1. 05 Jan, 2020 1 commit
  2. 04 Jan, 2020 4 commits
    • John Johansen's avatar
      apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock · 8c62ed27
      John Johansen authored
      aa_xattrs_match() is unfortunately calling vfs_getxattr_alloc() from a
      context protected by an rcu_read_lock. This can not be done as
      vfs_getxattr_alloc() may sleep regardles of the gfp_t value being
      passed to it.
      
      Fix this by breaking the rcu_read_lock on the policy search when the
      xattr match feature is requested and restarting the search if a policy
      changes occur.
      
      Fixes: 8e51f908 ("apparmor: Add support for attaching profiles via xattr, presence and value")
      Reported-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
      Reported-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      8c62ed27
    • Linus Torvalds's avatar
      Merge tag 'mips_fixes_5.5_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux · c420ddda
      Linus Torvalds authored
      Pull MIPS fixes from Paul Burton:
       "A collection of MIPS fixes:
      
         - Fill the struct cacheinfo shared_cpu_map field with sensible
           values, notably avoiding issues with perf which was unhappy in the
           absence of these values.
      
         - A boot fix for Loongson 2E & 2F machines which was fallout from
           some refactoring performed this cycle.
      
         - A Kconfig dependency fix for the Loongson CPU HWMon driver.
      
         - A couple of VDSO fixes, ensuring gettimeofday() behaves
           appropriately for kernel configurations that don't include support
           for a clocksource the VDSO can use & fixing the calling convention
           for the n32 & n64 VDSOs which would previously clobber the $gp/$28
           register.
      
         - A build fix for vmlinuz compressed images which were
           inappropriately building with -fsanitize-coverage despite not being
           part of the kernel proper, then failing to link due to the missing
           __sanitizer_cov_trace_pc() function.
      
         - A couple of eBPF JIT fixes, including disabling it for MIPS32 due
           to a large number of issues with the code generated there &
           reflecting ISA dependencies in Kconfig to enforce that systems
           which don't support the JIT must include the interpreter"
      
      * tag 'mips_fixes_5.5_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
        MIPS: Avoid VDSO ABI breakage due to global register variable
        MIPS: BPF: eBPF JIT: check for MIPS ISA compliance in Kconfig
        MIPS: BPF: Disable MIPS32 eBPF JIT
        MIPS: Prevent link failure with kcov instrumentation
        MIPS: Kconfig: Use correct form for 'depends on'
        mips: Fix gettimeofday() in the vdso library
        MIPS: Fix boot on Fuloong2 systems
        mips: cacheinfo: report shared CPU map
      c420ddda
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-5.5-rc5' of git://git.infradead.org/users/vkoul/slave-dma · 5613970a
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "A bunch of fixes for:
      
         - uninitialized dma_slave_caps access
      
         - virt-dma use after free in vchan_complete()
      
         - driver fixes for ioat, k3dma and jz4780"
      
      * tag 'dmaengine-fix-5.5-rc5' of git://git.infradead.org/users/vkoul/slave-dma:
        ioat: ioat_alloc_ring() failure handling.
        dmaengine: virt-dma: Fix access after free in vchan_complete()
        dmaengine: k3dma: Avoid null pointer traversal
        dmaengine: dma-jz4780: Also break descriptor chains on JZ4725B
        dmaengine: Fix access to uninitialized dma_slave_caps
      5613970a
    • Linus Torvalds's avatar
      Merge tag 'media/v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 50978df3
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
      
       - some fixes at CEC core to comply with HDMI 2.0 specs and fix some
         border cases
      
       - a fix at the transmission logic of the pulse8-cec driver
      
       - one alignment fix on a data struct at ipu3 when built with 32 bits
      
      * tag 'media/v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        media: intel-ipu3: Align struct ipu3_uapi_awb_fr_config_s to 32 bytes
        media: pulse8-cec: fix lost cec_transmit_attempt_done() call
        media: cec: check 'transmit_in_progress', not 'transmitting'
        media: cec: avoid decrementing transmit_queue_sz if it is 0
        media: cec: CEC 2.0-only bcast messages were ignored
      50978df3
  3. 03 Jan, 2020 19 commits
    • Linus Torvalds's avatar
      Merge tag 'for-5.5-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 3a562aee
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
       "A few fixes for btrfs:
      
