1. 06 Sep, 2020 2 commits
  2. 05 Sep, 2020 25 commits
    • Linus Torvalds's avatar
      Merge tags 'auxdisplay-for-linus-v5.9-rc4', 'clang-format-for-linus-v5.9-rc4'... · dd9fb9bb
      Linus Torvalds authored
      Merge tags 'auxdisplay-for-linus-v5.9-rc4', 'clang-format-for-linus-v5.9-rc4' and 'compiler-attributes-for-linus-v5.9-rc4' of git://github.com/ojeda/linux
      
      Pull misc fixes from Miguel Ojeda:
       "A trivial patch for auxdisplay:
      
         - Replace HTTP links with HTTPS ones (Alexander A. Klimov)
      
        The usual clang-format trivial update:
      
         - Update with the latest for_each macro list (Miguel Ojeda)
      
        And Luc requested me to pick a sparse fix on my queue, so here it goes
        along with other two trivial Compiler Attributes ones (also from Luc).
      
         - sparse: use static inline for __chk_{user,io}_ptr() (Luc Van
           Oostenryck)
      
         - Compiler Attributes: fix comment concerning GCC 4.6 (Luc Van
           Oostenryck)
      
         - Compiler Attributes: remove comment about sparse not supporting
           __has_attribute (Luc Van Oostenryck)"
      
      * tag 'auxdisplay-for-linus-v5.9-rc4' of git://github.com/ojeda/linux:
        auxdisplay: Replace HTTP links with HTTPS ones
      
      * tag 'clang-format-for-linus-v5.9-rc4' of git://github.com/ojeda/linux:
        clang-format: Update with the latest for_each macro list
      
      * tag 'compiler-attributes-for-linus-v5.9-rc4' of git://github.com/ojeda/linux:
        sparse: use static inline for __chk_{user,io}_ptr()
        Compiler Attributes: fix comment concerning GCC 4.6
        Compiler Attributes: remove comment about sparse not supporting __has_attribute
      dd9fb9bb
    • Linus Torvalds's avatar
      Merge tag 'arc-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc · 70187f77
      Linus Torvalds authored
      Pull ARC fixes from Vineet Gupta:
      
       - HSDK-4xd Dev system: perf driver updates for sampling interrupt
      
       - HSDK* Dev System: Ethernet broken [Evgeniy Didin]
      
       - HIGHMEM broken (2 memory banks) [Mike Rapoport]
      
       - show_regs() rewrite once and for all
      
       - Other minor fixes
      
      * tag 'arc-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
        ARC: [plat-hsdk]: Switch ethernet phy-mode to rgmii-id
        arc: fix memory initialization for systems with two memory banks
        irqchip/eznps: Fix build error for !ARC700 builds
        ARC: show_regs: fix r12 printing and simplify
        ARC: HSDK: wireup perf irq
        ARC: perf: don't bail setup if pct irq missing in device-tree
        ARC: pgalloc.h: delete a duplicated word + other fixes
      70187f77
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · 7514c036
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton:
       "19 patches.
      
        Subsystems affected by this patch series: MAINTAINERS, ipc, fork,
        checkpatch, lib, and mm (memcg, slub, pagemap, madvise, migration,
        hugetlb)"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        include/linux/log2.h: add missing () around n in roundup_pow_of_two()
        mm/khugepaged.c: fix khugepaged's request size in collapse_file
        mm/hugetlb: fix a race between hugetlb sysctl handlers
        mm/hugetlb: try preferred node first when alloc gigantic page from cma
        mm/migrate: preserve soft dirty in remove_migration_pte()
        mm/migrate: remove unnecessary is_zone_device_page() check
        mm/rmap: fixup copying of soft dirty and uffd ptes
        mm/migrate: fixup setting UFFD_WP flag
        mm: madvise: fix vma user-after-free
        checkpatch: fix the usage of capture group ( ... )
        fork: adjust sysctl_max_threads definition to match prototype
        ipc: adjust proc_ipc_sem_dointvec definition to match prototype
        mm: track page table modifications in __apply_to_page_range()
        MAINTAINERS: IA64: mark Status as Odd Fixes only
        MAINTAINERS: add LLVM maintainers
        MAINTAINERS: update Cavium/Marvell entries
        mm: slub: fix conversion of freelist_corrupted()
        mm: memcg: fix memcg reclaim soft lockup
        memcg: fix use-after-free in uncharge_batch
      7514c036
    • Jason Gunthorpe's avatar
      include/linux/log2.h: add missing () around n in roundup_pow_of_two() · 428fc0af
      Jason Gunthorpe authored
      Otherwise gcc generates warnings if the expression is complicated.
      
      Fixes: 312a0c17 ("[PATCH] LOG2: Alter roundup_pow_of_two() so that it can use a ilog2() on a constant")
      Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Link: https://lkml.kernel.org/r/0-v1-8a2697e3c003+41165-log_brackets_jgg@nvidia.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      428fc0af
    • David Howells's avatar
      mm/khugepaged.c: fix khugepaged's request size in collapse_file · e5a59d30
      David Howells authored
      collapse_file() in khugepaged passes PAGE_SIZE as the number of pages to
      be read to page_cache_sync_readahead().  The intent was probably to read
      a single page.  Fix it to use the number of pages to the end of the
      window instead.
      
      Fixes: 99cb0dbd ("mm,thp: add read-only THP support for (non-shmem) FS")
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
      Acked-by: default avatarSong Liu <songliubraving@fb.com>
      Acked-by: default avatarYang Shi <shy828301@gmail.com>
      Acked-by: default avatarPankaj Gupta <pankaj.gupta.linux@gmail.com>
      Cc: Eric Biggers <ebiggers@google.com>
      Link: https://lkml.kernel.org/r/20200903140844.14194-2-willy@infradead.orgSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e5a59d30
    • Muchun Song's avatar
      mm/hugetlb: fix a race between hugetlb sysctl handlers · 17743798
      Muchun Song authored
      There is a race between the assignment of `table->data` and write value
      to the pointer of `table->data` in the __do_proc_doulongvec_minmax() on
      the other thread.
      
        CPU0:                                 CPU1:
                                              proc_sys_write
        hugetlb_sysctl_handler                  proc_sys_call_handler
        hugetlb_sysctl_handler_common             hugetlb_sysctl_handler
          table->data = &tmp;                       hugetlb_sysctl_handler_common
                                                      table->data = &tmp;
            proc_doulongvec_minmax
              do_proc_doulongvec_minmax           sysctl_head_finish
                __do_proc_doulongvec_minmax         unuse_table
                  i = table->data;
                  *i = val;  // corrupt CPU1's stack
      
      Fix this by duplicating the `table`, and only update the duplicate of
      it.  And introduce a helper of proc_hugetlb_doulongvec_minmax() to
      simplify the code.
      
