summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2021-11-26net: qed: fix the array may be out of boundzhangyue1-3/+3
If the variable 'p_bit->flags' is always 0, the loop condition is always 0. The variable 'j' may be greater than or equal to 32. At this time, the array 'p_aeu->bits[32]' may be out of bound. Signed-off-by: zhangyue <zhangyue1@kylinos.cn> Link: https://lore.kernel.org/r/20211125113610.273841-1-zhangyue1@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26Merge tag 'for-5.16-rc2-tag' of ↵Linus Torvalds1-0/+2
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "One more fix to the lzo code, a missing put_page causing memory leaks when some error branches are taken" * tag 'for-5.16-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix the memory leak caused in lzo_compress_pages()
2021-11-26net/smc: Don't call clcsock shutdown twice when smc shutdownTony Lu1-1/+7
When applications call shutdown() with SHUT_RDWR in userspace, smc_close_active() calls kernel_sock_shutdown(), and it is called twice in smc_shutdown(). This fixes this by checking sk_state before do clcsock shutdown, and avoids missing the application's call of smc_shutdown(). Link: https://lore.kernel.org/linux-s390/1f67548e-cbf6-0dce-82b5-10288a4583bd@linux.ibm.com/ Fixes: 606a63c9783a ("net/smc: Ensure the active closing peer first closes clcsock") Signed-off-by: Tony Lu <tonylu@linux.alibaba.com> Reviewed-by: Wen Gu <guwen@linux.alibaba.com> Acked-by: Karsten Graul <kgraul@linux.ibm.com> Link: https://lore.kernel.org/r/20211126024134.45693-1-tonylu@linux.alibaba.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26net: vlan: fix underflow for the real_dev refcntZiyang Xuan2-3/+3
Inject error before dev_hold(real_dev) in register_vlan_dev(), and execute the following testcase: ip link add dev dummy1 type dummy ip link add name dummy1.100 link dummy1 type vlan id 100 ip link del dev dummy1 When the dummy netdevice is removed, we will get a WARNING as following: ======================================================================= refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 2 PID: 0 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 and an endless loop of: ======================================================================= unregister_netdevice: waiting for dummy1 to become free. Usage count = -1073741824 That is because dev_put(real_dev) in vlan_dev_free() be called without dev_hold(real_dev) in register_vlan_dev(). It makes the refcnt of real_dev underflow. Move the dev_hold(real_dev) to vlan_dev_init() which is the call-back of ndo_init(). That makes dev_hold() and dev_put() for vlan's real_dev symmetrical. Fixes: 563bcbae3ba2 ("net: vlan: fix a UAF in vlan_dev_real_dev()") Reported-by: Petr Machata <petrm@nvidia.com> Suggested-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com> Link: https://lore.kernel.org/r/20211126015942.2918542-1-william.xuanziyang@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26ptp: fix filter names in the documentationJakub Kicinski1-2/+2
All the filter names are missing _PTP in them. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Acked-by: Richard Cochran <richardcochran@gmail.com> Link: https://lore.kernel.org/r/20211126031921.2466944-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()Julian Wiedmann1-1/+1
ethtool_set_coalesce() now uses both the .get_coalesce() and .set_coalesce() callbacks. But the check for their availability is buggy, so changing the coalesce settings on a device where the driver provides only _one_ of the callbacks results in a NULL pointer dereference instead of an -EOPNOTSUPP. Fix the condition so that the availability of both callbacks is ensured. This also matches the netlink code. Note that reproducing this requires some effort - it only affects the legacy ioctl path, and needs a specific combination of driver options: - have .get_coalesce() and .coalesce_supported but no .set_coalesce(), or - have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn't cause the crash as it first attempts to call ethtool_get_coalesce() and bails out on error. Fixes: f3ccfda19319 ("ethtool: extend coalesce setting uAPI with CQE mode") Cc: Yufeng Mo <moyufeng@huawei.com> Cc: Huazhong Tan <tanhuazhong@huawei.com> Cc: Andrew Lunn <andrew@lunn.ch> Cc: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Link: https://lore.kernel.org/r/20211126175543.28000-1-jwi@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26nfc: virtual_ncidev: change default device permissionsThadeu Lima de Souza Cascardo1-1/+1
Device permissions is S_IALLUGO, with many unnecessary bits. Remove them and also remove read and write permissions from group and others. Before the change: crwsrwsrwt 1 0 0 10, 125 Nov 25 13:59 /dev/virtual_nci After the change: crw------- 1 0 0 10, 125 Nov 25 14:05 /dev/virtual_nci Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Reviewed-by: Bongsu Jeon <bongsu.jeon@samsung.com> Link: https://lore.kernel.org/r/20211125141457.716921-1-cascardo@canonical.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26net/sched: sch_ets: don't peek at classes beyond 'nbands'Davide Caratti1-3/+5