         - blkcg accounting problem with compression that could stall writes
      
         - setting up blkcg bio for compression crashes due to NULL bdev
           pointer
      
         - fix possible infinite loop in writeback for nocow files (here
           possible means almost impossible, 13 things that need to happen to
           trigger it)"
      
      * tag 'for-5.5-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        Btrfs: fix infinite loop during nocow writeback due to race
        btrfs: fix compressed write bio blkcg attribution
        btrfs: punt all bios created in btrfs_submit_compressed_write()
      3a562aee
    • Linus Torvalds's avatar
      Merge tag 'block-5.5-20200103' of git://git.kernel.dk/linux-block · b6b4aafc
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Three fixes in here:
      
         - Fix for a missing split on default memory boundary mask (4G) (Ming)
      
         - Fix for multi-page read bio truncate (Ming)
      
         - Fix for null_blk zone close request handling (Damien)"
      
      * tag 'block-5.5-20200103' of git://git.kernel.dk/linux-block:
        null_blk: Fix REQ_OP_ZONE_CLOSE handling
        block: fix splitting segments on boundary masks
        block: add bio_truncate to fix guard_bio_eod
      b6b4aafc
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v5.5-2' of... · bed72351
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - fix build error in usr/gen_initramfs_list.sh
      
       - fix libelf-dev dependency in deb-pkg build
      
      * tag 'kbuild-fixes-v5.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kbuild/deb-pkg: annotate libelf-dev dependency as :native
        gen_initramfs_list.sh: fix 'bad variable name' error
      bed72351
    • Linus Torvalds's avatar
      Merge tag 'for-linus-2020-01-03' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux · d9c82fd8
      Linus Torvalds authored
      Pull thread fixes from Christian Brauner:
       "Here are two fixes:
      
         - Panic earlier when global init exits to generate useable coredumps.
      
           Currently, when global init and all threads in its thread-group
           have exited we panic via:
      
             do_exit()
             -> exit_notify()
                -> forget_original_parent()
                   -> find_child_reaper()
      
           This makes it hard to extract a useable coredump for global init
           from a kernel crashdump because by the time we panic exit_mm() will
           have already released global init's mm. We now panic slightly
           earlier. This has been a problem in certain environments such as
           Android.
      
         - Fix a race in assigning and reading taskstats for thread-groups
           with more than one thread.
      
           This patch has been waiting for quite a while since people
           disagreed on what the correct fix was at first"
      
      * tag 'for-linus-2020-01-03' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux:
        exit: panic before exit_mm() on global init exit
        taskstats: fix data-race
      d9c82fd8
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 6f2e9c3d
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "Two more powerpc fixes for 5.5:
      
         - One commit to fix a build error when CONFIG_JUMP_LABEL=n,
           introduced by our recent fix to is_shared_processor().
      
         - A commit marking some SLB related functions as notrace, as tracing
           them triggers warnings.
      
        Thanks to Jason A Donenfeld"
      
      * tag 'powerpc-5.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/spinlocks: Include correct header for static key
        powerpc/mm: Mark get_slice_psize() & slice_addr_is_low() as notrace
      6f2e9c3d
    • Linus Torvalds's avatar
      Merge tag 'sound-5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · e35d0165
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Nothing to worry at this stage but all nice small changes:
      
         - A regression fix for AMD GPU detection in HD-audio
      
         - A long-standing sleep-in-atomic fix for an ice1724 device
      
         - Usual suspects, the device-specific quirks for HD- and USB-audio"
      
      * tag 'sound-5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC
        ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code
        ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker
        ALSA: hda - Apply sync-write workaround to old Intel platforms, too
        ALSA: hda/hdmi - fix atpx_present when CLASS is not VGA
        ALSA: usb-audio: fix set_format altsetting sanity check
        ALSA: hda/realtek - Add headset Mic no shutup for ALC283
        ALSA: usb-audio: set the interface format after resume on Dell WD19
      e35d0165
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2020-01-03' of git://anongit.freedesktop.org/drm/drm · ca78fdeb
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "New Years fixes! Mostly amdgpu with a light smattering of arm
        graphics, and two AGP warning fixes.
      
