[PATCH 5.10 45/54] bpf: Fix 32 bit src register truncation on div/mod

From: Daniel Borkmann commit e88b2c6e5a4d9ce30d75391e4d950da74bb2bd90 upstream. While reviewing a different fix, John and I noticed an oddity in one of the BPF program dumps that stood out, for example: # bpftool p d x i 13 0: (b7) r0 = 808464450 1: (b4) w4 = 808464432 2: (bc) w0 = w

[PATCH 5.10 44/54] bpf: Fix verifier jmp32 pruning decision logic

From: Daniel Borkmann commit fd675184fc7abfd1e1c52d23e8e900676b5a1c1a upstream. Anatoly has been fuzzing with kBdysch harness and reported a hang in one of the outcomes: func#0 @0 0: R1=ctx(id=0,off=0,imm=0) R10=fp0 0: (b7) r0 = 808464450 1: R0_w=invP808464450 R1=ctx(id=0,off=0,imm=0) R

[PATCH 5.10 46/54] bpf: Fix verifier jsgt branch analysis on max bound

From: Daniel Borkmann commit ee114dd64c0071500345439fc79dd5e0f9d106ed upstream. Fix incorrect is_branch{32,64}_taken() analysis for the jsgt case. The return code for both will tell the caller whether a given conditional jump is taken or not, e.g. 1 means branch will be taken [for the involved r

[PATCH 5.10 50/54] Revert "mm: memcontrol: avoid workload stalls when lowering memory.high"

From: Johannes Weiner commit e82553c10b084153f9bf0af333c0a1550fd7 upstream. This reverts commit 536d3bf261a2fc3b05b3e91e7eef7383443015cf, as it can cause writers to memory.high to get stuck in the kernel forever, performing page reclaim and consuming excessive amounts of CPU cycles. Before

[PATCH 5.10 00/54] 5.10.16-rc1 review

This is the start of the stable review cycle for the 5.10.16 release. There are 54 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 13 Feb 2021 15:01:39 +. Anything rec

[PATCH 5.10 05/54] io_uring: always batch cancel in *cancel_files()

From: Pavel Begunkov [ Upstream commit f6edbabb8359798c541b0776616c5eab3a840d3d ] Instead of iterating over each request and cancelling it individually in io_uring_cancel_files(), try to cancel all matching requests and use ->inflight_list only to check if there anything left. In many cases it

[PATCH 5.10 42/54] blk-cgroup: Use cond_resched() when destroy blkgs

From: Baolin Wang [ Upstream commit 6c635caef410aa757befbd8857c1eadde5cc22ed ] On !PREEMPT kernel, we can get below softlockup when doing stress testing with creating and destroying block cgroup repeatly. The reason is it may take a long time to acquire the queue's lock in the loop of blkcg_dest

[PATCH 5.10 47/54] drm/i915: Fix ICL MG PHY vswing handling

From: Ville Syrjälä commit a2a5f5628e5494ca9353f761f7fe783dfa82fb9a upstream. The MH PHY vswing table does have all the entries these days. Get rid of the old hacks in the code which claim otherwise. This hack was totally bogus anyway. The correct way to handle the lack of those two entries wou

[PATCH 5.10 06/54] io_uring: fix files cancellation

From: Pavel Begunkov [ Upstream commit bee749b187ac57d1faf00b2ab356ff322230fce8 ] io_uring_cancel_files()'s task check condition mistakenly got flipped. 1. There can't be a request in the inflight list without IO_WQ_WORK_FILES, kill this check to keep the whole condition simpler. 2. Also, don't

[PATCH 5.10 48/54] drm/i915: Skip vswing programming for TBT

From: Ville Syrjälä commit eaf5bfe37db871031232d2bf2535b6ca92afbad8 upstream. In thunderbolt mode the PHY is owned by the thunderbolt controller. We are not supposed to touch it. So skip the vswing programming as well (we already skipped the other steps not applicable to TBT). Touching this stu

[PATCH 5.10 31/54] iwlwifi: mvm: skip power command when unbinding vif during CSA

From: Sara Sharon [ Upstream commit bf544e9aa570034e094a8a40d5f9e1e2c4916d18 ] In the new CSA flow, we remain associated during CSA, but still do a unbind-bind to the vif. However, sending the power command right after when vif is unbound but still associated causes FW to assert (0x3400) since i

[PATCH 5.10 49/54] nilfs2: make splice write available again

From: Joachim Henke commit a35d8f016e0b68634035217d06d1c53863456b50 upstream. Since 5.10, splice() or sendfile() to NILFS2 return EINVAL. This was caused by commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops"). This patch initializes the splice_write field in file_ope

[PATCH 5.10 09/54] io_uring: fix __io_uring_files_cancel() with TASK_UNINTERRUPTIBLE

