL8366S
        net: dsa: realtek: fix Kconfig to assure consistent driver linkage
        net: ftgmac100: access hardware register after clock ready
        Revert "net: dsa: setup master before ports"
        macvlan: Fix leaking skb in source mode with nodst option
        netfilter: nf_tables: nft_parse_register can return a negative value
        net: lan966x: Stop processing the MAC entry is port is wrong.
        net: lan966x: Fix when a port's upper is changed.
        net: lan966x: Fix IGMP snooping when frames have vlan tag
        net: lan966x: Update lan966x_ptp_get_nominal_value
        sctp: Initialize daddr on peeled off socket
        net/smc: Fix af_ops of child socket pointing to released memory
        net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()
        net/smc: use memcpy instead of snprintf to avoid out of bounds read
        net: macb: Restart tx only if queue pointer is lagging
        ...
      d20339fa
    • Linus Torvalds's avatar
      Merge tag 'sound-5.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · b9b4c79e
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This became an unexpectedly large pull request due to various
        regression fixes in the previous kernels.
      
        The majority of fixes are a series of patches to address the
        regression at probe errors in devres'ed drivers, while there are yet
        more fixes for the x86 SG allocations and for USB-audio buffer
        management. In addition, a few HD-audio quirks and other small fixes
        are found"
      
      * tag 'sound-5.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (52 commits)
        ALSA: usb-audio: Limit max buffer and period sizes per time
        ALSA: memalloc: Add fallback SG-buffer allocations for x86
        ALSA: nm256: Don't call card private_free at probe error path
        ALSA: mtpav: Don't call card private_free at probe error path
        ALSA: rme9652: Fix the missing snd_card_free() call at probe error
        ALSA: hdspm: Fix the missing snd_card_free() call at probe error
        ALSA: hdsp: Fix the missing snd_card_free() call at probe error
        ALSA: oxygen: Fix the missing snd_card_free() call at probe error
        ALSA: lx6464es: Fix the missing snd_card_free() call at probe error
        ALSA: cmipci: Fix the missing snd_card_free() call at probe error
        ALSA: aw2: Fix the missing snd_card_free() call at probe error
        ALSA: als300: Fix the missing snd_card_free() call at probe error
        ALSA: lola: Fix the missing snd_card_free() call at probe error
        ALSA: bt87x: Fix the missing snd_card_free() call at probe error
        ALSA: sis7019: Fix the missing error handling
        ALSA: intel_hdmi: Fix the missing snd_card_free() call at probe error
        ALSA: via82xx: Fix the missing snd_card_free() call at probe error
        ALSA: sonicvibes: Fix the missing snd_card_free() call at probe error
        ALSA: rme96: Fix the missing snd_card_free() call at probe error
        ALSA: rme32: Fix the missing snd_card_free() call at probe error
        ...
      b9b4c79e
    • Linus Torvalds's avatar
      Merge tag 'for-5.18-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 722985e2
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
       "A few more code and warning fixes.
      
        There's one feature ioctl removal patch slated for 5.18 that did not
        make it to the main pull request. It's just a one-liner and the ioctl
        has a v2 that's in use for a long time, no point to postpone it to
        5.19.
      
        Late update:
      
         - remove balance v1 ioctl, superseded by v2 in 2012
      
        Fixes:
      
         - add back cgroup attribution for compressed writes
      
         - add super block write start/end annotations to asynchronous balance
      
         - fix root reference count on an error handling path
      
         - in zoned mode, activate zone at the chunk allocation time to avoid
           ENOSPC due to timing issues
      
         - fix delayed allocation accounting for direct IO
      
        Warning fixes:
      
         - simplify assertion condition in zoned check
      
         - remove an unused variable"
      
      * tag 'for-5.18-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: fix btrfs_submit_compressed_write cgroup attribution
        btrfs: fix root ref counts in error handling in btrfs_get_root_ref
        btrfs: zoned: activate block group only for extent allocation
        btrfs: return allocated block group from do_chunk_alloc()
        btrfs: mark resumed async balance as writing
        btrfs: remove support of balance v1 ioctl
        btrfs: release correct delalloc amount in direct IO write path
        btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups()
        btrfs: zoned: remove redundant condition in btrfs_run_delalloc_range
      722985e2
    • Linus Torvalds's avatar
      Merge tag 'fscache-fixes-20220413' of... · ec9c57a7
      Linus Torvalds authored
      Merge tag 'fscache-fixes-20220413' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs
      
      Pull fscache fixes from David Howells:
       "Here's a collection of fscache and cachefiles fixes and misc small
        cleanups. The two main fixes are:
      
         - Add a missing unmark of the inode in-use mark in an error path.
      