        Quiet as expected, hopefully we don't get a post holiday rush.
      
        agp:
         - two unused variable removed
      
        amdgpu:
         - ATPX regression fix
         - SMU metrics table locking fixes
         - gfxoff fix for raven
         - RLC firmware loading stability fix
      
        mediatek:
         - external display fix
         - dsi timing fix
      
        sun4i:
         - Fix double-free in connector/encoder cleanup (Stefan)
      
        maildp:
         - Make vtable static (Ben)"
      
      * tag 'drm-fixes-2020-01-03' of git://anongit.freedesktop.org/drm/drm:
        agp: remove unused variable arqsz in agp_3_5_enable()
        agp: remove unused variable mcapndx
        drm/amdgpu: correct RLC firmwares loading sequence
        drm/amdgpu: enable gfxoff for raven1 refresh
        drm/amdgpu/smu: add metrics table lock for vega20 (v2)
        drm/amdgpu/smu: add metrics table lock for navi (v2)
        drm/amdgpu/smu: add metrics table lock for arcturus (v2)
        drm/amdgpu/smu: add metrics table lock
        Revert "drm/amdgpu: simplify ATPX detection"
        drm/arm/mali: make malidp_mw_connector_helper_funcs static
        drm/sun4i: hdmi: Remove duplicate cleanup calls
        drm/mediatek: reduce the hbp and hfp for phy timing
        drm/mediatek: Fix can't get component for external display plane.
        drm/mediatek: Check return value of mtk_drm_ddp_comp_for_plane.
      ca78fdeb
    • Jan Stancek's avatar
      mm/hugetlbfs: fix for_each_hstate() loop in init_hugetlbfs_fs() · 15f0ec94
      Jan Stancek authored
      LTP memfd_create04 started failing for some huge page sizes
      after v5.4-10135-gc3bfc5dd.
      
      The problem is the check introduced to for_each_hstate() loop that
      should skip default_hstate_idx.  Since it doesn't update 'i' counter,
      all subsequent huge page sizes are skipped as well.
      
      Fixes: 8fc312b3 ("mm/hugetlbfs: fix error handling when setting up mounts")
      Signed-off-by: default avatarJan Stancek <jstancek@redhat.com>
      Reviewed-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      15f0ec94
    • Ard Biesheuvel's avatar
      kbuild/deb-pkg: annotate libelf-dev dependency as :native · 8ffdc54b
      Ard Biesheuvel authored
      Cross compiling the x86 kernel on a non-x86 build machine produces
      the following error when CONFIG_UNWINDER_ORC is enabled, regardless
      of whether libelf-dev is installed or not.
      
        dpkg-checkbuilddeps: error: Unmet build dependencies: libelf-dev
        dpkg-buildpackage: warning: build dependencies/conflicts unsatisfied; aborting
        dpkg-buildpackage: warning: (Use -d flag to override.)
      
      Since this is a build time dependency for a build tool, we need to
      depend on the native version of libelf-dev so add the appropriate
      annotation.
      Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
      Signed-off-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      8ffdc54b
    • Masahiro Yamada's avatar
      gen_initramfs_list.sh: fix 'bad variable name' error · cc976614
      Masahiro Yamada authored
      Prior to commit 858805b3 ("kbuild: add $(BASH) to run scripts with
      bash-extension"), this shell script was almost always run by bash since
      bash is usually installed on the system by default.
      
      Now, this script is run by sh, which might be a symlink to dash. On such
      distributions, the following code emits an error:
      
        local dev=`LC_ALL=C ls -l "${location}"`
      
      You can reproduce the build error, for example by setting
      CONFIG_INITRAMFS_SOURCE="/dev".
      
          GEN     usr/initramfs_data.cpio.gz
        ./usr/gen_initramfs_list.sh: 131: local: 1: bad variable name
        make[1]: *** [usr/Makefile:61: usr/initramfs_data.cpio.gz] Error 2
      
      This is because `LC_ALL=C ls -l "${location}"` contains spaces.
      Surrounding it with double-quotes fixes the error.
      
      Fixes: 858805b3 ("kbuild: add $(BASH) to run scripts with bash-extension")
      Reported-by: default avatarJory A. Pratt <anarchy@gentoo.org>
      Signed-off-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      cc976614
    • Sakari Ailus's avatar
      media: intel-ipu3: Align struct ipu3_uapi_awb_fr_config_s to 32 bytes · ce644cf3
      Sakari Ailus authored
      A struct that needs to be aligned to 32 bytes has a size of 28. Increase
      the size to 32.
      
