843 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	e4cac2c332	This is the 5.10.54 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEBT00ACgkQONu9yGCS aT7svA/9HCRwW+pK3UpK1+0FK7gGH8DA3jSONj775zVEKhboDZNIwZsDqG0Ly+jm /JejWXPKZlekaDXgzBfZY3H59xgij/VwYHe8p7cdxfi1TlhmAQwFjLNZnWav8as6 IyNkpsDJn8fMXmfHDi2u3cb8wrVi/aQDzTlwu88cUtREyZCaaYlo0Fdv9MJyhww/ p6LWPYQoZ8TmFY+Y/2ORVxFos2UVuU0hhhMdGt9LrX2WNEGRNUZUqmbhcXYfdsX0 ckSHbijIcWdcka3nQ6yOvdxw75rTqd8c/bP0y+yAteeJ0CykjVnI2cdK+M2ZEi4j /JqpGJrRWhsZf5MiO8b3k+I1K62JDa1GYBQ9Amp8FKKzjYLPTNeFAP9IsMyDc4oi oW98XM7XzoSEU9t/FSAIGT0hYK9k+lnPxw623LhxD6x3VPynnNAnQsLr+HirOgG6 mZ79L4ZFu3lUvVsCuCgKn/uxwDopUNlhqo5B2/4M2kSWwe2Xu5bExpGc2bT9xCOP 6fF9DmvmpG1UPGCXrOqaxemyEPmHqmyjKJpxDt6vZqlOL9vqHez4WmEEM1C+E2NZ 5VKKbBk/KZDxNX9EiFOtI2HRFb1cghoI2Hcb/QjRoB9Dv3a6cHgjxDl0eKm8SiDN +1ytV0IFH3fT4aRiXJ7I3GBwkjKcDaX0sjYwtnCx9s5XZmm9PRQ= =HAyL -----END PGP SIGNATURE----- Merge 5.10.54 into android12-5.10-lts Changes in 5.10.54 igc: Fix use-after-free error during reset igb: Fix use-after-free error during reset igc: change default return of igc_read_phy_reg() ixgbe: Fix an error handling path in 'ixgbe_probe()' igc: Fix an error handling path in 'igc_probe()' igb: Fix an error handling path in 'igb_probe()' fm10k: Fix an error handling path in 'fm10k_probe()' e1000e: Fix an error handling path in 'e1000_probe()' iavf: Fix an error handling path in 'iavf_probe()' igb: Check if num of q_vectors is smaller than max before array access igb: Fix position of assignment to *ring gve: Fix an error handling path in 'gve_probe()' net: add kcov handle to skb extensions bonding: fix suspicious RCU usage in bond_ipsec_add_sa() bonding: fix null dereference in bond_ipsec_add_sa() ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops bonding: fix suspicious RCU usage in bond_ipsec_del_sa() bonding: disallow setting nested bonding + ipsec offload bonding: Add struct bond_ipesc to manage SA bonding: fix suspicious RCU usage in bond_ipsec_offload_ok() bonding: fix incorrect return value of bond_ipsec_offload_ok() ipv6: fix 'disable_policy' for fwd packets stmmac: platform: Fix signedness bug in stmmac_probe_config_dt() selftests: icmp_redirect: remove from checking for IPv6 route get selftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect pwm: sprd: Ensure configuring period and duty_cycle isn't wrongly skipped cxgb4: fix IRQ free race during driver unload mptcp: fix warning in __skb_flow_dissect() when do syn cookie for subflow join nvme-pci: do not call nvme_dev_remove_admin from nvme_remove KVM: x86/pmu: Clear anythread deprecated bit when 0xa leaf is unsupported on the SVM perf inject: Fix dso->nsinfo refcounting perf map: Fix dso->nsinfo refcounting perf probe: Fix dso->nsinfo refcounting perf env: Fix sibling_dies memory leak perf test session_topology: Delete session->evlist perf test event_update: Fix memory leak of evlist perf dso: Fix memory leak in dso__new_map() perf test maps__merge_in: Fix memory leak of maps perf env: Fix memory leak of cpu_pmu_caps perf report: Free generated help strings for sort option perf script: Fix memory 'threads' and 'cpus' leaks on exit perf lzma: Close lzma stream on exit perf probe-file: Delete namelist in del_events() on the error path perf data: Close all files in close_dir() perf sched: Fix record failure when CONFIG_SCHEDSTATS is not set ASoC: wm_adsp: Correct wm_coeff_tlv_get handling spi: imx: add a check for speed_hz before calculating the clock spi: stm32: fixes pm_runtime calls in probe/remove regulator: hi6421: Use correct variable type for regmap api val argument regulator: hi6421: Fix getting wrong drvdata spi: mediatek: fix fifo rx mode ASoC: rt5631: Fix regcache sync errors on resume bpf, test: fix NULL pointer dereference on invalid expected_attach_type bpf: Fix tail_call_reachable rejection for interpreter when jit failed xdp, net: Fix use-after-free in bpf_xdp_link_release timers: Fix get_next_timer_interrupt() with no timers pending liquidio: Fix unintentional sign extension issue on left shift of u16 s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1] bpf, sockmap: Fix potential memory leak on unlikely error case bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats bpf, sockmap, udp: sk_prot needs inuse_idx set for proc stats bpftool: Check malloc return value in mount_bpffs_for_pin net: fix uninit-value in caif_seqpkt_sendmsg usb: hso: fix error handling code of hso_create_net_device dma-mapping: handle vmalloc addresses in dma_common_{mmap,get_sgtable} efi/tpm: Differentiate missing and invalid final event log table. net: decnet: Fix sleeping inside in af_decnet KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak net: sched: fix memory leak in tcindex_partial_destroy_work sctp: trim optlen when it's a huge value in sctp_setsockopt netrom: Decrease sock refcount when sock timers expire scsi: iscsi: Fix iface sysfs attr detection scsi: target: Fix protect handling in WRITE SAME(32) spi: cadence: Correct initialisation of runtime PM again ACPI: Kconfig: Fix table override from built-in initrd bnxt_en: don't disable an already disabled PCI device bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe() bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task() bnxt_en: Validate vlan protocol ID on RX packets bnxt_en: Check abort error state in bnxt_half_open_nic() net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition net/tcp_fastopen: fix data races around tfo_active_disable_stamp ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID net: hns3: fix possible mismatches resp of mailbox net: hns3: fix rx VLAN offload state inconsistent issue spi: spi-bcm2835: Fix deadlock net/sched: act_skbmod: Skip non-Ethernet packets ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions ceph: don't WARN if we're still opening a session to an MDS nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem" afs: Fix tracepoint string placement with built-in AFS r8169: Avoid duplicate sysfs entry creation error nvme: set the PRACT bit when using Write Zeroes with T10 PI sctp: update active_key for asoc when old key is being replaced tcp: disable TFO blackhole logic by default net: dsa: sja1105: make VID 4095 a bridge VLAN too net: sched: cls_api: Fix the the wrong parameter drm/panel: raspberrypi-touchscreen: Prevent double-free cifs: only write 64kb at a time when fallocating a small region of a file cifs: fix fallocate when trying to allocate a hole. proc: Avoid mixing integer types in mem_rw() mmc: core: Don't allocate IDA for OF aliases s390/ftrace: fix ftrace_update_ftrace_func implementation s390/boot: fix use of expolines in the DMA code ALSA: usb-audio: Add missing proc text entry for BESPOKEN type ALSA: usb-audio: Add registration quirk for JBL Quantum headsets ALSA: sb: Fix potential ABBA deadlock in CSP driver ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine ALSA: hdmi: Expose all pins on MSI MS-7C94 board ALSA: pcm: Call substream ack() method upon compat mmap commit ALSA: pcm: Fix mmap capability check Revert "usb: renesas-xhci: Fix handling of unknown ROM state" usb: xhci: avoid renesas_usb_fw.mem when it's unusable xhci: Fix lost USB 2 remote wake KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state usb: hub: Disable USB 3 device initiated lpm if exit latency is too high usb: hub: Fix link power management max exit latency (MEL) calculations USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS usb: max-3421: Prevent corruption of freed memory usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop() USB: serial: option: add support for u-blox LARA-R6 family USB: serial: cp210x: fix comments for GE CS1000 USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick usb: gadget: Fix Unbalanced pm_runtime_enable in tegra_xudc_probe usb: dwc2: gadget: Fix GOUTNAK flow for Slave mode. usb: dwc2: gadget: Fix sending zero length packet in DDMA mode. usb: typec: stusb160x: register role switch before interrupt registration firmware/efi: Tell memblock about EFI iomem reservations tracepoints: Update static_call before tp_funcs when adding a tracepoint tracing/histogram: Rename "cpu" to "common_cpu" tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. tracing: Synthetic event field_pos is an index not a boolean btrfs: check for missing device in btrfs_trim_fs media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() ixgbe: Fix packet corruption due to missing DMA sync bus: mhi: core: Validate channel ID when processing command completions posix-cpu-timers: Fix rearm racing against process tick selftest: use mmap instead of posix_memalign to allocate memory io_uring: explicitly count entries for poll reqs io_uring: remove double poll entry on arm failure userfaultfd: do not untag user pointers memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions hugetlbfs: fix mount mode command line processing rbd: don't hold lock_rwsem while running_list is being drained rbd: always kick acquire on "acquired" and "released" notifications misc: eeprom: at24: Always append device id even if label property is set. nds32: fix up stack guard gap driver core: Prevent warning when removing a device link from unregistered consumer drm: Return -ENOTTY for non-drm ioctls drm/amdgpu: update golden setting for sienna_cichlid net: dsa: mv88e6xxx: enable SerDes RX stats for Topaz net: dsa: mv88e6xxx: enable SerDes PCS register dump via ethtool -d on Topaz PCI: Mark AMD Navi14 GPU ATS as broken bonding: fix build issue skbuff: Release nfct refcount on napi stolen or re-used skbs Documentation: Fix intiramfs script name perf inject: Close inject.output on exit usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI drm/i915/gvt: Clear d3_entered on elsp cmd submission. sfc: ensure correct number of XDP queues xhci: add xhci_get_virt_ep() helper skbuff: Fix build with SKB extensions disabled Linux 5.10.54 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ifd2823b47ab1544cd1f168b138624ffe060a471e	2021-07-28 15:23:47 +02:00
David Howells	0f5dc39714	afs: Fix tracepoint string placement with built-in AFS ... [ Upstream commit 6c881ca0b3 ] To quote Alexey[1]: I was adding custom tracepoint to the kernel, grabbed full F34 kernel .config, disabled modules and booted whole shebang as VM kernel. Then did perf record -a -e ... It crashed: general protection fault, probably for non-canonical address 0x435f5346592e4243: 0000 [#1] SMP PTI CPU: 1 PID: 842 Comm: cat Not tainted 5.12.6+ #26 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 RIP: 0010:t_show+0x22/0xd0 Then reproducer was narrowed to # cat /sys/kernel/tracing/printk_formats Original F34 kernel with modules didn't crash. So I started to disable options and after disabling AFS everything started working again. The root cause is that AFS was placing char arrays content into a section full of _pointers_ to strings with predictable consequences. Non canonical address 435f5346592e4243 is "CB.YFS_" which came from CM_NAME macro. Steps to reproduce: CONFIG_AFS=y CONFIG_TRACING=y # cat /sys/kernel/tracing/printk_formats Fix this by the following means: (1) Add enum->string translation tables in the event header with the AFS and YFS cache/callback manager operations listed by RPC operation ID. (2) Modify the afs_cb_call tracepoint to print the string from the translation table rather than using the string at the afs_call name pointer. (3) Switch translation table depending on the service we're being accessed as (AFS or YFS) in the tracepoint print clause. Will this cause problems to userspace utilities? Note that the symbolic representation of the YFS service ID isn't available to this header, so I've put it in as a number. I'm not sure if this is the best way to do this. (4) Remove the name wrangling (CM_NAME) macro and put the names directly into the afs_call_type structs in cmservice.c. Fixes: 8e8d7f13b6 ("afs: Add some tracepoints") Reported-by: Alexey Dobriyan (SK hynix) <adobriyan@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Reviewed-by: Marc Dionne <marc.dionne@auristor.com> cc: Andrew Morton <akpm@linux-foundation.org> cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/YLAXfvZ+rObEOdc%2F@localhost.localdomain/ [1] Link: https://lore.kernel.org/r/643721.1623754699@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/162430903582.2896199.6098150063997983353.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/162609463957.3133237.15916579353149746363.stgit@warthog.procyon.org.uk/ # v1 (repost) Link: https://lore.kernel.org/r/162610726860.3408253.445207609466288531.stgit@warthog.procyon.org.uk/ # v2 Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-07-28 14:35:41 +02:00
Greg Kroah-Hartman	948d38f94d	This is the 5.10.46 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmDTLFUACgkQONu9yGCS aT5eThAApQAh1A++P729NJOTeoewU5YH0/1c+ZVN4nfxxEOApeBpfA4tTDvfHJeI MYx10AI1UiLPHfLtHI5exvG00/Ll4lb0fs2bpVL2b/SQKCm2G3kZf7xOdJOBtoy4 DEaTORhmZ001weapZN+G4oz+FEnNZEyR/rThqKTA0G/PS1MxNl4ZBhY9BrySpH1V Cq7OFX18IbTh3/XXmcPotZa2sXE6Z+jjWQb5GLZ+ZjicbzgLiWWcnrm8bzLahVC4 N7TToeGv9zOLKgrE+HVR52UoFB1+2vRUEaRVOiFbDViLjoF5KWw5rAzioTCvfXW+ g/ldoAuDQBNGUrYfVUrSNwj5JuWCI2Cltt//9f/xGfPPn0HNjAxSM7ExpnMNVhVK 1gjTco+0kWzv2BGjgpNAe7+aLka5sQkLEOYlSExI6VVuF5CCcIywWjWZ6zHG0CF1 7kW8CfINV4BFP+IYw5Gnt5K3hUTulDt+alX9WgsdPxpsZ9gbIscO1/awnRrAyDyO 2EeCbZ3WWSuvFL6qAjJERiDbhDPRaZV0cwGPxzLZ7NN8ZPXLxTVv7Nc6QoiNXYkk E+LYcMua9dxFXjoHA0imKxlxqJD64mh3oUkdpTGOwIxrE5bavnKGrO2B3Nl7zWVn u8mazeKHWpJ+t+dDZ47CjrNTul0SOvryKmog//DCkvAIYSjRzVc= =WRWw -----END PGP SIGNATURE----- Merge 5.10.46 into android12-5.10-lts Changes in 5.10.46 dmaengine: idxd: add missing dsa driver unregister dmaengine: fsl-dpaa2-qdma: Fix error return code in two functions dmaengine: xilinx: dpdma: initialize registers before request_irq dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM dmaengine: SF_PDMA depends on HAS_IOMEM dmaengine: stedma40: add missing iounmap() on error in d40_probe() afs: Fix an IS_ERR() vs NULL check mm/memory-failure: make sure wait for page writeback in memory_failure kvm: LAPIC: Restore guard to prevent illegal APIC register access fanotify: fix copy_event_to_user() fid error clean up batman-adv: Avoid WARN_ON timing related checks mac80211: fix skb length check in ieee80211_scan_rx() mlxsw: reg: Spectrum-3: Enforce lowest max-shaper burst size of 11 mlxsw: core: Set thermal zone polling delay argument to real value at init libbpf: Fixes incorrect rx_ring_setup_done net: ipv4: fix memory leak in netlbl_cipsov4_add_std vrf: fix maximum MTU net: rds: fix memory leak in rds_recvmsg net: dsa: felix: re-enable TX flow control in ocelot_port_flush() net: lantiq: disable interrupt before sheduling NAPI netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local ice: add ndo_bpf callback for safe mode netdev ops ice: parameterize functions responsible for Tx ring management udp: fix race between close() and udp_abort() rtnetlink: Fix regression in bridge VLAN configuration net/sched: act_ct: handle DNAT tuple collision net/mlx5e: Remove dependency in IPsec initialization flows net/mlx5e: Fix page reclaim for dead peer hairpin net/mlx5: Consider RoCE cap before init RDMA resources net/mlx5: DR, Allow SW steering for sw_owner_v2 devices net/mlx5: DR, Don't use SW steering when RoCE is not supported net/mlx5e: Block offload of outer header csum for UDP tunnels netfilter: synproxy: Fix out of bounds when parsing TCP options mptcp: Fix out of bounds when parsing TCP options sch_cake: Fix out of bounds when parsing TCP options and header mptcp: try harder to borrow memory from subflow under pressure mptcp: do not warn on bad input from the network selftests: mptcp: enable syncookie only in absence of reorders alx: Fix an error handling path in 'alx_probe()' cxgb4: fix endianness when flashing boot image cxgb4: fix sleep in atomic when flashing