         - Fix a KASAN slab-out-of-bounds error when setting the xattr on a
           cachefiles volume due to the wrong length being given to memcpy().
      
        In addition, there's the removal of an unused parameter, removal of an
        unused Kconfig option, conditionalising a bit of procfs-related stuff
        and some doc fixes"
      
      * tag 'fscache-fixes-20220413' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
        fscache: remove FSCACHE_OLD_API Kconfig option
        fscache: Use wrapper fscache_set_cache_state() directly when relinquishing
        fscache: Move fscache_cookies_seq_ops specific code under CONFIG_PROC_FS
        fscache: Remove the cookie parameter from fscache_clear_page_bits()
        docs: filesystems: caching/backend-api.rst: fix an object withdrawn API
        docs: filesystems: caching/backend-api.rst: correct two relinquish APIs use
        cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr
        cachefiles: unmark inode in use in error path
      ec9c57a7
    • Jeremy Linton's avatar
      net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" · 2df3fc4a
      Jeremy Linton authored
      It turns out after digging deeper into this bug, that it was being
      triggered by GCC12 failing to call the bcmgenet_enable_dma()
      routine. Given that a gcc12 fix has been merged [1] and the genet
      driver now works properly when built with gcc12, this commit should
      be reverted.
      
      [1]
      https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105160
      https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=aabb9a261ef060cf24fd626713f1d7d9df81aa57
      
      Fixes: 8d3ea3d4 ("net: bcmgenet: Use stronger register read/writes to assure ordering")
      Signed-off-by: default avatarJeremy Linton <jeremy.linton@arm.com>
      Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Link: https://lore.kernel.org/r/20220412210420.1129430-1-jeremy.linton@arm.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      2df3fc4a
    • Petr Machata's avatar
      rtnetlink: Fix handling of disabled L3 stats in RTM_GETSTATS replies · 23cfe941
      Petr Machata authored
      When L3 stats are disabled, rtnl_offload_xstats_get_size_stats() returns
      size of 0, which is supposed to be an indication that the corresponding
      attribute should not be emitted. However, instead, the current code
      reserves a 0-byte attribute.
      
      The reason this does not show up as a citation on a kasan kernel is that
      netdev_offload_xstats_get(), which is supposed to fill in the data, never
      ends up getting called, because rtnl_offload_xstats_get_stats() notices
      that the stats are not actually used and skips the call.
      
      Thus a zero-length IFLA_OFFLOAD_XSTATS_L3_STATS attribute ends up in a
      response, confusing the userspace.
      
      Fix by skipping the L3-stats related block in rtnl_offload_xstats_fill().
      
      Fixes: 0e7788fd ("net: rtnetlink: Add UAPI for obtaining L3 offload xstats")
      Signed-off-by: default avatarPetr Machata <petrm@nvidia.com>
      Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
      Link: https://lore.kernel.org/r/591b58e7623edc3eb66dd1fcfa8c8f133d090974.1649794741.git.petrm@nvidia.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      23cfe941
    • Vladimir Oltean's avatar
      net: dsa: felix: fix tagging protocol changes with multiple CPU ports · 00fa91bc
      Vladimir Oltean authored
      When the device tree has 2 CPU ports defined, a single one is active
      (has any dp->cpu_dp pointers point to it). Yet the second one is still a
      CPU port, and DSA still calls ->change_tag_protocol on it.
      
      On the NXP LS1028A, the CPU ports are ports 4 and 5. Port 4 is the
      active CPU port and port 5 is inactive.
      