when the number of DRR classes decreases, the round-robin active list can contain elements that have already been freed in ets_qdisc_change(). As a consequence, it's possible to see a NULL dereference crash, caused by the attempt to call cl->qdisc->ops->peek(cl->qdisc) when cl->qdisc is NULL: BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 910 Comm: mausezahn Not tainted 5.16.0-rc1+ #475 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 RIP: 0010:ets_qdisc_dequeue+0x129/0x2c0 [sch_ets] Code: c5 01 41 39 ad e4 02 00 00 0f 87 18 ff ff ff 49 8b 85 c0 02 00 00 49 39 c4 0f 84 ba 00 00 00 49 8b ad c0 02 00 00 48 8b 7d 10 <48> 8b 47 18 48 8b 40 38 0f ae e8 ff d0 48 89 c3 48 85 c0 0f 84 9d RSP: 0000:ffffbb36c0b5fdd8 EFLAGS: 00010287 RAX: ffff956678efed30 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000002 RSI: ffffffff9b938dc9 RDI: 0000000000000000 RBP: ffff956678efed30 R08: e2f3207fe360129c R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff956678efeac0 R13: ffff956678efe800 R14: ffff956611545000 R15: ffff95667ac8f100 FS: 00007f2aa9120740(0000) GS:ffff95667b800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000011070c000 CR4: 0000000000350ee0 Call Trace: <TASK> qdisc_peek_dequeued+0x29/0x70 [sch_ets] tbf_dequeue+0x22/0x260 [sch_tbf] __qdisc_run+0x7f/0x630 net_tx_action+0x290/0x4c0 __do_softirq+0xee/0x4f8 irq_exit_rcu+0xf4/0x130 sysvec_apic_timer_interrupt+0x52/0xc0 asm_sysvec_apic_timer_interrupt+0x12/0x20 RIP: 0033:0x7f2aa7fc9ad4 Code: b9 ff ff 48 8b 54 24 18 48 83 c4 08 48 89 ee 48 89 df 5b 5d e9 ed fc ff ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa <53> 48 83 ec 10 48 8b 05 10 64 33 00 48 8b 00 48 85 c0 0f 85 84 00 RSP: 002b:00007ffe5d33fab8 EFLAGS: 00000202 RAX: 0000000000000002 RBX: 0000561f72c31460 RCX: 0000561f72c31720 RDX: 0000000000000002 RSI: 0000561f72c31722 RDI: 0000561f72c31720 RBP: 000000000000002a R08: 00007ffe5d33fa40 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 0000561f7187e380 R13: 0000000000000000 R14: 0000000000000000 R15: 0000561f72c31460 </TASK> Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt intel_rapl_msr iTCO_vendor_support intel_rapl_common joydev virtio_balloon lpc_ich i2c_i801 i2c_smbus pcspkr ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel serio_raw libata virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod CR2: 0000000000000018 Ensuring that 'alist' was never zeroed [1] was not sufficient, we need to remove from the active list those elements that are no more SP nor DRR. [1] https://lore.kernel.org/netdev/60d274838bf09777f0371253416e8af71360bc08.1633609148.git.dcaratti@redhat.com/ v3: fix race between ets_qdisc_change() and ets_qdisc_dequeue() delisting DRR classes beyond 'nbands' in ets_qdisc_change() with the qdisc lock acquired, thanks to Cong Wang. v2: when a NULL qdisc is found in the DRR active list, try to dequeue skb from the next list item. Reported-by: Hangbin Liu <liuhangbin@gmail.com> Fixes: dcc68b4d8084 ("net: sch_ets: Add a new Qdisc") Signed-off-by: Davide Caratti <dcaratti@redhat.com> Link: https://lore.kernel.org/r/7a5c496eed2d62241620bdbb83eb03fb9d571c99.1637762721.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26Merge branch 'acpi-properties'Rafael J. Wysocki2-16/+5
Merge fix and cleanup related to the management of ACPI device properties for 5.16-rc3. * acpi-properties: ACPI: Make acpi_node_get_parent() local ACPI: Get acpi_device's parent from the parent field
2021-11-26Merge branch 'pm-sleep'Rafael J. Wysocki2-4/+4
Merge hibernation-related fixes for 5.16-rc3. * pm-sleep: PM: hibernate: Fix snapshot partial write lengths PM: hibernate: use correct mode for swsusp_close()
2021-11-26net: stmmac: Disable Tx queues when reconfiguring the interfaceYannick Vignon1-0/+2
The Tx queues were not disabled in situations where the driver needed to stop the interface to apply a new configuration. This could result in a kernel panic when doing any of the 3 following actions: * reconfiguring the number of queues (ethtool -L) * reconfiguring the size of the ring buffers (ethtool -G) * installing/removing an XDP program (ip l set dev ethX xdp) Prevent the panic by making sure netif_tx_disable is called when stopping an interface. Without this patch, the following kernel panic can be observed when doing any of the actions above: Unable to handle kernel paging request at virtual address ffff80001238d040 [....] Call trace: dwmac4_set_addr+0x8/0x10 dev_hard_start_xmit+0xe4/0x1ac sch_direct_xmit+0xe8/0x39c __dev_queue_xmit+0x3ec/0xaf0 dev_queue_xmit+0x14/0x20 [...] [ end trace 0000000000000002 ]--- Fixes: 5fabb01207a2d ("net: stmmac: Add initial XDP support") Fixes: aa042f60e4961 ("net: stmmac: Add support to Ethtool get/set ring parameters") Fixes: 0366f7e06a6be ("net: stmmac: add ethtool support for get/set channels") Signed-off-by: Yannick Vignon <yannick.vignon@nxp.com> Link: https://lore.kernel.org/r/20211124154731.1676949-1-yannick.vignon@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26Merge tag 'char-misc-5.16-rc3' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fix from Greg KH: "Here is a single binder driver fix for 5.16-rc3. It resolves a problem reported in the set of binder fixes that went into 5.16-rc1. It has been in linux-next for a while with no reported problems" * tag 'char-misc-5.