From: Pavel Begunkov [ Upstream commit a1bb3cd58913338e1b627ea6b8c03c2ae82d293f ] If the tctx inflight number haven't changed because of cancellation, __io_uring_task_cancel() will continue leaving the task in TASK_UNINTERRUPTIBLE state, that's not expected by __io_uring_files_cancel(). Ensure w

[PATCH 5.10 08/54] io_uring: if we see flush on exit, cancel related tasks

From: Jens Axboe [ Upstream commit 84965ff8a84f0368b154c9b367b62e59c1193f30 ] Ensure we match tasks that belong to a dead or dying task as well, as we need to reap those in addition to those belonging to the exiting task. Cc: sta...@vger.kernel.org # 5.9+ Reported-by: Josef Grieb Signed-off-by

[PATCH 5.10 41/54] i2c: mediatek: Move suspend and resume handling to NOIRQ phase

From: Qii Wang [ Upstream commit de96c3943f591018727b862f51953c1b6c55bcc3 ] Some i2c device driver indirectly uses I2C driver when it is now being suspended. The i2c devices driver is suspended during the NOIRQ phase and this cannot be changed due to other dependencies. Therefore, we also need t

[PATCH 5.10 07/54] io_uring: account io_uring internal files as REQ_F_INFLIGHT

From: Jens Axboe [ Upstream commit 02a13674fa0e8dd326de8b9f4514b41b03d99003 ] We need to actively cancel anything that introduces a potential circular loop, where io_uring holds a reference to itself. If the file in question is an io_uring file, then add the request to the inflight list. Cc: st

[PATCH 5.10 51/54] squashfs: avoid out of bounds writes in decompressors

From: Phillip Lougher commit e812cbb15adbbbee176baa1e8bda53059bf0 upstream. Patch series "Squashfs: fix BIO migration regression and add sanity checks". Patch [1/4] fixes a regression introduced by the "migrate from ll_rw_block usage to BIO" patch, which has produced a number of Sysbot/Syzk

[PATCH 5.10 32/54] iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time()

From: Johannes Berg [ Upstream commit 5c56d862c749669d45c256f581eac4244be00d4d ] We need to take the mutex to call iwl_mvm_get_sync_time(), do it. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/iwlwifi.20210115130252.4bb5ccf

[PATCH 5.10 43/54] regulator: Fix lockdep warning resolving supplies

From: Mark Brown [ Upstream commit 14a71d509ac809dcf56d7e3ca376b15d17bd0ddd ] With commit eaa7995c529b54 (regulator: core: avoid regulator_resolve_supply() race condition) we started holding the rdev lock while resolving supplies, an operation that requires holding the regulator_list_mutex. This

[PATCH 5.4 17/24] i2c: mediatek: Move suspend and resume handling to NOIRQ phase

From: Qii Wang [ Upstream commit de96c3943f591018727b862f51953c1b6c55bcc3 ] Some i2c device driver indirectly uses I2C driver when it is now being suspended. The i2c devices driver is suspended during the NOIRQ phase and this cannot be changed due to other dependencies. Therefore, we also need t

[PATCH 5.4 21/24] Fix unsynchronized access to sev members through svm_register_enc_region

From: Peter Gonda commit 19a23da53932bc8011220bd8c410cb76012de004 upstream. Grab kvm->lock before pinning memory when registering an encrypted region; sev_pin_memory() relies on kvm->lock being held to ensure correctness when checking and updating the number of pinned pages. Add a lockdep asser

[PATCH 5.4 18/24] blk-cgroup: Use cond_resched() when destroy blkgs

From: Baolin Wang [ Upstream commit 6c635caef410aa757befbd8857c1eadde5cc22ed ] On !PREEMPT kernel, we can get below softlockup when doing stress testing with creating and destroying block cgroup repeatly. The reason is it may take a long time to acquire the queue's lock in the loop of blkcg_dest

Re: [PATCH] arm64: Fix warning in mte_get_random_tag()

On 2/11/21 1:35 PM, Ard Biesheuvel wrote: > On Thu, 11 Feb 2021 at 13:57, Vincenzo Frascino > wrote: >> >> The simplification of mte_get_random_tag() caused the introduction of the >> warning below: >> >> In file included from arch/arm64/include/asm/kasan.h:9, >> from include/l

[PATCH 5.4 24/24] squashfs: add more sanity checks in xattr id lookup

From: Phillip Lougher commit 506220d2ba21791314af569211ffd8870b8208fa upstream. Sysbot has reported a warning where a kmalloc() attempt exceeds the maximum limit. This has been identified as corruption of the xattr_ids count when reading the xattr id lookup table. This patch adds a number of a

[PATCH 5.4 19/24] regulator: Fix lockdep warning resolving supplies

From: Mark Brown [ Upstream commit 14a71d509ac809dcf56d7e3ca376b15d17bd0ddd ] With commit eaa7995c529b54 (regulator: core: avoid regulator_resolve_supply() race condition) we started holding the rdev lock while resolving supplies, an operation that requires holding the regulator_list_mutex. This

