[PATCH 4.19 06/36] mm/slub: fix stack overruns with SLUB_STATS

2020-07-07 Thread Greg Kroah-Hartman
From: Qian Cai [ Upstream commit a68ee0573991e90af2f1785db309206408bad3e5 ] There is no need to copy SLUB_STATS items from root memcg cache to new memcg cache copies. Doing so could result in stack overruns because the store function only accepts 0 to clear the stat and returns an error for eve

[PATCH 5.4 10/65] tools lib traceevent: Add append() function helper for appending strings

2020-07-07 Thread Greg Kroah-Hartman
From: Steven Rostedt (VMware) [ Upstream commit 27d4d336f2872193e90ee5450559e1699fae0f6d ] There's several locations that open code realloc and strcat() to append text to strings. Add an append() function that takes a delimiter and a string to append to another string. Signed-off-by: Steven Ros

[PATCH 5.4 55/65] MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen

2020-07-07 Thread Greg Kroah-Hartman
From: Hauke Mehrtens commit fcec538ef8cca0ad0b84432235dccd9059c8e6f8 upstream. This resolves the hazard between the mtc0 in the change_c0_status() and the mfc0 in configure_exception_vector(). Without resolving this hazard configure_exception_vector() could read an old value and would restore th

[PATCH 5.4 30/65] hwmon: (max6697) Make sure the OVERT mask is set correctly

2020-07-07 Thread Greg Kroah-Hartman
From: Chu Lin [ Upstream commit 016983d138cbe99a5c0aaae0103ee88f5300beb3 ] Per the datasheet for max6697, OVERT mask and ALERT mask are different. For example, the 7th bit of OVERT is the local channel but for alert mask, the 6th bit is the local channel. Therefore, we can't apply the same mask

[PATCH 5.4 20/65] tpm: Fix TIS locality timeout problems

2020-07-07 Thread Greg Kroah-Hartman
From: James Bottomley commit 7862840219058436b80029a0263fd1ef065fb1b3 upstream. It has been reported that some TIS based TPMs are giving unexpected errors when using the O_NONBLOCK path of the TPM device. The problem is that some TPMs don't like it when you get and then relinquish a locality (as

[PATCH 5.4 58/65] drm/amdgpu/atomfirmware: fix vram_info fetching for renoir

2020-07-07 Thread Greg Kroah-Hartman
From: Alex Deucher commit d7a6634a4cfba073ff6a526cb4265d6e58ece234 upstream. Renoir uses integrated_system_info table v12. The table has the same layout as v11 with respect to this data. Just reuse the existing code for v12 for stable. Fixes incorrectly reported vram info in the driver output

[PATCH 5.4 50/65] SMB3: Honor persistent/resilient handle flags for multiuser mounts

2020-07-07 Thread Greg Kroah-Hartman
From: Paul Aurich commit 00dfbc2f9c61185a2e662f27c45a0bb29b2a134f upstream. Without this: - persistent handles will only be enabled for per-user tcons if the server advertises the 'Continuous Availabity' capability - resilient handles would never be enabled for per-user tcons Signed-off-by:

[PATCH 5.4 18/65] kgdb: Avoid suspicious RCU usage warning

2020-07-07 Thread Greg Kroah-Hartman
From: Douglas Anderson [ Upstream commit 440ab9e10e2e6e5fd677473ee6f9e3af0f6904d6 ] At times when I'm using kgdb I see a splat on my console about suspicious RCU usage. I managed to come up with a case that could reproduce this that looked like this: WARNING: suspicious RCU usage 5.7.0-rc4

[PATCH 5.4 52/65] SMB3: Honor handletimeout flag for multiuser mounts

2020-07-07 Thread Greg Kroah-Hartman
From: Paul Aurich commit 6b356f6cf941d5054d7fab072cae4a5f8658e3db upstream. Fixes: ca567eb2b3f0 ("SMB3: Allow persistent handle timeout to be configurable on mount") Signed-off-by: Paul Aurich CC: Stable Signed-off-by: Steve French Reviewed-by: Aurelien Aptel Signed-off-by: Greg Kroah-Hartm

[PATCH 5.4 60/65] irqchip/gic: Atomically update affinity

2020-07-07 Thread Greg Kroah-Hartman
From: Marc Zyngier commit 005c34ae4b44f085120d7f371121ec7ded677761 upstream. The GIC driver uses a RMW sequence to update the affinity, and relies on the gic_lock_irqsave/gic_unlock_irqrestore sequences to update it atomically. But these sequences only expand into anything meaningful if the BL_

[PATCH 5.4 25/65] cxgb4: use unaligned conversion for fetching timestamp

2020-07-07 Thread Greg Kroah-Hartman
From: Rahul Lakkireddy [ Upstream commit 589b1c9c166dce120e27b32a83a78f55464a7ef9 ] Use get_unaligned_be64() to fetch the timestamp needed for ns_to_ktime() conversion. Fixes following sparse warning: sge.c:3282:43: warning: cast to restricted __be64 Fixes: a456950445a0 ("cxgb4: time stamping

[PATCH 5.4 31/65] hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add()

2020-07-07 Thread Greg Kroah-Hartman
From: Misono Tomohiro [ Upstream commit 8b97f9922211c44a739c5cbd9502ecbb9f17f6d1 ] Although it rarely happens, we should call free_capabilities() if error happens after read_capabilities() to free allocated strings. Fixes: de584afa5e188 ("hwmon driver for ACPI 4.0 power meters") Signed-off-by:

[PATCH 5.4 21/65] crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()

2020-07-07 Thread Greg Kroah-Hartman
From: Herbert Xu commit 34c86f4c4a7be3b3e35aa48bd18299d4c756064d upstream. The locking in af_alg_release_parent is broken as the BH socket lock can only be taken if there is a code-path to handle the case where the lock is owned by process-context. Instead of adding such handling, we can fix th