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: binder: fix test regression due to sender_euid change
2021-11-26Merge tag 'staging-5.16-rc3' of ↵Linus Torvalds16-2443/+21
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging fixes from Greg KH: "Here are some small staging driver fixes and one driver removal for 5.16-rc3. The fixes resolve a number of small issues found in 5.16-rc1, nothing huge at all. The driver removal was due to a platform being removed in 5.16-rc1, but this driver was forgotten about. It wasn't being built anymore so it's safe to delete. All have been in linux-next for a while with no reported problems" * tag 'staging-5.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() staging: greybus: Add missing rwsem around snd_ctl_remove() calls staging: Remove Netlogic XLP network driver staging: r8188eu: fix a memory leak in rtw_wx_read32() staging: r8188eu: use GFP_ATOMIC under spinlock staging: r8188eu: Use kzalloc() with GFP_ATOMIC in atomic context staging/fbtft: Fix backlight staging: r8188eu: Fix breakage introduced when 5G code was removed
2021-11-26Merge tag 'usb-5.16-rc1' of ↵Linus Torvalds13-67/+136
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a number of small USB fixes for reported problems for 5.16-rc3 They include: - typec driver fixes - new usb-serial driver ids - usb hub enumeration issues that were much reported - gadget driver fixes - dwc3 driver fix - chipidea driver fixe All of these have been in linux-next with no reported problems" * tag 'usb-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: option: add Fibocom FM101-GL variants usb: typec: tipd: Fix initialization sequence for cd321x usb: typec: tipd: Fix typo in cd321x_switch_power_state usb: hub: Fix locking issues with address0_mutex USB: serial: pl2303: fix GC type detection USB: serial: option: add Telit LE910S1 0x9200 composition usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe usb: hub: Fix usb enumeration issue due to address0 race usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts usb: dwc3: leave default DMA for PCI devices usb: dwc2: hcd_queue: Fix use of floating point literal usb: dwc3: gadget: Fix null pointer exception usb: gadget: udc-xilinx: Fix an error handling path in 'xudc_probe()' usb: xhci: tegra: Check padctrl interrupt presence in device tree usb: dwc2: gadget: Fix ISOC flow for elapsed frames usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer usb: dwc3: gadget: Ignore NoStream after End Transfer usb: dwc3: core: Revise GHWPARAMS9 offset
2021-11-26Merge tag 'mmc-v5.16-rc1' of ↵Linus Torvalds4-6/+28
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - mmc_spi: Add SPI IDs to silence warning - sdhci: Fix ADMA for PAGE_SIZE >= 64KiB - sdhci-esdhc-imx: Disable broken CMDQ for imx8qm/imx8qxp/imx8mm * tag 'mmc-v5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: spi: Add device-tree SPI IDs mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB mmc: sdhci-esdhc-imx: disable CMDQ support
2021-11-26Merge branch 'i2c/for-current' of ↵Linus Torvalds4-24/+41
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C has an interrupt storm fix for the i801, better timeout handling for the new virtio driver, and some documentation fixes this time" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: docs: i2c: smbus-protocol: mention the repeated start condition i2c: virtio: disable timeout handling i2c: i801: Fix interrupt storm from SMB_ALERT signal i2c: i801: Restore INTREN on unload dt-bindings: i2c: imx-lpi2c: Fix i.MX 8QM compatible matching
2021-11-26Merge tag 'for-linus-5.16c-rc3-tag' of ↵Linus Torvalds12-15/+46
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - Kconfig fix to make it possible to control building of the privcmd driver - three fixes for issues identified by the kernel test robot - a five-patch series to simplify timeout handling for Xen PV driver initialization - two patches to fix error paths in xenstore/xenbus driver initialization * tag 'for-linus-5.16c-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: make HYPERVISOR_set_debugreg() always_inline xen: make HYPERVISOR_get_debugreg() always_inline xen: detect uninitialized xenbus in xenbus_init xen: flag xen_snd_front to be not essential for system boot xen: flag pvcalls-front to be not essential for system boot xen: flag hvc_xen to be not essential for system boot xen: flag xen_drm_front to be not essential for system boot xen: add "not_essential" flag to struct xenbus_driver xen/pvh: add missing prototype to header xen: don't continue xenstore initialization in case of errors xen/privcmd: make option visible in Kconfig