PHY firmware cxgb4: halt chip before flashing PHY firmware image net: stmmac: dwmac1000: Fix extended MAC address registers definition net: make get_net_ns return error if NET_NS is disabled net: qualcomm: rmnet: Update rmnet device MTU based on real device net: qualcomm: rmnet: don't over-count statistics ethtool: strset: fix message length calculation qlcnic: Fix an error handling path in 'qlcnic_probe()' netxen_nic: Fix an error handling path in 'netxen_nic_probe()' cxgb4: fix wrong ethtool n-tuple rule lookup ipv4: Fix device used for dst_alloc with local routes net: qrtr: fix OOB Read in qrtr_endpoint_post bpf: Fix leakage under speculation on mispredicted branches ptp: improve max_adj check against unreasonable values net: cdc_ncm: switch to eth%d interface naming lantiq: net: fix duplicated skb in rx descriptor ring net: usb: fix possible use-after-free in smsc75xx_bind net: fec_ptp: fix issue caused by refactor the fec_devtype net: ipv4: fix memory leak in ip_mc_add1_src net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock net/mlx5: E-Switch, Read PF mac address net/mlx5: E-Switch, Allow setting GUID for host PF vport net/mlx5: Reset mkey index on creation be2net: Fix an error handling path in 'be_probe()' net: hamradio: fix memory leak in mkiss_close net: cdc_eem: fix tx fixup skb leak cxgb4: fix wrong shift. bnxt_en: Rediscover PHY capabilities after firmware reset bnxt_en: Fix TQM fastpath ring backing store computation bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path icmp: don't send out ICMP messages with a source address of 0.0.0.0 net: ethernet: fix potential use-after-free in ec_bhf_remove regulator: cros-ec: Fix error code in dev_err message regulator: bd70528: Fix off-by-one for buck123 .n_voltages setting platform/x86: thinkpad_acpi: Add X1 Carbon Gen 9 second fan support ASoC: rt5659: Fix the lost powers for the HDA header phy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init() ASoC: fsl-asoc-card: Set .owner attribute when registering card. regulator: rtmv20: Fix to make regcache value first reading back from HW spi: spi-zynq-qspi: Fix some wrong goto jumps & missing error code sched/pelt: Ensure that *_sum is always synced with *_avg ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values spi: stm32-qspi: Always wait BUSY bit to be cleared in stm32_qspi_wait_cmd() regulator: rt4801: Fix NULL pointer dereference if priv->enable_gpios is NULL ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode pinctrl: ralink: rt2880: avoid to error in calls is pin is already enabled drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device ASoC: qcom: lpass-cpu: Fix pop noise during audio capture begin radeon: use memcpy_to/fromio for UVD fw upload hwmon: (scpi-hwmon) shows the negative temperature properly mm: relocate 'write_protect_seq' in struct mm_struct irqchip/gic-v3: Workaround inconsistent PMR setting on NMI entry bpf: Inherit expanded/patched seen count from old aux data bpf: Do not mark insn as seen under speculative path verification can: bcm: fix infoleak in struct bcm_msg_head can: bcm/raw/isotp: use per module netdevice notifier can: j1939: fix Use-after-Free, hold skb ref while in use can: mcba_usb: fix memory leak in mcba_usb usb: core: hub: Disable autosuspend for Cypress CY7C65632 usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection tracing: Do not stop recording cmdlines when tracing is off tracing: Do not stop recording comms if the trace file is being read tracing: Do no increment trace_clock_global() by one PCI: Mark TI C667X to avoid bus reset PCI: Mark some NVIDIA GPUs to avoid bus reset PCI: aardvark: Fix kernel panic during PIO transfer PCI: Add ACS quirk for Broadcom BCM57414 NIC PCI: Work around Huawei Intelligent NIC VF FLR erratum KVM: x86: Immediately reset the MMU context when the SMM flag is cleared KVM: x86/mmu: Calculate and check "full" mmu_role for nested MMU KVM: X86: Fix x86_emulator slab cache leak s390/mcck: fix calculation of SIE critical section size s390/ap: Fix hanging ioctl caused by wrong msg counter ARCv2: save ABI registers across signal handling x86/mm: Avoid truncating memblocks for SGX memory x86/process: Check PF_KTHREAD and not current->mm for kernel threads x86/ioremap: Map EFI-reserved memory as encrypted for SEV x86/pkru: Write hardware init value to PKRU when xstate is init x86/fpu: Prevent state corruption in __fpu__restore_sig() x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer x86/fpu: Reset state for all signal restore failures crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc mac80211: Fix NULL ptr deref for injected rate info cfg80211: make certificate generation more robust cfg80211: avoid double free of PMSR request drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell. drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue. net: ll_temac: Make sure to free skb when it is completely used net: ll_temac: Fix TX BD buffer overwrite net: bridge: fix vlan tunnel dst null pointer dereference net: bridge: fix vlan tunnel dst refcnt when egressing mm/swap: fix pte_same_as_swp() not removing uffd-wp bit when compare mm/slub: clarify verification reporting mm/slub: fix redzoning for small allocations mm/slub: actually fix freelist pointer vs redzoning mm/slub.c: include swab.h net: stmmac: disable clocks in stmmac_remove_config_dt() net: fec_ptp: add clock rate zero check tools headers UAPI: Sync linux/in.h copy with the kernel sources perf beauty: Update copy of linux/socket.h with the kernel sources usb: dwc3: debugfs: Add and remove endpoint dirs dynamically usb: dwc3: core: fix kernel panic when do reboot Linux 5.10.46 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I99f37c9f257f90ccdb091306f3d4cfb7c32e3880	2021-06-23 17:53:08 +02:00
Dan Carpenter	090b1bb928	afs: Fix an IS_ERR() vs NULL check ... [ Upstream commit a33d62662d ] The proc_symlink() function returns NULL on error, it doesn't return error pointers. Fixes: 5b86d4ff5d ("afs: Implement network namespacing") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/YLjMRKX40pTrJvgf@mwanda/ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-23 14:42:40 +02:00
Greg Kroah-Hartman	c5d480cd47	Merge 5.10.42 into android12-5.10 ... Changes in 5.10.42 ALSA: hda/realtek: the bass speaker can't output sound on Yoga 9i ALSA: hda/realtek: Headphone volume is controlled by Front mixer ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation P340 ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8 ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook G8 ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 15 G8 ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 17 G8 ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci ALSA: usb-audio: scarlett2: Improve driver startup messages cifs: set server->cipher_type to AES-128-CCM for SMB3.0 NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() iommu/vt-d: Fix sysfs leak in alloc_iommu() perf intel-pt: Fix sample instruction bytes perf intel-pt: Fix transaction abort handling perf scripts python: exported-sql-viewer.py: Fix copy to clipboard from Top Calls by elapsed Time report perf scripts python: exported-sql-viewer.py: Fix Array TypeError perf scripts python: exported-sql-viewer.py: Fix warning display proc: Check /proc/$pid/attr/ writes against file opener net: hso: fix control-request directions net/sched: fq_pie: re-factor fix for fq_pie endless loop net/sched: fq_pie: fix OOB access in the traffic path netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version mac80211: assure all fragments are encrypted mac80211: prevent mixed key and fragment cache attacks mac80211: properly handle A-MSDUs that start with an RFC 1042 header cfg80211: mitigate A-MSDU aggregation attacks mac80211: drop A-MSDUs on old ciphers mac80211: add fragment cache to sta_info mac80211: check defrag PN against current frame mac80211: prevent attacks on TKIP/WEP as well mac80211: do not accept/forward invalid EAPOL frames mac80211: extend protection against mixed key and fragment cache attacks ath10k: add CCMP PN replay protection for fragmented frames for PCIe ath10k: drop fragments with multicast DA for PCIe ath10k: drop fragments with multicast DA for SDIO ath10k: drop MPDU which has discard flag set by firmware for SDIO ath10k: Fix TKIP Michael MIC verification for PCIe ath10k: Validate first subframe of A-MSDU before processing the list ath11k: Clear the fragment cache during key install dm snapshot: properly fix a crash when an origin has no snapshots drm/amd/pm: correct MGpuFanBoost setting drm/amdgpu/vcn1: add cancel_delayed_work_sync before power gate drm/amdkfd: correct sienna_cichlid SDMA RLC register offset error drm/amdgpu/vcn2.0: add cancel_delayed_work_sync before power gate drm/amdgpu/vcn2.5: add cancel_delayed_work_sync before power gate drm/amdgpu/jpeg2.0: add cancel_delayed_work_sync before power gate selftests/gpio: Use TEST_GEN_PROGS_EXTENDED selftests/gpio: Move include of lib.mk up selftests/gpio: Fix build when source tree is read only kgdb: fix gcc-11 warnings harder Documentation: seccomp: Fix user notification documentation seccomp: Refactor notification handler to prepare for new semantics serial: core: fix suspicious security_locked_down() call misc/uss720: fix memory leak in uss720_probe thunderbolt: usb4: Fix NVM read buffer bounds and offset issue thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue KVM: X86: Fix vCPU preempted state from guest's point of view KVM: arm64: Prevent mixed-width VM creation mei: request autosuspend after sending rx flow control staging: iio: cdc: ad7746: avoid overwrite of num_channels iio: gyro: fxas21002c: balance runtime power in error path iio: dac: ad5770r: Put fwnode in error case during ->probe() iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timestamp() iio: adc: ad7124: Fix missbalanced regulator enable / disable on error. iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers iio: adc: ad7923: Fix undersized rx buffer. iio: adc: ad7793: Add missing error code in ad7793_setup() iio: adc: ad7192: Avoid disabling a clock that was never enabled. iio: adc: ad7192: handle regulator voltage error first serial: 8250: Add UART_BUG_TXRACE workaround for Aspeed VUART serial: 8250_dw: Add device HID for new AMD UART controller serial: 8250_pci: Add support for new HPE serial device serial: 8250_pci: handle FL_NOIRQ board flag USB: trancevibrator: fix control-request direction Revert "irqbypass: do not start cons/prod when failed connect" USB: usbfs: Don't WARN about excessively large memory allocations drivers: base: Fix device link removal serial: tegra: Fix a mask operation that is always true serial: sh-sci: Fix off-by-one error in FIFO threshold register setting serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait' USB: serial: ti_usb_3410_5052: add startech.com device id USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011 USB: serial: ftdi_sio: add IDs for IDS GmbH Products USB: serial: pl2303: add device id for ADLINK ND-6530 GC thermal/drivers/intel: Initialize RW trip to THERMAL_TEMP_INVALID usb: dwc3: gadget: Properly track pending and queued SG usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen() usb: typec: mux: Fix matching with typec_altmode_desc net: usb: fix memory leak in smsc75xx_bind Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails fs/nfs: Use fatal_signal_pending instead of signal_pending NFS: fix an incorrect limit in filelayout_decode_layout() NFS: Fix an Oopsable condition in __nfs_pageio_add_request() NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config drm/meson: fix shutdown crash when component not probed net/mlx5e: reset XPS on error flow if netdev isn't registered yet net/mlx5e: Fix multipath lag activation net/mlx5e: Fix error path of updating netdev queues {net,vdpa}/mlx5: Configure interface MAC into mpfs L2 table net/mlx5e: Fix nullptr in add_vlan_push_action() net/mlx5: Set reformat action when needed for termination rules net/mlx5e: Fix null deref accessing lag dev net/mlx4: Fix EEPROM dump support net/mlx5: Set term table as an unmanaged flow table SUNRPC in case of backlog, hand free slots directly to waiting task Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv" tipc: wait and exit until all work queues are done tipc: skb_linearize the head skb when reassembling msgs spi: spi-fsl-dspi: Fix a resource leak in an error handling path netfilter: flowtable: Remove redundant hw refresh bit net: dsa: mt7530: fix VLAN traffic leaks net: dsa: fix a crash if ->get_sset_count() fails net: dsa: sja1105: update existing VLANs from the bridge VLAN list net: dsa: sja1105: use 4095 as the private VLAN for untagged traffic net: dsa: sja1105: error out on unsupported PHY mode net: dsa: sja1105: add error handling in sja1105_setup() net: dsa: sja1105: call dsa_unregister_switch when allocating memory fails net: dsa: sja1105: fix VL lookup command packing for P/Q/R/S i2c: s3c2410: fix possible NULL pointer deref on read message after write i2c: mediatek: Disable i2c start_en and clear intr_stat brfore reset i2c: i801: Don't generate an interrupt on bus reset i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E afs: Fix the nlink handling of dir-over-dir rename perf jevents: Fix getting maximum number of fds nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response mptcp: avoid error message on infinite mapping mptcp: drop unconditional pr_warn on bad opt mptcp: fix data stream corruption platform/x86: hp_accel: Avoid invoking _INI to speed up resume gpio: cadence: Add missing MODULE_DEVICE_TABLE Revert "crypto: cavium/nitrox - add an error message to explain the failure of pci_request_mem_regions" Revert "media: usb: gspca: add a missed check for goto_low_power" Revert "ALSA: sb: fix a missing check of snd_ctl_add" Revert "serial: max310x: pass return value of spi_register_driver" serial: max310x: unregister uart driver in case of failure and abort Revert "net: fujitsu: fix a potential NULL pointer dereference" net: fujitsu: fix potential null-ptr-deref Revert "net/smc: fix a NULL pointer dereference" net/smc: properly handle workqueue allocation failure Revert "net: caif: replace BUG_ON with recovery code" net: caif: remove BUG_ON(dev == NULL) in caif_xmit Revert "char: hpet: fix a missing check of ioremap" char: hpet: add checks after calling ioremap Revert "ALSA: gus: add a check of the status of snd_ctl_add" Revert "ALSA: usx2y: Fix potential NULL pointer dereference" Revert "isdn: mISDNinfineon: fix potential NULL pointer dereference" isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io Revert "ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()" ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() Revert "isdn: mISDN: Fix potential NULL pointer dereference of kzalloc" isdn: mISDN: correctly handle ph_info allocation failure in hfcsusb_ph_info Revert "dmaengine: qcom_hidma: Check for driver register failure" dmaengine: qcom_hidma: comment platform_driver_register call Revert "libertas: add checks for the return value of sysfs_create_group" libertas: register sysfs groups properly Revert "ASoC: cs43130: fix a NULL pointer dereference" ASoC: cs43130: handle errors in cs43130_probe() properly Revert "media: dvb: Add check on sp8870_readreg" media: dvb: Add check on sp8870_readreg return Revert "media: gspca: mt9m111: Check write_bridge for timeout" media: gspca: mt9m111: Check write_bridge for timeout Revert "media: gspca: Check the return value of write_bridge for timeout" media: gspca: properly check for errors in po1030_probe() Revert "net: liquidio: fix a NULL pointer dereference" net: liquidio: Add missing null pointer checks Revert "brcmfmac: add a check for the status of usb_register" brcmfmac: properly check for bus register errors btrfs: return whole extents in fiemap scsi: ufs: ufs-mediatek: Fix power down spec violation scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic openrisc: Define memory barrier mb scsi: pm80xx: Fix drives missing during rmmod/insmod loop btrfs: release path before starting transaction when cloning inline extent btrfs: do not BUG_ON in link_to_fixup_dir platform/x86: hp-wireless: add AMD's hardware id to the supported list platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI platform/x86: touchscreen_dmi: Add info for the Mediacom Winpad 7.0 W700 tablet SMB3: incorrect file id in requests compounded with open drm/amd/display: Disconnect non-DP with no EDID drm/amd/amdgpu: fix refcount leak drm/amdgpu: Fix a use-after-free drm/amd/amdgpu: fix a potential deadlock in gpu reset drm/amdgpu: stop touching sched.ready in the backend platform/x86: touchscreen_dmi: Add info for the Chuwi Hi10 Pro (CWI529) tablet block: fix a race between del_gendisk and BLKRRPART linux/bits.h: fix compilation error with GENMASK net: netcp: Fix an error message net: dsa: fix error code getting shifted with 4 in dsa_slave_get_sset_count interconnect: qcom: bcm-voter: add a missing of_node_put() interconnect: qcom: Add missing MODULE_DEVICE_TABLE ASoC: cs42l42: Regmap must use_single_read/write net: stmmac: Fix MAC WoL not working if PHY does not support WoL net: ipa: memory region array is variable size vfio-ccw: Check initialized flag in cp_init() spi: Assume GPIO CS active high in ACPI case net: really orphan skbs tied to closing sk net: packetmmap: fix only tx timestamp on request net: fec: fix the potential memory leak in fec_enet_init() chelsio/chtls: unlock on error in chtls_pt_recvmsg() net: mdio: thunder: Fix a double free issue in the .remove function net: mdio: octeon: Fix some double free issues cxgb4/ch_ktls: Clear resources when pf4 device is removed openvswitch: meter: fix race when getting now_ms. tls splice: check SPLICE_F_NONBLOCK instead of MSG_DONTWAIT net: sched: fix packet stuck problem for lockless qdisc net: sched: fix tx action rescheduling issue during deactivation net: sched: fix tx action reschedule issue with stopped queue net: hso: check for allocation failure in hso_create_bulk_serial_device() net: bnx2: Fix error return code in bnx2_init_board() bnxt_en: Include new P5 HV definition in VF check. bnxt_en: Fix context memory setup for 64K page size. mld: fix panic in mld_newpack() net/smc: remove device from smcd_dev_list after failed device_add() gve: Check TX QPL was actually assigned gve: Update mgmt_msix_idx if num_ntfy changes gve: Add NULL pointer checks when freeing irqs. gve: Upgrade memory barrier in poll routine gve: Correct SKB queue index validation. iommu/virtio: Add missing MODULE_DEVICE_TABLE net: hns3: fix incorrect resp_msg issue net: hns3: put off calling register_netdev() until client initialize complete iommu/vt-d: Use user privilege for RID2PASID translation cxgb4: avoid accessing registers when clearing filters staging: emxx_udc: fix loop in _nbu2ss_nuke() ASoC: cs35l33: fix an error code in probe() bpf, offload: Reorder offload callback 'prepare' in verifier bpf: Set mac_len in bpf_skb_change_head ixgbe: fix large MTU request from VF ASoC: qcom: lpass-cpu: Use optional clk APIs scsi: libsas: Use _safe() loop in sas_resume_port() net: lantiq: fix memory corruption in RX ring ipv6: record frag_max_size in atomic fragments in input path ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create() can be static net: ethernet: mtk_eth_soc: Fix packet statistics support for MT7628/88 sch_dsmark: fix a NULL deref in qdisc_reset() net: hsr: fix mac_len checks MIPS: alchemy: xxs1500: add gpio-au1000.h header file MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c net: zero-initialize tc skb extension on allocation net: mvpp2: add buffer header handling in RX i915: fix build warning in intel_dp_get_link_status() samples/bpf: Consider frame size in tx_only of xdpsock sample net: hns3: check the return of skb_checksum_help() bpftool: Add sock_release help info for cgroup attach/prog load command SUNRPC: More fixes for backlog congestion Revert "Revert "ALSA: usx2y: Fix potential NULL pointer dereference"" net: hso: bail out on interrupt URB allocation failure scripts/clang-tools: switch explicitly to Python 3 neighbour: Prevent Race condition in neighbour subsytem usb: core: reduce power-on-good delay time of root hub Linux 5.10.42 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I05d98d1355a080e0951b4b2ae77f0a9ccb6dfc5d	2021-06-03 18:47:38 +02:00
David Howells	ee8a8dd10e	afs: Fix the nlink handling of dir-over-dir rename ... commit f610a5a29c upstream. Fix rename of one directory over another such that the nlink on the deleted directory is cleared to 0 rather than being decremented to 1. This was causing the generic/035 xfstest to fail. Fixes: e49c7b2f6d ("afs: Build an abstraction around an "operation" concept") Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Marc Dionne <marc.dionne@auristor.com> cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/162194384460.3999479.7605572278074191079.stgit@warthog.procyon.org.uk/ # v1 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-06-03 09:00:39 +02:00
Greg Kroah-Hartman	e054456ced	Merge 5.10.37 into android12-5.10 ... Changes in 5.10.37 Bluetooth: verify AMP hci_chan before amp_destroy bluetooth: eliminate the potential race condition when removing the HCI controller net/nfc: fix use-after-free llcp_sock_bind/connect io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL" usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() tty: moxa: fix TIOCSSERIAL jiffies conversions tty: amiserial: fix TIOCSSERIAL permission check USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions staging: greybus: uart: fix TIOCSSERIAL jiffies conversions USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check staging: fwserial: fix TIOCSSERIAL jiffies conversions tty: moxa: fix TIOCSSERIAL permission check staging: fwserial: fix TIOCSSERIAL permission check drm: bridge: fix LONTIUM use of mipi_dsi_() functions usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply usb: typec: tcpm: update power supply once partner accepts usb: xhci-mtk: remove or operator for setting schedule parameters usb: xhci-mtk: improve bandwidth scheduling with TT ASoC: samsung: tm2_wm5110: check of of_parse return value ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function ASoC: tlv320aic32x4: Register clocks before registering component ASoC: tlv320aic32x4: Increase maximum register in regmap MIPS: pci-mt7620: fix PLL lock check MIPS: pci-rt2880: fix slot 0 configuration FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR PCI: Allow VPD access for QLogic ISP2722 KVM: x86: Defer the MMU unload to the normal path on an global INVPCID PCI: xgene: Fix cfg resource mapping PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c PM / devfreq: Unlock mutex and free devfreq struct in error path soc/tegra: regulators: Fix locking up when voltage-spread is out of range iio: inv_mpu6050: Fully validate gyro and accel scale writes iio:accel:adis16201: Fix wrong axis assignment that prevents loading iio:adc:ad7476: Fix remove handling sc16is7xx: Defer probe if device read fails phy: cadence: Sierra: Fix PHY power_on sequence misc: lis3lv02d: Fix false-positive WARN on various HP models phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create() misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct misc: vmw_vmci: explicitly initialize vmci_datagram payload selinux: add proper NULL termination to the secclass_map permissions x86, sched: Treat Intel SNC topology as default, COD as exception async_xor: increase src_offs when dropping destination page md/bitmap: wait for external bitmap writes to complete during tear down md-cluster: fix use-after-free issue when removing rdev md: split mddev_find md: factor out a mddev_find_locked helper from mddev_find md: md_open returns -EBUSY when entering racing area md: Fix missing unused status line of /proc/mdstat mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put() ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() cfg80211: scan: drop entry from hidden_list on overflow rtw88: Fix array overrun in rtw_get_tx_power_params() mt76: fix potential DMA mapping leak FDDI: defxx: Make MMIO the configuration default except for EISA drm/i915/gvt: Fix virtual display setup for BXT/APL drm/i915/gvt: Fix vfio_edid issue for BXT/APL drm/qxl: use ttm bo priorities drm/panfrost: Clear MMU irqs before handling the fault drm/panfrost: Don't try to map pages that are already mapped drm/radeon: fix copy of uninitialized variable back to userspace drm/dp_mst: Revise broadcast msg lct & lcr drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast drm: bridge/panel: Cleanup connector on bridge detach drm/amd/display: Reject non-zero src_y and src_x for video planes drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2 ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries ALSA: hda/realtek: Re-order ALC269 HP quirk table entries ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries ALSA: hda/realtek: Re-order ALC662 quirk table entries ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32 KVM: s390: VSIE: correctly handle MVPG when in VSIE KVM: s390: split kvm_s390_logical_to_effective KVM: s390: fix guarded storage control register handling s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility KVM: s390: VSIE: fix MVPG handling for prefixing and MSO KVM: s390: split kvm_s390_real_to_abs KVM: s390: extend kvm_s390_shadow_fault to return entry pointer KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads KVM: nSVM: Set the shadow root level to the TDP level for nested NPT KVM: SVM: Don't strip the C-bit from CR2 on #PF interception KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU KVM: Stop looking for coalesced MMIO zones if the bus is destroyed KVM: arm64: Fully zero the vcpu state on reset KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit" Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" ovl: fix missing revert_creds() on error path Revert "drm/qxl: do not run release if qxl failed to init" usb: gadget: pch_udc: Revert d3cb25a121 completely Revert "tools/power turbostat: adjust for temperature offset" firmware: xilinx: Fix dereferencing freed memory firmware: xilinx: Add a blank line after function declaration firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE) fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER crypto: sun8i-ss - fix result memory leak on error path memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100 ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 ARM: dts: exynos: correct PMIC interrupt trigger level on Snow ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files arm64: dts: renesas: Add mmc aliases into board dts files x86/platform/uv: Set section block size for hubless architectures serial: stm32: fix code cleaning warnings and checks serial: stm32: add "_usart" prefix in functions name serial: stm32: fix probe and remove order for dma serial: stm32: Use of_device_get_match_data() serial: stm32: fix startup by enabling usart for reception serial: stm32: fix incorrect characters on console serial: stm32: fix TX and RX FIFO thresholds serial: stm32: fix a deadlock condition with wakeup event serial: stm32: fix wake-up flag handling serial: stm32: fix a deadlock in set_termios serial: stm32: fix tx dma completion, release channel serial: stm32: call stm32_transmit_chars locked serial: stm32: fix FIFO flush in startup and set_termios serial: stm32: add FIFO flush when port is closed serial: stm32: fix tx_empty condition usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS usb: typec: tps6598x: Fix return value check in tps6598x_probe() usb: typec: stusb160x: fix return value check in stusb160x_probe() regmap: set debugfs_name to NULL after it is freed spi: rockchip: avoid objtool warning mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() mtd: rawnand: qcom: Return actual error code instead of -ENODEV mtd: don't lock when recursively deleting partitions mtd: maps: fix error return code of physmap_flash_remove() ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer arm64: dts: qcom: sdm845: fix number of pins in 'gpio-ranges' arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges' arm64: dts: qcom: sm8250: fix number of pins in 'gpio-ranges' arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map spi: stm32: drop devres version of spi_register_master regulator: bd9576: Fix return from bd957x_probe() arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding spi: stm32: Fix use-after-free on unbind x86/microcode: Check for offline CPUs before requesting new microcode devtmpfs: fix placement of complete() call usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() usb: gadget: pch_udc: Check if driver is present before calling ->setup() usb: gadget: pch_udc: Check for DMA mapping error usb: gadget: pch_udc: Initialize device pointer before use usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1) crypto: ccp - fix command queuing to TEE ring buffer crypto: qat - don't release uninitialized resources crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init fotg210-udc: Fix DMA on EP0 for length > max packet size fotg210-udc: Fix EP0 IN requests bigger than two packets fotg210-udc: Remove a dubious condition leading to fotg210_done fotg210-udc: Mask GRP2 interrupts we don't handle fotg210-udc: Don't DMA more than the buffer can take fotg210-udc: Complete OUT requests on short packets usb: gadget: s3c: Fix incorrect resources releasing usb: gadget: s3c: Fix the error handling path in 's3c2410_udc_probe()' dt-bindings: serial: stm32: Use 'type: object' instead of false for 'additionalProperties' mtd: require write permissions for locking and badblock ioctls arm64: dts: renesas: r8a779a0: Fix PMU interrupt bus: qcom: Put child node before return soundwire: bus: Fix device found flag correctly phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally arm64: dts: mediatek: fix reset GPIO level on pumpkin NFSD: Fix sparse warning in nfs4proc.c NFSv4.2: fix copy stateid copying for the async copy crypto: poly1305 - fix poly1305_core_setkey() declaration crypto: qat - fix error path in adf_isr_resource_alloc() usb: gadget: aspeed: fix dma map failure USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() drivers: nvmem: Fix voltage settings for QTI qfprom-efuse driver core: platform: Declare early_platform_cleanup() prototype memory: pl353: fix mask of ECC page_size config register soundwire: stream: fix memory leak in stream config error path m68k: mvme147,mvme16x: Don't wipe PCC timer config bits firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool firmware: qcom_scm: Reduce locking section for __get_convention() firmware: qcom_scm: Workaround lack of "is available" call on SC7180 iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init irqchip/gic-v3: Fix OF_BAD_ADDR error handling staging: comedi: tests: ni_routes_test: Fix compilation error staging: rtl8192u: Fix potential infinite loop staging: fwserial: fix TIOCSSERIAL implementation staging: fwserial: fix TIOCGSERIAL implementation staging: greybus: uart: fix unprivileged TIOCCSERIAL soc: qcom: pdr: Fix error return code in pdr_register_listener PM / devfreq: Use more accurate returned new_freq as resume_freq clocksource/drivers/timer-ti-dm: Fix posted mode status check order clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe() spi: Fix use-after-free with devm_spi_alloc_* spi: fsl: add missing iounmap() on error in of_fsl_spi_probe() soc: qcom: mdt_loader: Validate that p_filesz < p_memsz soc: qcom: mdt_loader: Detect truncated read of segments PM: runtime: Replace inline function pm_runtime_callbacks_present() cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration ACPI: CPPC: Replace cppc_attr with kobj_attribute crypto: allwinner - add missing CRYPTO_ prefix crypto: sun8i-ss - Fix memory leak of pad crypto: sa2ul - Fix memory leak of rxd crypto: qat - Fix a double free in adf_create_ring cpufreq: armada-37xx: Fix setting TBG parent for load levels clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock cpufreq: armada-37xx: Fix the AVS value for load L1 clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0 cpufreq: armada-37xx: Fix driver cleanup when registration failed cpufreq: armada-37xx: Fix determining base CPU frequency spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op not interruptible spi: spi-zynqmp-gqspi: add mutex locking for exec_op spi: spi-zynqmp-gqspi: transmit dummy circles by using the controller's internal functionality spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware() usb: gadget: r8a66597: Add missing null check on return from platform_get_resource USB: cdc-acm: fix unprivileged TIOCCSERIAL USB: cdc-acm: fix TIOCGSERIAL implementation tty: actually undefine superseded ASYNC flags tty: fix return value for unsupported ioctls tty: Remove dead termiox code tty: fix return value for unsupported termiox ioctls serial: core: return early on unsupported ioctls firmware: qcom-scm: Fix QCOM_SCM configuration node: fix device cleanups in error handling code crypto: chelsio - Read rxchannel-id from firmware usbip: vudc: fix missing unlock on error in usbip_sockfd_store() m68k: Add missing mmap_read_lock() to sys_cacheflush() spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op() memory: renesas-rpc-if: fix possible NULL pointer dereference of resource memory: samsung: exynos5422-dmc: handle clk_set_parent() failure security: keys: trusted: fix TPM2 authorizations platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table ARM: dts: aspeed: Rainier: Fix humidity sensor bus address Drivers: hv: vmbus: Use after free in __vmbus_open() spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails x86/platform/uv: Fix !KEXEC build failure hwmon: (pmbus/pxe1610) don't bail out when not all pages are active Drivers: hv: vmbus: Increase wait time for VMbus unload PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. usb: dwc2: Fix hibernation between host and device modes. ttyprintk: Add TTY hangup callback. serial: omap: don't disable rs485 if rts gpio is missing serial: omap: fix rs485 half-duplex filtering xen-blkback: fix compatibility bug with single page rings soc: aspeed: fix a ternary sign expansion bug drm/tilcdc: send vblank event when disabling crtc drm/stm: Fix bus_flags handling drm/amd/display: Fix off by one in hdmi_14_process_transaction() drm/mcde/panel: Inverse misunderstood flag sched/fair: Fix shift-out-of-bounds in load_balance() afs: Fix updating of i_mode due to 3rd party change rcu: Remove spurious instrumentation_end() in rcu_nmi_enter() media: vivid: fix assignment of dev->fbuf_out_flags media: saa7134: use sg_dma_len when building pgtable media: saa7146: use sg_dma_len when building pgtable media: omap4iss: return error code when omap4iss_get() failed media: rkisp1: rsz: crash fix when setting src format media: aspeed: fix clock handling logic drm/probe-helper: Check epoch counter in output_poll_execute() media: venus: core: Fix some resource leaks in the error path of 'venus_probe()' media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_streaming() media: m88ds3103: fix return value check in m88ds3103_probe() media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30 media: [next] staging: media: atomisp: fix memory leak of object flash media: atomisp: Fixed error handling path media: m88rs6000t: avoid potential out-of-bounds reads on arrays media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() drm/amdkfd: fix build error with AMD_IOMMU_V2=m of: overlay: fix for_each_child.cocci warnings x86/kprobes: Fix to check non boostable prefixes correctly selftests: fix prepending $(OUTPUT) to $(TEST_PROGS) pata_arasan_cf: fix IRQ check pata_ipx4xx_cf: fix IRQ check sata_mv: add IRQ checks ata: libahci_platform: fix IRQ check seccomp: Fix CONFIG tests for Seccomp_filters nvme-tcp: block BH in sk state_change sk callback nvmet-tcp: fix incorrect locking in state_change sk callback clk: imx: Fix reparenting of UARTs not associated with stdout power: supply: bq25980: Move props from battery node nvme: retrigger ANA log update if group descriptor isn't found media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream media: i2c: imx219: Balance runtime PM use-count media: v4l2-ctrls.c: fix race condition in hdl->requests list vfio/fsl-mc: Re-order vfio_fsl_mc_probe() vfio/pci: Move VGA and VF initialization to functions vfio/pci: Re-order vfio_pci_probe() vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train() clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct drm/radeon: Fix a missing check bug in radeon_dp_mst_detect() clk: uniphier: Fix potential infinite loop scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check() scsi: pm80xx: Fix potential infinite loop scsi: ufs: ufshcd-pltfrm: Fix deferred probing scsi: hisi_sas: Fix IRQ checks scsi: jazz_esp: Add IRQ check scsi: sun3x_esp: Add IRQ check scsi: sni_53c710: Add IRQ check scsi: ibmvfc: Fix invalid state machine BUG_ON() mailbox: sprd: Introduce refcnt when clients requests/free channels mfd: stm32-timers: Avoid clearing auto reload register nvmet-tcp: fix a segmentation fault during io parsing error nvme-pci: don't simple map sgl when sgls are disabled media: cedrus: Fix H265 status definitions HSI: core: fix resource leaks in hsi_add_client_from_dt() x86/events/amd/iommu: Fix sysfs type mismatch perf/amd/uncore: Fix sysfs type mismatch io_uring: fix overflows checks in provide buffers sched/debug: Fix cgroup_path[] serialization drivers/block/null_blk/main: Fix a double free in null_init. xsk: Respect device's headroom and tailroom on generic xmit path HID: plantronics: Workaround for double volume key presses perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars ASoC: Intel: boards: sof-wm8804: add check for PLL setting ASoC: Intel: Skylake: Compile when any configuration is selected RDMA/mlx5: Fix mlx5 rates to IB rates map wilc1000: write value to WILC_INTR2_ENABLE register KVM: x86/mmu: Retry page faults that hit an invalid memslot Bluetooth: avoid deadlock between hci_dev->lock and socket lock net: lapbether: Prevent racing when checking whether the netif is running libbpf: Add explicit padding to bpf_xdp_set_link_opts bpftool: Fix maybe-uninitialized warnings iommu: Check dev->iommu in iommu_dev_xxx functions iommu/vt-d: Reject unsupported page request modes selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed libbpf: Add explicit padding to btf_dump_emit_type_decl_opts powerpc/fadump: Mark fadump_calculate_reserve_size as __init powerpc/prom: Mark identical_pvr_fixup as __init MIPS: fix local_irq_{disable,enable} in asmmacro.h ima: Fix the error code for restoring the PCR value inet: use bigger hash table for IP ID generation pinctrl: pinctrl-single: remove unused parameter pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero MIPS: loongson64: fix bug when PAGE_SIZE > 16KB ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK RDMA/mlx5: Fix drop packet rule in egress table IB/isert: Fix a use after free in isert_connect_request powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP ALSA: core: remove redundant spin_lock pair in snd_card_disconnect net: phy: lan87xx: fix access to wrong register of LAN87xx udp: never accept GSO_FRAGLIST packets powerpc/pseries: Only register vio drivers if vio bus exists net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start() bug: Remove redundant condition check in report_bug RDMA/core: Fix corrupted SL on passive side nfc: pn533: prevent potential memory corruption net: hns3: Limiting the scope of vector_ring_chain variable mips: bmips: fix syscon-reboot nodes iommu/vt-d: Don't set then clear private data in prq_event_thread() iommu: Fix a boundary issue to avoid performance drop iommu/vt-d: Report right snoop capability when using FL for IOVA iommu/vt-d: Report the right page fault address iommu/vt-d: Preset Access/Dirty bits for IOVA over FL iommu/vt-d: Remove WO permissions on second-level paging entries iommu/vt-d: Invalidate PASID cache when root/context entry changed ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event() HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE KVM: arm64: Initialize VCPU mdcr_el2 before loading it ASoC: simple-card: fix possible uninitialized single_cpu local variable liquidio: Fix unintented sign extension of a left shift of a u16 IB/hfi1: Use kzalloc() for mmu_rb_handler allocation powerpc/64s: Fix pte update for kernel memory on radix powerpc/perf: Fix PMU constraint check for EBB events powerpc: iommu: fix build when neither PCI or IBMVIO is set mac80211: bail out if cipher schemes are invalid perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric xfs: fix return of uninitialized value in variable error rtw88: Fix an error code in rtw_debugfs_set_rsvd_page() mt7601u: fix always true expression mt76: mt7615: fix tx skb dma unmap mt76: mt7915: fix tx skb dma unmap mt76: mt7915: fix aggr len debugfs node mt76: mt7615: fix mib stats counter reporting to mac80211 mt76: mt7915: fix mib stats counter reporting to mac80211 mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation mt76: mt7663s: fix the possible device hang in high traffic KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit ovl: invalidate readdir cache on changes to dir with origin RDMA/qedr: Fix error return code in qedr_iw_connect() IB/hfi1: Fix error return code in parse_platform_config() RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() cxgb4: Fix unintentional sign extension issues net: thunderx: Fix unintentional sign extension issue RDMA/srpt: Fix error return code in srpt_cm_req_recv() RDMA/rtrs-clt: destroy sysfs after removing session from active list i2c: cadence: fix reference leak when pm_runtime_get_sync fails i2c: img-scb: fix reference leak when pm_runtime_get_sync fails i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails i2c: imx: fix reference leak when pm_runtime_get_sync fails i2c: omap: fix reference leak when pm_runtime_get_sync fails i2c: sprd: fix reference leak when pm_runtime_get_sync fails i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails i2c: xiic: fix reference leak when pm_runtime_get_sync fails i2c: cadence: add IRQ check i2c: emev2: add IRQ check i2c: jz4780: add IRQ check i2c: mlxbf: add IRQ check i2c: rcar: make sure irq is not threaded on Gen2 and earlier i2c: rcar: protect against supurious interrupts on V3U i2c: rcar: add IRQ check i2c: sh7760: add IRQ check powerpc/xive: Drop check on irq_data in xive_core_debug_show() powerpc/xive: Fix xmon command "dxi" ASoC: ak5558: correct reset polarity net/mlx5: Fix bit-wise and with zero net/packet: make packet_fanout.arr size configurable up to 64K net/packet: remove data races in fanout operations drm/i915/gvt: Fix error code in intel_gvt_init_device() iommu/amd: Put newline after closing bracket in warning perf beauty: Fix fsconfig generator drm/amd/pm: fix error code in smu_set_power_limit() MIPS: pci-legacy: stop using of_pci_range_to_resource powerpc/pseries: extract host bridge from pci_bus prior to bus removal powerpc/smp: Reintroduce cpu_core_mask KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid rtlwifi: 8821ae: upgrade PHY and RF parameters wlcore: fix overlapping snprintf arguments in debugfs i2c: sh7760: fix IRQ error path i2c: mediatek: Fix wrong dma sync flag mwl8k: Fix a double Free in mwl8k_probe_hw netfilter: nft_payload: fix C-VLAN offload support netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector netfilter: nftables_offload: special ethertype handling for VLAN vsock/vmci: log once the failed queue pair allocation libbpf: Initialize the bpf_seq_printf parameters array field by field net: ethernet: ixp4xx: Set the DMA masks explicitly gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check RDMA/cxgb4: add missing qpid increment RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails sfc: ef10: fix TX queue lookup in TX event handling vsock/virtio: free queued packets when closing socket net: marvell: prestera: fix port event handling on init net: davinci_emac: Fix incorrect masking of tx and rx error channel mt76: mt7615: fix memleak when mt7615_unregister_device() crypto: ccp: Detect and reject "invalid" addresses destined for PSP nfp: devlink: initialize the devlink port attribute "lanes" net: stmmac: fix TSO and TBS feature enabling during driver open net: renesas: ravb: Fix a stuck issue when a lot of frames are received net: phy: intel-xway: enable integrated led functions RDMA/rxe: Fix a bug in rxe_fill_ip_info() RDMA/core: Add CM to restrack after successful attachment to a device powerpc/64: Fix the definition of the fixmap area ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices ath10k: Fix a use after free in ath10k_htc_send_bundle ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock wlcore: Fix buffer overrun by snprintf due to incorrect buffer size powerpc/perf: Fix the threshold event selection for memory events in power10 powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add') net: phy: marvell: fix m88e1011_set_downshift net: phy: marvell: fix m88e1111_set_downshift net: enetc: fix link error again bnxt_en: fix ternary sign extension bug in bnxt_show_temp() ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test bnxt_en: Fix RX consumer index logic in the error path. KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro selftests/bpf: Fix field existence CO-RE reloc tests selftests/bpf: Fix core_reloc test runner bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds RDMA/siw: Fix a use after free in siw_alloc_mr RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res net: bridge: mcast: fix broken length + header check for MRDv6 Adv. net:nfc:digital: Fix a double free in digital_tg_recv_dep_req perf tools: Change fields type in perf_record_time_conv perf jit: Let convert_timestamp() to be backwards-compatible perf session: Add swap operation for event TIME_CONV ia64: fix EFI_DEBUG build kfifo: fix ternary sign extension bugs mm/sl?b.c: remove ctor argument from kmem_cache_flags mm: memcontrol: slab: fix obtain a reference to a freeing memcg mm/sparse: add the missing sparse_buffer_fini() in error branch mm/memory-failure: unnecessary amount of unmapping afs: Fix speculative status fetches bpf: Fix alu32 const subreg bound tracking on bitwise operations bpf, ringbuf: Deny reserve of buffers larger than ringbuf bpf: Prevent writable memory-mapping of read-only ringbuf pages arm64: Remove arm64_dma32_phys_limit and its uses net: Only allow init netns to set default tcp cong to a restricted algo smp: Fix smp_call_function_single_async prototype Revert "net/sctp: fix race condition in sctp_destroy_sock" sctp: delay auto_asconf init until binding the first addr Linux 5.10.37 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5bee89c285d9dd72de967b0e70d96951ae4e06ae	2021-05-15 09:28:55 +02:00