[PATCH 5.4 29/65] cxgb4: fix SGE queue dump destination buffer context

2020-07-07 Thread Greg Kroah-Hartman
From: Rahul Lakkireddy [ Upstream commit 1992ded5d111997877a9a25205976d8d03c46814 ] The data in destination buffer is expected to be be parsed in big endian. So, use the right context. Fixes following sparse warning: cudbg_lib.c:2041:44: warning: incorrect type in assignment (different base typ

[PATCH 5.4 34/65] kthread: save thread function

2020-07-07 Thread Greg Kroah-Hartman
From: J. Bruce Fields [ Upstream commit 52782c92ac85c4e393eb4a903a62e6c24afa633f ] It's handy to keep the kthread_fn just as a unique cookie to identify classes of kthreads. E.g. if you can verify that a given task is running your thread_fn, then you may know what sort of type kthread_data poin

[PATCH 5.4 51/65] SMB3: Honor lease disabling for multiuser mounts

2020-07-07 Thread Greg Kroah-Hartman
From: Paul Aurich commit ad35f169db6cd5a4c5c0a5a42fb0cad3efeccb83 upstream. Fixes: 3e7a02d47872 ("smb3: allow disabling requesting leases") Signed-off-by: Paul Aurich CC: Stable Signed-off-by: Steve French Reviewed-by: Aurelien Aptel Signed-off-by: Greg Kroah-Hartman --- fs/cifs/connect.c

[PATCH 5.4 14/65] nvme: fix possible deadlock when I/O is blocked

2020-07-07 Thread Greg Kroah-Hartman
From: Sagi Grimberg [ Upstream commit 3b4b19721ec652ad2c4fe51dfbe5124212b5f581 ] Revert fab7772bfbcf ("nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns") When adding a new namespace to the head disk (via nvme_mpath_set_live) we will see partition scan which triggers I/O on th

[PATCH 5.4 42/65] nvme: fix a crash in nvme_mpath_add_disk

2020-07-07 Thread Greg Kroah-Hartman
From: Christoph Hellwig [ Upstream commit 72d447113bb751ded97b2e2c38f886e4a4139082 ] For private namespaces ns->head_disk is NULL, so add a NULL check before updating the BDI capabilities. Fixes: b2ce4d90690b ("nvme-multipath: set bdi capabilities once") Reported-by: Avinash M N Signed-off-by:

[PATCH 5.4 23/65] rxrpc: Fix afs large storage transmission performance drop

2020-07-07 Thread Greg Kroah-Hartman
From: David Howells [ Upstream commit 02c28dffb13abbaaedece1e4a6493b48ad3f913a ] Commit 2ad6691d988c, which moved the modification of the status annotation for a packet in the Tx buffer prior to the retransmission moved the state clearance, but managed to lose the bit that set it to UNACK. Cons

[PATCH 5.4 07/65] mm/slub: fix stack overruns with SLUB_STATS

2020-07-07 Thread Greg Kroah-Hartman
From: Qian Cai [ Upstream commit a68ee0573991e90af2f1785db309206408bad3e5 ] There is no need to copy SLUB_STATS items from root memcg cache to new memcg cache copies. Doing so could result in stack overruns because the store function only accepts 0 to clear the stat and returns an error for eve

[PATCH 5.4 11/65] tools lib traceevent: Handle __attribute__((user)) in field names

2020-07-07 Thread Greg Kroah-Hartman
From: Steven Rostedt (VMware) [ Upstream commit 74621d929d944529a5e2878a84f48bfa6fb69a66 ] Commit c61f13eaa1ee1 ("gcc-plugins: Add structleak for more stack initialization") added "__attribute__((user))" to the user when stackleak detector is enabled. This now appears in the field format of syst

[PATCH 5.4 45/65] i2c: mlxcpld: check correct size of maximum RECV_LEN packet

2020-07-07 Thread Greg Kroah-Hartman
From: Wolfram Sang [ Upstream commit 597911287fcd13c3a4b4aa3e0a52b33d431e0a8e ] I2C_SMBUS_BLOCK_MAX defines already the maximum number as defined in the SMBus 2.0 specs. I don't see a reason to add 1 here. Also, fix the errno to what is suggested for this error. Fixes: c9bfdc7c16cb ("i2c: mlxcp

[PATCH 5.4 49/65] SMB3: Honor seal flag for multiuser mounts

2020-07-07 Thread Greg Kroah-Hartman
From: Paul Aurich commit cc15461c73d7d044d56c47e869a215e49bd429c8 upstream. Ensure multiuser SMB3 mounts use encryption for all users' tcons if the mount options are configured to require encryption. Without this, only the primary tcon and IPC tcons are guaranteed to be encrypted. Per-user tcons

[PATCH 5.4 43/65] samples/vfs: avoid warning in statx override

2020-07-07 Thread Greg Kroah-Hartman
From: Kees Cook [ Upstream commit c3eeaae9fd736b7f2afbda8d3cbb1cbae06decf3 ] Something changed recently to uncover this warning: samples/vfs/test-statx.c:24:15: warning: `struct foo' declared inside parameter list will not be visible outside of this definition or declaration 24 | #defin

[PATCH 5.4 12/65] s390/debug: avoid kernel warning on too large number of pages

2020-07-07 Thread Greg Kroah-Hartman
From: Christian Borntraeger [ Upstream commit 827c4913923e0b441ba07ba4cc41e01181102303 ] When specifying insanely large debug buffers a kernel warning is printed. The debug code does handle the error gracefully, though. Instead of duplicating the check let us silence the warning to avoid crashes

[PATCH 5.4 48/65] Revert "ALSA: usb-audio: Improve frames size computation"