      After the following commands:
      
       # Initial setting
       cat /sys/class/net/eno2/dsa/tagging
       ocelot
       echo ocelot-8021q > /sys/class/net/eno2/dsa/tagging
       echo ocelot > /sys/class/net/eno2/dsa/tagging
      
      traffic is now broken, because the driver has moved the NPI port from
      port 4 to port 5, unbeknown to DSA.
      
      The problem can be avoided by detecting that the second CPU port is
      unused, and not doing anything for it. Further rework will be needed
      when proper support for multiple CPU ports is added.
      
      Treat this as a bug and prepare current kernels to work in single-CPU
      mode with multiple-CPU DT blobs.
      
      Fixes: adb3dccf ("net: dsa: felix: convert to the new .change_tag_protocol DSA API")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Link: https://lore.kernel.org/r/20220412172209.2531865-1-vladimir.oltean@nxp.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      00fa91bc
    • Antoine Tenart's avatar
      tun: annotate access to queue->trans_start · 968a1a5d
      Antoine Tenart authored
      Commit 5337824f ("net: annotate accesses to queue->trans_start")
      introduced a new helper, txq_trans_cond_update, to update
      queue->trans_start using WRITE_ONCE. One snippet in drivers/net/tun.c
      was missed, as it was introduced roughly at the same time.
      
      Fixes: 5337824f ("net: annotate accesses to queue->trans_start")
      Cc: Eric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarAntoine Tenart <atenart@kernel.org>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Link: https://lore.kernel.org/r/20220412135852.466386-1-atenart@kernel.orgSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      968a1a5d
  3. 13 Apr, 2022 13 commits
    • Lin Ma's avatar
      nfc: nci: add flush_workqueue to prevent uaf · ef27324e
      Lin Ma authored
      Our detector found a concurrent use-after-free bug when detaching an
      NCI device. The main reason for this bug is the unexpected scheduling
      between the used delayed mechanism (timer and workqueue).
      
      The race can be demonstrated below:
      
      Thread-1                           Thread-2
                                       | nci_dev_up()
                                       |   nci_open_device()
                                       |     __nci_request(nci_reset_req)
                                       |       nci_send_cmd
                                       |         queue_work(cmd_work)
      nci_unregister_device()          |
        nci_close_device()             | ...
          del_timer_sync(cmd_timer)[1] |
      ...                              | Worker
      nci_free_device()                | nci_cmd_work()
        kfree(ndev)[3]                 |   mod_timer(cmd_timer)[2]
      
      In short, the cleanup routine thought that the cmd_timer has already
      been detached by [1] but the mod_timer can re-attach the timer [2], even
      it is already released [3], resulting in UAF.
      