2021-11-26Merge tag 'arm64-fixes' of ↵Linus Torvalds6-27/+64
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Three arm64 fixes. The main one is a fix to the way in which we evaluate the macro arguments to our uaccess routines, which we _think_ might be the root cause behind some unkillable tasks we've seen in the Android arm64 CI farm (testing is ongoing). In any case, it's worth fixing. Other than that, we've toned down an over-zealous VM_BUG_ON() and fixed ftrace stack unwinding in a bunch of cases. Summary: - Evaluate uaccess macro arguments outside of the critical section - Tighten up VM_BUG_ON() in pmd_populate_kernel() to avoid false positive - Fix ftrace stack unwinding using HAVE_FUNCTION_GRAPH_RET_ADDR_PTR" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: uaccess: avoid blocking within critical sections arm64: mm: Fix VM_BUG_ON(mm != &init_mm) for trans_pgd arm64: ftrace: use HAVE_FUNCTION_GRAPH_RET_ADDR_PTR
2021-11-26zram: only make zram_wb_devops for CONFIG_ZRAM_WRITEBACKJens Axboe1-0/+2
If writeback isn't configured, then we get the following warning when compiling zram: drivers/block/zram/zram_drv.c:1824:45: warning: unused variable 'zram_wb_devops' [-Wunused-const-variable] Make sure we only define the block_device_operations if that option is enabled. Link: https://lore.kernel.org/lkml/202111261614.gCJMqcyh-lkp@intel.com/ Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-11-26block: call rq_qos_done() before ref check in batch completionsJens Axboe1-1/+2
We need to call rq_qos_done() regardless of whether or not we're freeing the request or not, as the reference count doesn't cover the IO completion tracking. Fixes: f794f3351f26 ("block: add support for blk_mq_end_request_batch()") Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com> Reported-by: Kenneth R. Crudup <kenny@panix.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-11-26io_uring: fix link traversal lockingPavel Begunkov1-18/+42
WARNING: inconsistent lock state 5.16.0-rc2-syzkaller #0 Not tainted inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. ffff888078e11418 (&ctx->timeout_lock ){?.+.}-{2:2} , at: io_timeout_fn+0x6f/0x360 fs/io_uring.c:5943 {HARDIRQ-ON-W} state was registered at: [...] spin_unlock_irq include/linux/spinlock.h:399 [inline] __io_poll_remove_one fs/io_uring.c:5669 [inline] __io_poll_remove_one fs/io_uring.c:5654 [inline] io_poll_remove_one+0x236/0x870 fs/io_uring.c:5680 io_poll_remove_all+0x1af/0x235 fs/io_uring.c:5709 io_ring_ctx_wait_and_kill+0x1cc/0x322 fs/io_uring.c:9534 io_uring_release+0x42/0x46 fs/io_uring.c:9554 __fput+0x286/0x9f0 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xc14/0x2b40 kernel/exit.c:832 674ee8e1b4a41 ("io_uring: correct link-list traversal locking") fixed a data race but introduced a possible deadlock and inconsistentcy in irq states. E.g. io_poll_remove_all() spin_lock_irq(timeout_lock) io_poll_remove_one() spin_lock/unlock_irq(poll_lock); spin_unlock_irq(timeout_lock) Another type of problem is freeing a request while holding ->timeout_lock, which may leads to a deadlock in io_commit_cqring() -> io_flush_timeouts() and other places. Having 3 nested locks is also too ugly. Add io_match_task_safe(), which would briefly take and release timeout_lock for race prevention inside, so the actuall request cancellation / free / etc. code doesn't have it taken. Reported-by: syzbot+ff49a3059d49b0ca0eec@syzkaller.appspotmail.com Reported-by: syzbot+847f02ec20a6609a328b@syzkaller.appspotmail.com Reported-by: syzbot+3368aadcd30425ceb53b@syzkaller.appspotmail.com Reported-by: syzbot+51ce8887cdef77c9ac83@syzkaller.appspotmail.com Reported-by: syzbot+3cb756a49d2f394a9ee3@syzkaller.appspotmail.com Fixes: 674ee8e1b4a41 ("io_uring: correct link-list traversal locking") Cc: stable@kernel.org # 5.15+ Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/397f7ebf3f4171f1abe41f708ac1ecb5766f0b68.1637937097.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-11-26io_uring: fail cancellation for EXITING tasksPavel Begunkov1-2/+3
