1. 23 May, 2021 13 commits
  2. 22 May, 2021 4 commits
    • Linus Torvalds's avatar
      Merge tag 'block-5.13-2021-05-22' of git://git.kernel.dk/linux-block · 4ff2473b
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - Fix BLKRRPART and deletion race (Gulam, Christoph)
      
       - NVMe pull request (Christoph):
            - nvme-tcp corruption and timeout fixes (Sagi Grimberg, Keith
              Busch)
            - nvme-fc teardown fix (James Smart)
            - nvmet/nvme-loop memory leak fixes (Wu Bo)"
      
      * tag 'block-5.13-2021-05-22' of git://git.kernel.dk/linux-block:
        block: fix a race between del_gendisk and BLKRRPART
        block: prevent block device lookups at the beginning of del_gendisk
        nvme-fc: clear q_live at beginning of association teardown
        nvme-tcp: rerun io_work if req_list is not empty
        nvme-tcp: fix possible use-after-completion
        nvme-loop: fix memory leak in nvme_loop_create_ctrl()
        nvmet: fix memory leak in nvmet_alloc_ctrl()
      4ff2473b
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.13-2021-05-22' of git://git.kernel.dk/linux-block · b9231dfb
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "One fix for a regression with poll in this merge window, and another
        just hardens the io-wq exit path a bit"
      
      * tag 'io_uring-5.13-2021-05-22' of git://git.kernel.dk/linux-block:
        io_uring: fortify tctx/io_wq cleanup
        io_uring: don't modify req->poll for rw
      b9231dfb
    • Linus Torvalds's avatar
      Merge tag 'for-linus-5.13b-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 23d72926
      Linus Torvalds authored
      Pull xen fixes from Juergen Gross:
      
       - a fix for a boot regression when running as PV guest on hardware
         without NX support
      
       - a small series fixing a bug in the Xen pciback driver when
         configuring a PCI card with multiple virtual functions
      
      * tag 'for-linus-5.13b-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen-pciback: reconfigure also from backend watch handler
        xen-pciback: redo VF placement in the virtual topology
        x86/Xen: swap NX determination and GDT setup on BSP
      23d72926
    • Linus Torvalds's avatar
      Merge tag 'xfs-5.13-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · a3969ef4
      Linus Torvalds authored
      Pull xfs fixes from Darrick Wong:
      
       - Fix some math errors in the realtime allocator when extent size hints
         are applied.
      
       - Fix unnecessary short writes to realtime files when free space is
         fragmented.
      
       - Fix a crash when using scrub tracepoints.
      
       - Restore ioctl uapi definitions that were accidentally removed in
         5.13-rc1.
      
      * tag 'xfs-5.13-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: restore old ioctl definitions
        xfs: fix deadlock retry tracepoint arguments
        xfs: retry allocations when locality-based search fails
        xfs: adjust rt allocation minlen when extszhint > rtextsize
      a3969ef4
  3. 21 May, 2021 20 commits
  4. 20 May, 2021 3 commits
    • Rohith Surabattula's avatar
      Fix KASAN identified use-after-free issue. · 9687c85d
      Rohith Surabattula authored
      [  612.157429] ==================================================================
      [  612.158275] BUG: KASAN: use-after-free in process_one_work+0x90/0x9b0
      [  612.158801] Read of size 8 at addr ffff88810a31ca60 by task kworker/2:9/2382
      
