mirror of
https://github.com/torvalds/linux.git
synced 2026-07-28 01:55:51 +02:00
9f0933ac02
1138040 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
David Howells
|
9f0933ac02 |
fscache: fix OOB Read in __fscache_acquire_volume
The type of a->key[0] is char in fscache_volume_same(). If the length
of cache volume key is greater than 127, the value of a->key[0] is less
than 0. In this case, klen becomes much larger than 255 after type
conversion, because the type of klen is size_t. As a result, memcmp()
is read out of bounds.
This causes a slab-out-of-bounds Read in __fscache_acquire_volume(), as
reported by Syzbot.
Fix this by changing the type of the stored key to "u8 *" rather than
"char *" (it isn't a simple string anyway). Also put in a check that
the volume name doesn't exceed NAME_MAX.
BUG: KASAN: slab-out-of-bounds in memcmp+0x16f/0x1c0 lib/string.c:757
Read of size 8 at addr ffff888016f3aa90 by task syz-executor344/3613
Call Trace:
memcmp+0x16f/0x1c0 lib/string.c:757
memcmp include/linux/fortify-string.h:420 [inline]
fscache_volume_same fs/fscache/volume.c:133 [inline]
fscache_hash_volume fs/fscache/volume.c:171 [inline]
__fscache_acquire_volume+0x76c/0x1080 fs/fscache/volume.c:328
fscache_acquire_volume include/linux/fscache.h:204 [inline]
v9fs_cache_session_get_cookie+0x143/0x240 fs/9p/cache.c:34
v9fs_session_init+0x1166/0x1810 fs/9p/v9fs.c:473
v9fs_mount+0xba/0xc90 fs/9p/vfs_super.c:126
legacy_get_tree+0x105/0x220 fs/fs_context.c:610
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
do_new_mount fs/namespace.c:3040 [inline]
path_mount+0x1326/0x1e20 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
Fixes:
|
||
|
Linus Torvalds
|
eb7081409f | Linux 6.1-rc6 | ||
|
Linus Torvalds
|
c6c67bf9bc |
tracing/probes: Fixes for v6.1
- Fix possible NULL pointer dereference on trace_event_file in kprobe_event_gen_test_exit() - Fix NULL pointer dereference for trace_array in kprobe_event_gen_test_exit() - Fix memory leak of filter string for eprobes - Fix a possible memory leak in rethook_alloc() - Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case which can cause a possible use-after-free - Fix warning in eprobe filter creation - Fix eprobe filter creation as it picked the wrong event for the fields -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCY3qRDhQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qgCdAP0cB1ZjmMM7O8OFdnrTV0jfavZTnNNC ut9sczpYQ0upcwEArmVvB+H3sTM6Y7PrsQEUn8gsc7WmieUoDAOr0hIe4AI= =DGVC -----END PGP SIGNATURE----- Merge tag 'trace-probes-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing/probes fixes from Steven Rostedt: - Fix possible NULL pointer dereference on trace_event_file in kprobe_event_gen_test_exit() - Fix NULL pointer dereference for trace_array in kprobe_event_gen_test_exit() - Fix memory leak of filter string for eprobes - Fix a possible memory leak in rethook_alloc() - Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case which can cause a possible use-after-free - Fix warning in eprobe filter creation - Fix eprobe filter creation as it picked the wrong event for the fields * tag 'trace-probes-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/eprobe: Fix eprobe filter to make a filter correctly tracing/eprobe: Fix warning in filter creation kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case rethook: fix a potential memleak in rethook_alloc() tracing/eprobe: Fix memory leak of filter string tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit() tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit() |
||
|
Linus Torvalds
|
5239ddeb48 |
Tracing fixes:
- Fix polling to block on watermark like the reads do, as user space applications get confused when the select says read is available, and then the read blocks. - Fix accounting of ring buffer dropped pages as it is what is used to determine if the buffer is empty or not. - Fix memory leak in tracing_read_pipe() - Fix struct trace_array warning about being declared in parameters - Fix accounting of ftrace pages used in output at start up. - Fix allocation of dyn_ftrace pages by subtracting one from order instead of diving it by 2 - Static analyzer found a case were a pointer being used outside of a NULL check. (rb_head_page_deactivate()) - Fix possible NULL pointer dereference if kstrdup() fails in ftrace_add_mod() - Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() - Fix bad pointer dereference in register_synth_event() on error path. - Remove unused __bad_type_size() method - Fix possible NULL pointer dereference of entry in list 'tr->err_log' - Fix NULL pointer deference race if eprobe is called before the event setup -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCY3qNNBQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qiVzAP9vdtLkseOueVqPJ/Wc6v3z0xlkxO4L Aj9jOac822SPOQEAvUJ1DM1bxm/D2BY5AQsfgSGjdaVYP+I3kvETNgWspQI= =3ta3 -----END PGP SIGNATURE----- Merge tag 'trace-v6.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix polling to block on watermark like the reads do, as user space applications get confused when the select says read is available, and then the read blocks - Fix accounting of ring buffer dropped pages as it is what is used to determine if the buffer is empty or not - Fix memory leak in tracing_read_pipe() - Fix struct trace_array warning about being declared in parameters - Fix accounting of ftrace pages used in output at start up. - Fix allocation of dyn_ftrace pages by subtracting one from order instead of diving it by 2 - Static analyzer found a case were a pointer being used outside of a NULL check (rb_head_page_deactivate()) - Fix possible NULL pointer dereference if kstrdup() fails in ftrace_add_mod() - Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() - Fix bad pointer dereference in register_synth_event() on error path - Remove unused __bad_type_size() method - Fix possible NULL pointer dereference of entry in list 'tr->err_log' - Fix NULL pointer deference race if eprobe is called before the event setup * tag 'trace-v6.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix race where eprobes can be called before the event tracing: Fix potential null-pointer-access of entry in list 'tr->err_log' tracing: Remove unused __bad_type_size() method tracing: Fix wild-memory-access in register_synth_event() tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() ftrace: Fix null pointer dereference in ftrace_add_mod() ring_buffer: Do not deactivate non-existant pages ftrace: Optimize the allocation for mcount entries ftrace: Fix the possible incorrect kernel message tracing: Fix warning on variable 'struct trace_array' tracing: Fix memory leak in tracing_read_pipe() ring-buffer: Include dropped pages in counting dirty patches tracing/ring-buffer: Have polling block on watermark |
||
|
Steven Rostedt (Google)
|
94eedf3dde |
tracing: Fix race where eprobes can be called before the event
The flag that tells the event to call its triggers after reading the event
is set for eprobes after the eprobe is enabled. This leads to a race where
the eprobe may be triggered at the beginning of the event where the record
information is NULL. The eprobe then dereferences the NULL record causing
a NULL kernel pointer bug.