WARNING: CPU: 1 PID: 20 at fs/io_uring.c:6269 io_try_cancel_userdata+0x3c5/0x640 fs/io_uring.c:6269 CPU: 1 PID: 20 Comm: kworker/1:0 Not tainted 5.16.0-rc1-syzkaller #0 Workqueue: events io_fallback_req_func RIP: 0010:io_try_cancel_userdata+0x3c5/0x640 fs/io_uring.c:6269 Call Trace: <TASK> io_req_task_link_timeout+0x6b/0x1e0 fs/io_uring.c:6886 io_fallback_req_func+0xf9/0x1ae fs/io_uring.c:1334 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> We need original task's context to do cancellations, so if it's dying and the callback is executed in a fallback mode, fail the cancellation attempt. Fixes: 89b263f6d56e6 ("io_uring: run linked timeouts from task_work") Cc: stable@kernel.org # 5.15+ Reported-by: syzbot+ab0cfe96c2b3cd1c1153@syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/4c41c5f379c6941ad5a07cd48cb66ed62199cf7e.1637937097.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-11-26btrfs: fix the memory leak caused in lzo_compress_pages()Qu Wenruo1-0/+2
[BUG] Fstests generic/027 is pretty easy to trigger a slow but steady memory leak if run with "-o compress=lzo" mount option. Normally one single run of generic/027 is enough to eat up at least 4G ram. [CAUSE] In commit d4088803f511 ("btrfs: subpage: make lzo_compress_pages() compatible") we changed how @page_in is released. But that refactoring makes @page_in only released after all pages being compressed. This leaves error path not releasing @page_in. And by "error path" things like incompressible data will also be treated as an error (-E2BIG). Thus it can cause a memory leak if even nothing wrong happened. [FIX] Add check under @out label to release @page_in when needed, so when we hit any error, the input page is properly released. Reported-by: Josef Bacik <josef@toxicpanda.com> Fixes: d4088803f511 ("btrfs: subpage: make lzo_compress_pages() compatible") Reviewed-and-tested-by: Josef Bacik <josef@toxicpanda.com> Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2021-11-26Merge branch 'tls-splice_read-fixes'Jakub Kicinski3-152/+456
Jakub Kicinski says: ==================== tls: splice_read fixes As I work my way to unlocked and zero-copy TLS Rx the obvious bugs in the splice_read implementation get harder and harder to ignore. This is to say the fixes here are discovered by code inspection, I'm not aware of anyone actually using splice_read. ==================== Link: https://lore.kernel.org/r/20211124232557.2039757-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26selftests: tls: test for correct proto_opsJakub Kicinski1-0/+55
Previous patch fixes overriding callbacks incorrectly. Triggering the crash in sendpage_locked would be more spectacular but it's hard to get to, so take the easier path of proving this is broken and call getname. We're currently getting IPv4 socket info on an IPv6 socket. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26tls: fix replacing proto_opsJakub Kicinski1-7/+40
We replace proto_ops whenever TLS is configured for RX. But our replacement also overrides sendpage_locked, which will crash unless TX is also configured. Similarly we plug both of those in for TLS_HW (NIC crypto offload) even tho TLS_HW has a completely different implementation for TX. Last but not least we always plug in something based on inet_stream_ops even though a few of the callbacks differ for IPv6 (getname, release, bind). Use a callback building method similar to what we do for struct proto. Fixes: c46234ebb4d1 ("tls: RX path for ktls") Fixes: d4ffb02dee2f ("net/tls: enable sk_msg redirect to tls socket egress") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26selftests: tls: test splicing decrypted recordsJakub Kicinski1-0/+49
Add tests for half-received and peeked records. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26tls: splice_read: fix accessing pre-processed recordsJakub Kicinski1-8/+25
recvmsg() will put peek()ed and partially read records onto the rx_list. splice_read() needs to consult that list otherwise it may miss data. Align with recvmsg() and also put partially-read records onto rx_list. tls_sw_advance_skb() is pretty pointless now and will be removed in net-next. Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26selftests: tls: test splicing cmsgsJakub Kicinski1-0/+40
Make sure we correctly reject splicing non-data records. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26tls: splice_read: fix record type checkJakub Kicinski1-13/+10
We don't support splicing control records. TLS 1.3 changes moved the record type check into the decrypt if(). The skb may already be decrypted and still be an alert. Note that decrypt_skb_update() is idempotent and updates ctx->decrypted so the if() is pointless. Reorder the check for decryption errors with the content type check while touching them. This part is not really a bug, because if decryption failed in TLS 1.3 content type will be DATA, and for TLS 1.2 it will be correct. Nevertheless its strange to touch output before checking if the function has failed. Fixes: fedf201e1296 ("net: tls: Refactor control message handling on recv") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26selftests: tls: add tests for handling of bad recordsJakub Kicinski1-0/+154
Test broken records. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26selftests: tls: factor out cmsg send/receiveJakub Kicinski1-41/+70