      The following oops was seen:
      
          BUG: kernel NULL pointer dereference, address: 0000000000000000
          #PF: supervisor instruction fetch in kernel mode
          #PF: error_code(0x0010) - not-present page
          Code: Bad RIP value.
          ...
          Call Trace:
           ? set_max_huge_pages+0x3da/0x4f0
           ? alloc_pool_huge_page+0x150/0x150
           ? proc_doulongvec_minmax+0x46/0x60
           ? hugetlb_sysctl_handler_common+0x1c7/0x200
           ? nr_hugepages_store+0x20/0x20
           ? copy_fd_bitmaps+0x170/0x170
           ? hugetlb_sysctl_handler+0x1e/0x20
           ? proc_sys_call_handler+0x2f1/0x300
           ? unregister_sysctl_table+0xb0/0xb0
           ? __fd_install+0x78/0x100
           ? proc_sys_write+0x14/0x20
           ? __vfs_write+0x4d/0x90
           ? vfs_write+0xef/0x240
           ? ksys_write+0xc0/0x160
           ? __ia32_sys_read+0x50/0x50
           ? __close_fd+0x129/0x150
           ? __x64_sys_write+0x43/0x50
           ? do_syscall_64+0x6c/0x200
           ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Fixes: e5ff2159 ("hugetlb: multiple hstates for multiple page sizes")
      Signed-off-by: default avatarMuchun Song <songmuchun@bytedance.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Cc: Andi Kleen <ak@linux.intel.com>
      Link: http://lkml.kernel.org/r/20200828031146.43035-1-songmuchun@bytedance.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      17743798
    • Li Xinhai's avatar
      mm/hugetlb: try preferred node first when alloc gigantic page from cma · 953f064a
      Li Xinhai authored
      Since commit cf11e85f ("mm: hugetlb: optionally allocate gigantic
      hugepages using cma"), the gigantic page would be allocated from node
      which is not the preferred node, although there are pages available from
      that node.  The reason is that the nid parameter has been ignored in
      alloc_gigantic_page().
      
      Besides, the __GFP_THISNODE also need be checked if user required to
      alloc only from the preferred node.
      
      After this patch, the preferred node is tried first before other allowed
      nodes, and don't try to allocate from other nodes if __GFP_THISNODE is
      specified.  If user don't specify the preferred node, the current node
      will be used as preferred node, which makes sure consistent behavior of
      allocating gigantic and non-gigantic hugetlb page.
      
      Fixes: cf11e85f ("mm: hugetlb: optionally allocate gigantic hugepages using cma")
      Signed-off-by: default avatarLi Xinhai <lixinhai.lxh@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Cc: Roman Gushchin <guro@fb.com>
      Link: https://lkml.kernel.org/r/20200902025016.697260-1-lixinhai.lxh@gmail.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      953f064a
    • Ralph Campbell's avatar
      mm/migrate: preserve soft dirty in remove_migration_pte() · 3d321bf8
      Ralph Campbell authored
      The code to remove a migration PTE and replace it with a device private
      PTE was not copying the soft dirty bit from the migration entry.  This
      could lead to page contents not being marked dirty when faulting the page
      back from device private memory.
      Signed-off-by: default avatarRalph Campbell <rcampbell@nvidia.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Cc: Jerome Glisse <jglisse@redhat.com>
      Cc: Alistair Popple <apopple@nvidia.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Jason Gunthorpe <jgg@nvidia.com>
      Cc: Bharata B Rao <bharata@linux.ibm.com>
      Link: https://lkml.kernel.org/r/20200831212222.22409-3-rcampbell@nvidia.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3d321bf8
    • Ralph Campbell's avatar
      mm/migrate: remove unnecessary is_zone_device_page() check · 6128763f
      Ralph Campbell authored
      Patch series "mm/migrate: preserve soft dirty in remove_migration_pte()".
      
      I happened to notice this from code inspection after seeing Alistair
      Popple's patch ("mm/rmap: Fixup copying of soft dirty and uffd ptes").
      
      This patch (of 2):
      
      The check for is_zone_device_page() and is_device_private_page() is
      unnecessary since the latter is sufficient to determine if the page is a
      device private page.  Simplify the code for easier reading.
      Signed-off-by: default avatarRalph Campbell <rcampbell@nvidia.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Cc: Jerome Glisse <jglisse@redhat.com>
      Cc: Alistair Popple <apopple@nvidia.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Jason Gunthorpe <jgg@nvidia.com>
      Cc: Bharata B Rao <bharata@linux.ibm.com>
      Link: https://lkml.kernel.org/r/20200831212222.22409-1-rcampbell@nvidia.com
      Link: https://lkml.kernel.org/r/20200831212222.22409-2-rcampbell@nvidia.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6128763f
    • Alistair Popple's avatar
      mm/rmap: fixup copying of soft dirty and uffd ptes · ad7df764
      Alistair Popple authored
      During memory migration a pte is temporarily replaced with a migration
      swap pte.  Some pte bits from the existing mapping such as the soft-dirty
      and uffd write-protect bits are preserved by copying these to the
      temporary migration swap pte.
      
      However these bits are not stored at the same location for swap and
      non-swap ptes.  Therefore testing these bits requires using the
      appropriate helper function for the given pte type.
      
      Unfortunately several code locations were found where the wrong helper
      function is being used to test soft_dirty and uffd_wp bits which leads to
      them getting incorrectly set or cleared during page-migration.
      
      Fix these by using the correct tests based on pte type.
      
      Fixes: a5430dda ("mm/migrate: support un-addressable ZONE_DEVICE page in migration")
      Fixes: 8c3328f1 ("mm/migrate: migrate_vma() unmap page from vma while collecting pages")
      Fixes: f45ec5ff ("userfaultfd: wp: support swap and page migration")
      Signed-off-by: default avatarAlistair Popple <alistair@popple.id.au>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarPeter Xu <peterx@redhat.com>
      Cc: Jérôme Glisse <jglisse@redhat.com>
      Cc: John Hubbard <jhubbard@nvidia.com>
      Cc: Ralph Campbell <rcampbell@nvidia.com>
      Cc: Alistair Popple <alistair@popple.id.au>
      Cc: <stable@vger.kernel.org>
      Link: https://lkml.kernel.org/r/20200825064232.10023-2-alistair@popple.id.auSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ad7df764
    • Alistair Popple's avatar
      mm/migrate: fixup setting UFFD_WP flag · ebdf8321
      Alistair Popple authored
      Commit f45ec5ff ("userfaultfd: wp: support swap and page migration")
      introduced support for tracking the uffd wp bit during page migration.
      However the non-swap PTE variant was used to set the flag for zone device
      private pages which are a type of swap page.
      