2020-07-07 Thread Greg Kroah-Hartman
From: Greg Kroah-Hartman This reverts commit aba41867dd66939d336fdf604e4d73b805d8039f which is commit f0bd62b64016508938df9babe47f65c2c727d25c upstream. It causes a number of reported issues and a fix for it has not hit Linus's tree yet. Revert this to resolve those problems. Cc: Alexander Tso

[PATCH 5.4 04/65] usbnet: smsc95xx: Fix use-after-free after removal

2020-07-07 Thread Greg Kroah-Hartman
From: Tuomas Tynkkynen [ Upstream commit b835a71ef64a61383c414d6bf2896d2c0161deca ] Syzbot reports an use-after-free in workqueue context: BUG: KASAN: use-after-free in mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737 mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737 __smsc95xx_mdio_read dri

[PATCH 5.4 63/65] x86/resctrl: Fix memory bandwidth counter width for AMD

2020-07-07 Thread Greg Kroah-Hartman
From: Babu Moger commit 2c18bd525c47f882f033b0a813ecd09c93e1ecdf upstream. Memory bandwidth is calculated reading the monitoring counter at two intervals and calculating the delta. It is the software’s responsibility to read the count often enough to avoid having the count roll over _twice_ betw

[PATCH 5.4 19/65] selftests: tpm: Use /bin/sh instead of /bin/bash

2020-07-07 Thread Greg Kroah-Hartman
From: Jarkko Sakkinen commit 377ff83083c953dd58c5a030b3c9b5b85d8cc727 upstream. It's better to use /bin/sh instead of /bin/bash in order to run the tests in the BusyBox shell. Fixes: 6ea3dfe1e073 ("selftests: add TPM 2.0 tests") Cc: sta...@vger.kernel.org Cc: linux-integr...@vger.kernel.org Cc:

[PATCH 5.4 61/65] mm, compaction: fully assume capture is not NULL in compact_zone_order()

2020-07-07 Thread Greg Kroah-Hartman
From: Vlastimil Babka commit 6467552ca64c4ddd2b83ed73192107d7145f533b upstream. Dan reports: The patch 5e1f0f098b46: "mm, compaction: capture a page under direct compaction" from Mar 5, 2019, leads to the following Smatch complaint: mm/compaction.c:2321 compact_zone_order() error: we

[PATCH 5.4 47/65] nfsd: apply umask on fs without ACL support

2020-07-07 Thread Greg Kroah-Hartman
From: J. Bruce Fields commit 22cf8419f1319ff87ec759d0ebdff4cbafaee832 upstream. The server is failing to apply the umask when creating new objects on filesystems without ACL support. To reproduce this, you need to use NFSv4.2 and a client and server recent enough to support umask, and you need

[PATCH 5.4 13/65] nvme-multipath: set bdi capabilities once

2020-07-07 Thread Greg Kroah-Hartman
From: Keith Busch [ Upstream commit b2ce4d90690bd29ce5b554e203cd03682dd59697 ] The queues' backing device info capabilities don't change with each namespace revalidation. Set it only when each path's request_queue is initially added to a multipath queue. Signed-off-by: Keith Busch Reviewed-by:

[PATCH 5.4 54/65] MIPS: lantiq: xway: sysctrl: fix the GPHY clock alias names

2020-07-07 Thread Greg Kroah-Hartman
From: Martin Blumenstingl commit 03e62fd67d3ab33f39573fc8787d89dc9b4d7255 upstream. The dt-bindings for the GSWIP describe that the node should be named "switch". Use the same name in sysctrl.c so the GSWIP driver can actually find the "gphy0" and "gphy1" clocks. Fixes: 14fceff4771e51 ("net: ds

[PATCH 5.4 33/65] thermal/drivers/rcar_gen3: Fix undefined temperature if negative

2020-07-07 Thread Greg Kroah-Hartman
From: Dien Pham [ Upstream commit 5f8f06425a0dcdad7bedbb77e67f5c65ab4dacfc ] As description for DIV_ROUND_CLOSEST in file include/linux/kernel.h. "Result is undefined for negative divisors if the dividend variable type is unsigned and for negative dividends if the divisor variable type i

[PATCH 5.4 02/65] mm: fix swap cache node allocation mask

2020-07-07 Thread Greg Kroah-Hartman
From: Hugh Dickins [ Upstream commit 243bce09c91b0145aeaedd5afba799d81841c030 ] Chris Murphy reports that a slightly overcommitted load, testing swap and zram along with i915, splats and keeps on splatting, when it had better fail less noisily: gnome-shell: page allocation failure: order:0,

[PATCH 5.4 46/65] spi: spi-fsl-dspi: Fix external abort on interrupt in resume or exit paths

2020-07-07 Thread Greg Kroah-Hartman
From: Krzysztof Kozlowski commit 3d87b613d6a3c6f0980e877ab0895785a2dde581 upstream. If shared interrupt comes late, during probe error path or device remove (could be triggered with CONFIG_DEBUG_SHIRQ), the interrupt handler dspi_interrupt() will access registers with the clock being disabled. T

[PATCH 5.4 08/65] rxrpc: Fix race between incoming ACK parser and retransmitter

2020-07-07 Thread Greg Kroah-Hartman
From: David Howells [ Upstream commit 2ad6691d988c0c611362ddc2aad89e0fb50e3261 ] There's a race between the retransmission code and the received ACK parser. The problem is that the retransmission loop has to drop the lock under which it is iterating through the transmission buffer in order to tr

[PATCH 5.4 59/65] dma-buf: Move dma_buf_release() from fops to dentry_ops

2020-07-07 Thread Greg Kroah-Hartman
From: Sumit Semwal commit 4ab59c3c638c6c8952bf07739805d20eb6358a4d upstream. Charan Teja reported a 'use-after-free' in dmabuffs_dname [1], which happens if the dma_buf_release() is called while the userspace is accessing the dma_buf pseudo fs's dmabuffs_dname() in another process, and dma_buf_r