Add helpers for sending and receiving special record types. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26selftests: tls: add helper for creating sock pairsJakub Kicinski1-99/+29
We have the same code 3 times, about to add a fourth copy. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-26Merge tag 'drm-fixes-2021-11-26' of git://anongit.freedesktop.org/drm/drmLinus Torvalds38-211/+376
Pull drm fixes from Dave Airlie: "No idea if turkey comes before pull request processing, but here's the regular week's fixes. A bunch for amdgpu, nouveau adds support for a new GPU (like a PCI ID addition), and a scattering of fixes across i915/hyperv/aspeed/vc4. Specifics: amdgpu: - SRIOV fixes - dma-buf double free fix - Display fixes for GPU resets - Fix DSC powergating regression - GPU TSC fixes - Interrupt handler overflow fixes - Endian fix in IP discovery table handling - Aldebaran ASPM fix - Fix overclocking regression on older asics - Backlight/ACPI fix amdkfd: - SVM fixes - VMA removal race fix hyperv: - removal fix aspeed: - vga_pw sysfs file fix vc4: - error checking fix nouveau: - support GA106 - fix a few error checks i915: - fix wakeref handling around PXP suspend" * tag 'drm-fixes-2021-11-26' of git://anongit.freedesktop.org/drm/drm: (25 commits) drm/amd/display: update bios scratch when setting backlight drm/amdgpu/pm: fix powerplay OD interface drm/amdgpu: Skip ASPM programming on aldebaran drm/amdgpu: fix byteorder error in amdgpu discovery drm/amdgpu: enable Navi retry fault wptr overflow drm/amdgpu: enable Navi 48-bit IH timestamp counter drm/amdkfd: simplify drain retry fault drm/amdkfd: handle VMA remove race drm/amdkfd: process exit and retry fault race drm/amdgpu: IH process reset count when restart drm/amdgpu/gfx9: switch to golden tsc registers for renoir+ drm/amdgpu/gfx10: add wraparound gpu counter check for APUs as well drm/amdgpu: move kfd post_reset out of reset_sriov function drm/amd/display: Fixed DSC would not PG after removing DSC stream drm/amd/display: Reset link encoder assignments for GPU reset drm/amd/display: Set plane update flags for all planes in reset drm/amd/display: Fix DPIA outbox timeout after GPU reset drm/amdgpu: Fix double free of dmabuf drm/amdgpu: Fix MMIO HDP flush on SRIOV drm/i915/gt: Hold RPM wakelock during PXP suspend ...
2021-11-26Merge tag 'drm-intel-fixes-2021-11-24' of ↵Dave Airlie3-17/+46
git://anongit.freedesktop.org/drm/drm-intel into drm-fixes Fix wakeref handling of PXP suspend. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/YZ65bsPOK+6JLv0d@intel.com
2021-11-26Merge tag 'drm-misc-fixes-2021-11-25' of ↵Dave Airlie6-7/+50
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes One removal fix for hyperv, one fix in aspeed for the vga_pw sysfs file content, one error-checking fix for vc4 and two fixes for nouveau, one to support a new device and another one to properly check for errors. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <maxime@cerno.tech> Link: https://patchwork.freedesktop.org/patch/msgid/20211125101819.ynu7zgbs7yfwedri@houat
2021-11-26Merge tag 'amd-drm-fixes-5.16-2021-11-24' of ↵Dave Airlie28-186/+279
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.16-2021-11-24: amdgpu: - SRIOV fixes - dma-buf double free fix - Display fixes for GPU resets - Fix DSC powergating regression - GPU TSC fixes - Interrupt handler overflow fixes - Endian fix in IP discovery table handling - Aldebaran ASPM fix - Fix overclocking regression on older asics - Backlight/ACPI fix amdkfd: - SVM fixes - VMA removal race fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211124212056.6327-1-alexander.deucher@amd.com
2021-11-25Merge tag 'block-5.16-2021-11-25' of git://git.kernel.dk/linux-blockLinus Torvalds7-52/+102
Pull block fixes from Jens Axboe: - NVMe pull request via Christoph: - Add a NO APST quirk for a Kioxia device (Enzo Matsumiya) - Fix write zeroes pi (Klaus Jensen) - Various TCP transport fixes (Maurizio Lombardi and Varun Prakash) - Ignore invalid fast_io_fail_tmo values (Maurizio Lombardi) - Use IOCB_NOWAIT only if the filesystem supports it (Maurizio Lombardi) - Module loading fix (Ming) - Kerneldoc warning fix (Yang) * tag 'block-5.16-2021-11-25' of git://git.kernel.dk/linux-block: block: fix parameter not described warning nvmet: use IOCB_NOWAIT only if the filesystem supports it nvme: fix write zeroes pi nvme-fabrics: ignore invalid fast_io_fail_tmo values nvme-pci: add NO APST quirk for Kioxia device nvme-tcp: fix memory leak when freeing a queue nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t() nvmet-tcp: fix incomplete data digest send nvmet-tcp: fix memory leak when performing a controller reset nvmet-tcp: add an helper to free the cmd buffers nvmet-tcp: fix a race condition between release_queue and io_work block: avoid to touch unloaded module instance when opening bdev