      This leads to corruption of the swap offset if the original PTE has the
      uffd_wp flag set.
      
      Fixes: f45ec5ff ("userfaultfd: wp: support swap and page migration")
      Signed-off-by: default avatarAlistair Popple <alistair@popple.id.au>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarPeter Xu <peterx@redhat.com>
      Cc: Jérôme Glisse <jglisse@redhat.com>
      Cc: John Hubbard <jhubbard@nvidia.com>
      Cc: Ralph Campbell <rcampbell@nvidia.com>
      Link: https://lkml.kernel.org/r/20200825064232.10023-1-alistair@popple.id.auSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ebdf8321
    • Yang Shi's avatar
      mm: madvise: fix vma user-after-free · 7867fd7c
      Yang Shi authored
      The syzbot reported the below use-after-free:
      
        BUG: KASAN: use-after-free in madvise_willneed mm/madvise.c:293 [inline]
        BUG: KASAN: use-after-free in madvise_vma mm/madvise.c:942 [inline]
        BUG: KASAN: use-after-free in do_madvise.part.0+0x1c8b/0x1cf0 mm/madvise.c:1145
        Read of size 8 at addr ffff8880a6163eb0 by task syz-executor.0/9996
      
        CPU: 0 PID: 9996 Comm: syz-executor.0 Not tainted 5.9.0-rc1-syzkaller #0
        Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
        Call Trace:
          __dump_stack lib/dump_stack.c:77 [inline]
          dump_stack+0x18f/0x20d lib/dump_stack.c:118
          print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383
          __kasan_report mm/kasan/report.c:513 [inline]
          kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
          madvise_willneed mm/madvise.c:293 [inline]
          madvise_vma mm/madvise.c:942 [inline]
          do_madvise.part.0+0x1c8b/0x1cf0 mm/madvise.c:1145
          do_madvise mm/madvise.c:1169 [inline]
          __do_sys_madvise mm/madvise.c:1171 [inline]
          __se_sys_madvise mm/madvise.c:1169 [inline]
          __x64_sys_madvise+0xd9/0x110 mm/madvise.c:1169
          do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
          entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
        Allocated by task 9992:
          kmem_cache_alloc+0x138/0x3a0 mm/slab.c:3482
          vm_area_alloc+0x1c/0x110 kernel/fork.c:347
          mmap_region+0x8e5/0x1780 mm/mmap.c:1743
          do_mmap+0xcf9/0x11d0 mm/mmap.c:1545
          vm_mmap_pgoff+0x195/0x200 mm/util.c:506
          ksys_mmap_pgoff+0x43a/0x560 mm/mmap.c:1596
          do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
          entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
        Freed by task 9992:
          kmem_cache_free.part.0+0x67/0x1f0 mm/slab.c:3693
          remove_vma+0x132/0x170 mm/mmap.c:184
          remove_vma_list mm/mmap.c:2613 [inline]
          __do_munmap+0x743/0x1170 mm/mmap.c:2869
          do_munmap mm/mmap.c:2877 [inline]
          mmap_region+0x257/0x1780 mm/mmap.c:1716
          do_mmap+0xcf9/0x11d0 mm/mmap.c:1545
          vm_mmap_pgoff+0x195/0x200 mm/util.c:506
          ksys_mmap_pgoff+0x43a/0x560 mm/mmap.c:1596
          do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
          entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      It is because vma is accessed after releasing mmap_lock, but someone
      else acquired the mmap_lock and the vma is gone.
      
      Releasing mmap_lock after accessing vma should fix the problem.
      
      Fixes: 692fe624 ("mm: Handle MADV_WILLNEED through vfs_fadvise()")
      Reported-by: syzbot+b90df26038d1d5d85c97@syzkaller.appspotmail.com
      Signed-off-by: default avatarYang Shi <shy828301@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Cc: <stable@vger.kernel.org>	[5.4+]
      Link: https://lkml.kernel.org/r/20200816141204.162624-1-shy828301@gmail.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7867fd7c
    • Mrinal Pandey's avatar
      checkpatch: fix the usage of capture group ( ... ) · 13e45417
      Mrinal Pandey authored
      The usage of "capture group (...)" in the immediate condition after `&&`
      results in `$1` being uninitialized.  This issues a warning "Use of
      uninitialized value $1 in regexp compilation at ./scripts/checkpatch.pl
      line 2638".
      
      I noticed this bug while running checkpatch on the set of commits from
      v5.7 to v5.8-rc1 of the kernel on the commits with a diff content in
      their commit message.
      
      This bug was introduced in the script by commit e518e9a5
      ("checkpatch: emit an error when there's a diff in a changelog").  It
      has been in the script since then.
      
      The author intended to store the match made by capture group in variable
      `$1`.  This should have contained the name of the file as `[\w/]+`
      matched.  However, this couldn't be accomplished due to usage of capture
      group and `$1` in the same regular expression.
      
      Fix this by placing the capture group in the condition before `&&`.
      Thus, `$1` can be initialized to the text that capture group matches
      thereby setting it to the desired and required value.
      