Test for a NULL record to keep this from happening.
Link: https://lore.kernel.org/linux-trace-kernel/20221116192552.1066630-1-rafaelmendsr@gmail.com/
Link: https://lore.kernel.org/linux-trace-kernel/20221117214249.2addbe10@gandalf.local.home
Cc: Linux Trace Kernel <linux-trace-kernel@vger.kernel.org>
Cc: Tzvetomir Stoyanov <tz.stoyanov@gmail.com>
Cc: Tom Zanussi <zanussi@kernel.org>
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Linus Torvalds
|
894909f95a |
- Do not hold fpregs lock when inheriting FPU permissions because the
fpregs lock disables preemption on RT but fpu_inherit_perms() does spin_lock_irq(), which, on RT, uses rtmutexes and they need to be preemptible. - Check the page offset and the length of the data supplied by userspace for overflow when specifying a set of pages to add to an SGX enclave -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmN6GjgACgkQEsHwGGHe VUpzog/+OIX3ZAZ0EJqg9GgvhacPjww1oPr+DRcpXCFYjk1jTJ3seJc2we+uun0j zYHbgO6BYyP3LdlrSjt8MgosMZGz1s14r9TXc46T8IhvUu0imbUkO9vLcxwL6pJl LJgPIYvBu6IUoVIQVlVr7PrVvUj8nUPc3w/8qmjR91bJAWTeeFvFflvn713jlWBP hLKiUvhdjA08Sp9gjF2drGl+NkSXPPLPHQetKa4BhVYqwDK5hRGBOt51CuDHdUOQ QYaP5JRy435ZsoFGgYq0lOxCXIYDe8rWRBCnDWdi7kjXEYhnKJLj6Fi1SxjD+cZC wDX+LQGFiShJFonGzxbeORBU04Owbz+nLsSeHCQsl/70kAv/W/44BLj+BPl0dit1 XBTUUCr9Wi9VdDTBVJT+EQbD3F5dBn1TO00Z0qzhv3D3gVruUNmv7SDHMoRUyYcy 9LueWCzF9YV1Se6V9gUox9vwTuc09J63IS2zkMm2ahCbfmWTSsx9P5BWLFK3E3Em lPsdZWNJQ7F6f0B3AfRjTDXvaMyzBRYfuZHEaBMq5avDWDFBCyOhc3PqjpKt5wHS URP6M/kOtz1zg8fy/XmMRCfCDBoAm+NfvF4zG9md1GYta7aP74Z824M+FMoXNv7f YcR4mCzpeeiG0hXyywcL+QDpmjlsYCPhe24Gnh/Bb+1g7Huyyc8= =VQD4 -----END PGP SIGNATURE----- Merge tag 'x86_urgent_for_v6.1_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Do not hold fpregs lock when inheriting FPU permissions because the fpregs lock disables preemption on RT but fpu_inherit_perms() does spin_lock_irq(), which, on RT, uses rtmutexes and they need to be preemptible. - Check the page offset and the length of the data supplied by userspace for overflow when specifying a set of pages to add to an SGX enclave * tag 'x86_urgent_for_v6.1_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Drop fpregs lock before inheriting FPU permissions x86/sgx: Add overflow check in sgx_validate_offset_length() |
||
|
Linus Torvalds
|
d4f754c361 |
- Fix a small race on the task's exit path where there's a
misunderstanding whether the task holds rq->lock or not - Prevent processes from getting killed when using deprecated or unknown rseq ABI flags in order to be able to fuzz the rseq() syscall with syzkaller -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmN6FH0ACgkQEsHwGGHe VUrsFw//QdGg/ZpGdeGH5njOFX9KCLrcMojz+Ip7vn4TeWiT/0J70jym4Pxkvwls Cz1s47kmhEE56xYi0gMJJi6XtjYWh1/sptuTkS+wHNp+NliaHMnmPPY08wL6/ZEq Zm8KP1e3OHjl+k82yhuIeYAFFdUpbLlQkjCKHqQkBlemh0MF+GeTavHDWe3kLolb arEld+kIo7OUkBDmVGk6BaE3R0DuCYGokDcj9xGNx0alcQCtu+oT+T9jYMgwBIn2 zGpfM2jeB4nwYKYv+Mg6tY38vaz6bHZWSoDhaB/+GzewhZMdGGCo3SdN207WJHUK TSjjz6a5sMJSZTpVW0K6MxJhv245KNt3Tc/JpDtqVq4KfKNcv0Rs4bDIWWyIsvow KlSUvRBeDT3rx9152vB72GiPptZogWsTc5dM0/ZlBaCfM4UBreYgO37ZYYK9hPdx M2rCOafUSwkDFG+A5JCWM7d5sPAndvAAX29qqmrgbTVSV+XKAx3UdWpGJTEL8bSF OWIFhVd2nqOglL41c1Rm4zk9TJ3k9mMsgnsuskgclmAI7GmRkPADHlv19bRRe8UL TEDBOCQaNYFkjkp+4IM/I3GXGa+SiOHEiK7G2CjJEeHbzWoGKQPFpJtOtH4zHNV+ m32Ek2XBw1zKjfAyr1WGyA+GE4tTIIphqgonu4cA2cKCYjm/SG4= =I+nD -----END PGP SIGNATURE----- Merge tag 'sched_urgent_for_v6.1_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Borislav Petkov: - Fix a small race on the task's exit path where there's a misunderstanding whether the task holds rq->lock or not - Prevent processes from getting killed when using deprecated or unknown rseq ABI flags in order to be able to fuzz the rseq() syscall with syzkaller * tag 'sched_urgent_for_v6.1_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Fix race in task_call_func() rseq: Use pr_warn_once() when deprecated/unknown ABI flags are encountered |
||
|
Linus Torvalds
|
eb0ef8add5 |
- Fix an intel PT erratum where CPUs do not support single range output