[PATCH 5.4 04/24] mac80211: 160MHz with extended NSS BW in CSA

From: Shay Bar [ Upstream commit dcf3c8fb32ddbfa3b8227db38aa6746405bd4527 ] Upon receiving CSA with 160MHz extended NSS BW from associated AP, STA should set the HT operation_mode based on new_center_freq_seg1 because it is later used as ccfs2 in ieee80211_chandef_vht_oper(). Signed-off-by: Avi

[PATCH 5.4 23/24] squashfs: add more sanity checks in inode lookup

From: Phillip Lougher commit eabac19e40c095543def79cb6ffeb3a8588aaff4 upstream. Sysbot has reported an "slab-out-of-bounds read" error which has been identified as being caused by a corrupted "ino_num" value read from the inode. This could be because the metadata block is uncompressed, or becau

[PATCH 5.4 22/24] squashfs: add more sanity checks in id lookup

From: Phillip Lougher commit f37aa4c7366e23f91b81d00bafd6a7ab54e4a381 upstream. Sysbot has reported a number of "slab-out-of-bounds reads" and "use-after-free read" errors which has been identified as being caused by a corrupted index value read from the inode. This could be because the metadat

[PATCH 5.4 05/24] ASoC: Intel: Skylake: Zero snd_ctl_elem_value

From: Ricardo Ribalda [ Upstream commit 1d8fe0648e118fd495a2cb393a34eb8d428e7808 ] Clear struct snd_ctl_elem_value before calling ->put() to avoid any data leak. Signed-off-by: Ricardo Ribalda Reviewed-by: Cezary Rojewski Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/202101211

Re: [PATCH ghak124 v3] audit: log nftables configuration change events

Hi, On Thu, Jun 04, 2020 at 09:20:49AM -0400, Richard Guy Briggs wrote: > iptables, ip6tables, arptables and ebtables table registration, > replacement and unregistration configuration events are logged for the > native (legacy) iptables setsockopt api, but not for the > nftables netlink api which

[PATCH 4.19 12/24] iwlwifi: pcie: fix context info memory leak

From: Johannes Berg [ Upstream commit 2d6bc752cc2806366d9a4fd577b3f6c1f7a7e04e ] If the image loader allocation fails, we leak all the previously allocated memory. Fix this. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/iwl

[PATCH 5.4 20/24] bpf: Fix 32 bit src register truncation on div/mod

From: Daniel Borkmann commit e88b2c6e5a4d9ce30d75391e4d950da74bb2bd90 upstream. While reviewing a different fix, John and I noticed an oddity in one of the BPF program dumps that stood out, for example: # bpftool p d x i 13 0: (b7) r0 = 808464450 1: (b4) w4 = 808464432 2: (bc) w0 = w

[PATCH 4.19 00/24] 4.19.176-rc1 review

This is the start of the stable review cycle for the 4.19.176 release. There are 24 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 13 Feb 2021 15:01:39 +. Anything re

[PATCH 4.19 02/24] block: fix NULL pointer dereference in register_disk

From: zhengbin commit 4d7c1d3fd7c7eda7dea351f071945e843a46c145 upstream. If __device_add_disk-->bdi_register_owner-->bdi_register--> bdi_register_va-->device_create_vargs fails, bdi->dev is still NULL, __device_add_disk-->register_disk will visit bdi->dev->kobj. This patch fixes that. Signed-of

[PATCH 5.4 02/24] af_key: relax availability checks for skb size calculation

From: Cong Wang [ Upstream commit afbc293add6466f8f3f0c3d944d85f53709c170f ] xfrm_probe_algs() probes kernel crypto modules and changes the availability of struct xfrm_algo_desc. But there is a small window where ealg->available and aalg->available get changed between count_ah_combs()/count_esp_

[PATCH 4.19 11/24] iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap

From: Emmanuel Grumbach [ Upstream commit 98c7d21f957b10d9c07a3a60a3a5a8f326a197e5 ] I hit a NULL pointer exception in this function when the init flow went really bad. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/iwlw

[PATCH 5.4 07/24] pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()

From: Trond Myklebust [ Upstream commit 08bd8dbe88825760e953759d7ec212903a026c75 ] If the server returns a new stateid that does not match the one in our cache, then try to return the one we hold instead of just invalidating it on the client side. This ensures that both client and server will ag

[PATCH 5.4 08/24] ASoC: ak4458: correct reset polarity

From: Eliot Blennerhassett [ Upstream commit e953daeb68b1abd8a7d44902786349fdeef5c297 ] Reset (aka power off) happens when the reset gpio is made active. Change function name to ak4458_reset to match devicetree property "reset-gpios" Signed-off-by: Eliot Blennerhassett Reviewed-by: Linus Walle