David Howells	f76e0829bb	afs: Fix speculative status fetches ... [ Upstream commit 22650f1481 ] The generic/464 xfstest causes kAFS to emit occasional warnings of the form: kAFS: vnode modified {100055:8a} 30->31 YFS.StoreData64 (c=6015) This indicates that the data version received back from the server did not match the expected value (the DV should be incremented monotonically for each individual modification op committed to a vnode). What is happening is that a lookup call is doing a bulk status fetch speculatively on a bunch of vnodes in a directory besides getting the status of the vnode it's actually interested in. This is racing with a StoreData operation (though it could also occur with, say, a MakeDir op). On the client, a modification operation locks the vnode, but the bulk status fetch only locks the parent directory, so no ordering is imposed there (thereby avoiding an avenue to deadlock). On the server, the StoreData op handler doesn't lock the vnode until it's received all the request data, and downgrades the lock after committing the data until it has finished sending change notifications to other clients - which allows the status fetch to occur before it has finished. This means that: - a status fetch can access the target vnode either side of the exclusive section of the modification - the status fetch could start before the modification, yet finish after, and vice-versa. - the status fetch and the modification RPCs can complete in either order. - the status fetch can return either the before or the after DV from the modification. - the status fetch might regress the locally cached DV. Some of these are handled by the previous fix[1], but that's not sufficient because it checks the DV it received against the DV it cached at the start of the op, but the DV might've been updated in the meantime by a locally generated modification op. Fix this by the following means: (1) Keep track of when we're performing a modification operation on a vnode. This is done by marking vnode parameters with a 'modification' note that causes the AFS_VNODE_MODIFYING flag to be set on the vnode for the duration. (2) Alter the speculation race detection to ignore speculative status fetches if either the vnode is marked as being modified or the data version number is not what we expected. Note that whilst the "vnode modified" warning does get recovered from as it causes the client to refetch the status at the next opportunity, it will also invalidate the pagecache, so changes might get lost. Fixes: a9e5c87ca7 ("afs: Fix speculative status fetch going out of order wrt to modifications") Reported-by: Marc Dionne <marc.dionne@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com> Tested-and-reviewed-by: Marc Dionne <marc.dionne@auristor.com> cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/160605082531.252452.14708077925602709042.stgit@warthog.procyon.org.uk/ [1] Link: https://lore.kernel.org/linux-fsdevel/161961335926.39335.2552653972195467566.stgit@warthog.procyon.org.uk/ # v1 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-05-14 09:50:45 +02:00
David Howells	95f4e9f33b	afs: Fix updating of i_mode due to 3rd party change ... [ Upstream commit 6e1eb04a87 ] Fix afs_apply_status() to mask off the irrelevant bits from status->mode when OR'ing them into i_mode. This can happen when a 3rd party chmod occurs. Also fix afs_inode_init_from_status() to mask off the mode bits when initialising i_mode. Fixes: 260a980317 ("[AFS]: Add "directory write" support.") Reported-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-05-14 09:50:22 +02:00
Greg Kroah-Hartman	57b60a3a15	Merge 5.10.26 into android12-5.10-lts ... Changes in 5.10.26 ASoC: ak4458: Add MODULE_DEVICE_TABLE ASoC: ak5558: Add MODULE_DEVICE_TABLE spi: cadence: set cqspi to the driver_data field of struct device ALSA: dice: fix null pointer dereference when node is disconnected ALSA: hda/realtek: apply pin quirk for XiaomiNotebook Pro ALSA: hda: generic: Fix the micmute led init state ALSA: hda/realtek: Apply headset-mic quirks for Xiaomi Redmibook Air ALSA: hda/realtek: fix mute/micmute LEDs for HP 840 G8 ALSA: hda/realtek: fix mute/micmute LEDs for HP 440 G8 ALSA: hda/realtek: fix mute/micmute LEDs for HP 850 G8 Revert "PM: runtime: Update device status before letting suppliers suspend" s390/vtime: fix increased steal time accounting s390/pci: refactor zpci_create_device() s390/pci: remove superfluous zdev->zbus check s390/pci: fix leak of PCI device structure zonefs: Fix O_APPEND async write handling zonefs: prevent use of seq files as swap file zonefs: fix to update .i_wr_refcnt correctly in zonefs_open_zone() btrfs: fix race when cloning extent buffer during rewind of an old root btrfs: fix slab cache flags for free space tree bitmap vhost-vdpa: fix use-after-free of v->config_ctx vhost-vdpa: set v->config_ctx to NULL if eventfd_ctx_fdget() fails drm/amd/display: Correct algorithm for reversed gamma ASoC: fsl_ssi: Fix TDM slot setup for I2S mode ASoC: Intel: bytcr_rt5640: Fix HP Pavilion x2 10-p0XX OVCD current threshold ASoC: SOF: Intel: unregister DMIC device on probe error ASoC: SOF: intel: fix wrong poll bits in dsp power down ASoC: qcom: sdm845: Fix array out of bounds access ASoC: qcom: sdm845: Fix array out of range on rx slim channels ASoC: codecs: wcd934x: add a sanity check in set channel map ASoC: qcom: lpass-cpu: Fix lpass dai ids parse ASoC: simple-card-utils: Do not handle device clock afs: Fix accessing YFS xattrs on a non-YFS server afs: Stop listxattr() from listing "afs.*" attributes ALSA: usb-audio: Fix unintentional sign extension issue nvme: fix Write Zeroes limitations nvme-tcp: fix misuse of __smp_processor_id with preemption enabled nvme-tcp: fix possible hang when failing to set io queues nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU nvmet: don't check iosqes,iocqes for discovery controllers nfsd: Don't keep looking up unhashed files in the nfsd file cache nfsd: don't abort copies early NFSD: Repair misuse of sv_lock in 5.10.16-rt30. NFSD: fix dest to src mount in inter-server COPY svcrdma: disable timeouts on rdma backchannel vfio: IOMMU_API should be selected vhost_vdpa: fix the missing irq_bypass_unregister_producer() invocation sunrpc: fix refcount leak for rpc auth modules i915/perf: Start hrtimer only if sampling the OA buffer pstore: Fix warning in pstore_kill_sb() io_uring: ensure that SQPOLL thread is started for exit net/qrtr: fix __netdev_alloc_skb call kbuild: Fix <linux/version.h> for empty SUBLEVEL or PATCHLEVEL again cifs: fix allocation size on newly created files riscv: Correct SPARSEMEM configuration scsi: lpfc: Fix some error codes in debugfs scsi: myrs: Fix a double free in myrs_cleanup() scsi: ufs: ufs-mediatek: Correct operator & -> && RISC-V: correct enum sbi_ext_rfence_fid counter: stm32-timer-cnt: Report count function when SLAVE_MODE_DISABLED gpiolib: Assign fwnode to parent's if no primary one provided nvme-rdma: fix possible hang when failing to set io queues ibmvnic: add some debugs ibmvnic: serialize access to work queue on remove tty: serial: stm32-usart: Remove set but unused 'cookie' variables serial: stm32: fix DMA initialization error handling bpf: Declare __bpf_free_used_maps() unconditionally RDMA/rtrs: Remove unnecessary argument dir of rtrs_iu_free RDMA/rtrs-srv: Jump to dereg_mr label if allocate iu fails RDMA/rtrs: Introduce rtrs_post_send RDMA/rtrs: Fix KASAN: stack-out-of-bounds bug module: merge repetitive strings in module_sig_check() module: avoid *goto*s in module_sig_check() module: harden ELF info handling scsi: pm80xx: Make mpi_build_cmd locking consistent scsi: pm80xx: Make running_req atomic scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition scsi: pm8001: Neaten debug logging macros and uses scsi: libsas: Remove notifier indirection scsi: libsas: Introduce a _gfp() variant of event notifiers scsi: mvsas: Pass gfp_t flags to libsas event notifiers scsi: isci: Pass gfp_t flags in isci_port_link_down() scsi: isci: Pass gfp_t flags in isci_port_link_up() scsi: isci: Pass gfp_t flags in isci_port_bc_change_received() RDMA/mlx5: Allow creating all QPs even when non RDMA profile is used powerpc/sstep: Fix load-store and update emulation powerpc/sstep: Fix darn emulation i40e: Fix endianness conversions net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8081 MIPS: compressed: fix build with enabled UBSAN drm/amd/display: turn DPMS off on connector unplug iwlwifi: Add a new card for MA family io_uring: fix inconsistent lock state media: cedrus: h264: Support profile controls ibmvnic: remove excessive irqsave s390/qeth: schedule TX NAPI on QAOB completion drm/amd/pm: fulfill the Polaris implementation for get_clock_by_type_with_latency() io_uring: don't attempt IO reissue from the ring exit path io_uring: clear IOCB_WAITQ for non -EIOCBQUEUED return net: bonding: fix error return code of bond_neigh_init() regulator: pca9450: Add SD_VSEL GPIO for LDO5 regulator: pca9450: Enable system reset on WDOG_B assertion regulator: pca9450: Clear PRESET_EN bit to fix BUCK1/2/3 voltage setting gfs2: Add common helper for holding and releasing the freeze glock gfs2: move freeze glock outside the make_fs_rw and _ro functions gfs2: bypass signal_our_withdraw if no journal powerpc: Force inlining of cpu_has_feature() to avoid build failure usb-storage: Add quirk to defeat Kindle's automatic unload usbip: Fix incorrect double assignment to udc->ud.tcp_rx usb: gadget: configfs: Fix KASAN use-after-free usb: typec: Remove vdo[3] part of tps6598x_rx_identity_reg struct usb: typec: tcpm: Invoke power_supply_changed for tcpm-source-psy- usb: dwc3: gadget: Allow runtime suspend if UDC unbinded usb: dwc3: gadget: Prevent EP queuing while stopping transfers thunderbolt: Initialize HopID IDAs in tb_switch_alloc() thunderbolt: Increase runtime PM reference count on DP tunnel discovery iio:adc:stm32-adc: Add HAS_IOMEM dependency iio:adc:qcom-spmi-vadc: add default scale to LR_MUX2_BAT_ID channel iio: adis16400: Fix an error code in adis16400_initial_setup() iio: gyro: mpu3050: Fix error handling in mpu3050_trigger_handler iio: adc: ab8500-gpadc: Fix off by 10 to 3 iio: adc: ad7949: fix wrong ADC result due to incorrect bit mask iio: adc: adi-axi-adc: add proper Kconfig dependencies iio: hid-sensor-humidity: Fix alignment issue of timestamp channel iio: hid-sensor-prox: Fix scale not correct issue iio: hid-sensor-temperature: Fix issues of timestamp channel counter: stm32-timer-cnt: fix ceiling write max value counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register PCI: rpadlpar: Fix potential drc_name corruption in store functions perf/x86/intel: Fix a crash caused by zero PEBS status perf/x86/intel: Fix unchecked MSR access error caused by VLBR_EVENT x86/ioapic: Ignore IRQ2 again kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data() x86: Move TS_COMPAT back to asm/thread_info.h x86: Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall() efivars: respect EFI_UNSUPPORTED return from firmware ext4: fix error handling in ext4_end_enable_verity() ext4: find old entry again if failed to rename whiteout ext4: stop inode update before return ext4: do not try to set xattr into ea_inode if value is empty ext4: fix potential error in ext4_do_update_inode ext4: fix rename whiteout with fast commit MAINTAINERS: move some real subsystems off of the staging mailing list MAINTAINERS: move the staging subsystem to lists.linux.dev static_call: Fix static_call_update() sanity check efi: use 32-bit alignment for efi_guid_t literals firmware/efi: Fix a use after bug in efi_mem_reserve_persistent genirq: Disable interrupts for force threaded handlers x86/apic/of: Fix CPU devicetree-node lookups cifs: Fix preauth hash corruption Linux 5.10.26 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I6f6bdd1dc46dc744c848e778f9edd0be558b46ac	2021-03-25 17:15:27 +01:00
David Howells	64195f022a	afs: Stop listxattr() from listing "afs.*" attributes ... commit a7889c6320 upstream. afs_listxattr() lists all the available special afs xattrs (i.e. those in the "afs.*" space), no matter what type of server we're dealing with. But OpenAFS servers, for example, cannot deal with some of the extra-capable attributes that AuriStor (YFS) servers provide. Unfortunately, the presence of the afs.yfs.* attributes causes errors[1] for anything that tries to read them if the server is of the wrong type. Fix the problem by removing afs_listxattr() so that none of the special xattrs are listed (AFS doesn't support xattrs). It does mean, however, that getfattr won't list them, though they can still be accessed with getxattr() and setxattr(). This can be tested with something like: getfattr -d -m ".*" /afs/example.com/path/to/file With this change, none of the afs.* attributes should be visible. Changes: ver #2: - Hide all of the afs.* xattrs, not just the ACL ones. Fixes: ae46578b96 ("afs: Get YFS ACLs and information through xattrs") Reported-by: Gaja Sophie Peters <gaja.peters@math.uni-hamburg.de> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Gaja Sophie Peters <gaja.peters@math.uni-hamburg.de> Reviewed-by: Jeffrey Altman <jaltman@auristor.com> Reviewed-by: Marc Dionne <marc.dionne@auristor.com> cc: linux-afs@lists.infradead.org Link: http://lists.infradead.org/pipermail/linux-afs/2021-March/003502.html [1] Link: http://lists.infradead.org/pipermail/linux-afs/2021-March/003567.html # v1 Link: http://lists.infradead.org/pipermail/linux-afs/2021-March/003573.html # v2 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-25 09:04:07 +01:00
David Howells	78ba4793b0	afs: Fix accessing YFS xattrs on a non-YFS server ... commit 64fcbb6158 upstream. If someone attempts to access YFS-related xattrs (e.g. afs.yfs.acl) on a file on a non-YFS AFS server (such as OpenAFS), then the kernel will jump to a NULL function pointer because the afs_fetch_acl_operation descriptor doesn't point to a function for issuing an operation on a non-YFS server[1]. Fix this by making afs_wait_for_operation() check that the issue_afs_rpc method is set before jumping to it and setting -ENOTSUPP if not. This fix also covers other potential operations that also only exist on YFS servers. afs_xattr_get/set_yfs() then need to translate -ENOTSUPP to -ENODATA as the former error is internal to the kernel. The bug shows up as an oops like the following: BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [...] Call Trace: afs_wait_for_operation+0x83/0x1b0 [kafs] afs_xattr_get_yfs+0xe6/0x270 [kafs] __vfs_getxattr+0x59/0x80 vfs_getxattr+0x11c/0x140 getxattr+0x181/0x250 ? __check_object_size+0x13f/0x150 ? __fput+0x16d/0x250 __x64_sys_fgetxattr+0x64/0xb0 do_syscall_64+0x49/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fb120a9defe This was triggered with "cp -a" which attempts to copy xattrs, including afs ones, but is easier to reproduce with getfattr, e.g.: getfattr -d -m ".*" /afs/openafs.org/ Fixes: e49c7b2f6d ("afs: Build an abstraction around an "operation" concept") Reported-by: Gaja Sophie Peters <gaja.peters@math.uni-hamburg.de> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Gaja Sophie Peters <gaja.peters@math.uni-hamburg.de> Reviewed-by: Marc Dionne <marc.dionne@auristor.com> Reviewed-by: Jeffrey Altman <jaltman@auristor.com> cc: linux-afs@lists.infradead.org Link: http://lists.infradead.org/pipermail/linux-afs/2021-March/003498.html [1] Link: http://lists.infradead.org/pipermail/linux-afs/2021-March/003566.html # v1 Link: http://lists.infradead.org/pipermail/linux-afs/2021-March/003572.html # v2 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-25 09:04:07 +01:00