for more than 4K - Fix a NULL ptr dereference which can happen after an NMI interferes with the event enabling dance in amd_pmu_enable_all() - Free the events array too when freeing uncore contexts on CPU online, thereby fixing a memory leak - Improve the pending SIGTRAP check -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmN6DfgACgkQEsHwGGHe VUoVUxAAuAaPNOil4T95BGBYL7O7w5VvUQtaq9TtSm1ZwDlz63BNFwrLdlyi3pnc 4J84lWB1m0hPJHggqqWwBcIRL4xgrNZN4F0Q641Ns8IcAUtYbuQ4Gxm4io5IysFN DYph6EZ597S7izdZD/S0wETqjgE5/zs16x2/E9E9aJ9CH6Kewqa0y5bXhieF4+UF o0z55KB8YtS19BvopZLunj3tvwOSgAqgkgW7UtbR6clhcXBiq6/6bAjEBxoPrYRE 7B8LEEMol7ERyIZHLE/xA38D6o1BhlD9OnVNpwYtDeYe63dtPrQAfjDwkk7gOdWB H9mNHqYB4kPMaUt4sDfDRTVYvioUXH0y7gjvl54efUtnj3vdxhUFzjD+JFh4nzrr efCU+Cy8TzYV1V7c9yn9JjIp7w0rLX2jMlPvL8GGwlYQ8nXQKR6OHi3Dw9kYLKrT /jtAxkv8+enbUiMukw0AyhJfgzSM8OkUIjtHGTgkY7Q2BEv+yC7ogvD9wIozocLa w0EIJo5wtLUHu78u5+5tIOZYcZq1A89lPV8TXNzCGU6+xwm3wRzpvcAICp285NqA gXBEtWGULUB+paz4db5tnChP9xK8MOt4Ro3/Y00Hxr3ZgO6zJ2nc7j8fENX9gON0 YAeZB9yPPcvy6oABYcVDH3sG/wyN5wCnlPGxrVom4EYRRWzhAL8= =9ZHJ -----END PGP SIGNATURE----- Merge tag 'perf_urgent_for_v6.1_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Fix an intel PT erratum where CPUs do not support single range output for more than 4K - Fix a NULL ptr dereference which can happen after an NMI interferes with the event enabling dance in amd_pmu_enable_all() - Free the events array too when freeing uncore contexts on CPU online, thereby fixing a memory leak - Improve the pending SIGTRAP check * tag 'perf_urgent_for_v6.1_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/pt: Fix sampling using single range output perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling perf/x86/amd/uncore: Fix memory leak for events array perf: Improve missing SIGTRAP checking |
||
|
Linus Torvalds
|
6a211a753d |
- Fix a build error with clang 11
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmN6CYEACgkQEsHwGGHe VUpqmw/+MQGhkFT9AFYKfboGteNbX//j/yeexEz6wiJX8InhIAPsJiVoGr26bQvr L+oMXbunkW4th+rXHlEf21xYbc4GhX+PymZFbqgPEC7WPSIOKkpMHQpRJIQCmQy0 bIy63pN6j3FYKr+xdmI1rGUjNcEfyLsQ9VDBw/+/by+VhpMRTdK8m+LYF2nXNLxR eNZMekVFRlOx1iOfoYN8JLCNSljrMEgvBtk3iiCBezs09i91uJTCfWwdyGMP48YX wjA1DwKvJjq29YwZvpI332Aknk7gZCDP3Sx7bOonf3lo1tUj/VBV45Zl+XxSxKz/ bnFOjgUfHfOp2F7LuNSR1914DWHc3y0A6ULgov9kXiGKp+XeJ0mwqHR+amTZEqyb i3Z7YJynkFVH8o2mdL1yNc4X8YGEatGIO6fnWaK8WiBDC9XeF7E/YBpHhF63S0dW uP/50dndJF7MXV9ByM3O8JlQXh86m7xf2CDwlufZyUbWeaycn2wl75IUXzwa/UU+ bCJkmVG8GMJDyqwGGnC9EL+ExLYrZV0d0cr1S3R8Z0P8a/ArHuZkoJ614ZVMtBwc 6LJP83aqzY/mbTx5IJKqNOvjG2cyt6H+LrT6NetmosOTOJbdQqSleuB1SG4KTz84 sv0m9qGqXsm/iSRHHK7Fy/g+/rv8crTi3QZmyF0s84TkUFhu7R0= =RPx/ -----END PGP SIGNATURE----- Merge tag 'locking_urgent_for_v6.1_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Borislav Petkov: - Fix a build error with clang 11 * tag 'locking_urgent_for_v6.1_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking: Fix qspinlock/x86 inline asm error |
||
|
Linus Torvalds
|
712fb83dc3 |
powerpc fixes for 6.1 #5
- Fix writable sections being moved into the rodata region. Thanks to: Nicholas Piggin, Christophe Leroy. -----BEGIN PGP SIGNATURE----- iQJHBAABCAAxFiEEJFGtCPCthwEv2Y/bUevqPMjhpYAFAmN5f4wTHG1wZUBlbGxl cm1hbi5pZC5hdQAKCRBR6+o8yOGlgKMQD/93p6s5EnHFYiwJe3rXt4XMUqHq4UtE GxZKmf917KUevm9I6+M4SDfbEATrx+QVXh7Wbu8ysFrLtkVXRTn2MJODTyklRrX4 UZO5a1OGRwOW8MuD3BSrGIBQcWVGN+cfswPwWGmYM/6zrcvoK/C+ALvPLu8jiM1Q v2vinn+9r4mRxHPY/KTgbvjLQ1b2Rv/Tn1djZeyYgz+dG6IlT+SHVyC1zIhdam5x jBRx+RVJMjEhxBa4n3+3Hzdso1ZhvF4loYGjRXO3/VHDs2HoVAiK2ZHeVSTFEqm2 LPev7cX0KgeXEUt2H3fHzciei1aN9b3WadNJjD1t4hzu11G6XLyPWF5jsGcinB6l eMquU4bsuoB2F5u/Iyt813c0BLcGhG2XsH5evl+N4ATX8X302JkhDT7hCD43q0hg pvqwMhsgfh7HdY4ft5WnbZp3TWzSpwAVZQRUbbExPHwgBuCGUOA0HFVctKiRqSKZ YR9y640Jw4rptAxKvRKK3O5MpDU08GH8k8fD4Qwt7AWZle1lL2AI1UntTgEKrfbw /QB6KpU0E/AiTi3kvtSQ3NrDThukPRPFt05rX0L7Di5hTc/E7h4Htd63G89jfw8d KoKsURnE0CgaAZZ6NQKDbzaK+jYz2s8Usrl1rH+hrfdkscGp3LzKelCY1N/dJCpD uDSoP+mTGJngmA== =KaMV -----END PGP SIGNATURE----- Merge tag 'powerpc-6.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: - Fix writable sections being moved into the rodata region. Thanks to Nicholas Piggin and Christophe Leroy. * tag 'powerpc-6.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: Fix writable sections being moved into the rodata region |
||
|
Linus Torvalds
|
77c51ba552 |
SCSI fixes on 20221119