      This UAF is easy to trigger, crash trace by POC is like below
      
      [   66.703713] ==================================================================
      [   66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490
      [   66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33
      [   66.703974]
      [   66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5
      [   66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work
      [   66.703974] Call Trace:
      [   66.703974]  <TASK>
      [   66.703974]  dump_stack_lvl+0x57/0x7d
      [   66.703974]  print_report.cold+0x5e/0x5db
      [   66.703974]  ? enqueue_timer+0x448/0x490
      [   66.703974]  kasan_report+0xbe/0x1c0
      [   66.703974]  ? enqueue_timer+0x448/0x490
      [   66.703974]  enqueue_timer+0x448/0x490
      [   66.703974]  __mod_timer+0x5e6/0xb80
      [   66.703974]  ? mark_held_locks+0x9e/0xe0
      [   66.703974]  ? try_to_del_timer_sync+0xf0/0xf0
      [   66.703974]  ? lockdep_hardirqs_on_prepare+0x17b/0x410
      [   66.703974]  ? queue_work_on+0x61/0x80
      [   66.703974]  ? lockdep_hardirqs_on+0xbf/0x130
      [   66.703974]  process_one_work+0x8bb/0x1510
      [   66.703974]  ? lockdep_hardirqs_on_prepare+0x410/0x410
      [   66.703974]  ? pwq_dec_nr_in_flight+0x230/0x230
      [   66.703974]  ? rwlock_bug.part.0+0x90/0x90
      [   66.703974]  ? _raw_spin_lock_irq+0x41/0x50
      [   66.703974]  worker_thread+0x575/0x1190
      [   66.703974]  ? process_one_work+0x1510/0x1510
      [   66.703974]  kthread+0x2a0/0x340
      [   66.703974]  ? kthread_complete_and_exit+0x20/0x20
      [   66.703974]  ret_from_fork+0x22/0x30
      [   66.703974]  </TASK>
      [   66.703974]
      [   66.703974] Allocated by task 267:
      [   66.703974]  kasan_save_stack+0x1e/0x40
      [   66.703974]  __kasan_kmalloc+0x81/0xa0
      [   66.703974]  nci_allocate_device+0xd3/0x390
      [   66.703974]  nfcmrvl_nci_register_dev+0x183/0x2c0
      [   66.703974]  nfcmrvl_nci_uart_open+0xf2/0x1dd
      [   66.703974]  nci_uart_tty_ioctl+0x2c3/0x4a0
      [   66.703974]  tty_ioctl+0x764/0x1310
      [   66.703974]  __x64_sys_ioctl+0x122/0x190
      [   66.703974]  do_syscall_64+0x3b/0x90
      [   66.703974]  entry_SYSCALL_64_after_hwframe+0x44/0xae
      [   66.703974]
      [   66.703974] Freed by task 406:
      [   66.703974]  kasan_save_stack+0x1e/0x40
      [   66.703974]  kasan_set_track+0x21/0x30
      [   66.703974]  kasan_set_free_info+0x20/0x30
      [   66.703974]  __kasan_slab_free+0x108/0x170
      [   66.703974]  kfree+0xb0/0x330
      [   66.703974]  nfcmrvl_nci_unregister_dev+0x90/0xd0
      [   66.703974]  nci_uart_tty_close+0xdf/0x180
      [   66.703974]  tty_ldisc_kill+0x73/0x110
      [   66.703974]  tty_ldisc_hangup+0x281/0x5b0
      [   66.703974]  __tty_hangup.part.0+0x431/0x890
      [   66.703974]  tty_release+0x3a8/0xc80
      [   66.703974]  __fput+0x1f0/0x8c0
      [   66.703974]  task_work_run+0xc9/0x170
      [   66.703974]  exit_to_user_mode_prepare+0x194/0x1a0
      [   66.703974]  syscall_exit_to_user_mode+0x19/0x50
      [   66.703974]  do_syscall_64+0x48/0x90
      [   66.703974]  entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      To fix the UAF, this patch adds flush_workqueue() to ensure the
      nci_cmd_work is finished before the following del_timer_sync.
      This combination will promise the timer is actually detached.
      
      Fixes: 6a2968aa ("NFC: basic NCI protocol implementation")
      Signed-off-by: default avatarLin Ma <linma@zju.edu.cn>
      Reviewed-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ef27324e
    • Alvin Šipraga's avatar
      net: dsa: realtek: don't parse compatible string for RTL8366S · 8e925de6
      Alvin Šipraga authored
      This switch is not even supported, but if someone were to actually put
      this compatible string "realtek,rtl8366s" in their device tree, they
      would be greeted with a kernel panic because the probe function would
      dereference NULL. So let's just remove it.
      
      Link: https://lore.kernel.org/all/CACRpkdYdKZs0WExXc3=0yPNOwP+oOV60HRz7SRoGjZvYHaT=1g@mail.gmail.com/Signed-off-by: default avatarAlvin Šipraga <alsi@bang-olufsen.dk>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8e925de6
    • Alvin Šipraga's avatar
      net: dsa: realtek: fix Kconfig to assure consistent driver linkage · 2511e0c8
      Alvin Šipraga authored
      The kernel test robot reported a build failure:
      
      or1k-linux-ld: drivers/net/dsa/realtek/realtek-smi.o:(.rodata+0x16c): undefined reference to `rtl8366rb_variant'
      
      ... with the following build configuration:
      
      CONFIG_NET_DSA_REALTEK=y
      CONFIG_NET_DSA_REALTEK_SMI=y
      CONFIG_NET_DSA_REALTEK_RTL8365MB=y
      CONFIG_NET_DSA_REALTEK_RTL8366RB=m
      
      The problem here is that the realtek-smi interface driver gets built-in,
      while the rtl8366rb switch subdriver gets built as a module, hence the
      symbol rtl8366rb_variant is not reachable when defining the OF device
      table in the interface driver.
      