Greg Kroah-Hartman	1092f698e5	This is the 5.10.15 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmAjmYgACgkQONu9yGCS aT6bohAAiRtT6WoMrzEFXvs44tWxB4JPXJR290RmmO+fZGj+HoujKbhnWCwNMD5q s2PGELPybWaii7schjuXqUl0vhatUnVLs04A59hGKKHHlvpWTznQYT7Urt8C6c8I sm2zAB6oeGwkwG8vQnujq2srxdgZVzffx09Tm1l+PtFGudROVixuthw21Q0QhRt0 2z2O5lcJC7utlUIudI/pe7WECgMIZHS2lRZyz8EKJ6ynMuNpQl2WuchPWuLgVhYB hiHV0yRLIHRzi3wNDMy8GJzjjfS1dkMuwnDK+3rZNZH+IVV3wvs/8mdr8p5d/VYU kfPDP1EMjnik0sBLvavl9d4ixnUcCn05HjGnFrqSbfpi8j88npqKriV3jkDrhQpO cLlMcVTN3ufpcrr6BIDgL6uCVCul+txeaPkUuafP6y3yNtQXDWbLxlgfm7u+TwAB nIr12H8cgMR6zK2iQFSZk4rGt1eXUIZkZYLcoINW88Zey9jsTImg9ZgAA+BJJMzs 4A3UKAOthCCyGJYju3hoTUVyS0QPJVuplAODIMSklUjnxQT4JfPJ9Jk2BRw5cY4K Xecpb/+6vxKj7Zl6HFvcZCkU8+pul5wboDnCIgpIGOLUhq8OTyu5716Q7c9T6MbO R6ftZosij+bmuapo4HZhnYzybzHb7LHLsa+B/5DzK0CwTTmV1JM= =YVjW -----END PGP SIGNATURE----- Merge 5.10.15 into android12-5.10 Changes in 5.10.15 USB: serial: cp210x: add pid/vid for WSDA-200-USB USB: serial: cp210x: add new VID/PID for supporting Teraoka AD2000 USB: serial: option: Adding support for Cinterion MV31 usb: host: xhci: mvebu: make USB 3.0 PHY optional for Armada 3720 USB: gadget: legacy: fix an error code in eth_bind() usb: gadget: aspeed: add missing of_node_put USB: usblp: don't call usb_set_interface if there's a single alt usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop() usb: dwc2: Fix endpoint direction check in ep_from_windex usb: dwc3: fix clock issue during resume in OTG mode usb: xhci-mtk: fix unreleased bandwidth data usb: xhci-mtk: skip dropping bandwidth of unchecked endpoints usb: xhci-mtk: break loop when find the endpoint to drop ARM: OMAP1: OSK: fix ohci-omap breakage arm64: dts: qcom: c630: keep both touchpad devices enabled Input: i8042 - unbreak Pegatron C15B arm64: dts: amlogic: meson-g12: Set FL-adj property value arm64: dts: rockchip: fix vopl iommu irq on px30 arm64: dts: rockchip: Use only supported PCIe link speed on Pinebook Pro ARM: dts: stm32: Fix polarity of the DH DRC02 uSD card detect ARM: dts: stm32: Connect card-detect signal on DHCOM ARM: dts: stm32: Disable WP on DHCOM uSD slot ARM: dts: stm32: Disable optional TSC2004 on DRC02 board ARM: dts: stm32: Fix GPIO hog flags on DHCOM DRC02 vdpa/mlx5: Fix memory key MTT population bpf, cgroup: Fix optlen WARN_ON_ONCE toctou bpf, cgroup: Fix problematic bounds check bpf, inode_storage: Put file handler if no storage was found um: virtio: free vu_dev only with the contained struct device bpf, preload: Fix build when $(O) points to a relative path arm64: dts: meson: switch TFLASH_VDD_EN pin to open drain on Odroid-C4 r8169: work around RTL8125 UDP hw bug rxrpc: Fix deadlock around release of dst cached on udp tunnel arm64: dts: ls1046a: fix dcfg address range SUNRPC: Fix NFS READs that start at non-page-aligned offsets igc: set the default return value to -IGC_ERR_NVM in igc_write_nvm_srwr igc: check return value of ret_val in igc_config_fc_after_link_up i40e: Revert "i40e: don't report link up for a VF who hasn't enabled queues" ibmvnic: device remove has higher precedence over reset net/mlx5: Fix function calculation for page trees net/mlx5: Fix leak upon failure of rule creation net/mlx5e: Update max_opened_tc also when channels are closed net/mlx5e: Release skb in case of failure in tc update skb net: lapb: Copy the skb before sending a packet net: mvpp2: TCAM entry enable should be written after SRAM data r8169: fix WoL on shutdown if CONFIG_DEBUG_SHIRQ is set net: ipa: pass correct dma_handle to dma_free_coherent() ARM: dts: sun7i: a20: bananapro: Fix ethernet phy-mode nvmet-tcp: fix out-of-bounds access when receiving multiple h2cdata PDUs vdpa/mlx5: Restore the hardware used index after change map memblock: do not start bottom-up allocations with kernel_end kbuild: fix duplicated flags in DEBUG_CFLAGS thunderbolt: Fix possible NULL pointer dereference in tb_acpi_add_link() ovl: fix dentry leak in ovl_get_redirect ovl: avoid deadlock on directory ioctl ovl: implement volatile-specific fsync error behaviour mac80211: fix station rate table updates on assoc gpiolib: free device name on error path to fix kmemleak fgraph: Initialize tracing_graph_pause at task creation tracing/kprobe: Fix to support kretprobe events on unloaded modules kretprobe: Avoid re-registration of the same kretprobe earlier tracing: Use pause-on-trace with the latency tracers tracepoint: Fix race between tracing and removing tracepoint libnvdimm/namespace: Fix visibility of namespace resource attribute libnvdimm/dimm: Avoid race between probe and available_slots_show() genirq: Prevent [devm_]irq_alloc_desc from returning irq 0 genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set scripts: use pkg-config to locate libcrypto xhci: fix bounce buffer usage for non-sg list case RISC-V: Define MAXPHYSMEM_1GB only for RV32 cifs: report error instead of invalid when revalidating a dentry fails iommu: Check dev->iommu in dev_iommu_priv_get() before dereferencing it smb3: Fix out-of-bounds bug in SMB2_negotiate() smb3: fix crediting for compounding when only one request in flight mmc: sdhci-pltfm: Fix linking err for sdhci-brcmstb mmc: core: Limit retries when analyse of SDIO tuples fails Fix unsynchronized access to sev members through svm_register_enc_region drm/dp/mst: Export drm_dp_get_vc_payload_bw() drm/i915: Fix the MST PBN divider calculation drm/i915/gem: Drop lru bumping on display unpinning drm/i915/gt: Close race between enable_breadcrumbs and cancel_breadcrumbs drm/i915/display: Prevent double YUV range correction on HDR planes drm/i915: Extract intel_ddi_power_up_lanes() drm/i915: Power up combo PHY lanes for for HDMI as well drm/amd/display: Revert "Fix EDID parsing after resume from suspend" io_uring: don't modify identity's files uncess identity is cowed nvme-pci: avoid the deepest sleep state on Kingston A2000 SSDs KVM: SVM: Treat SVM as unsupported when running as an SEV guest KVM: x86/mmu: Fix TDP MMU zap collapsible SPTEs KVM: x86: Allow guests to see MSR_IA32_TSX_CTRL even if tsx=off KVM: x86: fix CPUID entries returned by KVM_GET_CPUID2 ioctl KVM: x86: Update emulator context mode if SYSENTER xfers to 64-bit mode KVM: x86: Set so called 'reserved CR3 bits in LM mask' at vCPU reset DTS: ARM: gta04: remove legacy spi-cs-high to make display work again ARM: dts; gta04: SPI panel chip select is active low ARM: footbridge: fix dc21285 PCI configuration accessors ARM: 9043/1: tegra: Fix misplaced tegra_uart_config in decompressor mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page mm: hugetlb: fix a race between freeing and dissolving the page mm: hugetlb: fix a race between isolating and freeing page mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active mm, compaction: move high_pfn to the for loop scope mm/vmalloc: separate put pages and flush VM flags mm: thp: fix MADV_REMOVE deadlock on shmem THP mm/filemap: add missing mem_cgroup_uncharge() to __add_to_page_cache_locked() x86/build: Disable CET instrumentation in the kernel x86/debug: Fix DR6 handling x86/debug: Prevent data breakpoints on __per_cpu_offset x86/debug: Prevent data breakpoints on cpu_dr7 x86/apic: Add extra serialization for non-serializing MSRs Input: goodix - add support for Goodix GT9286 chip Input: xpad - sync supported devices with fork on GitHub Input: ili210x - implement pressure reporting for ILI251x md: Set prev_flush_start and flush_bio in an atomic way igc: Report speed and duplex as unknown when device is runtime suspended neighbour: Prevent a dead entry from updating gc_list net: ip_tunnel: fix mtu calculation udp: ipv4: manipulate network header of NATed UDP GRO fraglist net: dsa: mv88e6xxx: override existent unicast portvec in port_fdb_add net: sched: replaced invalid qdisc tree flush helper in qdisc_replace Linux 5.10.15 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I15750357b4c30739515fdc0bbbd0e04b7c986171	2021-02-10 09:53:50 +01:00
David Howells	e5ed4e08d8	rxrpc: Fix deadlock around release of dst cached on udp tunnel ... [ Upstream commit 5399d52233 ] AF_RXRPC sockets use UDP ports in encap mode. This causes socket and dst from an incoming packet to get stolen and attached to the UDP socket from whence it is leaked when that socket is closed. When a network namespace is removed, the wait for dst records to be cleaned up happens before the cleanup of the rxrpc and UDP socket, meaning that the wait never finishes. Fix this by moving the rxrpc (and, by dependence, the afs) private per-network namespace registrations to the device group rather than subsys group. This allows cached rxrpc local endpoints to be cleared and their UDP sockets closed before we try waiting for the dst records. The symptom is that lines looking like the following: unregister_netdevice: waiting for lo to become free get emitted at regular intervals after running something like the referenced syzbot test. Thanks to Vadim for tracking this down and work out the fix. Reported-by: syzbot+df400f2f24a1677cd7e0@syzkaller.appspotmail.com Reported-by: Vadim Fedorenko <vfedorenko@novek.ru> Fixes: 5271953cad ("rxrpc: Use the UDP encap_rcv hook") Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Vadim Fedorenko <vfedorenko@novek.ru> Link: https://lore.kernel.org/r/161196443016.3868642.5577440140646403533.stgit@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-02-10 09:29:13 +01:00
Greg Kroah-Hartman	4de82f1b3b	Merge a68a0262ab ("mm/madvise: remove racy mm ownership check") into android-mainline ... Steps on the way to 5.10-rc8/final Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0d1e2f396425894a7c2e9a2680edf763a223c644	2020-12-10 11:34:58 +01:00
David Howells	4cb6829647	afs: Fix memory leak when mounting with multiple source parameters ... There's a memory leak in afs_parse_source() whereby multiple source= parameters overwrite fc->source in the fs_context struct without freeing the previously recorded source. Fix this by only permitting a single source parameter and rejecting with an error all subsequent ones. This was caught by syzbot with the kernel memory leak detector, showing something like the following trace: unreferenced object 0xffff888114375440 (size 32): comm "repro", pid 5168, jiffies 4294923723 (age 569.948s) backtrace: slab_post_alloc_hook+0x42/0x79 __kmalloc_track_caller+0x125/0x16a kmemdup_nul+0x24/0x3c vfs_parse_fs_string+0x5a/0xa1 generic_parse_monolithic+0x9d/0xc5 do_new_mount+0x10d/0x15a do_mount+0x5f/0x8e __do_sys_mount+0xff/0x127 do_syscall_64+0x2d/0x3a entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 13fcc68370 ("afs: Add fs_context support") Reported-by: syzbot+86dc6632faaca40133ab@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com> cc: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2020-12-08 15:59:25 -08:00
Greg Kroah-Hartman	5acba58e59	Linux 5.10-rc5 ... -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl+69egeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGTSYH/ifRBlaxy5UiHFc0 2zdR7pkjWrYfDTTT3sazIAhdlzzcfnkUqgFxOP45F4ZIqeTzunH3sUY+5UlT9IX7 liUgnLxQ/1R9Gx8kPGQfu+tLCey78xVFydGsqJoW9sPRw2R+apMdGGa/lOrk+OXz DXIN+dDnGFqwCCNJpK+rxQQhFf++IPpSI8z6Y23moOFhsDZrEziHuVFy2FGyRM6z prZ/us/tcobE8ptCk1RmOxLoJ1DR6UxpA2vLimTE+JD8siOsSWPbjE0KudnWCnd5 BLqIjrsPJbSxyuzzK3v9dnO5wMv7tMDuMIuYM/MQTXDttNwtsqt/aP6gdnUCym7N 5eHEj5g= =MuO1 -----END PGP SIGNATURE----- Merge 5.10-rc5 into android-mainline Linux 5.10-rc5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia5b23cceb3e0212c1c841f1297ecfab65cc9aaa6	2020-11-23 08:17:16 +01:00
David Howells	a9e5c87ca7	afs: Fix speculative status fetch going out of order wrt to modifications ... When doing a lookup in a directory, the afs filesystem uses a bulk status fetch to speculatively retrieve the statuses of up to 48 other vnodes found in the same directory and it will then either update extant inodes or create new ones - effectively doing 'lookup ahead'. To avoid the possibility of deadlocking itself, however, the filesystem doesn't lock all of those inodes; rather just the directory inode is locked (by the VFS). When the operation completes, afs_inode_init_from_status() or afs_apply_status() is called, depending on whether the inode already exists, to commit the new status. A case exists, however, where the speculative status fetch operation may straddle a modification operation on one of those vnodes. What can then happen is that the speculative bulk status RPC retrieves the old status, and whilst that is happening, the modification happens - which returns an updated status, then the modification status is committed, then we attempt to commit the speculative status. This results in something like the following being seen in dmesg: kAFS: vnode modified {100058:861} 8->9 YFS.InlineBulkStatus showing that for vnode 861 on volume 100058, we saw YFS.InlineBulkStatus say that the vnode had data version 8 when we'd already recorded version 9 due to a local modification. This was causing the cache to be invalidated for that vnode when it shouldn't have been. If it happens on a data file, this might lead to local changes being lost. Fix this by ignoring speculative status updates if the data version doesn't match the expected value. Note that it is possible to get a DV regression if a volume gets restored from a backup - but we should get a callback break in such a case that should trigger a recheck anyway. It might be worth checking the volume creation time in the volsync info and, if a change is observed in that (as would happen on a restore), invalidate all caches associated with the volume. Fixes: 5cf9dd55a0 ("afs: Prospectively look up extra files when doing a single lookup") Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2020-11-22 11:27:03 -08:00
Greg Kroah-Hartman	73fd557b30	Merge e28c0d7c92 ("Merge branch 'akpm' (patches from Andrew)") into android-mainline ... Steps on the way to 5.10-rc4 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Id86ac2ef339902d7ea3689767ef52744c6fa0d9e	2020-11-15 14:37:09 +01:00
David Howells	3ad216ee73	afs: Fix afs_write_end() when called with copied == 0 [ver #3] ... When afs_write_end() is called with copied == 0, it tries to set the dirty region, but there's no way to actually encode a 0-length region in the encoding in page->private. "0,0", for example, indicates a 1-byte region at offset 0. The maths miscalculates this and sets it incorrectly. Fix it to just do nothing but unlock and put the page in this case. We don't actually need to mark the page dirty as nothing presumably changed. Fixes: 65dd2d6072 ("afs: Alter dirty range encoding in page->private") Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2020-11-14 11:51:18 -08:00
Greg Kroah-Hartman	07933490ae	Merge 4ef8451b33 ("Merge tag 'perf-tools-for-v5.10-2020-11-03' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux") into android-mainline ... Steps on the way to 5.10-rc3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia09418a96a25f6c602af953db5d3258e032c0f30	2020-11-06 08:00:53 +01:00
David Howells	f4c79144ed	afs: Fix incorrect freeing of the ACL passed to the YFS ACL store op ... The cleanup for the yfs_store_opaque_acl2_operation calls the wrong function to destroy the ACL content buffer. It's an afs_acl struct, not a yfs_acl struct - and the free function for latter may pass invalid pointers to kfree(). Fix this by using the afs_acl_put() function. The yfs_acl_put() function is then no longer used and can be removed. general protection fault, probably for non-canonical address 0x7ebde00000000: 0000 [#1] SMP PTI ... RIP: 0010:compound_head+0x0/0x11 ... Call Trace: virt_to_cache+0x8/0x51 kfree+0x5d/0x79 yfs_free_opaque_acl+0x16/0x29 afs_put_operation+0x60/0x114 __vfs_setxattr+0x67/0x72 __vfs_setxattr_noperm+0x66/0xe9 vfs_setxattr+0x67/0xce setxattr+0x14e/0x184 __do_sys_fsetxattr+0x66/0x8f do_syscall_64+0x2d/0x3a entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: e49c7b2f6d ("afs: Build an abstraction around an "operation" concept") Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2020-11-03 09:53:40 -08:00
David Howells	c80afa1d9c	afs: Fix warning due to unadvanced marshalling pointer ... When using the afs.yfs.acl xattr to change an AuriStor ACL, a warning can be generated when the request is marshalled because the buffer pointer isn't increased after adding the last element, thereby triggering the check at the end if the ACL wasn't empty. This just causes something like the following warning, but doesn't stop the call from happening successfully: kAFS: YFS.StoreOpaqueACL2: Request buffer underflow (36<108) Fix this simply by increasing the count prior to the check. Fixes: f5e4546347 ("afs: Implement YFS ACL setting") Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2020-11-03 09:53:40 -08:00