Five small fixes, all in drivers. Most of these are error leg freeing issues, with the only really user visible one being the zfcp fix. Signed-off-by: James E.J. Bottomley <jejb@linux.ibm.com> -----BEGIN PGP SIGNATURE----- iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCY3lYZyYcamFtZXMuYm90 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishflGAPwIJV0F 42sRod5/ULPVh3YRtSzUWwhVqSxlxN6eAaZJbgD/fcPsIa96WCtSYjevLPc+afDh Ecb5nfwbA8cc9cjqmS8= =NNYw -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Five small fixes, all in drivers. Most of these are error leg freeing issues, with the only really user visible one being the zfcp fix" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: iscsi: Fix possible memory leak when device_register() failed scsi: zfcp: Fix double free of FSF request when qdio send fails scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper() scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() scsi: mpi3mr: Suppress command reply debug prints |
||
|
Linus Torvalds
|
b6e7fdfd6f |
IOMMU Fixes for Linux v6.1-rc5
Including: - Fix presetting accessed bits in Intel VT-d page-directory entries to avoid hardware error - Set supervisor bit only when Intel IOMMU has the SRS capability -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmN5ACsACgkQK/BELZcB GuOBExAA1qO0GNBT58eTRxc4d17a8mIwX59Sl5FJwETsPGs9UaOfWlkUPd+P39G0 qUSmETmuwbUO7Ob5lfSDcpLj6+SmR3Ra/Ywy7Dnil3ecQXpvmnz6zalnbrw1pVTI UmRJqnhuCyN3gMVA8eQZdnF/1WOW9/tyC59MHmnn9kOWm2bUWOhAD33GqTn7a1Eh k9qGzvO3Q0QMY8ncYUq3p8zs8BvBTTcMqY7MNVUV52xje/y1VU3hkbKQqCwLjKN6 jphuiy9ESbiizxN0y588vPdKVULr030zXpYG+CIyvCt3z95q0eJpJp/hceyLdJGc HXeONh//YAfbbogG7CzsCK4NmMyQuKrjq/HFs1hnyBCn/HiDoE2CvKJnZ2uc/hMo g5D0zAd6RVSRCUx/kqrNr/4+dA7bllPmxNr0WaM6flUpZ3WCopj5dqE3KTexMbtf r/Xxkh8AdYyzbg4mTTBba8iO/bIFwf9iXPVQW2XJa8uxPh4Djq67jKyRPzB91xB3 S2jS2WwhdsR73YQv9/zJ4Xo1mYREjM0mWcrgacwZ7nD3iFK8eq3v40PzJ2qHyOiL 9YCGzvXdvvsv5aXQB4nvc87QZkT9r4Z8GhR4wyTe4l5Z+RGIq7GhBCh8zthP82Ce MpOmeYvM7AWBHOMcXvvUfbvGqCq14CJZfHKmpBWhqYMvcMTxJJw= =gjdA -----END PGP SIGNATURE----- Merge tag 'iommu-fixes-v6.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Preset accessed bits in Intel VT-d page-directory entries to avoid hardware error - Set supervisor bit only when Intel IOMMU has the SRS capability * tag 'iommu-fixes-v6.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Set SRE bit only when hardware has SRS cap iommu/vt-d: Preset Access bit for IOVA in FL non-leaf paging entries |
||
|
Linus Torvalds
|
8c67d863a9 |
Kbuild fixes for v6.1 (3rd)
- Update MAINTAINERS with Nathan and Nicolas as new Kbuild reviewers. - Increment the debian revision for deb-pkg builds -----BEGIN PGP SIGNATURE----- iQJJBAABCgAzFiEEbmPs18K1szRHjPqEPYsBB53g2wYFAmN49OMVHG1hc2FoaXJv eUBrZXJuZWwub3JnAAoJED2LAQed4NsGQ3oQALCDTSvWrkrsI1bkFyHGLGSmCBuI T+KXxeh+eJin7f+xJgr0og1OVgynnJlIwZH2NHEXH8A/K7DtdAbAq182tJ0bomLV 8G9zh0XUp7t/4b1Je9XFH965pPH4UUPMYwR6NL/1oNYtNz46pq9f/lN+o+lGV15F 4gRb9b5sISgd8YyGubcCPqpMtwQIXPIZhHBqDabDuTV0laBwRFuJqtmv4DSQgSCP 27xeJITI0Ib8/teJO3fEv/u5ntc9cCRfu53gfb+NjLADLtd6YKqHpWyXYvDT2+eP V5Y+tVp5NOI1XjoejilY3uXbP0AHYWWvujDP4kSFgW8y3UGJlFlg50GydOl/c/fG nnmWAhH7d1cES3Iz1+yg6VT9008Fblhci9gD/vFA8U+VaTtQzCfnsGKPNlx793iB rU6VL8PmCWRo2M47pxf4whGKh0M2OXGF/b6FWAuuyOC+R+NDZJCw3euW2Dmbr92T La3GiS+xA97Mw2IT+MPwdiG6SHuyl/I7Vz+ar3sJHqK0yXYWAHcsvbgusacMHc7R uoTOuJ/cS1w6xbsGfkNh38Je1KMPmshGnDbf6wN4R4nuPRpDZeEx8/Jh0MStxLKU GaGTFmeaf01OylA0Ap+jEgKA5SNPJG8rNeV6RNVHVNqczMsnnclHyVnGje1uQTWJ g700zz1wXXtzB4Gu =KSm6 -----END PGP SIGNATURE----- Merge tag 'kbuild-fixes-v6.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Update MAINTAINERS with Nathan and Nicolas as new Kbuild reviewers - Increment the debian revision for deb-pkg builds * tag 'kbuild-fixes-v6.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: Restore .version auto-increment behaviour for Debian packages MAINTAINERS: Add linux-kbuild's patchwork MAINTAINERS: Remove Michal Marek from Kbuild maintainers MAINTAINERS: Add Nathan and Nicolas to Kbuild reviewers |
||
|
Linus Torvalds
|
926028aaa3 |
4 cifs/smb3 client fixes
