1. Apr 01, 2021
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v5.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 39192106
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
       "Some overly ripe fixes for the v5.12 kernel. I should have sent
        earlier but had my head stuck in GDB.
      
        All are driver fixes:
      
         - Fix up some Intel GPIO base calculations.
      
         - Fix a register offset in the Microchip driver.
      
         - Fix suspend/resume bug in the Rockchip driver.
      
         - Default pull up strength in the Qualcomm LPASS driver.
      
         - Fix two pingroup offsets in the Qualcomm SC7280 driver.
      
         - Fix SDC1 register offset in the Qualcomm SC7280 driver.
      
         - Fix a nasty string concatenation in the Qualcomm SDX55 driver.
      
         - Check the REVID register to see if the device is real or
           virtualized during virtualization in the Intel driver"
      
      * tag 'pinctrl-v5.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: intel: check REVID register value for device presence
        pinctrl: qcom: fix unintentional string concatenation
        pinctrl: qcom: sc7280: Fix SDC1_RCLK configurations
        pinctrl: qcom: sc7280: Fix SDC_QDSD_PINGROUP and UFS_RESET offsets
        pinctrl: qcom: lpass lpi: use default pullup/strength values
        pinctrl: rockchip: fix restore error in resume
        pinctrl: microchip-sgpio: Fix wrong register offset for IRQ trigger
        pinctrl: intel: Show the GPIO base calculation explicitly
      39192106
  2. Mar 31, 2021
    • Tetsuo Handa's avatar
      reiserfs: update reiserfs_xattrs_initialized() condition · 5e46d1b7
      Tetsuo Handa authored
      syzbot is reporting NULL pointer dereference at reiserfs_security_init()
      [1], for commit ab17c4f0 ("reiserfs: fixup xattr_root caching")
      is assuming that REISERFS_SB(s)->xattr_root != NULL in
      reiserfs_xattr_jcreate_nblocks() despite that commit made
      REISERFS_SB(sb)->priv_root != NULL && REISERFS_SB(s)->xattr_root == NULL
      case possible.
      
      I guess that commit 6cb4aff0 ("reiserfs: fix oops while creating
      privroot with selinux enabled") wanted to check xattr_root != NULL
      before reiserfs_xattr_jcreate_nblocks(), for the changelog is talking
      about the xattr root.
      
        The issue is that while creating the privroot during mount
        reiserfs_security_init calls reiserfs_xattr_jcreate_nblocks which
        dereferences the xattr root. The xattr root doesn't exist, so we get
        an oops.
      
      Therefore, update reiserfs_xattrs_initialized() to check both the
      privroot and the xattr root.
      
      Link: https://syzkaller.appspot.com/bug?id=8abaedbdeb32c861dc5340544284167dd0e46cde
      
       # [1]
      Reported-and-tested-by: default avatarsyzbot <syzbot+690cb1e51970435f9775@syzkaller.appspotmail.com>
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Fixes: 6cb4aff0
      
       ("reiserfs: fix oops while creating privroot with selinux enabled")
      Acked-by: default avatarJeff Mahoney <jeffm@suse.com>
      Acked-by: default avatarJan Kara <jack@suse.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5e46d1b7
    • Linus Torvalds's avatar
      Merge tag 's390-5.12-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 6ac86aae
      Linus Torvalds authored
      Pull s390 updates from Heiko Carstens:
      
       - fix incorrect initialization and update of vdso data pages, which
         results in incorrect tod clock steering, and that
         clock_gettime(CLOCK_MONOTONIC_RAW, ...) returns incorrect values.
      