[PATCH 5.4 11/24] iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap

From: Emmanuel Grumbach [ Upstream commit 98c7d21f957b10d9c07a3a60a3a5a8f326a197e5 ] I hit a NULL pointer exception in this function when the init flow went really bad. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/iwlw

[PATCH 5.4 10/24] iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time()

From: Johannes Berg [ Upstream commit 5c56d862c749669d45c256f581eac4244be00d4d ] We need to take the mutex to call iwl_mvm_get_sync_time(), do it. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/iwlwifi.20210115130252.4bb5ccf

[PATCH 4.19 17/24] include/trace/events/writeback.h: fix -Wstringop-truncation warnings

From: Qian Cai [ Upstream commit d1a445d3b86c9341ce7a0954c23be0edb5c9bec5 ] There are many of those warnings. In file included from ./arch/powerpc/include/asm/paca.h:15, from ./arch/powerpc/include/asm/current.h:13, from ./include/linux/thread_info.h:21,

[PATCH 4.19 18/24] memcg: fix a crash in wb_workfn when a device disappears

From: Theodore Ts'o [ Upstream commit 68f23b89067fdf187763e75a56087550624fdbee ] Without memcg, there is a one-to-one mapping between the bdi and bdi_writeback structures. In this world, things are fairly straightforward; the first thing bdi_unregister() does is to shutdown the bdi_writeback st

[PATCH 4.19 19/24] Fix unsynchronized access to sev members through svm_register_enc_region

From: Peter Gonda commit 19a23da53932bc8011220bd8c410cb76012de004 upstream. Grab kvm->lock before pinning memory when registering an encrypted region; sev_pin_memory() relies on kvm->lock being held to ensure correctness when checking and updating the number of pinned pages. Add a lockdep asser

[PATCH 4.19 20/24] block: dont hold q->sysfs_lock in elevator_init_mq

From: Ming Lei commit c48dac137a62a5d6fa1ef3fa445cbd9c43655a76 upstream. The original comment says: q->sysfs_lock must be held to provide mutual exclusion between elevator_switch() and here. Which is simply wrong. elevator_init_mq() is only called from blk_mq_init_allocated_que

[PATCH 4.19 14/24] SUNRPC: Move simple_get_bytes and simple_get_netobj into private header

From: Dave Wysochanski [ Upstream commit ba6dfce47c4d002d96cd02a304132fca76981172 ] Remove duplicated helper functions to parse opaque XDR objects and place inside new file net/sunrpc/auth_gss/auth_gss_internal.h. In the new file carry the license and copyright from the source file net/sunrpc/au

[PATCH 4.19 03/24] fgraph: Initialize tracing_graph_pause at task creation

From: Steven Rostedt (VMware) commit 7e0a9220467dbcfdc5bc62825724f3e52e50ab31 upstream. On some archs, the idle task can call into cpu_suspend(). The cpu_suspend() will disable or pause function graph tracing, as there's some paths in bringing down the CPU that can have issues with its return ad

[PATCH 4.19 15/24] SUNRPC: Handle 0 length opaque XDR object data properly

From: Dave Wysochanski [ Upstream commit e4a7d1f7707eb44fd953a31dd59eff82009d879c ] When handling an auth_gss downcall, it's possible to get 0-length opaque object for the acceptor. In the case of a 0-length XDR object, make sure simple_get_netobj() fills in dest->data = NULL, and does not cont

[PATCH 4.19 13/24] iwlwifi: mvm: guard against device removal in reprobe

From: Johannes Berg [ Upstream commit 7a21b1d4a728a483f07c638ccd8610d4b4f12684 ] If we get into a problem severe enough to attempt a reprobe, we schedule a worker to do that. However, if the problem gets more severe and the device is actually destroyed before this worker has a chance to run, we

[PATCH 4.19 16/24] lib/string: Add strscpy_pad() function

From: Tobin C. Harding [ Upstream commit 458a3bf82df4fe1f951d0f52b1e0c1e9d5a88a3b ] We have a function to copy strings safely and we have a function to copy strings and zero the tail of the destination (if source string is shorter than destination buffer) but we do not have a function to do both

[PATCH 5.4 06/24] chtls: Fix potential resource leak

From: Pan Bian [ Upstream commit b6011966ac6f402847eb5326beee8da3a80405c7 ] The dst entry should be released if no neighbour is found. Goto label free_dst to fix the issue. Besides, the check of ndev against NULL is redundant. Signed-off-by: Pan Bian Link: https://lore.kernel.org/r/20210121145

Re: [PATCH] staging: vt6656: Fixed alignment with issue in rf.c

On 11/02/21 7:15 pm, Pritthijit Nath wrote: > This change fixes a checkpatch CHECK style issue for "Alignment should match > open parenthesis". > > Signed-off-by: Pritthijit Nath > --- > drivers/staging/vt6656/rf.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/driver