[PATCH 5.4 06/65] mm/slub.c: fix corrupted freechain in deactivate_slab()

2020-07-07 Thread Greg Kroah-Hartman
From: Dongli Zhang [ Upstream commit 52f23478081ae0dcdb95d1650ea1e7d52d586829 ] The slub_debug is able to fix the corrupted slab freelist/page. However, alloc_debug_processing() only checks the validity of current and next freepointer during allocation path. As a result, once some objects have

[PATCH 5.4 28/65] cxgb4: use correct type for all-mask IP address comparison

2020-07-07 Thread Greg Kroah-Hartman
From: Rahul Lakkireddy [ Upstream commit f286dd8eaad5a2758750f407ab079298e0bcc8a5 ] Use correct type to check for all-mask exact match IP addresses. Fixes following sparse warnings due to big endian value checks against 0x in is_addr_all_mask(): cxgb4_filter.c:977:25: warning: restricte

[PATCH 5.4 22/65] drm/msm/dpu: fix error return code in dpu_encoder_init

2020-07-07 Thread Greg Kroah-Hartman
From: Chen Tao [ Upstream commit aa472721c8dbe1713cf510f56ffbc56ae9e14247 ] Fix to return negative error code -ENOMEM with the use of ERR_PTR from dpu_encoder_init. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Chen Tao Signed-off-by: Rob Clark Signed-off-by: Sasha Le

[PATCH 5.4 39/65] virtio-blk: free vblk-vqs in error path of virtblk_probe()

2020-07-07 Thread Greg Kroah-Hartman
From: Hou Tao [ Upstream commit e7eea44eefbdd5f0345a0a8b80a3ca1c21030d06 ] Else there will be memory leak if alloc_disk() fails. Fixes: 6a27b656fc02 ("block: virtio-blk: support multi virt queues per virtio-blk device") Signed-off-by: Hou Tao Reviewed-by: Stefano Garzarella Reviewed-by: Ming

[PATCH 5.7 018/112] drm/amdgpu: fix non-pointer dereference for non-RAS supported

2020-07-07 Thread Greg Kroah-Hartman
From: Evan Quan [ Upstream commit a9d82d2f91297679cfafd7e61c4bccdca6cd550d ] Backtrace on gpu recover test on Navi10. [ 1324.516681] RIP: 0010:amdgpu_ras_set_error_query_ready+0x15/0x20 [amdgpu] [ 1324.523778] Code: 4c 89 f7 e8 cd a2 a0 d8 e9 99 fe ff ff 45 31 ff e9 91 fe ff ff 0f 1f 44 00 00

[PATCH 5.7 021/112] soc: ti: omap-prm: use atomic iopoll instead of sleeping one

2020-07-07 Thread Greg Kroah-Hartman
From: Tero Kristo [ Upstream commit 98ece19f247159a51003796ede7112fef2df5d7f ] The reset handling APIs for omap-prm can be invoked PM runtime which runs in atomic context. For this to work properly, switch to atomic iopoll version instead of the current which can sleep. Otherwise, this throws a

[PATCH 5.7 008/112] mm: fix swap cache node allocation mask

2020-07-07 Thread Greg Kroah-Hartman
From: Hugh Dickins [ Upstream commit 243bce09c91b0145aeaedd5afba799d81841c030 ] Chris Murphy reports that a slightly overcommitted load, testing swap and zram along with i915, splats and keeps on splatting, when it had better fail less noisily: gnome-shell: page allocation failure: order:0,

[PATCH 5.7 004/112] exfat: move setting VOL_DIRTY over exfat_remove_entries()

2020-07-07 Thread Greg Kroah-Hartman
From: Namjae Jeon [ Upstream commit 3bcfb701099acf96b0e883bf5544f96af473aa1d ] Move setting VOL_DIRTY over exfat_remove_entries() to avoid unneeded leaving VOL_DIRTY on -ENOTEMPTY. Fixes: 5f2aa075070c ("exfat: add inode operations") Cc: sta...@vger.kernel.org # v5.7 Reported-by: Tetsuhiro Kohad

[PATCH 5.7 013/112] tipc: fix kernel WARNING in tipc_msg_append()

2020-07-07 Thread Greg Kroah-Hartman
From: Tuong Lien [ Upstream commit c9aa81faf19115fc2e732e7f210b37bb316987ff ] syzbot found the following issue: WARNING: CPU: 0 PID: 6808 at include/linux/thread_info.h:150 check_copy_size include/linux/thread_info.h:150 [inline] WARNING: CPU: 0 PID: 6808 at include/linux/thread_info.h:150 cop

[PATCH 5.7 006/112] btrfs: block-group: refactor how we delete one block group item

2020-07-07 Thread Greg Kroah-Hartman
From: Qu Wenruo [ Upstream commit 7357623a7f4beb4ac76005f8fac9fc0230f9a67e ] When deleting a block group item, it's pretty straight forward, just delete the item pointed by the key. However it will not be that straight-forward for incoming skinny block group item. So refactor the block group i

[PATCH 5.7 033/112] io_uring: fix io_sq_thread no schedule when busy

2020-07-07 Thread Greg Kroah-Hartman
From: Xuan Zhuo [ Upstream commit b772f07add1c0b22e02c0f1e96f647560679d3a9 ] When the user consumes and generates sqe at a fast rate, io_sqring_entries can always get sqe, and ret will not be equal to -EBUSY, so that io_sq_thread will never call cond_resched or schedule, and then we will get the

[PATCH 5.4 64/65] dm zoned: assign max_io_len correctly

2020-07-07 Thread Greg Kroah-Hartman
From: Hou Tao commit 7b2377486767503d47265e4d487a63c651f6b55d upstream. The unit of max_io_len is sector instead of byte (spotted through code review), so fix it. Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target") Cc: sta...@vger.kernel.org Signed-off-by: Hou Tao Reviewe