       - update MAINTAINERS for s390 vfio drivers
      
      * tag 's390-5.12-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        MAINTAINERS: add backups for s390 vfio drivers
        s390/vdso: fix initializing and updating of vdso_data
        s390/vdso: fix tod_steering_delta type
        s390/vdso: copy tod_steering_delta value to vdso_data page
      6ac86aae
    • Linus Torvalds's avatar
      Merge tag 'vfio-v5.12-rc6' of git://github.com/awilliam/linux-vfio · 17860cca
      Linus Torvalds authored
      Pull VFIO fixes from Alex Williamson:
      
       - Fix pfnmap batch carryover (Daniel Jordan)
      
       - Fix nvlink Kconfig dependency (Jason Gunthorpe)
      
      * tag 'vfio-v5.12-rc6' of git://github.com/awilliam/linux-vfio:
        vfio/nvlink: Add missing SPAPR_TCE_IOMMU depends
        vfio/type1: Empty batch for pfnmap pages
      17860cca
    • Ilya Lipnitskiy's avatar
      mm: fix race by making init_zero_pfn() early_initcall · e720e7d0
      Ilya Lipnitskiy authored
      There are code paths that rely on zero_pfn to be fully initialized
      before core_initcall.  For example, wq_sysfs_init() is a core_initcall
      function that eventually results in a call to kernel_execve, which
      causes a page fault with a subsequent mmput.  If zero_pfn is not
      initialized by then it may not get cleaned up properly and result in an
      error:
      
        BUG: Bad rss-counter state mm:(ptrval) type:MM_ANONPAGES val:1
      
      Here is an analysis of the race as seen on a MIPS device. On this
      particular MT7621 device (Ubiquiti ER-X), zero_pfn is PFN 0 until
      initialized, at which point it becomes PFN 5120:
      
        1. wq_sysfs_init calls into kobject_uevent_env at core_initcall:
             kobject_uevent_env+0x7e4/0x7ec
             kset_register+0x68/0x88
             bus_register+0xdc/0x34c
             subsys_virtual_register+0x34/0x78
             wq_sysfs_init+0x1c/0x4c
             do_one_initcall+0x50/0x1a8
             kernel_init_freeable+0x230/0x2c8
             kernel_init+0x10/0x100
             ret_from_kernel_thread+0x14/0x1c
      
        2. kobject_uevent_env() calls call_usermodehelper_exec() which executes
           kernel_execve asynchronously.
      
        3. Memory allocations in kernel_execve cause a page fault, bumping the
           MM reference counter:
             add_mm_counter_fast+0xb4/0xc0
             handle_mm_fault+0x6e4/0xea0
             __get_user_pages.part.78+0x190/0x37c
             __get_user_pages_remote+0x128/0x360
             get_arg_page+0x34/0xa0
             copy_string_kernel+0x194/0x2a4
             kernel_execve+0x11c/0x298
             call_usermodehelper_exec_async+0x114/0x194
      
        4. In case zero_pfn has not been initialized yet, zap_pte_range does
           not decrement the MM_ANONPAGES RSS counter and the BUG message is
           triggered shortly afterwards when __mmdrop checks the ref counters:
             __mmdrop+0x98/0x1d0
             free_bprm+0x44/0x118
             kernel_execve+0x160/0x1d8
             call_usermodehelper_exec_async+0x114/0x194
             ret_from_kernel_thread+0x14/0x1c
      
      To avoid races such as described above, initialize init_zero_pfn at
      early_initcall level.  Depending on the architecture, ZERO_PAGE is
      either constant or gets initialized even earlier, at paging_init, so
      there is no issue with initializing zero_pfn earlier.
      
      Link: https://lkml.kernel.org/r/CALCv0x2YqOXEAy2Q=hafjhHCtTHVodChv1qpM=niAXOpqEbt7w@mail.gmail.com
      
      
      Signed-off-by: default avatarIlya Lipnitskiy <ilya.lipnitskiy@gmail.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: "Eric W. Biederman" <ebiederm@xmission.com>
      Cc: stable@vger.kernel.org
      Tested-by: default avatar周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e720e7d0
  3. Mar 30, 2021
  4. Mar 29, 2021
    • Linus Torvalds's avatar
      Linux 5.12-rc5 · a5e13c6d
      Linus Torvalds authored
      a5e13c6d
    • Linus Torvalds's avatar
      Merge tag 'perf-tools-fixes-for-v5.12-2020-03-28' of... · f9e2bb42
      Linus Torvalds authored
      Merge tag 'perf-tools-fixes-for-v5.12-2020-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux
      
      Pull perf tooling fixes from Arnaldo Carvalho de Melo:
      
       - Avoid write of uninitialized memory when generating PERF_RECORD_MMAP*
         records.
      