      Fixes: e518e9a5 ("checkpatch: emit an error when there's a diff in a changelog")
      Signed-off-by: default avatarMrinal Pandey <mrinalmni@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Tested-by: default avatarLukas Bulwahn <lukas.bulwahn@gmail.com>
      Reviewed-by: default avatarLukas Bulwahn <lukas.bulwahn@gmail.com>
      Cc: Joe Perches <joe@perches.com>
      Link: https://lkml.kernel.org/r/20200714032352.f476hanaj2dlmiot@mrinalpandeySigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      13e45417
    • Tobias Klauser's avatar
      fork: adjust sysctl_max_threads definition to match prototype · b0daa2c7
      Tobias Klauser authored
      Commit 32927393 ("sysctl: pass kernel pointers to ->proc_handler")
      changed ctl_table.proc_handler to take a kernel pointer.  Adjust the
      definition of sysctl_max_threads to match its prototype in
      linux/sysctl.h which fixes the following sparse error/warning:
      
        kernel/fork.c:3050:47: warning: incorrect type in argument 3 (different address spaces)
        kernel/fork.c:3050:47:    expected void *
        kernel/fork.c:3050:47:    got void [noderef] __user *buffer
        kernel/fork.c:3036:5: error: symbol 'sysctl_max_threads' redeclared with different type (incompatible argument 3 (different address spaces)):
        kernel/fork.c:3036:5:    int extern [addressable] [signed] [toplevel] sysctl_max_threads( ... )
        kernel/fork.c: note: in included file (through include/linux/key.h, include/linux/cred.h, include/linux/sched/signal.h, include/linux/sched/cputime.h):
        include/linux/sysctl.h:242:5: note: previously declared as:
        include/linux/sysctl.h:242:5:    int extern [addressable] [signed] [toplevel] sysctl_max_threads( ... )
      
      Fixes: 32927393 ("sysctl: pass kernel pointers to ->proc_handler")
      Signed-off-by: default avatarTobias Klauser <tklauser@distanz.ch>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Link: https://lkml.kernel.org/r/20200825093647.24263-1-tklauser@distanz.chSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b0daa2c7
    • Tobias Klauser's avatar
      ipc: adjust proc_ipc_sem_dointvec definition to match prototype · fff1662c
      Tobias Klauser authored
      Commit 32927393 ("sysctl: pass kernel pointers to ->proc_handler")
      changed ctl_table.proc_handler to take a kernel pointer.  Adjust the
      signature of proc_ipc_sem_dointvec to match ctl_table.proc_handler which
      fixes the following sparse error/warning:
      
        ipc/ipc_sysctl.c:94:47: warning: incorrect type in argument 3 (different address spaces)
        ipc/ipc_sysctl.c:94:47:    expected void *buffer
        ipc/ipc_sysctl.c:94:47:    got void [noderef] __user *buffer
        ipc/ipc_sysctl.c:194:35: warning: incorrect type in initializer (incompatible argument 3 (different address spaces))
        ipc/ipc_sysctl.c:194:35:    expected int ( [usertype] *proc_handler )( ... )
        ipc/ipc_sysctl.c:194:35:    got int ( * )( ... )
      
      Fixes: 32927393 ("sysctl: pass kernel pointers to ->proc_handler")
      Signed-off-by: default avatarTobias Klauser <tklauser@distanz.ch>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Link: https://lkml.kernel.org/r/20200825105846.5193-1-tklauser@distanz.chSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fff1662c
    • Joerg Roedel's avatar
      mm: track page table modifications in __apply_to_page_range() · e80d3909
      Joerg Roedel authored
      __apply_to_page_range() is also used to change and/or allocate
      page-table pages in the vmalloc area of the address space.  Make sure
      these changes get synchronized to other page-tables in the system by
      calling arch_sync_kernel_mappings() when necessary.
      
      The impact appears limited to x86-32, where apply_to_page_range may miss
      updating the PMD.  That leads to explosions in drivers like
      
        BUG: unable to handle page fault for address: fe036000
        #PF: supervisor write access in kernel mode
        #PF: error_code(0x0002) - not-present page
        *pde = 00000000
        Oops: 0002 [#1] SMP
        CPU: 3 PID: 1300 Comm: gem_concurrent_ Not tainted 5.9.0-rc1+ #16
        Hardware name:  /NUC6i3SYB, BIOS SYSKLi35.86A.0024.2015.1027.2142 10/27/2015
        EIP: __execlists_context_alloc+0x132/0x2d0 [i915]
        Code: 31 d2 89 f0 e8 2f 55 02 00 89 45 e8 3d 00 f0 ff ff 0f 87 11 01 00 00 8b 4d e8 03 4b 30 b8 5a 5a 5a 5a ba 01 00 00 00 8d 79 04 <c7> 01 5a 5a 5a 5a c7 81 fc 0f 00 00 5a 5a 5a 5a 83 e7 fc 29 f9 81
        EAX: 5a5a5a5a EBX: f60ca000 ECX: fe036000 EDX: 00000001
        ESI: f43b7340 EDI: fe036004 EBP: f6389cb8 ESP: f6389c9c
        DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010286
        CR0: 80050033 CR2: fe036000 CR3: 2d361000 CR4: 001506d0
        DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
        DR6: fffe0ff0 DR7: 00000400
        Call Trace:
          execlists_context_alloc+0x10/0x20 [i915]
          intel_context_alloc_state+0x3f/0x70 [i915]
          __intel_context_do_pin+0x117/0x170 [i915]
          i915_gem_do_execbuffer+0xcc7/0x2500 [i915]
          i915_gem_execbuffer2_ioctl+0xcd/0x1f0 [i915]
          drm_ioctl_kernel+0x8f/0xd0
          drm_ioctl+0x223/0x3d0
          __ia32_sys_ioctl+0x1ab/0x760
          __do_fast_syscall_32+0x3f/0x70
          do_fast_syscall_32+0x29/0x60
          do_SYSENTER_32+0x15/0x20
          entry_SYSENTER_32+0x9f/0xf2
        EIP: 0xb7f28559
        Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90 8d 76
        EAX: ffffffda EBX: 00000005 ECX: c0406469 EDX: bf95556c
        ESI: b7e68000 EDI: c0406469 EBP: 00000005 ESP: bf9554d8
        DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00000296
        Modules linked in: i915 x86_pkg_temp_thermal intel_powerclamp crc32_pclmul crc32c_intel intel_cstate intel_uncore intel_gtt drm_kms_helper intel_pch_thermal video button autofs4 i2c_i801 i2c_smbus fan
        CR2: 00000000fe036000
      
      It looks like kasan, xen and i915 are vulnerable.
      