[PATCH 5.7 007/112] btrfs: fix race between block group removal and block group creation

2020-07-07 Thread Greg Kroah-Hartman
From: Filipe Manana [ Upstream commit ffcb9d44572afbaf8fa6dbf5115bff6dab7b299e ] There is a race between block group removal and block group creation when the removal is completed by a task running fitrim or scrub. When this happens we end up failing the block group creation with an error -EEXIS

[PATCH 5.4 41/65] nvme: fix identify error status silent ignore

2020-07-07 Thread Greg Kroah-Hartman
From: Sagi Grimberg [ Upstream commit ea43d9709f727e728e933a8157a7a7ca1a868281 ] Commit 59c7c3caaaf8 intended to only silently ignore non retry-able errors (DNR bit set) such that we can still identify misbehaving controllers, and in the other hand propagate retry-able errors (DNR bit cleared) s

[PATCH 5.7 022/112] powerpc/kvm/book3s: Add helper to walk partition scoped linux page table.

2020-07-07 Thread Greg Kroah-Hartman
From: Aneesh Kumar K.V [ Upstream commit 4b99412ed6972cc77c1f16009e1d00323fcef9ab ] The locking rules for walking partition scoped table is different from process scoped table. Hence add a helper for secondary linux page table walk and also add check whether we are holding the right locks. Sign

[PATCH 5.7 016/112] drm/i915/gt: Mark timeline->cacheline as destroyed after rcu grace period

2020-07-07 Thread Greg Kroah-Hartman
From: Chris Wilson [ Upstream commit 8e87e0139aff59c5961347ab1ef06814f092c439 ] Since we take advantage of RCU for some i915_active objects, like the intel_timeline_cacheline, we need to delay the i915_active_fini until after the RCU grace period and we perform the kfree -- that is until after a

[PATCH 5.4 37/65] nfsd: fix nfsdfs inode reference count leak

2020-07-07 Thread Greg Kroah-Hartman
From: J. Bruce Fields [ Upstream commit bf2654017e0268cc83dc88d56f0e67ff4406631d ] I don't understand this code well, but I'm seeing a warning about a still-referenced inode on unmount, and every other similar filesystem does a dput() here. Fixes: e8a79fb14f6b ("nfsd: add nfsd/clients director

[PATCH 5.4 36/65] nfsd4: fix nfsdfs reference count loop

2020-07-07 Thread Greg Kroah-Hartman
From: J. Bruce Fields [ Upstream commit 681370f4b00af0fcc65bbfb9f82de526ab7ceb0a ] We don't drop the reference on the nfsdfs filesystem with mntput(nn->nfsd_mnt) until nfsd_exit_net(), but that won't be called until the nfsd module's unloaded, and we can't unload the module as long as there's a

[PATCH 5.7 015/112] tipc: Fix NULL pointer dereference in __tipc_sendstream()

2020-07-07 Thread Greg Kroah-Hartman
From: YueHaibing [ Upstream commit 4c21daae3dbc9f8536cc18e6e53627821fa2c90c ] tipc_sendstream() may send zero length packet, then tipc_msg_append() do not alloc skb, skb_peek_tail() will get NULL, msg_set_ack_required will trigger NULL pointer dereference. Reported-by: syzbot+8eac6d030e7807c21.

[PATCH 5.7 014/112] usbnet: smsc95xx: Fix use-after-free after removal

2020-07-07 Thread Greg Kroah-Hartman
From: Tuomas Tynkkynen [ Upstream commit b835a71ef64a61383c414d6bf2896d2c0161deca ] Syzbot reports an use-after-free in workqueue context: BUG: KASAN: use-after-free in mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737 mutex_unlock+0x19/0x40 kernel/locking/mutex.c:737 __smsc95xx_mdio_read dri

[PATCH 5.7 009/112] drm/amd/display: Fix incorrectly pruned modes with deep color

2020-07-07 Thread Greg Kroah-Hartman
From: Stylon Wang [ Upstream commit cbd14ae7ea934fd9d9f95103a0601a7fea243573 ] [Why] When "max bpc" is set to enable deep color, some modes are removed from the list if they fail validation on max bpc. These modes should be kept if they validates fine with lower bpc. [How] - Retry with lower bp

[PATCH 5.7 036/112] nvme-multipath: fix deadlock between ana_work and scan_work

2020-07-07 Thread Greg Kroah-Hartman
From: Anton Eidelman [ Upstream commit 489dd102a2c7c94d783a35f9412eb085b8da1aa4 ] When scan_work calls nvme_mpath_add_disk() this holds ana_lock and invokes nvme_parse_ana_log(), which may issue IO in device_add_disk() and hang waiting for an accessible path. While nvme_mpath_set_live() only cal

[PATCH 5.7 020/112] sched/debug: Make sd->flags sysctl read-only

2020-07-07 Thread Greg Kroah-Hartman
From: Valentin Schneider [ Upstream commit 9818427c6270a9ce8c52c8621026fe9cebae0f92 ] Writing to the sysctl of a sched_domain->flags directly updates the value of the field, and goes nowhere near update_top_cache_domain(). This means that the cached domain pointers can end up containing stale da

[PATCH 5.7 024/112] mm/slub.c: fix corrupted freechain in deactivate_slab()

2020-07-07 Thread Greg Kroah-Hartman
From: Dongli Zhang [ Upstream commit 52f23478081ae0dcdb95d1650ea1e7d52d586829 ] The slub_debug is able to fix the corrupted slab freelist/page. However, alloc_debug_processing() only checks the validity of current and next freepointer during allocation path. As a result, once some objects have