      The Kconfig dependencies don't help in this scenario because they just
      say that the subdriver(s) depend on at least one interface driver. In
      fact, the subdrivers don't depend on the interface drivers at all, and
      can even be built even in their absence. Somewhat strangely, the
      interface drivers can also be built in the absence of any subdriver,
      BUT, if a subdriver IS enabled, then it must be reachable according to
      the linkage of the interface driver: effectively what the IS_REACHABLE()
      macro achieves. If it is not reachable, the above kind of linker error
      will be observed.
      
      Rather than papering over the above build error by simply using
      IS_REACHABLE(), we can do a little better and admit that it is actually
      the interface drivers that have a dependency on the subdrivers. So this
      patch does exactly that. Specifically, we ensure that:
      
      1. The interface drivers' Kconfig symbols must have a value no greater
         than the value of any subdriver Kconfig symbols.
      
      2. The subdrivers should by default enable both interface drivers, since
         most users probably want at least one of them; those interface
         drivers can be explicitly disabled however.
      
      What this doesn't do is prevent a user from building only a subdriver,
      without any interface driver. To that end, add an additional line of
      help in the menu to guide users in the right direction.
      
      Link: https://lore.kernel.org/all/202204110757.XIafvVnj-lkp@intel.com/Reported-by: default avatarkernel test robot <lkp@intel.com>
      Fixes: aac94001 ("net: dsa: realtek: add new mdio interface for drivers")
      Signed-off-by: default avatarAlvin Šipraga <alsi@bang-olufsen.dk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2511e0c8
    • David S. Miller's avatar
      Merge tag 'wireless-2022-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless · dad32cfe
      David S. Miller authored
      Kalle Valo says:
      
      ====================
      wireless fixes for v5.18
      
      First set of fixes for v5.18. Maintainers file updates, two
      compilation warning fixes, one revert for ath11k and smaller fixes to
      drivers and stack. All the usual stuff.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dad32cfe
    • Dylan Hung's avatar
      net: ftgmac100: access hardware register after clock ready · 3d250452
      Dylan Hung authored
      AST2600 MAC register 0x58 is writable only when the MAC clock is
      enabled.  Usually, the MAC clock is enabled by the bootloader so
      register 0x58 is set normally when the bootloader is involved.  To make
      ast2600 ftgmac100 work without the bootloader, postpone the register
      write until the clock is ready.
      
      Fixes: 137d23ce ("net: ftgmac100: Fix Aspeed ast2600 TX hang issue")
      Signed-off-by: default avatarDylan Hung <dylan_hung@aspeedtech.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3d250452
    • Vladimir Oltean's avatar
      Revert "net: dsa: setup master before ports" · 762c2998
      Vladimir Oltean authored
      This reverts commit 11fd667d.
      
      dsa_slave_change_mtu() updates the MTU of the DSA master and of the
      associated CPU port, but only if it detects a change to the master MTU.
      
      The blamed commit in the Fixes: tag below addressed a regression where
      dsa_slave_change_mtu() would return early and not do anything due to
      ds->ops->port_change_mtu() not being implemented.
      
      However, that commit also had the effect that the master MTU got set up
      to the correct value by dsa_master_setup(), but the associated CPU port's
      MTU did not get updated. This causes breakage for drivers that rely on
      the ->port_change_mtu() DSA call to account for the tagging overhead on
      the CPU port, and don't set up the initial MTU during the setup phase.
      
      Things actually worked before because they were in a fragile equilibrium
      where dsa_slave_change_mtu() was called before dsa_master_setup() was.
      So dsa_slave_change_mtu() could actually detect a change and update the
      CPU port MTU too.
      
      Restore the code to the way things used to work by reverting the reorder
      of dsa_tree_setup_master() and dsa_tree_setup_ports(). That change did
      not have a concrete motivation going for it anyway, it just looked
      better.
      