-----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmN4VVMACgkQiiy9cAdy T1F3AQv+N3jzbBdJobg19mr0tVrpz0Itw8BaPTAi2SmY5UFCXg8AEhT9bVj1XoSC lfTZJ7qhV6v1qu8HPyHY8sfW6Pna20FLsL8GyMD2dOU9NwfscecWJSeZX36OkaQX 8Q12cz+J6DgM2NJw0VW6NUCeY6DilbdYG23ZXO0i1NSL8rCMpr7mhK8j5SYgL3Bn yTpd0DZ30fHdcAzt6bAvsekFPaqqbaBtSJl2Z7ibg5wiq/gt0WZ9eqUco9aMdfqW HJ9xeoTDq/836ZtJiHNJ5li7/jEO6AYoImkhS3Cr5TXSqtgDdPWVKM7P7CTL42yV xVcp3OQSiCV9tbGoqJkLMlOqpuM4f2oCkNHxj/bmblCV0QGty7zNet+s4yks2B0d fnmzIwYRbHCV1+rPOiSTA7zhR9qQKIoPEw2tsuWm+Pw/LnraTvnc6Mf0TefK68O/ y/fEq2/zuvt4uHdBjDTUYqwzi9qYyglU/zga3FIRCG87WbOSUXSwVWIDaOgSrg9O FX+KKdA3 =/bd9 -----END PGP SIGNATURE----- Merge tag '6.1-rc5-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: - two missing and one incorrect return value checks - fix leak on tlink mount failure * tag '6.1-rc5-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: add check for returning value of SMB2_set_info_init cifs: Fix wrong return value checking when GETFLAGS cifs: add check for returning value of SMB2_close_init cifs: Fix connections leak when tlink setup failed |
||
|
Tina Zhang
|
7fc961cf7f |
iommu/vt-d: Set SRE bit only when hardware has SRS cap
SRS cap is the hardware cap telling if the hardware IOMMU can support
requests seeking supervisor privilege or not. SRE bit in scalable-mode
PASID table entry is treated as Reserved(0) for implementation not
supporting SRS cap.
Checking SRS cap before setting SRE bit can avoid the non-recoverable
fault of "Non-zero reserved field set in PASID Table Entry" caused by
setting SRE bit while there is no SRS cap support. The fault messages
look like below:
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Read NO_PASID] Request device [00:0d.0] fault addr 0x1154e1000
[fault reason 0x5a]
SM: Non-zero reserved field set in PASID Table Entry
Fixes:
|
||
|
Tina Zhang
|
242b0aaeab |
iommu/vt-d: Preset Access bit for IOVA in FL non-leaf paging entries
The A/D bits are preseted for IOVA over first level(FL) usage for both
kernel DMA (i.e, domain typs is IOMMU_DOMAIN_DMA) and user space DMA
usage (i.e., domain type is IOMMU_DOMAIN_UNMANAGED).
Presetting A bit in FL requires to preset the bit in every related paging
entries, including the non-leaf ones. Otherwise, hardware may treat this
as an error. For example, in a case of ECAP_REG.SMPWC==0, DMA faults might
occur with below DMAR fault messages (wrapped for line length) dumped.
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Read NO_PASID] Request device [aa:00.0] fault addr 0x10c3a6000
[fault reason 0x90]
SM: A/D bit update needed in first-level entry when set up in no snoop
Fixes:
|
||
|
Linus Torvalds
|
fe24a97cf2 |
Input updates for v6.1-rc5
- a fix for 8042 to stop leaking platform device on unload - a fix for Goodix touchscreens on devices like Nanote UMPC-01 where we need to reset controller to load config from firmware - a workaround for Acer Switch to avoid interrupt storm from home and power buttons - a workaround for more ASUS ZenBook models to detect keyboard controller - a fix for iforce driver to properly handle communication errors - touchpad on HP Laptop 15-da3001TU switched to RMI mode -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCY3gwkAAKCRBAj56VGEWX nIdPAP9qdY9UvJD3+suFxN/q0jH1V3MvOzkg96CeLhHtAHqr/QEAmnuxKyspqlPa kqH7eYAMrAH7UFPhTVAeEM0eM3rk9ws= =IjfA -----END PGP SIGNATURE----- Merge tag 'input-for-v6.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - a fix for 8042 to stop leaking platform device on unload - a fix for Goodix touchscreens on devices like Nanote UMPC-01 where we need to reset controller to load config from firmware - a workaround for Acer Switch to avoid interrupt storm from home and power buttons - a workaround for more ASUS ZenBook models to detect keyboard controller - a fix for iforce driver to properly handle communication errors - touchpad on HP Laptop 15-da3001TU switched to RMI mode * tag 'input-for-v6.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: i8042 - fix leaking of platform device on module removal Input: i8042 - apply probe defer to more ASUS ZenBook models Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[] Input: soc_button_array - add use_low_level_irq module parameter Input: iforce - invert valid length check when fetching device IDs Input: goodix - try resetting the controller when no config is set dt-bindings: input: touchscreen: Add compatible for Goodix GT7986U chip Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode |
||
|
Linus Torvalds
|
bf5003a0dc |
zonefs fixes for 6.1-rc6
- Fix the IO error recovery path for failures happening in the last
zone of device, and that zone is a "runt" zone (smaller than the
other zone). The current code was failing to properly obtain a zone
report in that case.