[PATCH 5.4 65/65] efi: Make it possible to disable efivar_ssdt entirely

2020-07-07 Thread Greg Kroah-Hartman
From: Peter Jones commit 435d1a471598752446a72ad1201b3c980526d869 upstream. In most cases, such as CONFIG_ACPI_CUSTOM_DSDT and CONFIG_ACPI_TABLE_UPGRADE, boot-time modifications to firmware tables are tied to specific Kconfig options. Currently this is not the case for modifying the ACPI SSDT v

[PATCH 5.7 017/112] drm/amdgpu: disable ras query and iject during gpu reset

2020-07-07 Thread Greg Kroah-Hartman
From: John Clements [ Upstream commit 61380faa4b4cc577df8a7ff5db5859bac6b351f7 ] added flag to ras context to indicate if ras query functionality is ready Reviewed-by: Hawking Zhang Signed-off-by: John Clements Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin --- drivers/gpu/drm/amd/

[PATCH 5.7 038/112] nvme-multipath: fix bogus request queue reference put

2020-07-07 Thread Greg Kroah-Hartman
From: Sagi Grimberg [ Upstream commit c31244669f57963b6ce133ab118fc50aec95 ] The mpath disk node takes a reference on the request mpath request queue when adding live path to the mpath gendisk. However if we connected to an inaccessible path device_add_disk is not called, so if we disconnect

[PATCH 5.7 027/112] io_uring: fix {SQ,IO}POLL with unsupported opcodes

2020-07-07 Thread Greg Kroah-Hartman
From: Pavel Begunkov [ Upstream commit 3232dd02af65f2d01be641120d2a710176b0c7a7 ] IORING_SETUP_IOPOLL is defined only for read/write, other opcodes should be disallowed, otherwise it'll get an error as below. Also refuse open/close with SQPOLL, as the polling thread wouldn't know which file tabl

[PATCH 5.7 085/112] spi: spi-fsl-dspi: Fix external abort on interrupt in resume or exit paths

2020-07-07 Thread Greg Kroah-Hartman
From: Krzysztof Kozlowski commit 3d87b613d6a3c6f0980e877ab0895785a2dde581 upstream. If shared interrupt comes late, during probe error path or device remove (could be triggered with CONFIG_DEBUG_SHIRQ), the interrupt handler dspi_interrupt() will access registers with the clock being disabled. T

[PATCH 5.7 071/112] nfsd: clients dont need to break their own delegations

2020-07-07 Thread Greg Kroah-Hartman
From: J. Bruce Fields [ Upstream commit 28df3d1539de5090f7916f6fff03891b67f366f4 ] We currently revoke read delegations on any write open or any operation that modifies file data or metadata (including rename, link, and unlink). But if the delegation in question is the only read delegation and

[PATCH 5.7 106/112] drm/amdgpu/atomfirmware: fix vram_info fetching for renoir

2020-07-07 Thread Greg Kroah-Hartman
From: Alex Deucher commit d7a6634a4cfba073ff6a526cb4265d6e58ece234 upstream. Renoir uses integrated_system_info table v12. The table has the same layout as v11 with respect to this data. Just reuse the existing code for v12 for stable. Fixes incorrectly reported vram info in the driver output

[PATCH 5.7 079/112] tpm: ibmvtpm: Wait for ready buffer before probing for TPM2 attributes

2020-07-07 Thread Greg Kroah-Hartman
From: David Gibson [ Upstream commit 72d0556dca39f45eca6c4c085e9eb0fc70aec025 ] The tpm2_get_cc_attrs_tbl() call will result in TPM commands being issued, which will need the use of the internal command/response buffer. But, we're issuing this *before* we've waited to make sure that buffer is a

[PATCH 5.7 055/112] xfs: fix use-after-free on CIL context on shutdown

2020-07-07 Thread Greg Kroah-Hartman
From: Dave Chinner [ Upstream commit c7f87f3984cfa1e6d32806a715f35c5947ad9c09 ] xlog_wait() on the CIL context can reference a freed context if the waiter doesn't get scheduled before the CIL context is freed. This can happen when a task is on the hard throttle and the CIL push aborts due to a s

[PATCH 5.7 074/112] drm: sun4i: hdmi: Remove extra HPD polling

2020-07-07 Thread Greg Kroah-Hartman
From: Chen-Yu Tsai [ Upstream commit bda8eaa6dee7525f4dac950810a85a88bf6c2ba0 ] The HPD sense mechanism in Allwinner's old HDMI encoder hardware is more or less an input-only GPIO. Other GPIO-based HPD implementations directly return the current state, instead of polling for a specific state and

Re: memory leak in inotify_update_watch

2020-07-07 Thread Jan Kara
Hello! On Mon 06-07-20 08:42:24, syzbot wrote: > syzbot found the following crash on: > > HEAD commit:7cc2a8ea Merge tag 'block-5.8-2020-07-01' of git://git.ker.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=17644c0510 > kernel config: https://sy

[PATCH 5.7 056/112] hsr: remove hsr interface if all slaves are removed

2020-07-07 Thread Greg Kroah-Hartman
From: Taehee Yoo [ Upstream commit 34a9c361dd480041d790fff3d6ea58513c8769e8 ] When all hsr slave interfaces are removed, hsr interface doesn't work. At that moment, it's fine to remove an unused hsr interface automatically for saving resources. That's a common behavior of virtual interfaces. Si

[PATCH 5.7 080/112] samples/vfs: avoid warning in statx override

2020-07-07 Thread Greg Kroah-Hartman
From: Kees Cook [ Upstream commit c3eeaae9fd736b7f2afbda8d3cbb1cbae06decf3 ] Something changed recently to uncover this warning: samples/vfs/test-statx.c:24:15: warning: `struct foo' declared inside parameter list will not be visible outside of this definition or declaration 24 | #defin

[PATCH 5.7 068/112] thermal/drivers/sprd: Fix return value of sprd_thm_probe()