      This makes elements of arrays of this struct aligned to 32 as well, and
      other structs where members are aligned to 32 mixing
      ipu3_uapi_awb_fr_config_s as well as other types.
      
      Fixes: commit dca5ef2a ("media: staging/intel-ipu3: remove the unnecessary compiler flags")
      Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Tested-by: default avatarBingbu Cao <bingbu.cao@intel.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
      ce644cf3
    • Yunfeng Ye's avatar
      agp: remove unused variable arqsz in agp_3_5_enable() · a6204fc7
      Yunfeng Ye authored
      This patch fix the following warning:
      drivers/char/agp/isoch.c: In function ‘agp_3_5_enable’:
      drivers/char/agp/isoch.c:322:13: warning: variable ‘arqsz’ set but not
      used [-Wunused-but-set-variable]
        u32 isoch, arqsz;
                   ^~~~~
      Signed-off-by: default avatarYunfeng Ye <yeyunfeng@huawei.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      a6204fc7
    • Yunfeng Ye's avatar
      agp: remove unused variable mcapndx · 2fec966f
      Yunfeng Ye authored
      This patch fix the following warning:
      drivers/char/agp/isoch.c: In function ‘agp_3_5_isochronous_node_enable’:
      drivers/char/agp/isoch.c:87:5: warning: variable ‘mcapndx’ set but not
      used [-Wunused-but-set-variable]
        u8 mcapndx;
           ^~~~~~~
      Signed-off-by: default avatarYunfeng Ye <yeyunfeng@huawei.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      2fec966f
    • Linus Torvalds's avatar
      Merge tag 'sizeof_field-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · 7ca4ad5b
      Linus Torvalds authored
      Pull final sizeof_field conversion from Kees Cook:
       "Remove now unused FIELD_SIZEOF() macro (Kees Cook)"
      
      * tag 'sizeof_field-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        kernel.h: Remove unused FIELD_SIZEOF()
      7ca4ad5b
    • Linus Torvalds's avatar
      Merge tag 'gcc-plugins-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · 90e0a47b
      Linus Torvalds authored
      Pull gcc-plugins fix from Kees Cook:
       "Build flexibility fix: allow builds to disable plugins even when
        plugins available (Arnd Bergmann)"
      
      * tag 'gcc-plugins-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        gcc-plugins: make it possible to disable CONFIG_GCC_PLUGINS again
      90e0a47b
    • Linus Torvalds's avatar
      Merge tag 'seccomp-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · bf6dd9a5
      Linus Torvalds authored
      Pull seccomp fixes from Kees Cook:
       "Fixes for seccomp_notify_ioctl uapi sanity from Sargun Dhillon.
      
        The bulk of this is fixing the surrounding samples and selftests so
        that seccomp can correctly validate the seccomp_notify_ioctl buffer as
        being initially zeroed.
      
        Summary:
      
         - Fix samples and selftests to zero passed-in buffer
      
         - Enforce zeroed buffer checking
      
         - Verify buffer sanity check in selftest"
      
      * tag 'seccomp-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        selftests/seccomp: Catch garbage on SECCOMP_IOCTL_NOTIF_RECV
        seccomp: Check that seccomp_notif is zeroed out by the user
        selftests/seccomp: Zero out seccomp_notif
        samples/seccomp: Zero out members based on seccomp_notif_sizes
      bf6dd9a5
    • Paul Burton's avatar
      MIPS: Avoid VDSO ABI breakage due to global register variable · bbcc5672
      Paul Burton authored
      Declaring __current_thread_info as a global register variable has the
      effect of preventing GCC from saving & restoring its value in cases
      where the ABI would typically do so.
      
      To quote GCC documentation:
      
      > If the register is a call-saved register, call ABI is affected: the
      > register will not be restored in function epilogue sequences after the
      > variable has been assigned. Therefore, functions cannot safely return
      > to callers that assume standard ABI.
      
      When our position independent VDSO is built for the n32 or n64 ABIs all
      functions it exposes should be preserving the value of $gp/$28 for their
      caller, but in the presence of the __current_thread_info global register
      variable GCC stops doing so & simply clobbers $gp/$28 when calculating
      the address of the GOT.
      