       - Fix 'perf top' BPF support related crash with perf_event_paranoid=3 +
         kptr_restrict.
      
       - Validate raw event with sysfs exported format bits.
      
       - Fix waipid on SIGCHLD delivery bugs in 'perf daemon'.
      
       - Change to use bash for daemon test on Debian, where the default is
         dash and thus fails for use of bashisms in this test.
      
       - Fix memory leak in vDSO found using ASAN.
      
       - Remove now useless (due to the fact that BPF now supports static
         vars) failing sub test "BPF relocation checker".
      
       - Fix auxtrace queue conflict.
      
       - Sync linux/kvm.h with the kernel sources.
      
      * tag 'perf-tools-fixes-for-v5.12-2020-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
        perf test: Change to use bash for daemon test
        perf record: Fix memory leak in vDSO found using ASAN
        perf test: Remove now useless failing sub test "BPF relocation checker"
        perf daemon: Return from kill functions
        perf daemon: Force waipid for all session on SIGCHLD delivery
        perf top: Fix BPF support related crash with perf_event_paranoid=3 + kptr_restrict
        perf pmu: Validate raw event with sysfs exported format bits
        perf synthetic events: Avoid write of uninitialized memory when generating PERF_RECORD_MMAP* records
        tools headers UAPI: Sync linux/kvm.h with the kernel sources
        perf synthetic-events: Fix uninitialized 'kernel_thread' variable
        perf auxtrace: Fix auxtrace queue conflict
      f9e2bb42
    • Linus Torvalds's avatar
      Merge tag 'auxdisplay-for-linus-v5.12-rc6' of git://github.com/ojeda/linux · 3fef15f8
      Linus Torvalds authored
      Pull auxdisplay fix from Miguel Ojeda:
       "Remove in_interrupt() usage (Sebastian Andrzej Siewior)"
      
      * tag 'auxdisplay-for-linus-v5.12-rc6' of git://github.com/ojeda/linux:
        auxdisplay: Remove in_interrupt() usage.
      3fef15f8
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2021-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 36a14638
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Two fixes:
      
         - Fix build failure on Ubuntu with new GCC packages that turn
           on -fcf-protection
      
         - Fix SME memory encryption PTE encoding bug - AFAICT the code
           worked on 4K page sizes (level 1) but had the wrong shift at
           higher page level orders (level 2 and higher)"
      
      * tag 'x86-urgent-2021-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/build: Turn off -fcf-protection for realmode targets
        x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc()
      36a14638
    • Linus Torvalds's avatar
      Merge tag 'locking-urgent-2021-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 47fbbc94
      Linus Torvalds authored
      Pull locking fix from Ingo Molnar:
       "Fix the non-debug mutex_lock_io_nested() method to map to
        mutex_lock_io() instead of mutex_lock().
      
        Right now nothing uses this API explicitly, but this is an
        accident waiting to happen"
      
      * tag 'locking-urgent-2021-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        locking/mutex: Fix non debug version of mutex_lock_io_nested()
      47fbbc94
    • Linus Torvalds's avatar
      Merge tag '5.12-rc4-smb3' of git://git.samba.org/sfrench/cifs-2.6 · 81b1d39f
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "Five cifs/smb3 fixes, two for stable.
      
        Includes an important fix for encryption and an ACL fix, as well as a
        fix for possible reflink data corruption"
      
      * tag '5.12-rc4-smb3' of git://git.samba.org/sfrench/cifs-2.6:
        smb3: fix cached file size problems in duplicate extents (reflink)
        cifs: Silently ignore unknown oplock break handle
        cifs: revalidate mapping when we open files for SMB1 POSIX
        cifs: Fix chmod with modefromsid when an older ACE already exists.
        cifs: Adjust key sizes and key generation routines for AES256 encryption
      81b1d39f
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.12-2021-03-27' of git://git.kernel.dk/linux-block · b44d1ddc
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
      
       - Use thread info versions of flag testing, as discussed last week.
      