2020-07-07 Thread Greg Kroah-Hartman
From: Tiezhu Yang [ Upstream commit b4147917ad4ff2c755e01a7ca296b14030d2d507 ] When call function devm_platform_ioremap_resource(), we should use IS_ERR() to check the return value and return PTR_ERR() if failed. Fixes: 554fdbaf19b1 ("thermal: sprd: Add Spreadtrum thermal driver support") Signe

[PATCH 5.7 090/112] SMB3: Honor persistent/resilient handle flags for multiuser mounts

2020-07-07 Thread Greg Kroah-Hartman
From: Paul Aurich commit 00dfbc2f9c61185a2e662f27c45a0bb29b2a134f upstream. Without this: - persistent handles will only be enabled for per-user tcons if the server advertises the 'Continuous Availabity' capability - resilient handles would never be enabled for per-user tcons Signed-off-by:

[PATCH 5.7 040/112] kgdb: Avoid suspicious RCU usage warning

2020-07-07 Thread Greg Kroah-Hartman
From: Douglas Anderson [ Upstream commit 440ab9e10e2e6e5fd677473ee6f9e3af0f6904d6 ] At times when I'm using kgdb I see a splat on my console about suspicious RCU usage. I managed to come up with a case that could reproduce this that looked like this: WARNING: suspicious RCU usage 5.7.0-rc4

[PATCH 5.7 067/112] thermal/drivers/mediatek: Fix bank number settings on mt8183

2020-07-07 Thread Greg Kroah-Hartman
From: Michael Kao [ Upstream commit 14533a5a6c12e8d7de79d309d4085bf186058fe1 ] MT8183_NUM_ZONES should be set to 1 because MT8183 doesn't have multiple banks. Fixes: a4ffe6b52d27 ("thermal: mediatek: add support for MT8183") Signed-off-by: Michael Kao Signed-off-by: Hsin-Yi Wang Signed-off-by

[PATCH 5.7 073/112] nfsd: fix nfsdfs inode reference count leak

2020-07-07 Thread Greg Kroah-Hartman
From: J. Bruce Fields [ Upstream commit bf2654017e0268cc83dc88d56f0e67ff4406631d ] I don't understand this code well, but I'm seeing a warning about a still-referenced inode on unmount, and every other similar filesystem does a dput() here. Fixes: e8a79fb14f6b ("nfsd: add nfsd/clients director

[PATCH 5.7 064/112] hwmon: (max6697) Make sure the OVERT mask is set correctly

2020-07-07 Thread Greg Kroah-Hartman
From: Chu Lin [ Upstream commit 016983d138cbe99a5c0aaae0103ee88f5300beb3 ] Per the datasheet for max6697, OVERT mask and ALERT mask are different. For example, the 7th bit of OVERT is the local channel but for alert mask, the 6th bit is the local channel. Therefore, we can't apply the same mask

[PATCH 5.7 026/112] mm, dump_page(): do not crash with invalid mapping pointer

2020-07-07 Thread Greg Kroah-Hartman
From: Vlastimil Babka [ Upstream commit 002ae7057069538aa3afd500f6f60a429cb948b2 ] We have seen a following problem on a RPi4 with 1G RAM: BUG: Bad page state in process systemd-hwdb pfn:35601 page:7ed58040 refcount:15 mapcount:131221 mapping:efd8fe765bc80080 index:0x1 compoun

[PATCH 5.7 028/112] rxrpc: Fix race between incoming ACK parser and retransmitter

2020-07-07 Thread Greg Kroah-Hartman
From: David Howells [ Upstream commit 2ad6691d988c0c611362ddc2aad89e0fb50e3261 ] There's a race between the retransmission code and the received ACK parser. The problem is that the retransmission loop has to drop the lock under which it is iterating through the transmission buffer in order to tr

[PATCH 5.7 098/112] gfs2: fix trans slab error when withdraw occurs inside log_flush

2020-07-07 Thread Greg Kroah-Hartman
From: Bob Peterson commit 58e08e8d83ab03a1ca25d53420bd0b87f2dfe458 upstream. Log flush operations (gfs2_log_flush()) can target a specific transaction. But if the function encounters errors (e.g. io errors) and withdraws, the transaction was only freed it if was queued to one of the ail lists. I

[PATCH 5.7 082/112] i2c: designware: platdrv: Set class based on DMI

2020-07-07 Thread Greg Kroah-Hartman
From: Ricardo Ribalda [ Upstream commit db2a8b6f1df93d5311970cca03052c01178de674 ] Current AMD's zen-based APUs use this core for some of its i2c-buses. With this patch we re-enable autodetection of hwmon-alike devices, so lm-sensors will be able to work automatically. It does not affect the b

[PATCH 5.7 077/112] nvme: fix identify error status silent ignore

2020-07-07 Thread Greg Kroah-Hartman
From: Sagi Grimberg [ Upstream commit ea43d9709f727e728e933a8157a7a7ca1a868281 ] Commit 59c7c3caaaf8 intended to only silently ignore non retry-able errors (DNR bit set) such that we can still identify misbehaving controllers, and in the other hand propagate retry-able errors (DNR bit cleared) s

[PATCH 5.7 105/112] drm/amdgpu: use %u rather than %d for sclk/mclk

2020-07-07 Thread Greg Kroah-Hartman
From: Alex Deucher commit beaf10efca64ac824240838ab1f054dfbefab5e6 upstream. Large clock values may overflow and show up as negative. Reported by prOMiNd on IRC. Acked-by: Nirmoy Das Signed-off-by: Alex Deucher Cc: sta...@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/d

[PATCH 5.7 107/112] dma-buf: Move dma_buf_release() from fops to dentry_ops

2020-07-07 Thread Greg Kroah-Hartman
From: Sumit Semwal commit 4ab59c3c638c6c8952bf07739805d20eb6358a4d upstream. Charan Teja reported a 'use-after-free' in dmabuffs_dname [1], which happens if the dma_buf_release() is called while the userspace is accessing the dma_buf pseudo fs's dmabuffs_dname() in another process, and dma_buf_r