[PATCH 5.4 09/24] iwlwifi: mvm: skip power command when unbinding vif during CSA

From: Sara Sharon [ Upstream commit bf544e9aa570034e094a8a40d5f9e1e2c4916d18 ] In the new CSA flow, we remain associated during CSA, but still do a unbind-bind to the vif. However, sending the power command right after when vif is unbound but still associated causes FW to assert (0x3400) since i

[PATCH 5.10 01/54] io_uring: simplify io_task_match()

From: Pavel Begunkov [ Upstream commit 06de5f5973c641c7ae033f133ecfaaf64fe633a6 ] If IORING_SETUP_SQPOLL is set all requests belong to the corresponding SQPOLL task, so skip task checking in that case and always match. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe Signed-off-by: Gre

[PATCH] arm: dts: sun5i: Add GPU node

sun5i has the same Mali 400 GPU as sun4i with the same interrupts, clocks and resets. Add node for it in dts. Signed-off-by: Yassine Oudjana --- arch/arm/boot/dts/sun5i.dtsi | 42 1 file changed, 42 insertions(+) diff --git a/arch/arm/boot/dts/sun5i.dtsi b/a

[PATCH 4.19 21/24] blk-mq: dont hold q->sysfs_lock in blk_mq_map_swqueue

From: Ming Lei commit c6ba933358f0d7a6a042b894dba20cc70396a6d3 upstream. blk_mq_map_swqueue() is called from blk_mq_init_allocated_queue() and blk_mq_update_nr_hw_queues(). For the former caller, the kobject isn't exposed to userspace yet. For the latter caller, hctx sysfs entries and debugfs ar

[PATCH 4.19 07/24] regulator: core: avoid regulator_resolve_supply() race condition

From: David Collins [ Upstream commit eaa7995c529b54d68d97a30f6344cc6ca2f214a7 ] The final step in regulator_register() is to call regulator_resolve_supply() for each registered regulator (including the one in the process of being registered). The regulator_resolve_supply() function first check

[PATCH 4.19 08/24] chtls: Fix potential resource leak

From: Pan Bian [ Upstream commit b6011966ac6f402847eb5326beee8da3a80405c7 ] The dst entry should be released if no neighbour is found. Goto label free_dst to fix the issue. Besides, the check of ndev against NULL is redundant. Signed-off-by: Pan Bian Link: https://lore.kernel.org/r/20210121145

[PATCH 4.19 09/24] pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()

From: Trond Myklebust [ Upstream commit 08bd8dbe88825760e953759d7ec212903a026c75 ] If the server returns a new stateid that does not match the one in our cache, then try to return the one we hold instead of just invalidating it on the client side. This ensures that both client and server will ag

[PATCH 4.19 10/24] iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time()

From: Johannes Berg [ Upstream commit 5c56d862c749669d45c256f581eac4244be00d4d ] We need to take the mutex to call iwl_mvm_get_sync_time(), do it. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/iwlwifi.20210115130252.4bb5ccf

[PATCH 4.19 06/24] af_key: relax availability checks for skb size calculation

From: Cong Wang [ Upstream commit afbc293add6466f8f3f0c3d944d85f53709c170f ] xfrm_probe_algs() probes kernel crypto modules and changes the availability of struct xfrm_algo_desc. But there is a small window where ealg->available and aalg->available get changed between count_ah_combs()/count_esp_

[PATCH 5.10 14/54] io_uring: fix sqo ownership false positive warning

From: Pavel Begunkov [ Upstream commit 70b2c60d3797bffe182dddb9bb55975b9be5889a ] WARNING: CPU: 0 PID: 21359 at fs/io_uring.c:9042 io_uring_cancel_task_requests+0xe55/0x10c0 fs/io_uring.c:9042 Call Trace: io_uring_flush+0x47b/0x6e0 fs/io_uring.c:9227 filp_close+0xb4/0x170 fs/open.c:1295 c

[PATCH 5.10 11/54] io_uring: fix cancellation taking mutex while TASK_UNINTERRUPTIBLE

From: Pavel Begunkov [ Upstream commit ca70f00bed6cb255b7a9b91aa18a2717c9217f70 ] do not call blocking ops when !TASK_RUNNING; state=2 set at [] prepare_to_wait+0x1f4/0x3b0 kernel/sched/wait.c:262 WARNING: CPU: 1 PID: 19888 at kernel/sched/core.c:7853 __

[PATCH 5.10 13/54] io_uring: fix list corruption for splice file_get

From: Pavel Begunkov [ Upstream commit f609cbb8911e40e15f9055e8f945f926ac906924 ] kernel BUG at lib/list_debug.c:29! Call Trace: __list_add include/linux/list.h:67 [inline] list_add include/linux/list.h:86 [inline] io_file_get+0x8cc/0xdb0 fs/io_uring.c:6466 __io_splice_prep+0x1bc/0x530 fs/io