      Actual impact is "on thinkpad X60 in 5.9-rc1, screen starts blinking
      after 30-or-so minutes, and machine is unusable"
      
      [sfr@canb.auug.org.au: ARCH_PAGE_TABLE_SYNC_MASK needs vmalloc.h]
        Link: https://lkml.kernel.org/r/20200825172508.16800a4f@canb.auug.org.au
      [chris@chris-wilson.co.uk: changelog addition]
      [pavel@ucw.cz: changelog addition]
      
      Fixes: 2ba3e694 ("mm/vmalloc: track which page-table levels were modified")
      Fixes: 86cf69f1 ("x86/mm/32: implement arch_sync_kernel_mappings()")
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      Signed-off-by: default avatarStephen Rothwell <sfr@canb.auug.org.au>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Tested-by: Chris Wilson <chris@chris-wilson.co.uk>	[x86-32]
      Tested-by: default avatarPavel Machek <pavel@ucw.cz>
      Acked-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Cc: <stable@vger.kernel.org>	[5.8+]
      Link: https://lkml.kernel.org/r/20200821123746.16904-1-joro@8bytes.orgSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e80d3909
    • Randy Dunlap's avatar
      MAINTAINERS: IA64: mark Status as Odd Fixes only · 9d90dd18
      Randy Dunlap authored
      IA64 isn't really being maintained, so mark it as Odd Fixes only.
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Acked-by: default avatarTony Luck <tony.luck@intel.com>
      Cc: Fenghua Yu <fenghua.yu@intel.com>
      Link: http://lkml.kernel.org/r/7e719139-450f-52c2-59a2-7964a34eda1f@infradead.orgSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      9d90dd18
    • Nick Desaulniers's avatar
      MAINTAINERS: add LLVM maintainers · b9644289
      Nick Desaulniers authored
      Nominate Nathan and myself to be point of contact for clang/LLVM related
      support, after a poll at the LLVM BoF at Linux Plumbers Conf 2020.
      
      While corporate sponsorship is beneficial, its important to not entrust
      the keys to the nukes with any one entity.  Should Nathan and I find
      ourselves at the same employer, I would gladly step down.
      Signed-off-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarSedat Dilek <sedat.dilek@gmail.com>
      Acked-by: default avatarNathan Chancellor <natechancellor@gmail.com>
      Acked-by: default avatarLukas Bulwahn <lukas.bulwahn@gmail.com>
      Acked-by: default avatarMiguel Ojeda <miguel.ojeda.sandonis@gmail.com>
      Acked-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      Link: https://lkml.kernel.org/r/20200825143540.2948637-1-ndesaulniers@google.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b9644289
    • Robert Richter's avatar
      MAINTAINERS: update Cavium/Marvell entries · f548a645
      Robert Richter authored
      I am leaving Marvell and already do not have access to my @marvell.com
      email address.  So switching over to my korg mail address or removing my
      address there another maintainer is already listed.  For the entries
      there no other maintainer is listed I will keep looking into patches for
      Cavium systems for a while until someone from Marvell takes it over.
      
      Since I might have limited access to hardware and also limited time I
      changed state to 'Odd Fixes' for those entries.
      Signed-off-by: default avatarRobert Richter <rric@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Ganapatrao Kulkarni <gkulkarni@marvell.com>
      Cc: Sunil Goutham <sgoutham@marvell.com>
      CC: Borislav Petkov <bp@alien8.de>
      Cc: Marc Zyngier <maz@kernel.org>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Wolfram Sang <wsa@kernel.org>,
      Link: https://lkml.kernel.org/r/20200824122050.31164-1-rric@kernel.orgSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f548a645
    • Eugeniu Rosca's avatar
      mm: slub: fix conversion of freelist_corrupted() · dc07a728
      Eugeniu Rosca authored
      Commit 52f23478 ("mm/slub.c: fix corrupted freechain in
      deactivate_slab()") suffered an update when picked up from LKML [1].
      
      Specifically, relocating 'freelist = NULL' into 'freelist_corrupted()'
      created a no-op statement.  Fix it by sticking to the behavior intended
      in the original patch [1].  In addition, make freelist_corrupted()
      immune to passing NULL instead of &freelist.
      
      The issue has been spotted via static analysis and code review.
      
      [1] https://lore.kernel.org/linux-mm/20200331031450.12182-1-dongli.zhang@oracle.com/
      
      Fixes: 52f23478 ("mm/slub.c: fix corrupted freechain in deactivate_slab()")
      Signed-off-by: default avatarEugeniu Rosca <erosca@de.adit-jv.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Dongli Zhang <dongli.zhang@oracle.com>
      Cc: Joe Jin <joe.jin@oracle.com>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: <stable@vger.kernel.org>
      Link: https://lkml.kernel.org/r/20200824130643.10291-1-erosca@de.adit-jv.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      dc07a728
    • Xunlei Pang's avatar
      mm: memcg: fix memcg reclaim soft lockup · e3336cab
      Xunlei Pang authored
      We've met softlockup with "CONFIG_PREEMPT_NONE=y", when the target memcg
      doesn't have any reclaimable memory.
      
      It can be easily reproduced as below:
      
        watchdog: BUG: soft lockup - CPU#0 stuck for 111s![memcg_test:2204]
        CPU: 0 PID: 2204 Comm: memcg_test Not tainted 5.9.0-rc2+ #12
        Call Trace:
          shrink_lruvec+0x49f/0x640
          shrink_node+0x2a6/0x6f0
          do_try_to_free_pages+0xe9/0x3e0
          try_to_free_mem_cgroup_pages+0xef/0x1f0
          try_charge+0x2c1/0x750
          mem_cgroup_charge+0xd7/0x240
          __add_to_page_cache_locked+0x2fd/0x370
          add_to_page_cache_lru+0x4a/0xc0
          pagecache_get_page+0x10b/0x2f0
          filemap_fault+0x661/0xad0
          ext4_filemap_fault+0x2c/0x40
          __do_fault+0x4d/0xf9
          handle_mm_fault+0x1080/0x1790
      
      It only happens on our 1-vcpu instances, because there's no chance for
      oom reaper to run to reclaim the to-be-killed process.
      