- Remove the unused to_attr() function as it is unused, causing
compilation warnings with clang.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSRPv8tYSvhwAzJdzjdoc3SxdoYdgUCY3gofwAKCRDdoc3SxdoY
dpUlAQDa1mHGQzT0Lrg7y+4HILKsX1dmzJ6wIWTKaFg1f68GNgD/cjZB/jp3UKEi
nmXAv/dGVx6ZBtIEybLDb522i1xccAg=
=gAqT
-----END PGP SIGNATURE-----
Merge tag 'zonefs-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs
Pull zonefs fixes from Damien Le Moal:
- Fix the IO error recovery path for failures happening in the last
zone of device, and that zone is a "runt" zone (smaller than the
other zone). The current code was failing to properly obtain a zone
report in that case.
- Remove the unused to_attr() function as it is unused, causing
compilation warnings with clang.
* tag 'zonefs-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs:
zonefs: Remove to_attr() helper function
zonefs: fix zone report size in __zonefs_io_error()
|
||
|
Chen Jun
|
81cd7e8489 |
Input: i8042 - fix leaking of platform device on module removal
Avoid resetting the module-wide i8042_platform_device pointer in
i8042_probe() or i8042_remove(), so that the device can be properly
destroyed by i8042_exit() on module unload.
Fixes:
|
||
|
Linus Torvalds
|
a66e4cbf7a |
io_uring-6.1-2022-11-18
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmN4ClYQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpgUND/4sDj30Ga1speiQ4ePkmyWSXJbKacROWM5A OFD0+UAcTPieQ4oEnzQuQjldlPKw7pVDsvS/XJzmXYSF3wZyWQKK3IKNEPQdEovF HvIEMjDA3XJCdn4xJfcBMlOUwzi8/08O+b6QsWbZuZQGuhmJP1nzlNKjETBnct1n 3yWcc7ZrZwKYP3rXsdKx/5gI6jY37tHuo2Xg/eF81QnWpiM8x0KKCDUSTxkbHphl efs+rQ85RGAUMocUEzRn2Ij9gMCzabeF+ZtRLBpTTj6dTjVMcBfn55NjPTBndlXN frBtZ/GNIbkLmi7Dho+ffi93mYhkrNciFrRedQOxYg0PVi6hEe4HZT/DsEb2YbHb +k6y1bh0OJnOp8GNTi9Mu0ZC6cHdiO4ZnE6mh+kU72uTlQcLrn4d3/qyJdL2DzQA VZlEM+xFUbY4MJ21q7bE4hc7WN5fERlSIg+7QEpcDJjukjehUUw8W0h7QudQqHSd uGLwfXDDXuqz6yd+UBs53G3NezsMOtJSXyGG4cd8YpF37YK/pZOl+tgX5bPL6eyM XG5vY6XPHJZ+EQqgpm43vnOiXd2YdzHZbzI6Tu5zbdFKWLgXmO+d1QpFEsyo5Sah FYsZQx6/cAiIA1LEJcxCTQQanULduAg+bdVj/QjxH+paw2ScNmsSrA5ZY/3hTtWj FjGfwSsFRA== =s84S -----END PGP SIGNATURE----- Merge tag 'io_uring-6.1-2022-11-18' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "This is mostly fixing issues around the poll rework, but also two tweaks for the multishot handling for accept and receive. All stable material" * tag 'io_uring-6.1-2022-11-18' of git://git.kernel.dk/linux: io_uring: disallow self-propelled ring polling io_uring: fix multishot recv request leaks io_uring: fix multishot accept request leaks io_uring: fix tw losing poll events io_uring: update res mask in io_poll_check_events |
||
|
Linus Torvalds
|
23a60a03d9 |
arm64 fixes:
- Fix a build error with CONFIG_CFI_CLANG + CONFIG_FTRACE when CONFIG_FUNCTION_GRAPH_TRACER is not enabled. - Fix a BUG_ON triggered by the page table checker due to incorrect file_map_count for non-leaf pmd/pud (the arm64 pmd_user_accessible_page() not checking whether it's a leaf entry). -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmN3+hMACgkQa9axLQDI XvEB0Q//QIP/rk7g4G5575wnESdNDJXBXfRN+C+p3b3YgXQ7pMnmYUhu96Vgn9Fw ErCpf9g+FzYsY0qg6wTToiVhUP58d1pogiSemAIA56PdVA/uDLM4ETCMqUGEV3Im 1vdtjRly8isdiQAilZBgFCD9mm8OZ75l03zME1ehDUEZVzjMScdaNNiMrRnPr5eq gKZvF2CCdtveCtfz8ycy/pH6U4gWBR6FU+L4wMPEnv/AyLcifFh+o6J1S+PLwzmi njKPvzsPE2sMOouyanagCdt/sdatajY3JWAL+pNs/hdlNmDk6QJvEhRvoII7wJ4K 9QDdF/Sxh8MXczZcU4k4B1ziCsbjbTFlJadBth78AA0B/iJK7+WLYxKKnFlnEO5r pnQxFjdu392HDwB/d/NRtUA8s9laHeDcQaYiIRJeZDm0o8gMJOrL6uNdrQ+iMvZL H+eB0rCnwrS5xFy79WlYgCE8Pff13ElrEg5Lqr9l+0fWlPIzbIONvlysdcBPOd5L kGdM4ADixyGFAHuZBlyMWdSHrMO6UgSL8wv5O44qQTvyHEpJsH7Oz1ZINvYqnZyV U2DfggaofoJi8WbnuRwWAQeTIqgtIRtxMnDV6PpyUPAMQ/39DZ1HhBEoTLqg7T+P nG78oktahqGe/QVgQgKg5Zwr6bi4lFbhGUxXNcWG+BlHYJf66VQ= =cGmY -----END PGP SIGNATURE----- Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Fix a build error with CONFIG_CFI_CLANG + CONFIG_FTRACE when CONFIG_FUNCTION_GRAPH_TRACER is not enabled. - Fix a BUG_ON triggered by the page table checker due to incorrect file_map_count for non-leaf pmd/pud (the arm64 pmd_user_accessible_page() not checking whether it's a leaf entry). * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud arm64: ftrace: Define ftrace_stub_graph only with FUNCTION_GRAPH_TRACER |