2021-11-25Merge tag 'io_uring-5.16-2021-11-25' of git://git.kernel.dk/linux-blockLinus Torvalds1-5/+9
Pull io_uring fixes from Jens Axboe: "A locking fix for link traversal, and fixing up an outdated function name in a comment" * tag 'io_uring-5.16-2021-11-25' of git://git.kernel.dk/linux-block: io_uring: correct link-list traversal locking io_uring: fix missed comment from *task_file rename
2021-11-25Merge tag '5.16-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds4-5/+7
Pull cifs fixes from Steve French: "Four small cifs/smb3 fixes: - two multichannel fixes - fix problem noted by kernel test robot - update internal version number" * tag '5.16-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal version number smb2: clarify rc initialization in smb2_reconnect cifs: populate server_hostname for extra channels cifs: nosharesock should be set on new server
2021-11-25Merge tag 'asm-generic-5.16-2' of ↵Linus Torvalds8-0/+8
git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic syscall table update from Arnd Bergmann: "André Almeida sends an update for the newly added futex_waitv syscall that was initially only added to a few architectures. Some additional ones have since made it through architecture maintainer trees, this finishes the remaining ones" * tag 'asm-generic-5.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: futex: Wireup futex_waitv syscall
2021-11-25Merge tag 'arm-fixes-5.16-2' of ↵Linus Torvalds14-30/+54
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "There are only a few devicetree fixes this time: - one outdated devicetree property that slipped into the newly added ExynosAutov9 support - three changes to Broadcom SoCs that had incorrect number values for interrupts or irqchips. In the MAINTAINERS file, Nishanth Menon gets listed for TI K3 SoCs, while Taichi Sugaya and Takao Orito take ownership of the Socionext Milbeaut platform. All other changes are for SoC specific drivers, fixing: - A missing NULL pointer check in the mediatek memory driver - An integer overflow issue in the Arm smccc firwmare interface - A false-positive fortify-source check - Error handling fixes for optee and smci - Incorrect message format in one SCMI call" * tag 'arm-fixes-5.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: memory: mtk-smi: Fix a null dereference for the ostd arm64: dts: exynos: drop samsung,ufs-shareability-reg-offset in ExynosAutov9 MAINTAINERS: Update maintainer entry for keystone platforms MAINTAINERS: Add entry to MAINTAINERS for Milbeaut firmware: smccc: Fix check for ARCH_SOC_ID not implemented ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE firmware: arm_scmi: Fix type error assignment in voltage protocol firmware: arm_scmi: Fix type error in sensor protocol firmware: arm_scmi: pm: Propagate return value to caller firmware: arm_scmi: Fix base agent discover response optee: fix kfree NULL pointer ARM: dts: bcm2711: Fix PCIe interrupts ARM: dts: BCM5301X: Add interrupt properties to GPIO node ARM: dts: BCM5301X: Fix I2C controller interrupt firmware: arm_scmi: Fix null de-reference on error path
2021-11-25Merge tag 'folio-5.16b' of git://git.infradead.org/users/willy/pagecacheLinus Torvalds20-43/+92
Pull folio fixes from Matthew Wilcox: "In the course of preparing the folio changes for iomap for next merge window, we discovered some problems that would be nice to address now: - Renaming multi-page folios to large folios. mapping_multi_page_folio_support() is just a little too long, so we settled on mapping_large_folio_support(). That meant renaming, eg folio_test_multi() to folio_test_large(). Rename AS_THP_SUPPORT to match - I hadn't included folio wrappers for zero_user_segments(), etc. Also, multi-page^W^W large folio support is now independent of CONFIG_TRANSPARENT_HUGEPAGE, so machines with HIGHMEM always need to fall back to the out-of-line zero_user_segments(). Remove FS_THP_SUPPORT to match - The build bots finally got round to telling me that I missed a couple of architectures when adding flush_dcache_folio(). Christoph suggested that we just add linux/cacheflush.h and not rely on asm-generic/cacheflush.h" * tag 'folio-5.16b' of git://git.infradead.org/users/willy/pagecache: mm: Add functions to zero portions of a folio fs: Rename AS_THP_SUPPORT and mapping_thp_support fs: Remove FS_THP_SUPPORT mm: Remove folio_test_single mm: Rename folio_test_multi to folio_test_large Add linux/cacheflush.h
2021-11-25block: fix parameter not described warningYang Guang1-0/+1
The build warning: block/blk-core.c:968: warning: Function parameter or member 'iob' not described in 'bio_poll'. Fixes: 5a72e899ceb4 ("block: add a struct io_comp_batch argument to fops->iopoll()") Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Yang Guang <yang.guang5@zte.com.cn> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-11-25MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48Huang Pei1-1/+1