      Add a cond_resched() at the upper shrink_node_memcgs() to solve this
      issue, this will mean that we will get a scheduling point for each memcg
      in the reclaimed hierarchy without any dependency on the reclaimable
      memory in that memcg thus making it more predictable.
      Suggested-by: default avatarMichal Hocko <mhocko@suse.com>
      Signed-off-by: default avatarXunlei Pang <xlpang@linux.alibaba.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Acked-by: default avatarChris Down <chris@chrisdown.name>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Link: http://lkml.kernel.org/r/1598495549-67324-1-git-send-email-xlpang@linux.alibaba.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e3336cab
    • Michal Hocko's avatar
      memcg: fix use-after-free in uncharge_batch · f1796544
      Michal Hocko authored
      syzbot has reported an use-after-free in the uncharge_batch path
      
        BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:71 [inline]
        BUG: KASAN: use-after-free in atomic64_sub_return include/asm-generic/atomic-instrumented.h:970 [inline]
        BUG: KASAN: use-after-free in atomic_long_sub_return include/asm-generic/atomic-long.h:113 [inline]
        BUG: KASAN: use-after-free in page_counter_cancel mm/page_counter.c:54 [inline]
        BUG: KASAN: use-after-free in page_counter_uncharge+0x3d/0xc0 mm/page_counter.c:155
        Write of size 8 at addr ffff8880371c0148 by task syz-executor.0/9304
      
        CPU: 0 PID: 9304 Comm: syz-executor.0 Not tainted 5.8.0-syzkaller #0
        Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
        Call Trace:
          __dump_stack lib/dump_stack.c:77 [inline]
          dump_stack+0x1f0/0x31e lib/dump_stack.c:118
          print_address_description+0x66/0x620 mm/kasan/report.c:383
          __kasan_report mm/kasan/report.c:513 [inline]
          kasan_report+0x132/0x1d0 mm/kasan/report.c:530
          check_memory_region_inline mm/kasan/generic.c:183 [inline]
          check_memory_region+0x2b5/0x2f0 mm/kasan/generic.c:192
          instrument_atomic_write include/linux/instrumented.h:71 [inline]
          atomic64_sub_return include/asm-generic/atomic-instrumented.h:970 [inline]
          atomic_long_sub_return include/asm-generic/atomic-long.h:113 [inline]
          page_counter_cancel mm/page_counter.c:54 [inline]
          page_counter_uncharge+0x3d/0xc0 mm/page_counter.c:155
          uncharge_batch+0x6c/0x350 mm/memcontrol.c:6764
          uncharge_page+0x115/0x430 mm/memcontrol.c:6796
          uncharge_list mm/memcontrol.c:6835 [inline]
          mem_cgroup_uncharge_list+0x70/0xe0 mm/memcontrol.c:6877
          release_pages+0x13a2/0x1550 mm/swap.c:911
          tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
          tlb_flush_mmu_free mm/mmu_gather.c:242 [inline]
          tlb_flush_mmu+0x780/0x910 mm/mmu_gather.c:249
          tlb_finish_mmu+0xcb/0x200 mm/mmu_gather.c:328
          exit_mmap+0x296/0x550 mm/mmap.c:3185
          __mmput+0x113/0x370 kernel/fork.c:1076
          exit_mm+0x4cd/0x550 kernel/exit.c:483
          do_exit+0x576/0x1f20 kernel/exit.c:793
          do_group_exit+0x161/0x2d0 kernel/exit.c:903
          get_signal+0x139b/0x1d30 kernel/signal.c:2743
          arch_do_signal+0x33/0x610 arch/x86/kernel/signal.c:811
          exit_to_user_mode_loop kernel/entry/common.c:135 [inline]
          exit_to_user_mode_prepare+0x8d/0x1b0 kernel/entry/common.c:166
          syscall_exit_to_user_mode+0x5e/0x1a0 kernel/entry/common.c:241
          entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Commit 1a3e1f40 ("mm: memcontrol: decouple reference counting from
      page accounting") reworked the memcg lifetime to be bound the the struct
      page rather than charges.  It also removed the css_put_many from
      uncharge_batch and that is causing the above splat.
      
      uncharge_batch() is supposed to uncharge accumulated charges for all
      pages freed from the same memcg.  The queuing is done by uncharge_page
      which however drops the memcg reference after it adds charges to the
      batch.  If the current page happens to be the last one holding the
      reference for its memcg then the memcg is OK to go and the next page to
      be freed will trigger batched uncharge which needs to access the memcg
      which is gone already.
      
      Fix the issue by taking a reference for the memcg in the current batch.
      
      Fixes: 1a3e1f40 ("mm: memcontrol: decouple reference counting from page accounting")
      Reported-by: syzbot+b305848212deec86eabe@syzkaller.appspotmail.com
      Reported-by: syzbot+b5ea6fb6f139c8b9482b@syzkaller.appspotmail.com
      Signed-off-by: default avatarMichal Hocko <mhocko@suse.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarShakeel Butt <shakeelb@google.com>
      Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Cc: Roman Gushchin <guro@fb.com>
      Cc: Hugh Dickins <hughd@google.com>
      Link: https://lkml.kernel.org/r/20200820090341.GC5033@dhcp22.suse.czSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f1796544
    • Linus Torvalds's avatar
      Merge tag 'xfs-5.9-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 9322c47b
      Linus Torvalds authored
      Pull xfs fix from Darrick Wong:
       "Fix a broken metadata verifier that would incorrectly validate attr
        fork extents of a realtime file against the realtime volume"
      
      * tag 'xfs-5.9-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt files
      9322c47b
    • Mikulas Patocka's avatar
      xfs: don't update mtime on COW faults · b17164e2
      Mikulas Patocka authored
      When running in a dax mode, if the user maps a page with MAP_PRIVATE and
      PROT_WRITE, the xfs filesystem would incorrectly update ctime and mtime
      when the user hits a COW fault.
      
      This breaks building of the Linux kernel.  How to reproduce:
      
       1. extract the Linux kernel tree on dax-mounted xfs filesystem
       2. run make clean
       3. run make -j12
       4. run make -j12
      
      at step 4, make would incorrectly rebuild the whole kernel (although it
      was already built in step 3).
      
      The reason for the breakage is that almost all object files depend on
      objtool.  When we run objtool, it takes COW page fault on its .data
      section, and these faults will incorrectly update the timestamp of the
      objtool binary.  The updated timestamp causes make to rebuild the whole
      tree.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b17164e2
    • Mikulas Patocka's avatar
      ext2: don't update mtime on COW faults · 1ef6ea0e
      Mikulas Patocka authored
      When running in a dax mode, if the user maps a page with MAP_PRIVATE and
      PROT_WRITE, the ext2 filesystem would incorrectly update ctime and mtime
      when the user hits a COW fault.
      
      This breaks building of the Linux kernel.  How to reproduce:
      
       1. extract the Linux kernel tree on dax-mounted ext2 filesystem
       2. run make clean
       3. run make -j12
       4. run make -j12
      
      at step 4, make would incorrectly rebuild the whole kernel (although it
      was already built in step 3).
      