      In cases where the VDSO returns success this problem will typically be
      masked by the caller in libc returning & restoring $gp/$28 itself, but
      that is by no means guaranteed. In cases where the VDSO returns an error
      libc will typically contain a fallback path which will now fail
      (typically with a bad memory access) if it attempts anything which
      relies upon the value of $gp/$28 - eg. accessing anything via the GOT.
      
      One fix for this would be to move the declaration of
      __current_thread_info inside the current_thread_info() function,
      demoting it from global register variable to local register variable &
      avoiding inadvertently creating a non-standard calling ABI for the VDSO.
      Unfortunately this causes issues for clang, which doesn't support local
      register variables as pointed out by commit fe92da0f ("MIPS: Changed
      current_thread_info() to an equivalent supported by both clang and GCC")
      which introduced the global register variable before we had a VDSO to
      worry about.
      
      Instead, fix this by continuing to use the global register variable for
      the kernel proper but declare __current_thread_info as a simple extern
      variable when building the VDSO. It should never be referenced, and will
      cause a link error if it is. This resolves the calling convention issue
      for the VDSO without having any impact upon the build of the kernel
      itself for either clang or gcc.
      Signed-off-by: default avatarPaul Burton <paulburton@kernel.org>
      Fixes: ebb5e78c ("MIPS: Initial implementation of a VDSO")
      Reported-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      Reviewed-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      Tested-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Christian Brauner <christian.brauner@canonical.com>
      Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
      Cc: <stable@vger.kernel.org> # v4.4+
      Cc: linux-mips@vger.kernel.org
      Cc: linux-kernel@vger.kernel.org
      bbcc5672
    • Linus Torvalds's avatar
      Merge tag 'pstore-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · 278b14eb
      Linus Torvalds authored
      Pull pstore bug fixes from Kees Cook:
      
       - always reset circular buffer state when writing new dump (Aleksandr
         Yashkin)
      
       - fix rare error-path memory leak (Kees Cook)
      
      * tag 'pstore-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        pstore/ram: Write new dumps to start of recycled zones
        pstore/ram: Fix error-path memory leak in persistent_ram_new() callers
      278b14eb
    • Dominik Brodowski's avatar
      Revert "fs: remove ksys_dup()" · 74f1a299
      Dominik Brodowski authored
      This reverts commit 8243186f ("fs: remove ksys_dup()") and the
      subsequent fix for it in commit 2d3145f8 ("early init: fix error
      handling when opening /dev/console").
      
      Trying to use filp_open() and f_dupfd() instead of pseudo-syscalls
      caused more trouble than what is worth it: it requires accessing vfs
      internals and it turns out there were other bugs in it too.
      
      In particular, the file reference counting was wrong - because unlike
      the original "open+2*dup" sequence it used "filp_open+3*f_dupfd" and
      thus had an extra leaked file reference.
      
      That in turn then caused odd problems with Androidx86 long after boot
      becaue of how the extra reference to the console kept the session active
      even after all file descriptors had been closed.
      Reported-by: default avataryouling 257 <youling257@gmail.com>
      Cc: Arvind Sankar <nivedita@alum.mit.edu>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarDominik Brodowski <linux@dominikbrodowski.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      74f1a299
  4. 02 Jan, 2020 10 commits
  5. 01 Jan, 2020 3 commits
  6. 31 Dec, 2019 3 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 738d2902
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix big endian overflow in nf_flow_table, from Arnd Bergmann.
      
       2) Fix port selection on big endian in nft_tproxy, from Phil Sutter.
      
       3) Fix precision tracking for unbound scalars in bpf verifier, from
          Daniel Borkmann.
      
       4) Fix integer overflow in socket rcvbuf check in UDP, from Antonio
          Messina.
      
       5) Do not perform a neigh confirmation during a pmtu update over a
          tunnel, from Hangbin Liu.
      
       6) Fix DMA mapping leak in dpaa_eth driver, from Madalin Bucur.
      
       7) Various PTP fixes for sja1105 dsa driver, from Vladimir Oltean.
      