It hangup when booting Loongson 3A1000 with BOTH CONFIG_PAGE_SIZE_64KB and CONFIG_MIPS_VA_BITS_48, that it turn out to use 2-level pgtable instead of 3-level. 64KB page size with 2-level pgtable only cover 42 bits VA, use 3-level pgtable to cover all 48 bits VA(55 bits) Fixes: 1e321fa917fb ("MIPS64: Support of at least 48 bits of SEGBITS) Signed-off-by: Huang Pei <huangpei@loongson.cn> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2021-11-25MIPS: loongson64: fix FTLB configurationHuang Pei1-2/+2
It turns out that 'decode_configs' -> 'set_ftlb_enable' is called under c->cputype unset, which leaves FTLB disabled on BOTH 3A2000 and 3A3000 Fix it by calling "decode_configs" after c->cputype is initialized Fixes: da1bd29742b1 ("MIPS: Loongson64: Probe CPU features via CPUCFG") Signed-off-by: Huang Pei <huangpei@loongson.cn> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2021-11-25MIPS: Fix using smp_processor_id() in preemptible in show_cpuinfo()Tiezhu Yang1-1/+1
There exists the following issue under DEBUG_PREEMPT: BUG: using smp_processor_id() in preemptible [00000000] code: systemd/1 caller is show_cpuinfo+0x460/0xea0 ... Call Trace: [<ffffffff8020f0dc>] show_stack+0x94/0x128 [<ffffffff80e6cab4>] dump_stack_lvl+0x94/0xd8 [<ffffffff80e74c5c>] check_preemption_disabled+0x104/0x110 [<ffffffff802209c8>] show_cpuinfo+0x460/0xea0 [<ffffffff80539d54>] seq_read_iter+0xfc/0x4f8 [<ffffffff804fcc10>] new_sync_read+0x110/0x1b8 [<ffffffff804ff57c>] vfs_read+0x1b4/0x1d0 [<ffffffff804ffb18>] ksys_read+0xd0/0x110 [<ffffffff8021c090>] syscall_common+0x34/0x58 We can see the following call trace: show_cpuinfo() cpu_has_fpu current_cpu_data smp_processor_id() $ addr2line -f -e vmlinux 0xffffffff802209c8 show_cpuinfo arch/mips/kernel/proc.c:188 $ head -188 arch/mips/kernel/proc.c | tail -1 if (cpu_has_fpu) arch/mips/include/asm/cpu-features.h # define cpu_has_fpu (current_cpu_data.options & MIPS_CPU_FPU) arch/mips/include/asm/cpu-info.h #define current_cpu_data cpu_data[smp_processor_id()] Based on the above analysis, fix the issue by using raw_cpu_has_fpu which calls raw_smp_processor_id() in show_cpuinfo(). Fixes: 626bfa037299 ("MIPS: kernel: proc: add CPU option reporting") Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2021-11-25mdio: aspeed: Fix "Link is Down" issueDylan Hung1-0/+7
The issue happened randomly in runtime. The message "Link is Down" is popped but soon it recovered to "Link is Up". The "Link is Down" results from the incorrect read data for reading the PHY register via MDIO bus. The correct sequence for reading the data shall be: 1. fire the command 2. wait for command done (this step was missing) 3. wait for data idle 4. read data from data register Cc: stable@vger.kernel.org Fixes: f160e99462c6 ("net: phy: Add mdio-aspeed") Reviewed-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Dylan Hung <dylan_hung@aspeedtech.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://lore.kernel.org/r/20211125024432.15809-1-dylan_hung@aspeedtech.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25igb: fix netpoll exit with trafficJesse Brandeburg1-1/+1
Oleksandr brought a bug report where netpoll causes trace messages in the log on igb. Danielle brought this back up as still occurring, so we'll try again. [22038.710800] ------------[ cut here ]------------ [22038.710801] igb_poll+0x0/0x1440 [igb] exceeded budget in poll [22038.710802] WARNING: CPU: 12 PID: 40362 at net/core/netpoll.c:155 netpoll_poll_dev+0x18a/0x1a0 As Alex suggested, change the driver to return work_done at the exit of napi_poll, which should be safe to do in this driver because it is not polling multiple queues in this single napi context (multiple queues attached to one MSI-X vector). Several other drivers contain the same simple sequence, so I hope this will not create new problems. Fixes: 16eb8815c235 ("igb: Refactor clean_rx_irq to reduce overhead and improve performance") Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name> Reported-by: Danielle Ratson <danieller@nvidia.com> Suggested-by: Alexander Duyck <alexander.duyck@gmail.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name> Tested-by: Danielle Ratson <danieller@nvidia.com> Link: https://lore.kernel.org/r/20211123204000.1597971-1-jesse.brandeburg@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-25xen: make HYPERVISOR_set_debugreg() always_inlineJuergen Gross1-1/+1
HYPERVISOR_set_debugreg() is being called from noinstr code, so it should be attributed "always_inline". Fixes: 7361fac0465ba96ec8f ("x86/xen: Make set_debugreg() noinstr") Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> Link: https://lore.kernel.org/r/20211125092056.24758-3-jgross@suse.com Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
generated by cgit v1.2.3 (git 2.39.0) at 2024-11-17 22:28:55 +0300