||
|
Linus Torvalds
|
f4408c3dfc |
block-6.1-2022-11-18
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmN38ZUQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpgXxD/9tUSFUKIVGIn4pmNILfY3XV45HOi1w44yR
zCxCELupcBeT+YixmaJcT8sunrrg2fLPOXMrDJk1cG/izXHzkjAQsHZvERfqC7hC
f5onH+2MyGm3qBwxV0iGqITJgTwQGInVJijT4f9UZd/8ultymyZR2nOdIdIydHCF
qzlOjq6hgIuGKHhFgOqRUg/OAkx510ZEEilUDcZ6XVV+zL7ccN6J9+eNTI3c58wT
7jvxZC4u6QGKteGvVniE3WXgk3QdFiQRORvV09g+PkbG/vPjAIZ5tJFb9PdIOebD
3guDiNUasgz2vnDetMK+yk4LcedcRfWnqgn+Vm8C26j5Fxs13eDx5kMDteVy7CYh
3bokOATHohoZZ9qTApgQUswTfGJfBdoy0nUTPuffxPdKDyUPteIxFCADcnyDHnDG
d/+PjU3FKF31o2HcUfvYp7OMO0VZP0hJSWps8znoVXKxb+LH9qKkYzHVlfni5kkS
k9XqqD1Ki98Erb346YqgvQjCkz+CUd5DxtGyh9Oh2+oS2qHP6WjdKo1QPFmWD5dp
EyXGSqGoZrIPtnKohLUN9EiVXanRQWJr3L0gw2CYXpmwfSKfMC3CQraEC1jOc01l
TfsLJGbl3L5XpLzxoBwDu44cqp+VvbalergdcmsDTLDFHhONY2g5LJh6C9/EDdnQ
Cde1uHikGw==
=sOGG
-----END PGP SIGNATURE-----
Merge tag 'block-6.1-2022-11-18' of git://git.kernel.dk/linux
Pull block fixes from Jens Axboe:
- NVMe pull request via Christoph:
- Two more bogus nid quirks (Bean Huo, Tiago Dias Ferreira)
- Memory leak fix in nvmet (Sagi Grimberg)
- Regression fix for block cgroups pinning the wrong blkcg, causing
leaks of cgroups and blkcgs (Chris)
- UAF fix for drbd setup error handling (Dan)
- Fix DMA alignment propagation in DM (Keith)
* tag 'block-6.1-2022-11-18' of git://git.kernel.dk/linux:
dm-log-writes: set dma_alignment limit in io_hints
dm-integrity: set dma_alignment limit in io_hints
block: make blk_set_default_limits() private
dm-crypt: provide dma_alignment limit in io_hints
block: make dma_alignment a stacking queue_limit
nvmet: fix a memory leak in nvmet_auth_set_key
nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV7000
drbd: use after free in drbd_create_device()
nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro
blk-cgroup: properly pin the parent in blkcg_css_online
|
||
|
Linus Torvalds
|
b5bf1d8a23 |
drm fixes for 6.1-rc6
core:
- Fix potential memory leak in drm_dev_init()
- Fix potential null-ptr-deref in drm_vblank_destroy_worker()
- Revert hiding unregistered connectors from userspace, as it breaks on DP-MST.
- Add workaround for DP++ dual mode adaptors that don't support
i2c subaddressing.
i915:
- Fix uaf with lmem_userfault_list handling
amdgpu:
- gang submit fixes
- Fix a possible memory leak in ganng submit error path
- DP tunneling fixes
- DCN 3.1 page flip fix
- DCN 3.2.x fixes
- DCN 3.1.4 fixes
- Don't expose degamma on hardware that doesn't support it
- BACO fixes for SMU 11.x
- BACO fixes for SMU 13.x
- Virtual display fix for devices with no display hardware
amdkfd:
- Memory limit regression fix
tegra:
- tegra20 GART fix
vc4:
- Fix error handling in vc4_atomic_commit_tail()
lima:
- Set lima's clkname corrrectly when regulator is missing.
panel:
- Set bpc for logictechno panels.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmN36xUACgkQDHTzWXnE
hr41XA/8CHevT3b4Q/MSZAjSqITSpRLdlxX6H/jXGUKfwkLTdJqMz46OXP1VqWcg
IwjKqjteGn89D8Ar4LacFPY2c9QgH1xjOZvXACj29f3zF7ySTRDqCstp08erwDVM
3gER1LZPzSxDQdFD0D3O70k+gpmSDekZKM4qV2IwQsmF8jSqwlABS3lpMzvRipId
+oGZc2ZxDpl25i4kTj/TlUTMH/8Ei3Zv5nf3jiyydv6++U/rZbIQbKCdpq7CAXwh
mLeXijT4iJJxqlBcSjO8PDnnl7tldqc4XZVdwkevapiSESXFkmFpmkoFO3ZLaKmT
hRxPv5mmvfrw6xP7buwl3Hq39KjeMWDLM537uM+UG1CFlu2V/JQlPTVl1pAY3ORW
0wPodi930E+WaZQiqwqM4w+BftG1Iq8i8ABeIfrpTmYH6ejCOqBB+rAbvKmwJsv+
HRsb+zRV1+07hrC6pel8C6Fe/c/oP85Jx6cGD7NWK3WllbC/744QG1NPPAkkAIiK
gJ88Hv+s7qI0RNa64J/p66PMkTgjGFZWp7JMDhiRJknt+Wx7sQ/0BDic3VWeotwe
dnw+5kg8eJWPac9NiSlo0v91TFf6U/KeTg6aEeAmo5U+rdHqKeCmYs6cowysvqxh
DRrcXQw5J3+ikMmV13c2h1pYMpZmazyHjYLwAytsB/huX5nTFNs=
=PDqy
-----END PGP SIGNATURE-----
Merge tag 'drm-fixes-2022-11-19' of git://anongit.freedesktop.org/drm/drm
Pull drm fixes from Dave Airlie:
"I guess the main question is are things settling down, and I'd say
kinda, these are all pretty small fixes, nothing big stands out
really, just seems to be quite a few of them.