      The reason for the breakage is that almost all object files depend on
      objtool.  When we run objtool, it takes COW page fault on its .data
      section, and these faults will incorrectly update the timestamp of the
      objtool binary.  The updated timestamp causes make to rebuild the whole
      tree.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1ef6ea0e
  3. 04 Sep, 2020 13 commits
    • Linus Torvalds's avatar
      Merge tag 's390-5.9-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · c70672d8
      Linus Torvalds authored
      Pull s390 fixes from Vasily Gorbik:
      
       - Fix GENERIC_LOCKBREAK dependency on PREEMPTION in Kconfig broken
         because of a typo
      
       - Update defconfigs
      
      * tag 's390-5.9-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390: update defconfigs
        s390: fix GENERIC_LOCKBREAK dependency typo in Kconfig
      c70672d8
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 09274aed
      Linus Torvalds authored
      Pull arm64 fixes from Catalin Marinas:
      
       - Fix the loading of modules built with binutils-2.35. This version
         produces writable and executable .text.ftrace_trampoline section
         which is rejected by the kernel.
      
       - Remove the exporting of cpu_logical_map() as the Tegra driver has now
         been fixed and no longer uses this function.
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64/module: set trampoline section flags regardless of CONFIG_DYNAMIC_FTRACE
        arm64: Remove exporting cpu_logical_map symbol
      09274aed
    • Linus Torvalds's avatar
      Merge tag 'mips_fixes_5.9_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux · 16bf121b
      Linus Torvalds authored
      Pull MIPS fixes from Thomas Bogendoerfer:
       "A few MIPS fixes:
      
         - fallthrough fallout fix
      
         - BMIPS fixes
      
         - MSA fix to avoid leaking MSA register contents
      
         - Loongson perf and cpu feature fix
      
         - SNI interrupt fix"
      
      * tag 'mips_fixes_5.9_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
        MIPS: SNI: Fix SCSI interrupt
        MIPS: add missing MSACSR and upper MSA initialization
        MIPS: perf: Fix wrong check condition of Loongson event IDs
        mips/oprofile: Fix fallthrough placement
        MIPS: Loongson64: Remove unnecessary inclusion of boot_param.h
        MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores
        MIPS: mm: BMIPS5000 has inclusive physical caches
        MIPS: Loongson64: Do not override watch and ejtag feature
      16bf121b
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v5.9-2' of... · 41bef91c
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v5.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - fix documents
      
       - fix warning in 'make localmodconfig'
      
      * tag 'kbuild-fixes-v5.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kconfig: remove redundant assignment prompt = prompt
        kbuild: Documentation: clean up makefiles.rst
        kconfig: streamline_config.pl: check defined(ENV variable) before using it
        Documentation/llvm: Improve formatting of commands, variables, and arguments
      41bef91c
    • Linus Torvalds's avatar
      Merge tag 'pm-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · f162626a
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These fix reference counting in the operating performance points (OPP)
        framework and address a few intel_pstate driver issues, mostly related
        to switching driver operation modes and similar with hardware-managed
        P-states (HWP) enabled.
      
        Specifics:
      
         - Fix reference counting of operating performance points (OPP) tables
           (Viresh Kumar).
      
         - Address intel_pstate driver interface issues, mostly related to
           switching operation modes and handling CPU offline and online and
           system-wide suspend/resume with hardware-managed P-states (HWP)
           enabled (Rafael Wysocki).
      
         - Fix the maximum frequency computation in the intel_pstate driver
           with turbo P-states disabled by the platform firmware and HWP
           enabled (Francisco Jerez)"
      
      * tag 'pm-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo disabled
        cpufreq: intel_pstate: Free memory only when turning off
        cpufreq: intel_pstate: Add ->offline and ->online callbacks
        cpufreq: intel_pstate: Tweak the EPP sysfs interface
        cpufreq: intel_pstate: Update cached EPP in the active mode
        cpufreq: intel_pstate: Refuse to turn off with HWP enabled
        opp: Don't drop reference for an OPP table that was never parsed
      f162626a
    • Linus Torvalds's avatar
      Merge tag 'libata-5.9-2020-09-04' of git://git.kernel.dk/linux-block · d824e080
      Linus Torvalds authored
      Pull libata fixes from Jens Axboe:
      
       - improve Sandisks ATA_HORKAGE on NCQ (Tejun)
      
       - link printk cleanup (Xu)
      
      * tag 'libata-5.9-2020-09-04' of git://git.kernel.dk/linux-block:
        libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks
        ata: ahci: use ata_link_info() instead of ata_link_printk()
      d824e080
    • Linus Torvalds's avatar
      Merge tag 'block-5.9-2020-09-04' of git://git.kernel.dk/linux-block · 8075fc3b
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A bit larger than usual this week, mostly due to the NVMe fixes
        arriving late for -rc3 and hence didn't make last weeks pull request.
      
         - NVMe:
              - instance leak and io boundary fixes from Keith
              - fc locking fix from Christophe
              - various tcp/rdma reset during traffic fixes from Sagi
              - pci use-after-free fix from Tong
              - tcp target null deref fix from Ziye
      
         - Locking fix for partition removal (Christoph)
      
         - Ensure bdi->io_pages is always set (me)
      
         - Fixup for hd struct reference (Ming)
      
         - Fix for zero length bvecs (Ming)
      
         - Two small blk-iocost fixes (Tejun)"
      
      * tag 'block-5.9-2020-09-04' of git://git.kernel.dk/linux-block:
        block: allow for_each_bvec to support zero len bvec
        blk-stat: make q->stats->lock irqsafe
        blk-iocost: ioc_pd_free() shouldn't assume irq disabled
        block: fix locking in bdev_del_partition
        block: release disk reference in hd_struct_free_work
        block: ensure bdi->io_pages is always initialized
        nvme-pci: cancel nvme device request before disabling
        nvme: only use power of two io boundaries
        nvme: fix controller instance leak
        nvmet-fc: Fix a missed _irqsave version of spin_lock in 'nvmet_fc_fod_op_done()'
        nvme: Fix NULL dereference for pci nvme controllers
        nvme-rdma: fix reset hang if controller died in the middle of a reset
        nvme-rdma: fix timeout handler
        nvme-rdma: serialize controller teardown sequences
        nvme-tcp: fix reset hang if controller died in the middle of a reset
        nvme-tcp: fix timeout handler
        nvme-tcp: serialize controller teardown sequences
        nvme: have nvme_wait_freeze_timeout return if it timed out
        nvme-fabrics: don't check state NVME_CTRL_NEW for request acceptance
        nvmet-tcp: Fix NULL dereference when a connect data comes in h2cdata pdu
      8075fc3b
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.9-2020-09-04' of git://git.kernel.dk/linux-block · d849ca48
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
      