Greg Kroah-Hartman	c13605829f	Merge 65b55d4c85 ("Merge tag 'arm-soc-fixes-v5.10-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc") into android-mainline ... Steps on the way to 5.10-rc2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I2aae8375aa349bd63596d4bd29e50e36993c764f	2020-11-02 11:04:03 +01:00
David Howells	2d9900f26a	afs: Fix dirty-region encoding on ppc32 with 64K pages ... The dirty region bounds stored in page->private on an afs page are 15 bits on a 32-bit box and can, at most, represent a range of up to 32K within a 32K page with a resolution of 1 byte. This is a problem for powerpc32 with 64K pages enabled. Further, transparent huge pages may get up to 2M, which will be a problem for the afs filesystem on all 32-bit arches in the future. Fix this by decreasing the resolution. For the moment, a 64K page will have a resolution determined from PAGE_SIZE. In the future, the page will need to be passed in to the helper functions so that the page size can be assessed and the resolution determined dynamically. Note that this might not be the ideal way to handle this, since it may allow some leakage of undirtied zero bytes to the server's copy in the case of a 3rd-party conflict. Fixing that would require a separately allocated record and is a more complicated fix. Fixes: 4343d00872 ("afs: Get rid of the afs_writeback record") Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>	2020-10-29 13:53:04 +00:00
David Howells	f86726a69d	afs: Fix afs_invalidatepage to adjust the dirty region ... Fix afs_invalidatepage() to adjust the dirty region recorded in page->private when truncating a page. If the dirty region is entirely removed, then the private data is cleared and the page dirty state is cleared. Without this, if the page is truncated and then expanded again by truncate, zeros from the expanded, but no-longer dirty region may get written back to the server if the page gets laundered due to a conflicting 3rd-party write. It mustn't, however, shorten the dirty region of the page if that page is still mmapped and has been marked dirty by afs_page_mkwrite(), so a flag is stored in page->private to record this. Fixes: 4343d00872 ("afs: Get rid of the afs_writeback record") Signed-off-by: David Howells <dhowells@redhat.com>	2020-10-29 13:53:04 +00:00
David Howells	65dd2d6072	afs: Alter dirty range encoding in page->private ... Currently, page->private on an afs page is used to store the range of dirtied data within the page, where the range includes the lower bound, but excludes the upper bound (e.g. 0-1 is a range covering a single byte). This, however, requires a superfluous bit for the last-byte bound so that on a 4KiB page, it can say 0-4096 to indicate the whole page, the idea being that having both numbers the same would indicate an empty range. This is unnecessary as the PG_private bit is clear if it's an empty range (as is PG_dirty). Alter the way the dirty range is encoded in page->private such that the upper bound is reduced by 1 (e.g. 0-0 is then specified the same single byte range mentioned above). Applying this to both bounds frees up two bits, one of which can be used in a future commit. This allows the afs filesystem to be compiled on ppc32 with 64K pages; without this, the following warnings are seen: ../fs/afs/internal.h: In function 'afs_page_dirty_to': ../fs/afs/internal.h:881:15: warning: right shift count >= width of type [-Wshift-count-overflow] 881 | return (priv >> __AFS_PAGE_PRIV_SHIFT) & __AFS_PAGE_PRIV_MASK; | ^~ ../fs/afs/internal.h: In function 'afs_page_dirty': ../fs/afs/internal.h:886:28: warning: left shift count >= width of type [-Wshift-count-overflow] 886 | return ((unsigned long)to << __AFS_PAGE_PRIV_SHIFT) | from; | ^~ Fixes: 4343d00872 ("afs: Get rid of the afs_writeback record") Signed-off-by: David Howells <dhowells@redhat.com>	2020-10-29 13:53:04 +00:00
David Howells	185f0c7073	afs: Wrap page->private manipulations in inline functions ... The afs filesystem uses page->private to store the dirty range within a page such that in the event of a conflicting 3rd-party write to the server, we write back just the bits that got changed locally. However, there are a couple of problems with this: (1) I need a bit to note if the page might be mapped so that partial invalidation doesn't shrink the range. (2) There aren't necessarily sufficient bits to store the entire range of data altered (say it's a 32-bit system with 64KiB pages or transparent huge pages are in use). So wrap the accesses in inline functions so that future commits can change how this works. Also move them out of the tracing header into the in-directory header. There's not really any need for them to be in the tracing header. Signed-off-by: David Howells <dhowells@redhat.com>	2020-10-29 13:53:04 +00:00
David Howells	f792e3ac82	afs: Fix where page->private is set during write ... In afs, page->private is set to indicate the dirty region of a page. This is done in afs_write_begin(), but that can't take account of whether the copy into the page actually worked. Fix this by moving the change of page->private into afs_write_end(). Fixes: 4343d00872 ("afs: Get rid of the afs_writeback record") Signed-off-by: David Howells <dhowells@redhat.com>	2020-10-29 13:53:04 +00:00
David Howells	21db2cdc66	afs: Fix page leak on afs_write_begin() failure ... Fix the leak of the target page in afs_write_begin() when it fails. Fixes: 15b4650e55 ("afs: convert to new aops") Signed-off-by: David Howells <dhowells@redhat.com> cc: Nick Piggin <npiggin@gmail.com>	2020-10-29 13:53:04 +00:00
David Howells	fa04a40b16	afs: Fix to take ref on page when PG_private is set ... Fix afs to take a ref on a page when it sets PG_private on it and to drop the ref when removing the flag. Note that in afs_write_begin(), a lot of the time, PG_private is already set on a page to which we're going to add some data. In such a case, we leave the bit set and mustn't increment the page count. As suggested by Matthew Wilcox, use attach/detach_page_private() where possible. Fixes: 31143d5d51 ("AFS: implement basic file write support") Reported-by: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>	2020-10-29 13:53:04 +00:00
David Howells	d383e346f9	afs: Fix afs_launder_page to not clear PG_writeback ... Fix afs_launder_page() to not clear PG_writeback on the page it is laundering as the flag isn't set in this case. Fixes: 4343d00872 ("afs: Get rid of the afs_writeback record") Signed-off-by: David Howells <dhowells@redhat.com>	2020-10-27 22:05:56 +00:00
Dan Carpenter	248c944e21	afs: Fix a use after free in afs_xattr_get_acl() ... The "op" pointer is freed earlier when we call afs_put_operation(). Fixes: e49c7b2f6d ("afs: Build an abstraction around an "operation" concept") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: Colin Ian King <colin.king@canonical.com>	2020-10-27 22:05:56 +00:00
David Howells	acc080d15d	afs: Fix tracing deref-before-check ... The patch dca54a7bbb8c: "afs: Add tracing for cell refcount and active user count" from Oct 13, 2020, leads to the following Smatch complaint: fs/afs/cell.c:596 afs_unuse_cell() warn: variable dereferenced before check 'cell' (see line 592) Fix this by moving the retrieval of the cell debug ID to after the check of the validity of the cell pointer. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Fixes: dca54a7bbb ("afs: Add tracing for cell refcount and active user count") Signed-off-by: David Howells <dhowells@redhat.com> cc: Dan Carpenter <dan.carpenter@oracle.com>	2020-10-27 22:05:56 +00:00
David Howells	06a17bbe1d	afs: Fix copy_file_range() ... The prevention of splice-write without explicit ops made the copy_file_write() syscall to an afs file (as done by the generic/112 xfstest) fail with EINVAL. Fix by using iter_file_splice_write() for afs. Fixes: 36e2c7421f ("fs: don't allow splice read/write without explicit ops") Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de>	2020-10-27 22:05:56 +00:00
Greg Kroah-Hartman	d131e058e3	Merge fad70111d5 ("Merge tag 'afs-fixes-20201016' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs") into android-mainline ... Steps on the way to 5.10-rc1 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ibe83dc01d469951189e54cb8f930cb0020295017	2020-10-26 09:44:28 +01:00
Greg Kroah-Hartman	c62fe038fe	Merge 3ad11d7ac8 ("Merge tag 'block-5.10-2020-10-12' of git://git.kernel.dk/linux-block") into android-mainline ... Steps on the way to 5.10-rc1 Resolves conflicts in: include/linux/blk-crypto.h Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I4012850c2e4b804d9e87e90b8e03a3b9ce21b5e7	2020-10-24 17:29:43 +02:00
Linus Torvalds	fad70111d5	afs fixes ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEqG5UsNXhtOCrfGQP+7dXa6fLC2sFAl+JqvsACgkQ+7dXa6fL C2sQeRAAiW+rGQa46ybOv8qBLgVEiH6OzNUk62fesbhl5rKRgapS2r2SJbau29gv KqBld29lp4o84/THJ6hZ6Al1iwZnO2FW+h53Q47M5TH9AbwZhf/zooRSoGb5AmKJ /FR4+K/zTLk7VCSptTtXlKG81bOKQF+tmi6sLdxx70h2T+Ythm3zdVq8PCZZhhGG hw1IfuNDNbUDGus5WgZfIdVkdFCs5WW5cEhrPgqKR0mXYQklnkwgtov/+RAh/Ewf bZ1JFqap15KJ2AcKgw79NZ01MBJ4KyZckzKwgaTVlIEtCMQMBDhJpbKzdtP767rh xkxdzmDmXOop9RNQ8WrIIt6EjpB0We2qxQVGLsPHdEixmlv5n2BjL/wdWa3u/4QZ ymjv7B8jcFSpXQzVnrmeNYsgHo1oJ7G8q8Xh+CJm9BNBtNUiz1raQfxWpS5TeWT4 dQsr/Z/PMCBCBOb6F08pjF8od67DUCx+x1nkCG4qFCeXiC4ouTNkfMZnxWH9mVKP v5Hca2E0ilR3PI5+tn8o/ZPul5NDTesBnAvAAEBQDT79Ff8kAgEJ3M3ipy38VoKV xFiNpNHwDPp15vzneJ7f7Ir27VauRlhCLEuSUtyYH4pD458K3UQAAQRFZB7bkzMX TQTbmEPUbtrs/mOEMKQN6ew8dwawRpMy01j0KnDl0KBFDtfTLU8= =0anM -----END PGP SIGNATURE----- Merge tag 'afs-fixes-20201016' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull afs updates from David Howells: "A collection of fixes to fix afs_cell struct refcounting, thereby fixing a slew of related syzbot bugs: - Fix the cell tree in the netns to use an rwsem rather than RCU. There seem to be some problems deriving from the use of RCU and a seqlock to walk the rbtree, but it's not entirely clear what since there are several different failures being seen. Changing things to use an rwsem instead makes it more robust. The extra performance derived from using RCU isn't necessary in this case since the only time we're looking up a cell is during mount or when cells are being manually added. - Fix the refcounting by splitting the usage counter into a memory refcount and an active users counter. The usage counter was doing double duty, keeping track of whether a cell is still in use and keeping track of when it needs to be destroyed - but this makes the clean up tricky. Separating these out simplifies the logic. - Fix purging a cell that has an alias. A cell alias pins the cell it's an alias of, but the alias is always later in the list. Trying to purge in a single pass causes rmmod to hang in such a case. - Fix cell removal. If a cell's manager is requeued whilst it's removing itself, the manager will run again and re-remove itself, causing problems in various places. Follow Hillf Danton's suggestion to insert a more terminal state that causes the manager to do nothing post-removal. In additional to the above, two other changes: - Add a tracepoint for the cell refcount and active users count. This helped with debugging the above and may be useful again in future. - Downgrade an assertion to a print when a still-active server is seen during purging. This was happening as a consequence of incomplete cell removal before the servers were cleaned up" * tag 'afs-fixes-20201016' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Don't assert on unpurgeable server records afs: Add tracing for cell refcount and active user count afs: Fix cell removal afs: Fix cell purging with aliases afs: Fix cell refcounting by splitting the usage counter afs: Fix rapid cell addition/removal by not using RCU on cells tree	2020-10-16 15:22:41 -07:00
David Howells	7530d3eb3d	afs: Don't assert on unpurgeable server records ... Don't give an assertion failure on unpurgeable afs_server records - which kills the thread - but rather emit a trace line when we are purging a record (which only happens during network namespace removal or rmmod) and print a notice of the problem. Signed-off-by: David Howells <dhowells@redhat.com>	2020-10-16 14:39:34 +01:00
David Howells	dca54a7bbb	afs: Add tracing for cell refcount and active user count ... Add a tracepoint to log the cell refcount and active user count and pass in a reason code through various functions that manipulate these counters. Additionally, a helper function, afs_see_cell(), is provided to log interesting places that deal with a cell without actually doing any accounting directly. Signed-off-by: David Howells <dhowells@redhat.com>	2020-10-16 14:39:21 +01:00
David Howells	1d0e850a49	afs: Fix cell removal ... Fix cell removal by inserting a more final state than AFS_CELL_FAILED that indicates that the cell has been unpublished in case the manager is already requeued and will go through again. The new AFS_CELL_REMOVED state will just immediately leave the manager function. Going through a second time in the AFS_CELL_FAILED state will cause it to try to remove the cell again, potentially leading to the proc list being removed. Fixes: 989782dcdc ("afs: Overhaul cell database management") Reported-by: syzbot+b994ecf2b023f14832c1@syzkaller.appspotmail.com Reported-by: syzbot+0e0db88e1eb44a91ae8d@syzkaller.appspotmail.com Reported-by: syzbot+2d0585e5efcd43d113c2@syzkaller.appspotmail.com Reported-by: syzbot+1ecc2f9d3387f1d79d42@syzkaller.appspotmail.com Reported-by: syzbot+18d51774588492bf3f69@syzkaller.appspotmail.com Reported-by: syzbot+a5e4946b04d6ca8fa5f3@syzkaller.appspotmail.com Suggested-by: Hillf Danton <hdanton@sina.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: Hillf Danton <hdanton@sina.com>	2020-10-16 14:38:26 +01:00
David Howells	286377f6bd	afs: Fix cell purging with aliases ... When the afs module is removed, one of the things that has to be done is to purge the cell database. afs_cell_purge() cancels the management timer and then starts the cell manager work item to do the purging. This does a single run through and then assumes that all cells are now purged - but this is no longer the case. With the introduction of alias detection, a later cell in the database can now be holding an active count on an earlier cell (cell->alias_of). The purge scan passes by the earlier cell first, but this can't be got rid of until it has discarded the alias. Ordinarily, afs_unuse_cell() would handle this by setting the management timer to trigger another pass - but afs_set_cell_timer() doesn't do anything if the namespace is being removed (net->live == false). rmmod then hangs in the wait on cells_outstanding in afs_cell_purge(). Fix this by making afs_set_cell_timer() directly queue the cell manager if net->live is false. This causes additional management passes. Queueing the cell manager increments cells_outstanding to make sure the wait won't complete until all cells are destroyed. Fixes: 8a070a9648 ("afs: Detect cell aliases 1 - Cells with root volumes") Signed-off-by: David Howells <dhowells@redhat.com>	2020-10-16 14:38:26 +01:00