[PATCH 5.7 062/112] cxgb4: fix SGE queue dump destination buffer context

2020-07-07 Thread Greg Kroah-Hartman
From: Rahul Lakkireddy [ Upstream commit 1992ded5d111997877a9a25205976d8d03c46814 ] The data in destination buffer is expected to be be parsed in big endian. So, use the right context. Fixes following sparse warning: cudbg_lib.c:2041:44: warning: incorrect type in assignment (different base typ

[PATCH 5.7 049/112] rxrpc: Fix afs large storage transmission performance drop

2020-07-07 Thread Greg Kroah-Hartman
From: David Howells [ Upstream commit 02c28dffb13abbaaedece1e4a6493b48ad3f913a ] Commit 2ad6691d988c, which moved the modification of the status annotation for a packet in the Tx buffer prior to the retransmission moved the state clearance, but managed to lose the bit that set it to UNACK. Cons

[PATCH 5.7 054/112] RDMA/counter: Query a counter before release

2020-07-07 Thread Greg Kroah-Hartman
From: Mark Zhang [ Upstream commit c1d869d64a1955817c4d6fff08ecbbe8e59d36f8 ] Query a dynamically-allocated counter before release it, to update it's hwcounters and log all of them into history data. Otherwise all values of these hwcounters will be lost. Fixes: f34a55e497e8 ("RDMA/core: Get sum

[PATCH 5.7 052/112] enetc: Fix HW_VLAN_CTAG_TX|RX toggling

2020-07-07 Thread Greg Kroah-Hartman
From: Claudiu Manoil [ Upstream commit 9deba33f1b7266a3870c9da31f787b605748fc0c ] VLAN tag insertion/extraction offload is correctly activated at probe time but deactivation of this feature (i.e. via ethtool) is broken. Toggling works only for Tx/Rx ring 0 of a PF, and is ignored for the other

[PATCH 5.7 091/112] SMB3: Honor lease disabling for multiuser mounts

2020-07-07 Thread Greg Kroah-Hartman
From: Paul Aurich commit ad35f169db6cd5a4c5c0a5a42fb0cad3efeccb83 upstream. Fixes: 3e7a02d47872 ("smb3: allow disabling requesting leases") Signed-off-by: Paul Aurich CC: Stable Signed-off-by: Steve French Reviewed-by: Aurelien Aptel Signed-off-by: Greg Kroah-Hartman --- fs/cifs/connect.c

[PATCH 5.7 110/112] mm/cma.c: use exact_nid true to fix possible per-numa cma leak

2020-07-07 Thread Greg Kroah-Hartman
From: Barry Song commit 40366bd70f822ca224dfc227a8c8e868c44f upstream. Calling cma_declare_contiguous_nid() with false exact_nid for per-numa reservation can easily cause cma leak and various confusion. For example, mm/hugetlb.c is trying to reserve per-numa cma for gigantic pages. But it

[PATCH 5.7 095/112] hwmon: (pmbus) Fix page vs. register when accessing fans

2020-07-07 Thread Greg Kroah-Hartman
From: Jan Kundrát commit b4c8af4c2a226fc9c25e1decbd26fdab1b0993ee upstream. Commit 16358542f32f ("hwmon: (pmbus) Implement multi-phase support") added support for multi-phase pmbus devices. However, when calling pmbus_add_sensor() for fans, the patch swapped the `page` and `reg` attributes. As a

[PATCH 5.7 025/112] mm/slub: fix stack overruns with SLUB_STATS

2020-07-07 Thread Greg Kroah-Hartman
From: Qian Cai [ Upstream commit a68ee0573991e90af2f1785db309206408bad3e5 ] There is no need to copy SLUB_STATS items from root memcg cache to new memcg cache copies. Doing so could result in stack overruns because the store function only accepts 0 to clear the stat and returns an error for eve

[PATCH 5.7 048/112] btrfs: fix RWF_NOWAIT writes blocking on extent locks and waiting for IO

2020-07-07 Thread Greg Kroah-Hartman
From: Filipe Manana [ Upstream commit 5dbb75ed6900048e146247b6325742d92c892548 ] A RWF_NOWAIT write is not supposed to wait on filesystem locks that can be held for a long time or for ongoing IO to complete. However when calling check_can_nocow(), if the inode has prealloc extents or has the NO

[PATCH 5.7 078/112] nvme: fix a crash in nvme_mpath_add_disk

2020-07-07 Thread Greg Kroah-Hartman
From: Christoph Hellwig [ Upstream commit 72d447113bb751ded97b2e2c38f886e4a4139082 ] For private namespaces ns->head_disk is NULL, so add a NULL check before updating the BDI capabilities. Fixes: b2ce4d90690b ("nvme-multipath: set bdi capabilities once") Reported-by: Avinash M N Signed-off-by:

[PATCH 5.7 104/112] drm/amd/display: Only revalidate bandwidth on medium and fast updates

2020-07-07 Thread Greg Kroah-Hartman
From: Nicholas Kazlauskas commit 6eb3cf2e06d22b2b08e6b0ab48cb9c05a8e1a107 upstream. [Why] Changes that are fast don't require updating DLG parameters making this call unnecessary. Considering this is an expensive call it should not be done on every flip. DML touches clocks, p-state support, DLG

[PATCH 5.7 032/112] s390/debug: avoid kernel warning on too large number of pages

2020-07-07 Thread Greg Kroah-Hartman
From: Christian Borntraeger [ Upstream commit 827c4913923e0b441ba07ba4cc41e01181102303 ] When specifying insanely large debug buffers a kernel warning is printed. The debug code does handle the error gracefully, though. Instead of duplicating the check let us silence the warning to avoid crashes

<    1   2   3   4   5   6   7   8   9   10   >