       - EAGAIN with O_NONBLOCK retry fix
      
       - Two small fixes for registered files (Jiufei)
      
      * tag 'io_uring-5.9-2020-09-04' of git://git.kernel.dk/linux-block:
        io_uring: no read/write-retry on -EAGAIN error and O_NONBLOCK marked file
        io_uring: set table->files[i] to NULL when io_sqe_file_register failed
        io_uring: fix removing the wrong file in __io_sqe_files_update()
      d849ca48
    • Linus Torvalds's avatar
      Merge tag 'thermal-v5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux · 2fb54791
      Linus Torvalds authored
      Pull thermal fixes from Daniel Lezcano:
      
       - Fix bogus thermal shutdowns for omap4430 where bogus values resulting
         from an incorrect ADC conversion are too high and fire an emergency
         shutdown (Tony Lindgren)
      
       - Don't suppress negative temp for qcom spmi as they are valid and
         userspace needs them (Veera Vegivada)
      
       - Fix use-after-free in thermal_zone_device_unregister reported by
         Kasan (Dmitry Osipenko)
      
      * tag 'thermal-v5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux:
        thermal: core: Fix use-after-free in thermal_zone_device_unregister()
        thermal: qcom-spmi-temp-alarm: Don't suppress negative temp
        thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430
      2fb54791
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine · e2dacf6c
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "A couple of core fixes and odd driver fixes for dmaengine subsystem:
      
        Core:
         - drop ACPI CSRT table reference after using it
         - fix of_dma_router_xlate() error handling
      
        Drivers fixes in idxd, at_hdmac, pl330, dw-edma and jz478"
      
      * tag 'dmaengine-fix-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
        dmaengine: ti: k3-udma: Update rchan_oes_offset for am654 SYSFW ABI 3.0
        drivers/dma/dma-jz4780: Fix race condition between probe and irq handler
        dmaengine: dw-edma: Fix scatter-gather address calculation
        dmaengine: ti: k3-udma: Fix the TR initialization for prep_slave_sg
        dmaengine: pl330: Fix burst length if burst size is smaller than bus width
        dmaengine: at_hdmac: add missing kfree() call in at_dma_xlate()
        dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()
        dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate()
        dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling
        dmaengine: idxd: reset states after device disable or reset
        dmaengine: acpi: Put the CSRT table after using it
      e2dacf6c
    • Linus Torvalds's avatar
      Merge tag 'sound-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 86edf52e
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "A collection of small changes, nothing intrusive:
      
         - remaining tasklet API conversions, now all sound stuff have been
           converted
      
         - a few HD-audio and USB-audio quirks and minor fixes
      
         - FireWire Tascam and Digi00xx fixes
      
         - drop a kernel WARNING from PCM OSS for syzkaller"
      
      * tag 'sound-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (29 commits)
        ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen
        ALSA: hda: use consistent HDAudio spelling in comments/docs
        ALSA: hda: add dev_dbg log when driver is not selected
        ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled
        ALSA: hda: hdmi - add Rocketlake support
        ALSA: ua101: convert tasklets to use new tasklet_setup() API
        ALSA: usb-audio: convert tasklets to use new tasklet_setup() API
        ASoC: txx9: convert tasklets to use new tasklet_setup() API
        ASoC: siu: convert tasklets to use new tasklet_setup() API
        ASoC: fsl_esai: convert tasklets to use new tasklet_setup() API
        ALSA: hdsp: convert tasklets to use new tasklet_setup() API
        ALSA: riptide: convert tasklets to use new tasklet_setup() API
        ALSA: pci/asihpi: convert tasklets to use new tasklet_setup() API
        ALSA: firewire: convert tasklets to use new tasklet_setup() API
        ALSA: core: convert tasklets to use new tasklet_setup() API
        ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check
        ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO
        ALSA: hda/hdmi: always check pin power status in i915 pin fixup
        ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A
        ALSA: usb-audio: Add basic capture support for Pioneer DJ DJM-250MK2
        ...
      86edf52e
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2020-09-04' of git://anongit.freedesktop.org/drm/drm · cf85f5de
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Not much going on this week, nouveau has a display hw bug workaround,
        amdgpu has some PM fixes and CIK regression fixes, one single radeon
        PLL fix, and a couple of i915 display fixes.
      
        amdgpu:
         - Fix for 32bit systems
         - SW CTF fix
         - Update for Sienna Cichlid
         - CIK bug fixes
      
        radeon:
         - PLL fix
      
        i915:
         - Clang build warning fix
         - HDCP fixes
      
        nouveau:
         - display fixes"
      
      * tag 'drm-fixes-2020-09-04' of git://anongit.freedesktop.org/drm/drm:
        drm/nouveau/kms/nv50-gp1xx: add WAR for EVO push buffer HW bug
        drm/nouveau/kms/nv50-gp1xx: disable notifies again after core update
        drm/nouveau/kms/nv50-: add some whitespace before debug message
        drm/nouveau/kms/gv100-: Include correct push header in crcc37d.c
        drm/radeon: Prefer lower feedback dividers
        drm/amdgpu: Fix bug in reporting voltage for CIK
        drm/amdgpu: Specify get_argument function for ci_smu_funcs
        drm/amd/pm: enable MP0 DPM for sienna_cichlid
        drm/amd/pm: avoid false alarm due to confusing softwareshutdowntemp setting
        drm/amd/pm: fix is_dpm_running() run error on 32bit system
        drm/i915: Clear the repeater bit on HDCP disable
        drm/i915: Fix sha_text population code
        drm/i915/display: Ensure that ret is always initialized in icl_combo_phy_verify_state
      cf85f5de
    • Or Cohen's avatar
      net/packet: fix overflow in tpacket_rcv · acf69c94
      Or Cohen authored
      Using tp_reserve to calculate netoff can overflow as
      tp_reserve is unsigned int and netoff is unsigned short.
      
      This may lead to macoff receving a smaller value then
      sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr
      is set, an out-of-bounds write will occur when
      calling virtio_net_hdr_from_skb.
      
      The bug is fixed by converting netoff to unsigned int
      and checking if it exceeds USHRT_MAX.
      
      This addresses CVE-2020-14386
      
      Fixes: 8913336a ("packet: add PACKET_RESERVE sockopt")
      Signed-off-by: default avatarOr Cohen <orcohen@paloaltonetworks.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      acf69c94