[PATCH v2] arm64: Fix warning in mte_get_random_tag()

The simplification of mte_get_random_tag() caused the introduction of the warning below: In file included from arch/arm64/include/asm/kasan.h:9, from include/linux/kasan.h:16, from mm/kasan/common.c:14: mm/kasan/common.c: In function ‘mte_get_random_tag’: arch/arm

[PATCH 5.10 12/54] io_uring: fix flush cqring overflow list while TASK_INTERRUPTIBLE

From: Hao Xu [ Upstream commit 6195ba09822c87cad09189bbf550d0fbe714687a ] Abaci reported the follow warning: [ 27.073425] do not call blocking ops when !TASK_RUNNING; state=1 set at [] prepare_to_wait_exclusive+0x3a/0xc0 [ 27.075805] WARNING: CPU: 0 PID: 951 at kernel/sched/core.c:7853 __

[PATCH 4.19 01/24] tracing/kprobe: Fix to support kretprobe events on unloaded modules

From: Masami Hiramatsu commit 97c753e62e6c31a404183898d950d8c08d752dbd upstream. Fix kprobe_on_func_entry() returns error code instead of false so that register_kretprobe() can return an appropriate error code. append_trace_kprobe() expects the kprobe registration returns -ENOENT when the targe

[PATCH 5.10 17/54] gpiolib: cdev: clear debounce period if line set to output

From: Kent Gibson commit 03a58ea5905fdbd93ff9e52e670d802600ba38cd upstream. When set_config changes a line from input to output debounce is implicitly disabled, as debounce makes no sense for outputs, but the debounce period is not being cleared and is still reported in the line info. So clear

[PATCH 4.19 24/24] squashfs: add more sanity checks in xattr id lookup

From: Phillip Lougher commit 506220d2ba21791314af569211ffd8870b8208fa upstream. Sysbot has reported a warning where a kmalloc() attempt exceeds the maximum limit. This has been identified as corruption of the xattr_ids count when reading the xattr id lookup table. This patch adds a number of a

[PATCH 4.19 04/24] remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load

From: Sibi Sankar commit 135b9e8d1cd8ba5ac9ad9bcf24b464b7b052e5b8 upstream The following mem abort is observed when one of the modem blob firmware size exceeds the allocated mpss region. Fix this by restricting the copy size to segment size using request_firmware_into_buf before load. Err Logs:

[PATCH 4.19 23/24] squashfs: add more sanity checks in inode lookup

From: Phillip Lougher commit eabac19e40c095543def79cb6ffeb3a8588aaff4 upstream. Sysbot has reported an "slab-out-of-bounds read" error which has been identified as being caused by a corrupted "ino_num" value read from the inode. This could be because the metadata block is uncompressed, or becau

[PATCH 4.19 22/24] squashfs: add more sanity checks in id lookup

From: Phillip Lougher commit f37aa4c7366e23f91b81d00bafd6a7ab54e4a381 upstream. Sysbot has reported a number of "slab-out-of-bounds reads" and "use-after-free read" errors which has been identified as being caused by a corrupted index value read from the inode. This could be because the metadat

[PATCH 4.19 05/24] remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load

From: Sibi Sankar commit e013f455d95add874f310dc47c608e8c70692ae5 upstream The following mem abort is observed when the mba firmware size exceeds the allocated mba region. MBA firmware size is restricted to a maximum size of 1M and remaining memory region is used by modem debug policy firmware w

[PATCH 5.10 18/54] powerpc/64/signal: Fix regression in __kernel_sigtramp_rt64() semantics

From: Raoni Fassina Firmino commit 24321ac668e452a4942598533d267805f291fdc9 upstream. Commit 0138ba5783ae ("powerpc/64/signal: Balance return predictor stack in signal trampoline") changed __kernel_sigtramp_rt64() VDSO and trampoline code, and introduced a regression in the way glibc's backtrace

Re: [PATCH v2 4/8] xen/netback: fix spurious event detection for common event case

On Thu, Feb 11, 2021 at 11:16:12AM +0100, Juergen Gross wrote: > In case of a common event for rx and tx queue the event should be > regarded to be spurious if no rx and no tx requests are pending. > > Unfortunately the condition for testing that is wrong causing to > decide a event being spurious

[PATCH 5.10 25/54] chtls: Fix potential resource leak

From: Pan Bian [ Upstream commit b6011966ac6f402847eb5326beee8da3a80405c7 ] The dst entry should be released if no neighbour is found. Goto label free_dst to fix the issue. Besides, the check of ndev against NULL is redundant. Signed-off-by: Pan Bian Link: https://lore.kernel.org/r/20210121145

[PATCH 5.10 29/54] ASoC: ak4458: correct reset polarity

From: Eliot Blennerhassett [ Upstream commit e953daeb68b1abd8a7d44902786349fdeef5c297 ] Reset (aka power off) happens when the reset gpio is made active. Change function name to ak4458_reset to match devicetree property "reset-gpios" Signed-off-by: Eliot Blennerhassett Reviewed-by: Linus Walle