       - The series enabling PF_IO_WORKER to just take signals, instead of
         needing to special case that they do not in a bunch of places. Ends
         up being pretty trivial to do, and then we can revert all the special
         casing we're currently doing.
      
       - Kill dead pointer assignment
      
       - Fix hashed part of async work queue trace
      
       - Fix sign extension issue for IORING_OP_PROVIDE_BUFFERS
      
       - Fix a link completion ordering regression in this merge window
      
       - Cancellation fixes
      
      * tag 'io_uring-5.12-2021-03-27' of git://git.kernel.dk/linux-block:
        io_uring: remove unsued assignment to pointer io
        io_uring: don't cancel extra on files match
        io_uring: don't cancel-track common timeouts
        io_uring: do post-completion chore on t-out cancel
        io_uring: fix timeout cancel return code
        Revert "signal: don't allow STOP on PF_IO_WORKER threads"
        Revert "kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing"
        Revert "kernel: treat PF_IO_WORKER like PF_KTHREAD for ptrace/signals"
        Revert "signal: don't allow sending any signals to PF_IO_WORKER threads"
        kernel: stop masking signals in create_io_thread()
        io_uring: handle signals for IO threads like a normal thread
        kernel: don't call do_exit() for PF_IO_WORKER threads
        io_uring: maintain CQE order of a failed link
        io-wq: fix race around pending work on teardown
        io_uring: do ctx sqd ejection in a clear context
        io_uring: fix provide_buffers sign extension
        io_uring: don't skip file_end_write() on reissue
        io_uring: correct io_queue_async_work() traces
        io_uring: don't use {test,clear}_tsk_thread_flag() for current
      b44d1ddc
    • Linus Torvalds's avatar
      Merge tag 'block-5.12-2021-03-27' of git://git.kernel.dk/linux-block · abed516e
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - Fix regression from this merge window with the xarray partition
         change, which allowed partition counts that overflow the u8 that
         holds the partition number (Ming)
      
       - Fix zone append warning (Johannes)
      
       - Segmentation count fix for multipage bvecs (David)
      
       - Partition scan fix (Chris)
      
      * tag 'block-5.12-2021-03-27' of git://git.kernel.dk/linux-block:
        block: don't create too many partitions
        block: support zone append bvecs
        block: recalculate segment count for multi-segment discards correctly
        block: clear GD_NEED_PART_SCAN later in bdev_disk_changed
      abed516e
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · e8cfe8fa
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Seven fixes, all in drivers (qla2xxx, mkt3sas, qedi, target,
        ibmvscsi).
      
        The most serious are the target pscsi oom and the qla2xxx revert which
        can otherwise cause a use after free"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: target: pscsi: Clean up after failure in pscsi_map_sg()
        scsi: target: pscsi: Avoid OOM in pscsi_map_sg()
        scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
        scsi: qedi: Fix error return code of qedi_alloc_global_queues()
        scsi: Revert "qla2xxx: Make sure that aborted commands are freed"
        scsi: ibmvfc: Make ibmvfc_wait_for_ops() MQ aware
        scsi: ibmvfc: Fix potential race in ibmvfc_wait_for_ops()
      e8cfe8fa
    • Matthew Rosato's avatar
      MAINTAINERS: add backups for s390 vfio drivers · 84d572e6
      Matthew Rosato authored
      
      
      Add a backup for s390 vfio-pci, an additional backup for vfio-ccw
      and replace the backup for vfio-ap as Pierre is focusing on other
      areas.
      
      Signed-off-by: default avatarMatthew Rosato <mjrosato@linux.ibm.com>
      Acked-by: default avatarEric Farman <farman@linux.ibm.com>
      Acked-by: default avatarHalil Pasic <pasic@linux.ibm.com>
      Acked-by: default avatarPierre Morel <pmorel@linux.ibm.com>
      Acked-by: default avatarJason J. Herne <jjherne@linux.ibm.com>
      Link: https://lore.kernel.org/r/1616679712-7139-1-git-send-email-mjrosato@linux.ibm.com
      
      
      Signed-off-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: default avatarHeiko Carstens <hca@linux.ibm.com>
      84d572e6
  5. Mar 28, 2021
  6. Mar 27, 2021