David Howells	88c853c3f5	afs: Fix cell refcounting by splitting the usage counter ... Management of the lifetime of afs_cell struct has some problems due to the usage counter being used to determine whether objects of that type are in use in addition to whether anyone might be interested in the structure. This is made trickier by cell objects being cached for a period of time in case they're quickly reused as they hold the result of a setup process that may be slow (DNS lookups, AFS RPC ops). Problems include the cached root volume from alias resolution pinning its parent cell record, rmmod occasionally hanging and occasionally producing assertion failures. Fix this by splitting the count of active users from the struct reference count. Things then work as follows: (1) The cell cache keeps +1 on the cell's activity count and this has to be dropped before the cell can be removed. afs_manage_cell() tries to exchange the 1 to a 0 with the cells_lock write-locked, and if successful, the record is removed from the net->cells. (2) One struct ref is 'owned' by the activity count. That is put when the active count is reduced to 0 (final_destruction label). (3) A ref can be held on a cell whilst it is queued for management on a work queue without confusing the active count. afs_queue_cell() is added to wrap this. (4) The queue's ref is dropped at the end of the management. This is split out into a separate function, afs_manage_cell_work(). (5) The root volume record is put after a cell is removed (at the final_destruction label) rather then in the RCU destruction routine. (6) Volumes hold struct refs, but aren't active users. (7) Both counts are displayed in /proc/net/afs/cells. There are some management function changes: (*) afs_put_cell() now just decrements the refcount and triggers the RCU destruction if it becomes 0. It no longer sets a timer to have the manager do this. (*) afs_use_cell() and afs_unuse_cell() are added to increase and decrease the active count. afs_unuse_cell() sets the management timer. (*) afs_queue_cell() is added to queue a cell with approprate refs. There are also some other fixes: (*) Don't let /proc/net/afs/cells access a cell's vllist if it's NULL. (*) Make sure that candidate cells in lookups are properly destroyed rather than being simply kfree'd. This ensures the bits it points to are destroyed also. (*) afs_dec_cells_outstanding() is now called in cell destruction rather than at "final_destruction". This ensures that cell->net is still valid to the end of the destructor. (*) As a consequence of the previous two changes, move the increment of net->cells_outstanding that was at the point of insertion into the tree to the allocation routine to correctly balance things. Fixes: 989782dcdc ("afs: Overhaul cell database management") Signed-off-by: David Howells <dhowells@redhat.com>	2020-10-16 14:38:22 +01:00
David Howells	92e3cc91d8	afs: Fix rapid cell addition/removal by not using RCU on cells tree ... There are a number of problems that are being seen by the rapidly mounting and unmounting an afs dynamic root with an explicit cell and volume specified (which should probably be rejected, but that's a separate issue): What the tests are doing is to look up/create a cell record for the name given and then tear it down again without actually using it to try to talk to a server. This is repeated endlessly, very fast, and the new cell collides with the old one if it's not quick enough to reuse it. It appears (as suggested by Hillf Danton) that the search through the RB tree under a read_seqbegin_or_lock() under RCU conditions isn't safe and that it's not blocking the write_seqlock(), despite taking two passes at it. He suggested that the code should take a ref on the cell it's attempting to look at - but this shouldn't be necessary until we've compared the cell names. It's possible that I'm missing a barrier somewhere. However, using an RCU search for this is overkill, really - we only need to access the cell name in a few places, and they're places where we're may end up sleeping anyway. Fix this by switching to an R/W semaphore instead. Additionally, draw the down_read() call inside the function (renamed to afs_find_cell()) since all the callers were taking the RCU read lock (or should've been[*]). [*] afs_probe_cell_name() should have been, but that doesn't appear to be involved in the bug reports. The symptoms of this look like: general protection fault, probably for non-canonical address 0xf27d208691691fdb: 0000 [#1] PREEMPT SMP KASAN KASAN: maybe wild-memory-access in range [0x93e924348b48fed8-0x93e924348b48fedf] ... RIP: 0010:strncasecmp lib/string.c:52 [inline] RIP: 0010:strncasecmp+0x5f/0x240 lib/string.c:43 afs_lookup_cell_rcu+0x313/0x720 fs/afs/cell.c:88 afs_lookup_cell+0x2ee/0x1440 fs/afs/cell.c:249 afs_parse_source fs/afs/super.c:290 [inline] ... Fixes: 989782dcdc ("afs: Overhaul cell database management") Reported-by: syzbot+459a5dce0b4cb70fd076@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com> cc: Hillf Danton <hdanton@sina.com> cc: syzkaller-bugs@googlegroups.com	2020-10-16 14:04:59 +01:00
Linus Torvalds	3ad11d7ac8	block-5.10-2020-10-12 ... -----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAl+EWUgQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpnoxEADCVSNBRkpV0OVkOEC3wf8EGhXhk01Jnjtl u5Mg2V55hcgJ0thQxBV/V28XyqmsEBrmAVi0Yf8Vr9Qbq4Ze08Wae4ChS4rEOyh1 jTcGYWx5aJB3ChLvV/HI0nWQ3bkj03mMrL3SW8rhhf5DTyKHsVeTenpx42Qu/FKf fRzi09FSr3Pjd0B+EX6gunwJnlyXQC5Fa4AA0GhnXJzAznANXxHkkcXu8a6Yw75x e28CfhIBliORsK8sRHLoUnPpeTe1vtxCBhBMsE+gJAj9ZUOWMzvNFIPP4FvfawDy 6cCQo2m1azJ/IdZZCDjFUWyjh+wxdKMp+NNryEcoV+VlqIoc3n98rFwrSL+GIq5Z WVwEwq+AcwoMCsD29Lu1ytL2PQ/RVqcJP5UheMrbL4vzefNfJFumQVZLIcX0k943 8dFL2QHL+H/hM9Dx5y5rjeiWkAlq75v4xPKVjh/DHb4nehddCqn/+DD5HDhNANHf c1kmmEuYhvLpIaC4DHjE6DwLh8TPKahJjwsGuBOTr7D93NUQD+OOWsIhX6mNISIl FFhP8cd0/ZZVV//9j+q+5B4BaJsT+ZtwmrelKFnPdwPSnh+3iu8zPRRWO+8P8fRC YvddxuJAmE6BLmsAYrdz6Xb/wqfyV44cEiyivF0oBQfnhbtnXwDnkDWSfJD1bvCm ZwfpDh2+Tg== =LzyE -----END PGP SIGNATURE----- Merge tag 'block-5.10-2020-10-12' of git://git.kernel.dk/linux-block Pull block updates from Jens Axboe: - Series of merge handling cleanups (Baolin, Christoph) - Series of blk-throttle fixes and cleanups (Baolin) - Series cleaning up BDI, seperating the block device from the backing_dev_info (Christoph) - Removal of bdget() as a generic API (Christoph) - Removal of blkdev_get() as a generic API (Christoph) - Cleanup of is-partition checks (Christoph) - Series reworking disk revalidation (Christoph) - Series cleaning up bio flags (Christoph) - bio crypt fixes (Eric) - IO stats inflight tweak (Gabriel) - blk-mq tags fixes (Hannes) - Buffer invalidation fixes (Jan) - Allow soft limits for zone append (Johannes) - Shared tag set improvements (John, Kashyap) - Allow IOPRIO_CLASS_RT for CAP_SYS_NICE (Khazhismel) - DM no-wait support (Mike, Konstantin) - Request allocation improvements (Ming) - Allow md/dm/bcache to use IO stat helpers (Song) - Series improving blk-iocost (Tejun) - Various cleanups (Geert, Damien, Danny, Julia, Tetsuo, Tian, Wang, Xianting, Yang, Yufen, yangerkun) * tag 'block-5.10-2020-10-12' of git://git.kernel.dk/linux-block: (191 commits) block: fix uapi blkzoned.h comments blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue blk-mq: get rid of the dead flush handle code path block: get rid of unnecessary local variable block: fix comment and add lockdep assert blk-mq: use helper function to test hw stopped block: use helper function to test queue register block: remove redundant mq check block: invoke blk_mq_exit_sched no matter whether have .exit_sched percpu_ref: don't refer to ref->data if it isn't allocated block: ratelimit handle_bad_sector() message blk-throttle: Re-use the throtl_set_slice_end() blk-throttle: Open code __throtl_de/enqueue_tg() blk-throttle: Move service tree validation out of the throtl_rb_first() blk-throttle: Move the list operation after list validation blk-throttle: Fix IO hang for a corner case blk-throttle: Avoid tracking latency if low limit is invalid blk-throttle: Avoid getting the current time if tg->last_finish_time is 0 blk-throttle: Remove a meaningless parameter for throtl_downgrade_state() block: Remove redundant 'return' statement ...	2020-10-13 12:12:44 -07:00
Greg Kroah-Hartman	8de87f4d1c	Linux 5.9 ... -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl+DdgYeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGB1sH/0B4REolPPxiQsPL P45+a2POUU0SQK8NjkcYskQmJ6DnPKkJSXeUU8rzuI2rty5bWEzEBxdUSh064ZaM DGxkWrdhYNaLJuceNLlanBk3vrM3KwGkaJFSKLgsEXkmH86gl33ptA8nlQVbfc+4 FK4hRZs2J6Y5YRsuzPO8nzzHWs1CThZEcwNPOeIZrAnv+/13zyP/piZ+R/2gKYwy RVrVrzSTkTGJXotn6J17Sa02+CGv5UqdxOZFv7jimYJOmFT7KnGngNrJbh8aYWk7 vPTRUvGozh6NyYxtRI9LKGZy1yQ05Cl7N927CnFYzD235/eT7zaRDZe1e1JaIE8Z r2yxGCM= =ZIYP -----END PGP SIGNATURE----- Merge 5.9 into android-mainline Linux 5.9 Change-Id: Ic4308a3e2a4015058efdac52bd51794b604c8435 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-10-12 09:12:41 +02:00
David Howells	ec0fa0b659	afs: Fix deadlock between writeback and truncate ... The afs filesystem has a lock[*] that it uses to serialise I/O operations going to the server (vnode->io_lock), as the server will only perform one modification operation at a time on any given file or directory. This prevents the the filesystem from filling up all the call slots to a server with calls that aren't going to be executed in parallel anyway, thereby allowing operations on other files to obtain slots. [*] Note that is probably redundant for directories at least since i_rwsem is used to serialise directory modifications and lookup/reading vs modification. The server does allow parallel non-modification ops, however. When a file truncation op completes, we truncate the in-memory copy of the file to match - but we do it whilst still holding the io_lock, the idea being to prevent races with other operations. However, if writeback starts in a worker thread simultaneously with truncation (whilst notify_change() is called with i_rwsem locked, writeback pays it no heed), it may manage to set PG_writeback bits on the pages that will get truncated before afs_setattr_success() manages to call truncate_pagecache(). Truncate will then wait for those pages - whilst still inside io_lock: # cat /proc/8837/stack [<0>] wait_on_page_bit_common+0x184/0x1e7 [<0>] truncate_inode_pages_range+0x37f/0x3eb [<0>] truncate_pagecache+0x3c/0x53 [<0>] afs_setattr_success+0x4d/0x6e [<0>] afs_wait_for_operation+0xd8/0x169 [<0>] afs_do_sync_operation+0x16/0x1f [<0>] afs_setattr+0x1fb/0x25d [<0>] notify_change+0x2cf/0x3c4 [<0>] do_truncate+0x7f/0xb2 [<0>] do_sys_ftruncate+0xd1/0x104 [<0>] do_syscall_64+0x2d/0x3a [<0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 The writeback operation, however, stalls indefinitely because it needs to get the io_lock to proceed: # cat /proc/5940/stack [<0>] afs_get_io_locks+0x58/0x1ae [<0>] afs_begin_vnode_operation+0xc7/0xd1 [<0>] afs_store_data+0x1b2/0x2a3 [<0>] afs_write_back_from_locked_page+0x418/0x57c [<0>] afs_writepages_region+0x196/0x224 [<0>] afs_writepages+0x74/0x156 [<0>] do_writepages+0x2d/0x56 [<0>] __writeback_single_inode+0x84/0x207 [<0>] writeback_sb_inodes+0x238/0x3cf [<0>] __writeback_inodes_wb+0x68/0x9f [<0>] wb_writeback+0x145/0x26c [<0>] wb_do_writeback+0x16a/0x194 [<0>] wb_workfn+0x74/0x177 [<0>] process_one_work+0x174/0x264 [<0>] worker_thread+0x117/0x1b9 [<0>] kthread+0xec/0xf1 [<0>] ret_from_fork+0x1f/0x30 and thus deadlock has occurred. Note that whilst afs_setattr() calls filemap_write_and_wait(), the fact that the caller is holding i_rwsem doesn't preclude more pages being dirtied through an mmap'd region. Fix this by: (1) Use the vnode validate_lock to mediate access between afs_setattr() and afs_writepages(): (a) Exclusively lock validate_lock in afs_setattr() around the whole RPC operation. (b) If WB_SYNC_ALL isn't set on entry to afs_writepages(), trying to shared-lock validate_lock and returning immediately if we couldn't get it. (c) If WB_SYNC_ALL is set, wait for the lock. The validate_lock is also used to validate a file and to zap its cache if the file was altered by a third party, so it's probably a good fit for this. (2) Move the truncation outside of the io_lock in setattr, using the same hook as is used for local directory editing. This requires the old i_size to be retained in the operation record as we commit the revised status to the inode members inside the io_lock still, but we still need to know if we reduced the file size. Fixes: d2ddc776a4 ("afs: Overhaul volume and server record caching and fileserver rotation") Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2020-10-08 10:50:55 -07:00
Christoph Hellwig	55b2598e84	bdi: initialize ->ra_pages and ->io_pages in bdi_init ... Set up a readahead size by default, as very few users have a good reason to change it. This means code, ecryptfs, and orangefs now set up the values while they were previously missing it, while ubifs, mtd and vboxsf manually set it to 0 to avoid readahead. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jan Kara <jack@suse.cz> Acked-by: David Sterba <dsterba@suse.com> [btrfs] Acked-by: Richard Weinberger <richard@nod.at> [ubifs, mtd] Signed-off-by: Jens Axboe <axboe@kernel.dk>	2020-09-24 13:43:39 -06:00
Greg Kroah-Hartman	3d3ef2a059	Linux 5.9-rc4 ... -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl9VerweHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGhc4H/iHD6qLdB36gZB6K oc2nJyrqyWitv4ti2Mnt5PA7o4wX4l6nnr1QvoaJ4BRs5Ja1czRvb2XDmdzqAoIA xITGoafqaAeDfxQ91bWrJsVN0pCRKiGwddXlU7TWmqw/riAkfOqi6GYKvav4biJH +n1mUPQb1M2IbRFsqkAS+ebKHq3CWaRvzKOEneS88nGlL5u31S9NAru8Ru/fkxRn 6CwGcs1XRaBPYaZAhdfIb0NuatUlpkhPC9yhNS9up6SqrWmK3m65vmFVng6H0eCF fwn1jVztboY/XcNAi5sM9ExpQCql6WLQEEktVikqRDojC8fVtSx6W55tPt7qeaoO Z6t4/DA= =bcA4 -----END PGP SIGNATURE----- Merge 5.9-rc4 into android-mainline Linux 5.9-rc4 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3d041935cae5e8f3421edcdee4892f17e2c776ad	2020-09-07 09:24:58 +02:00
Linus Torvalds	3e8d3bdc2a	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net ... Pull networking fixes from David Miller: 1) Use netif_rx_ni() when necessary in batman-adv stack, from Jussi Kivilinna. 2) Fix loss of RTT samples in rxrpc, from David Howells. 3) Memory leak in hns_nic_dev_probe(), from Dignhao Liu. 4) ravb module cannot be unloaded, fix from Yuusuke Ashizuka. 5) We disable BH for too lokng in sctp_get_port_local(), add a cond_resched() here as well, from Xin Long. 6) Fix memory leak in st95hf_in_send_cmd, from Dinghao Liu. 7) Out of bound access in bpf_raw_tp_link_fill_link_info(), from Yonghong Song. 8) Missing of_node_put() in mt7530 DSA driver, from Sumera Priyadarsini. 9) Fix crash in bnxt_fw_reset_task(), from Michael Chan. 10) Fix geneve tunnel checksumming bug in hns3, from Yi Li. 11) Memory leak in rxkad_verify_response, from Dinghao Liu. 12) In tipc, don't use smp_processor_id() in preemptible context. From Tuong Lien. 13) Fix signedness issue in mlx4 memory allocation, from Shung-Hsi Yu. 14) Missing clk_disable_prepare() in gemini driver, from Dan Carpenter. 15) Fix ABI mismatch between driver and firmware in nfp, from Louis Peens. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (110 commits) net/smc: fix sock refcounting in case of termination net/smc: reset sndbuf_desc if freed net/smc: set rx_off for SMCR explicitly net/smc: fix toleration of fake add_link messages tg3: Fix soft lockup when tg3_reset_task() fails. doc: net: dsa: Fix typo in config code sample net: dp83867: Fix WoL SecureOn password nfp: flower: fix ABI mismatch between driver and firmware tipc: fix shutdown() of connectionless socket ipv6: Fix sysctl max for fib_multipath_hash_policy drivers/net/wan/hdlc: Change the default of hard_header_len to 0 net: gemini: Fix another missing clk_disable_unprepare() in probe net: bcmgenet: fix mask check in bcmgenet_validate_flow() amd-xgbe: Add support for new port mode net: usb: dm9601: Add USB ID of Keenetic Plus DSL vhost: fix typo in error message net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() pktgen: fix error message with wrong function name net: ethernet: ti: am65-cpsw: fix rmii 100Mbit link mode cxgb4: fix thermal zone device registration ...	2020-09-03 18:50:48 -07:00