       8) Add missing to dummy definition of of_mdiobus_child_is_phy(), from
          Geert Uytterhoeven
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (54 commits)
        hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename()
        net/sched: add delete_empty() to filters and use it in cls_flower
        tcp: Fix highest_sack and highest_sack_seq
        ptp: fix the race between the release of ptp_clock and cdev
        net: dsa: sja1105: Reconcile the meaning of TPID and TPID2 for E/T and P/Q/R/S
        Documentation: net: dsa: sja1105: Remove text about taprio base-time limitation
        net: dsa: sja1105: Remove restriction of zero base-time for taprio offload
        net: dsa: sja1105: Really make the PTP command read-write
        net: dsa: sja1105: Take PTP egress timestamp by port, not mgmt slot
        cxgb4/cxgb4vf: fix flow control display for auto negotiation
        mlxsw: spectrum: Use dedicated policer for VRRP packets
        mlxsw: spectrum_router: Skip loopback RIFs during MAC validation
        net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs
        net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device
        net_sched: sch_fq: properly set sk->sk_pacing_status
        bnx2x: Fix accounting of vlan resources among the PFs
        bnx2x: Use appropriate define for vlan credit
        of: mdio: Add missing inline to of_mdiobus_child_is_phy() dummy
        net: phy: aquantia: add suspend / resume ops for AQR105
        dpaa_eth: fix DMA mapping leak
        ...
      738d2902
    • Linus Torvalds's avatar
      Merge tag 'tomoyo-fixes-for-5.5' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1 · c5c928c6
      Linus Torvalds authored
      Pull tomoyo fixes from Tetsuo Handa:
       "Two bug fixes:
      
         - Suppress RCU warning at list_for_each_entry_rcu()
      
         - Don't use fancy names on sockets"
      
      * tag 'tomoyo-fixes-for-5.5' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1:
        tomoyo: Suppress RCU warning at list_for_each_entry_rcu().
        tomoyo: Don't use nifty names on sockets.
      c5c928c6
    • Taehee Yoo's avatar
      hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename() · 04b69426
      Taehee Yoo authored
      hsr slave interfaces don't have debugfs directory.
      So, hsr_debugfs_rename() shouldn't be called when hsr slave interface name
      is changed.
      
      Test commands:
          ip link add dummy0 type dummy
          ip link add dummy1 type dummy
          ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1
          ip link set dummy0 name ap
      
      Splat looks like:
      [21071.899367][T22666] ap: renamed from dummy0
      [21071.914005][T22666] ==================================================================
      [21071.919008][T22666] BUG: KASAN: slab-out-of-bounds in hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.923640][T22666] Read of size 8 at addr ffff88805febcd98 by task ip/22666
      [21071.926941][T22666]
      [21071.927750][T22666] CPU: 0 PID: 22666 Comm: ip Not tainted 5.5.0-rc2+ #240
      [21071.929919][T22666] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
      [21071.935094][T22666] Call Trace:
      [21071.935867][T22666]  dump_stack+0x96/0xdb
      [21071.936687][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.937774][T22666]  print_address_description.constprop.5+0x1be/0x360
      [21071.939019][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.940081][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.940949][T22666]  __kasan_report+0x12a/0x16f
      [21071.941758][T22666]  ? hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.942674][T22666]  kasan_report+0xe/0x20
      [21071.943325][T22666]  hsr_debugfs_rename+0xaa/0xb0 [hsr]
      [21071.944187][T22666]  hsr_netdev_notify+0x1fe/0x9b0 [hsr]
      [21071.945052][T22666]  ? __module_text_address+0x13/0x140
      [21071.945897][T22666]  notifier_call_chain+0x90/0x160
      [21071.946743][T22666]  dev_change_name+0x419/0x840
      [21071.947496][T22666]  ? __read_once_size_nocheck.constprop.6+0x10/0x10
      [21071.948600][T22666]  ? netdev_adjacent_rename_links+0x280/0x280
      [21071.949577][T22666]  ? __read_once_size_nocheck.constprop.6+0x10/0x10
      [21071.950672][T22666]  ? lock_downgrade+0x6e0/0x6e0
      [21071.951345][T22666]  ? do_setlink+0x811/0x2ef0
      [21071.951991][T22666]  do_setlink+0x811/0x2ef0
      [21071.952613][T22666]  ? is_bpf_text_address+0x81/0xe0
      [ ... ]
      
      Reported-by: syzbot+9328206518f08318a5fd@syzkaller.appspotmail.com
      Fixes: 4c2d5e33 ("hsr: rename debugfs file when interface name is changed")
      Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      04b69426