[PATCH 5.10 21/54] ASoC: wm_adsp: Fix control name parsing for multi-fw

From: James Schulman [ Upstream commit a8939f2e138e418c2b059056ff5b501eaf2eae54 ] When switching between firmware types, the wrong control can be selected when requesting control in kernel API. Use the currently selected DSP firwmare type to select the proper mixer control. Signed-off-by: James

[PATCH 5.10 24/54] ASoC: Intel: Skylake: Zero snd_ctl_elem_value

From: Ricardo Ribalda [ Upstream commit 1d8fe0648e118fd495a2cb393a34eb8d428e7808 ] Clear struct snd_ctl_elem_value before calling ->put() to avoid any data leak. Signed-off-by: Ricardo Ribalda Reviewed-by: Cezary Rojewski Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/202101211

[PATCH 5.10 16/54] io_uring: drop mm/files between task_work_submit

From: Pavel Begunkov [ Upstream commit aec18a57edad562d620f7d19016de1fc0cc2208c ] Since SQPOLL task can be shared and so task_work entries can be a mix of them, we need to drop mm and files before trying to issue next request. Cc: sta...@vger.kernel.org # 5.10+ Signed-off-by: Pavel Begunkov Si

[PATCH 5.10 04/54] io_uring: pass files into kill timeouts/poll

From: Pavel Begunkov [ Upstream commit 6b81928d4ca8668513251f9c04cdcb9d38ef51c7 ] Make io_poll_remove_all() and io_kill_timeouts() to match against files as well. A preparation patch, effectively not used by now. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe Signed-off-by: Greg Kroa

[PATCH 5.10 02/54] io_uring: add a {task,files} pair matching helper

From: Pavel Begunkov [ Upstream commit 08d23634643c239ddae706758f54d3a8e0c24962 ] Add io_match_task() that matches both task and files. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- fs/io_uring.c | 63 +---

[PATCH 5.10 20/54] regulator: core: avoid regulator_resolve_supply() race condition

From: David Collins [ Upstream commit eaa7995c529b54d68d97a30f6344cc6ca2f214a7 ] The final step in regulator_register() is to call regulator_resolve_supply() for each registered regulator (including the one in the process of being registered). The regulator_resolve_supply() function first check

Re: [PATCH v1 0/9] x86/platform: Remove SFI framework and users

On Thu, Feb 11, 2021 at 2:50 PM Andy Shevchenko wrote: > > This is last part of Intel MID (SFI based) removal. We have no more users of > it > in the kernel and since SFI has been marked Obsolete for a few years already, > Remove all the stuff altogether. > > Note, the more recent platforms (Inte

[PATCH 5.10 03/54] io_uring: dont iterate io_uring_cancel_files()

From: Pavel Begunkov [ Upstream commit b52fda00dd9df8b4a6de5784df94f9617f6133a1 ] io_uring_cancel_files() guarantees to cancel all matching requests, that's not necessary to do that in a loop. Move it up in the callchain into io_uring_cancel_task_requests(). Signed-off-by: Pavel Begunkov Signe

[PATCH 5.10 28/54] ALSA: hda: intel-dsp-config: add PCI id for TGL-H

From: Bard Liao [ Upstream commit c5b5ff607d6fe5f4284acabd07066f96ecf96ac4 ] Adding PCI id for TGL-H. Like for other TGL platforms, SOF is used if Soundwire codecs or PCH-DMIC is detected. Signed-off-by: Bard Liao Reviewed-by: Xiuli Pan Reviewed-by: Libin Yang Signed-off-by: Kai Vehmanen Li

[PATCH] staging: vt6656: Fixed issue with alignment in rf.c

This change fixes a checkpatch CHECK style issue for "Alignment should match open parenthesis". Signed-off-by: Pritthijit Nath --- drivers/staging/vt6656/rf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c index 5b8d

[PATCH 5.10 15/54] io_uring: reinforce cancel on flush during exit

From: Pavel Begunkov [ Upstream commit 3a7efd1ad269ccaf9c1423364d97c9661ba6dafa ] What 84965ff8a84f0 ("io_uring: if we see flush on exit, cancel related tasks") really wants is to cancel all relevant REQ_F_INFLIGHT requests reliably. That can be achieved by io_uring_cancel_files(), but we'll mis