      Fixes: 066dfc42 ("Revert "net: dsa: stop updating master MTU from master.c"")
      Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      762c2998
    • Martin Willi's avatar
      macvlan: Fix leaking skb in source mode with nodst option · e16b8598
      Martin Willi authored
      The MACVLAN receive handler clones skbs to all matching source MACVLAN
      interfaces, before it passes the packet along to match on destination
      based MACVLANs.
      
      When using the MACVLAN nodst mode, passing the packet to destination based
      MACVLANs is omitted and the handler returns with RX_HANDLER_CONSUMED.
      However, the passed skb is not freed, leaking for any packet processed
      with the nodst option.
      
      Properly free the skb when consuming packets to fix that leak.
      
      Fixes: 427f0c8c ("macvlan: Add nodst option to macvlan type source")
      Signed-off-by: default avatarMartin Willi <martin@strongswan.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e16b8598
    • Takashi Iwai's avatar
      ALSA: usb-audio: Limit max buffer and period sizes per time · 24d0c9f0
      Takashi Iwai authored
      In the previous fix, we increased the max buffer bytes from 1MB to 4MB
      so that we can use bigger buffers for the modern HiFi devices with
      higher rates, more channels and wider formats.  OTOH, extending this
      has a concern that too big buffer is allowed for the lower rates, less
      channels and narrower formats; when an application tries to allocate
      as big buffer as possible, it'll lead to unexpectedly too huge size.
      
      Also, we had a problem about the inconsistent max buffer and period
      bytes for the implicit feedback mode when both streams have different
      channels.  This was fixed by the (relatively complex) patch to reduce
      the max buffer and period bytes accordingly.
      
      This is an alternative fix for those, a patch to kill two birds with
      one stone (*): instead of increasing the max buffer bytes blindly and
      applying the reduction per channels, we simply use the hw constraints
      for the buffer and period "time".  Meanwhile the max buffer and period
      bytes are set unlimited instead.
      
      Since the inconsistency of buffer (and period) bytes comes from the
      difference of the channels in the tied streams, as long as we care
      only about the buffer (and period) time, it doesn't matter; the buffer
      time is same for different channels, although we still allow higher
      buffer size.  Similarly, this will allow more buffer bytes for HiFi
      devices while it also keeps the reasonable size for the legacy
      devices, too.
      
      As of this patch, the max period and buffer time are set to 1 and 2
      seconds, which should be large enough for all possible use cases.
      
      (*) No animals were harmed in the making of this patch.
      
      Fixes: 98c27add ("ALSA: usb-audio: Cap upper limits of buffer/period bytes for implicit fb")
      Fixes: fee2ec8c ("ALSA: usb-audio: Increase max buffer size")
      Link: https://lore.kernel.org/r/20220412130740.18933-1-tiwai@suse.deSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      24d0c9f0
    • Takashi Iwai's avatar
      ALSA: memalloc: Add fallback SG-buffer allocations for x86 · 925ca893
      Takashi Iwai authored
      The recent change for memory allocator replaced the SG-buffer handling
      helper for x86 with the standard non-contiguous page handler.  This
      works for most cases, but there is a corner case I obviously
      overlooked, namely, the fallback of non-contiguous handler without
      IOMMU.  When the system runs without IOMMU, the core handler tries to
      use the continuous pages with a single SGL entry.  It works nicely for
      most cases, but when the system memory gets fragmented, the large
      allocation may fail frequently.
      
      Ideally the non-contig handler could deal with the proper SG pages,
      it's cumbersome to extend for now.  As a workaround, here we add new
      types for (minimalistic) SG allocations, instead, so that the
      allocator falls back to those types automatically when the allocation
      with the standard API failed.
      
      BTW, one better (but pretty minor) improvement from the previous
      SG-buffer code is that this provides the proper mmap support without
      the PCM's page fault handling.
      