      [  612.159611] CPU: 2 PID: 2382 Comm: kworker/2:9 Tainted: G
      OE     5.13.0-rc2+ #98
      [  612.159623] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
      BIOS 1.14.0-1.fc33 04/01/2014
      [  612.159640] Workqueue:  0x0 (deferredclose)
      [  612.159669] Call Trace:
      [  612.159685]  dump_stack+0xbb/0x107
      [  612.159711]  print_address_description.constprop.0+0x18/0x140
      [  612.159733]  ? process_one_work+0x90/0x9b0
      [  612.159743]  ? process_one_work+0x90/0x9b0
      [  612.159754]  kasan_report.cold+0x7c/0xd8
      [  612.159778]  ? lock_is_held_type+0x80/0x130
      [  612.159789]  ? process_one_work+0x90/0x9b0
      [  612.159812]  kasan_check_range+0x145/0x1a0
      [  612.159834]  process_one_work+0x90/0x9b0
      [  612.159877]  ? pwq_dec_nr_in_flight+0x110/0x110
      [  612.159914]  ? spin_bug+0x90/0x90
      [  612.159967]  worker_thread+0x3b6/0x6c0
      [  612.160023]  ? process_one_work+0x9b0/0x9b0
      [  612.160038]  kthread+0x1dc/0x200
      [  612.160051]  ? kthread_create_worker_on_cpu+0xd0/0xd0
      [  612.160092]  ret_from_fork+0x1f/0x30
      
      [  612.160399] Allocated by task 2358:
      [  612.160757]  kasan_save_stack+0x1b/0x40
      [  612.160768]  __kasan_kmalloc+0x9b/0xd0
      [  612.160778]  cifs_new_fileinfo+0xb0/0x960 [cifs]
      [  612.161170]  cifs_open+0xadf/0xf20 [cifs]
      [  612.161421]  do_dentry_open+0x2aa/0x6b0
      [  612.161432]  path_openat+0xbd9/0xfa0
      [  612.161441]  do_filp_open+0x11d/0x230
      [  612.161450]  do_sys_openat2+0x115/0x240
      [  612.161460]  __x64_sys_openat+0xce/0x140
      
      When mod_delayed_work is called to modify the delay of pending work,
      it might return false and queue a new work when pending work is
      already scheduled or when try to grab pending work failed.
      
      So, Increase the reference count when new work is scheduled to
      avoid use-after-free.
      Signed-off-by: default avatarRohith Surabattula <rohiths@microsoft.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      9687c85d
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · f01da525
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "A mixture of small bug fixes, most for longer standing problems:
      
         - NULL pointer crash in siw
      
         - Various error unwind bugs in siw, rxe, cm
      
         - User triggerable errors in uverbs
      
         - Minor bugs in mlx5 and rxe drivers"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/uverbs: Fix a NULL vs IS_ERR() bug
        RDMA/mlx5: Fix query DCT via DEVX
        RDMA/core: Don't access cm_id after its destruction
        RDMA/rxe: Return CQE error if invalid lkey was supplied
        RDMA/mlx5: Recover from fatal event in dual port mode
        RDMA/mlx5: Verify that DM operation is reasonable
        RDMA/rxe: Clear all QP fields if creation failed
        RDMA/core: Prevent divide-by-zero error triggered by the user
        RDMA/siw: Release xarray entry
        RDMA/siw: Properly check send and receive CQ pointers
      f01da525
    • Linus Torvalds's avatar
      Merge tag 'sound-5.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 6aa37a53
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "All small device-specific fixes here: a series of FireWire audio
        fixes, UAF and other fixes in USB-audio and co spotted by fuzzer,
        and a few HD-audio quirks as usual"
      
      * tag 'sound-5.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: line6: Fix racy initialization of LINE6 MIDI
        ALSA: dice: fix stream format for TC Electronic Konnekt Live at high sampling transfer frequency
        ALSA: dice: disable double_pcm_frames mode for M-Audio Profire 610, 2626 and Avid M-Box 3 Pro
        ALSA: intel8x0: Don't update period unless prepared
        ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293
        ALSA: firewire-lib: fix amdtp_packet tracepoints event for packet_index field
        ALSA: firewire-lib: fix calculation for size of IR context payload
        ALSA: firewire-lib: fix check for the size of isochronous packet payload
        ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro
        ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26
        ALSA: hda/realtek: Add fixup for HP Spectre x360 15-df0xxx
        ALSA: usb-audio: Fix potential out-of-bounce access in MIDI EP parser
        ALSA: usb-audio: Validate MS endpoint descriptors
        ALSA: hda: fixup headset for ASUS GU502 laptop
        ALSA: hda/realtek: reset eapd coeff to default value for alc287
      6aa37a53