[PATCH 5.10 19/54] af_key: relax availability checks for skb size calculation

From: Cong Wang [ Upstream commit afbc293add6466f8f3f0c3d944d85f53709c170f ] xfrm_probe_algs() probes kernel crypto modules and changes the availability of struct xfrm_algo_desc. But there is a small window where ealg->available and aalg->available get changed between count_ah_combs()/count_esp_

include/linux/compiler_types.h:319:38: error: call to '__compiletime_assert_234' declared with attribute error: BUILD_BUG_ON failed: FIX_KMAP_SLOTS > PTRS_PER_PTE

tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 291009f656e8eaebbdfd3a8d99f6b190a9ce9deb commit: 6e799cb69a70eedbb41561b750f7180c12cff280 mm/highmem: Provide and use CONFIG_DEBUG_KMAP_LOCAL date: 3 months ago config: arc-randconfig-r032-20210209 (attach

Re: [BUG REPORT] media: coda: mpeg4 decode corruption on i.MX6qp only

Hi Philipp, thank you so much for looking into this, I really appreciate it ! On Thu, Feb 11, 2021 at 9:32 AM Philipp Zabel wrote: > > Another thing that might help to identify who is writing where might be to > clear the whole OCRAM region and dump it after running only decode or only > PRE/PRG

Re: [PATCH/v2] bpf: add bpf_skb_adjust_room flag BPF_F_ADJ_ROOM_ENCAP_L2_ETH

On 2/10/21 3:50 PM, Willem de Bruijn wrote: On Wed, Feb 10, 2021 at 1:59 AM huangxuesen wrote: From: huangxuesen bpf_skb_adjust_room sets the inner_protocol as skb->protocol for packets encapsulation. But that is not appropriate when pushing Ethernet header. Add an option to further specify

Re: [PATCH v4 net-next 09/11] skbuff: allow to optionally use NAPI cache from __alloc_skb()

From: Paolo Abeni Date: Thu, 11 Feb 2021 15:55:04 +0100 > On Thu, 2021-02-11 at 14:28 +, Alexander Lobakin wrote: > > From: Paolo Abeni on Thu, 11 Feb 2021 11:16:40 +0100 > > wrote: > > > What about changing __napi_alloc_skb() to always use > > > the __napi_build_skb(), for both kmalloc and

[net-next] net: mvpp2: fix interrupt mask/unmask skip condition

From: Stefan Chulski The condition should be skipped if CPU ID equal to nthreads. The patch doesn't fix any actual issue since nthreads = min_t(unsigned int, num_present_cpus(), MVPP2_MAX_THREADS). On all current Armada platforms, the number of CPU's is less than MVPP2_MAX_THREADS. Fixes: e531f7

Re: [PATCH 4.19 07/24] regulator: core: avoid regulator_resolve_supply() race condition

On Thu, Feb 11, 2021 at 04:02:41PM +0100, Greg Kroah-Hartman wrote: > From: David Collins > > [ Upstream commit eaa7995c529b54d68d97a30f6344cc6ca2f214a7 ] > > The final step in regulator_register() is to call > regulator_resolve_supply() for each registered regulator This is buggy without a fol

[PATCH 2/2] quota: wire up quotactl_path

Wire up the quotactl_path syscall added in the previous patch. Signed-off-by: Sascha Hauer --- arch/alpha/kernel/syscalls/syscall.tbl | 1 + arch/arm/tools/syscall.tbl | 1 + arch/arm64/include/asm/unistd.h | 2 +- arch/arm64/include/asm/unistd32.h | 2

[PATCH v2 0/2] quota: Add mountpath based quota support

Current quotactl syscall uses a path to a block device to specify the filesystem to work on which makes it unsuitable for filesystems that do not have a block device. This series adds a new syscall quotactl_path() which replaces the path to the block device with a mountpath, but otherwise behaves l

[PATCH] quotactl.2: Add documentation for quotactl_path()

Expand the quotactl.2 manpage with a description for quotactl_path() that takes a mountpoint path instead of a path to a block device. Signed-off-by: Sascha Hauer --- man2/quotactl.2 | 31 --- man2/quotactl_path.2 | 1 + 2 files changed, 29 insertions(+), 3 dele

[PATCH 1/2] quota: Add mountpath based quota support

Add syscall quotactl_path, a variant of quotactl which allows to specify the mountpath instead of a path of to a block device. The quotactl syscall expects a path to the mounted block device to specify the filesystem to work on. This limits usage to filesystems which actually have a block device.

[PATCH 5.4 03/24] regulator: core: avoid regulator_resolve_supply() race condition

From: David Collins [ Upstream commit eaa7995c529b54d68d97a30f6344cc6ca2f214a7 ] The final step in regulator_register() is to call regulator_resolve_supply() for each registered regulator (including the one in the process of being registered). The regulator_resolve_supply() function first check

[PATCH 5.4 13/24] iwlwifi: mvm: invalidate IDs of internal stations at mvm start

From: Gregory Greenman [ Upstream commit e223e42aac30bf81f9302c676cdf58cf2bf36950 ] Having sta_id not set for aux_sta and snif_sta can potentially lead to a hard to debug issue in case remove station is called without an add. In this case sta_id 0, an unrelated regular station, will be removed.

  1   2   3   4   5   6   7   8   9   10   >