      Fixes: 2c95b92e ("ALSA: memalloc: Unify x86 SG-buffer handling (take#3)")
      BugLink: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/2272
      BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1198248
      Cc: <stable@vger.kernel.org>
      Link: https://lore.kernel.org/r/20220413054808.7547-1-tiwai@suse.deSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      925ca893
    • Linus Torvalds's avatar
      Merge tag 'hardening-v5.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · a1994480
      Linus Torvalds authored
      Pull hardening fixes from Kees Cook:
      
       - latent_entropy: Use /dev/urandom instead of small GCC seed (Jason
         Donenfeld)
      
       - uapi/stddef.h: add missed include guards (Tadeusz Struk)
      
      * tag 'hardening-v5.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        gcc-plugins: latent_entropy: use /dev/urandom
        uapi/linux/stddef.h: Add include guards
      a1994480
    • Linus Torvalds's avatar
      Merge tag 'nfsd-5.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux · c1488c97
      Linus Torvalds authored
      Pull nfsd fixes from Chuck Lever:
      
       - Fix a write performance regression
      
       - Fix crashes during request deferral on RDMA transports
      
      * tag 'nfsd-5.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
        SUNRPC: Fix the svc_deferred_event trace class
        SUNRPC: Fix NFSD's request deferral on RDMA transports
        nfsd: Clean up nfsd_file_put()
        nfsd: Fix a write performance regression
        SUNRPC: Return true/false (not 1/0) from bool functions
      c1488c97
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 453096eb
      Linus Torvalds authored
      Pull kvm fixes from Paolo Bonzini:
       "x86:
      
         - Miscellaneous bugfixes
      
         - A small cleanup for the new workqueue code
      
         - Documentation syntax fix
      
        RISC-V:
      
         - Remove hgatp zeroing in kvm_arch_vcpu_put()
      
         - Fix alignment of the guest_hang() in KVM selftest
      
         - Fix PTE A and D bits in KVM selftest
      
         - Missing #include in vcpu_fp.c
      
        ARM:
      
         - Some PSCI fixes after introducing PSCIv1.1 and SYSTEM_RESET2
      
         - Fix the MMU write-lock not being taken on THP split
      
         - Fix mixed-width VM handling
      
         - Fix potential UAF when debugfs registration fails
      
         - Various selftest updates for all of the above"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (24 commits)
        KVM: x86: hyper-v: Avoid writing to TSC page without an active vCPU
        KVM: SVM: Do not activate AVIC for SEV-enabled guest
        Documentation: KVM: Add SPDX-License-Identifier tag
        selftests: kvm: add tsc_scaling_sync to .gitignore
        RISC-V: KVM: include missing hwcap.h into vcpu_fp
        KVM: selftests: riscv: Fix alignment of the guest_hang() function
        KVM: selftests: riscv: Set PTE A and D bits in VS-stage page table
        RISC-V: KVM: Don't clear hgatp CSR in kvm_arch_vcpu_put()
        selftests: KVM: Free the GIC FD when cleaning up in arch_timer
        selftests: KVM: Don't leak GIC FD across dirty log test iterations
        KVM: Don't create VM debugfs files outside of the VM directory
        KVM: selftests: get-reg-list: Add KVM_REG_ARM_FW_REG(3)
        KVM: avoid NULL pointer dereference in kvm_dirty_ring_push
        KVM: arm64: selftests: Introduce vcpu_width_config
        KVM: arm64: mixed-width check should be skipped for uninitialized vCPUs
        KVM: arm64: vgic: Remove unnecessary type castings
        KVM: arm64: Don't split hugepages outside of MMU write lock
        KVM: arm64: Drop unneeded minor version check from PSCI v1.x handler
        KVM: arm64: Actually prevent SMC64 SYSTEM_RESET2 from AArch32
        KVM: arm64: Generally disallow SMC64 for AArch32 guests
        ...
      453096eb
    • Linus Torvalds's avatar
      Merge tag 'media/v5.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 7083b89e
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
      
       - a regression fix for si2157
      
       - a Kconfig dependency fix for imx-mipi-csis
      
       - fix the rockchip/rga driver probing logic
      
      * tag 'media/v5.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        media: si2157: unknown chip version Si2147-A30 ROM 0x50
        media: platform: imx-mipi-csis: Add dependency on VIDEO_DEV
        media: rockchip/rga: do proper error checking in probe
      7083b89e
  4. 12 Apr, 2022 7 commits