Mostly amdgpu and core fixes, with some i915, tegra, vc4, panel bits.
core:
- Fix potential memory leak in drm_dev_init()
- Fix potential null-ptr-deref in drm_vblank_destroy_worker()
- Revert hiding unregistered connectors from userspace, as it breaks
on DP-MST
- Add workaround for DP++ dual mode adaptors that don't support i2c
subaddressing
i915:
- Fix uaf with lmem_userfault_list handling
amdgpu:
- gang submit fixes
- Fix a possible memory leak in ganng submit error path
- DP tunneling fixes
- DCN 3.1 page flip fix
- DCN 3.2.x fixes
- DCN 3.1.4 fixes
- Don't expose degamma on hardware that doesn't support it
- BACO fixes for SMU 11.x
- BACO fixes for SMU 13.x
- Virtual display fix for devices with no display hardware
amdkfd:
- Memory limit regression fix
tegra:
- tegra20 GART fix
vc4:
- Fix error handling in vc4_atomic_commit_tail()
lima:
- Set lima's clkname corrrectly when regulator is missing
panel:
- Set bpc for logictechno panels"
* tag 'drm-fixes-2022-11-19' of git://anongit.freedesktop.org/drm/drm: (28 commits)
gpu: host1x: Avoid trying to use GART on Tegra20
drm/display: Don't assume dual mode adaptors support i2c sub-addressing
drm/amd/pm: fix SMU13 runpm hang due to unintentional workaround
drm/amd/pm: enable runpm support over BACO for SMU13.0.7
drm/amd/pm: enable runpm support over BACO for SMU13.0.0
drm/amdgpu: there is no vbios fb on devices with no display hw (v2)
drm/amdkfd: Fix a memory limit issue
drm/amdgpu: disable BACO support on more cards
drm/amd/display: don't enable DRM CRTC degamma property for DCE
drm/amd/display: Set max for prefetch lines on dcn32
drm/amd/display: use uclk pstate latency for fw assisted mclk validation dcn32
drm/amd/display: Fix prefetch calculations for dcn32
drm/amd/display: Fix optc2_configure warning on dcn314
drm/amd/display: Fix calculation for cursor CAB allocation
Revert "drm: hide unregistered connectors from GETCONNECTOR IOCTL"
drm/amd/display: Support parsing VRAM info v3.0 from VBIOS
drm/amd/display: Fix invalid DPIA AUX reply causing system hang
drm/amdgpu: Add psp_13_0_10_ta firmware to modinfo
drm/amd/display: Add HUBP surface flip interrupt handler
drm/amd/display: Fix access timeout to DPIA AUX at boot time
...
|
||
|
Linus Torvalds
|
ab290eaddc |
s390 updates for 6.1-rc6
- Fix deadlock in discontiguous saved segments (DCSS) block device driver. When adding a disk and scanning partitions the scan would not break out early without a missed flag. - Avoid using global register variable for current_stack_pointer due to an old bug in gcc versions prior to gcc-8.4. Due to this bug a broken code is generated, which leads to stack corruptions. -----BEGIN PGP SIGNATURE----- iI0EABYIADUWIQQrtrZiYVkVzKQcYivNdxKlNrRb8AUCY3edLRccYWdvcmRlZXZA bGludXguaWJtLmNvbQAKCRDNdxKlNrRb8MtqAQCIla7FAmztUpqFlW1yzOAb7JLd 9VtTX9lxiAwmKeL3rQD+Ow6nNhJiT7VX1+7YS+1a5lbq0fcckEbHoMtiWxRJVwc= =eAUy -----END PGP SIGNATURE----- Merge tag 's390-6.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Fix deadlock in discontiguous saved segments (DCSS) block device driver. When adding a disk and scanning partitions the scan would not break out early without a missed flag. - Avoid using global register variable for current_stack_pointer due to an old bug in gcc versions prior to gcc-8.4. Due to this bug a broken code is generated, which leads to stack corruptions. * tag 's390-6.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: avoid using global register for current_stack_pointer s390/dcssblk: fix deadlock when adding a DCSS |
||
|
Linus Torvalds
|
5556a78c74 |
- Fix misbehavior if list_versions DM ioctl races with module
loading. - Fix missing decrement of no_sleep_enabled if dm_bufio_client_create failed. - Allow DM integrity devices to be activated in read-only mode. -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEJfWUX4UqZ4x1O2wixSPxCi2dA1oFAmN3uGcACgkQxSPxCi2d A1pIKgf/Q97MyOJoMIdqhLR6lDHC6NqYs4B50Z0qikPriAopOCdsbZ0U7m3ftZLK WuDPN3hZVAJ4d+8Nhk2gWyZjDD0gJ8RuCkd/Cn9qMuXGwMNbpJgZ8rRLR7IKG2VA ENQ+nCwkD1ocJtflEIRgLaRwFBsnJDKllyOsAPOf4oVxHexA8Lpd1rWBrNbSe6Fy lxnW/qTUuabhAA9gWty2bJQnMGTBz6JHwwtmDJ35YI1BGMVrSxGlRrfBXqlwPtY3 eWJ6uykSOmc+5SwNmGHAN4N0DYQtLOLvw7rHXZ1WeGuxGlTZA2/vDK/UTxhfUhag 9v2DRawfttT+DoCf3UHeIDlXrnGLUg== =6Oz7 -----END PGP SIGNATURE----- Merge tag 'for-6.1/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix misbehavior if list_versions DM ioctl races with module loading - Fix missing decrement of no_sleep_enabled if dm_bufio_client_create failed - Allow DM integrity devices to be activated in read-only mode * tag 'for-6.1/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm integrity: clear the journal on suspend dm integrity: flush the journal on suspend dm bufio: Fix missing decrement of no_sleep_enabled if dm_bufio_client_create failed dm ioctl: fix misbehavior if list_versions races with module loading |
||
|
Dave Airlie
|
b1010b93fe |
drm/tegra: Fixes for v6.1-rc6
This contains a single fix that avoids using the GART on Tegra20 because it doesn't work well with the way the Tegra DRM driver tries to use it. -----BEGIN PGP SIGNATURE----- iQJHBAABCAAxFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmN3dtETHHRyZWRpbmdA bnZpZGlhLmNvbQAKCRDdI6zXfz6zoUjRD/9asvgInB2t2LXQXSpP/m48biafa3uw ybwz1pjWG9RA/1/atbDxxM/d8m+Woc/fNspC4e3fSVymaSNazuzY4uce26zKEqC8 wDUHutv3tb+l+0sw32vR12eM8Z5ATExG9OHZg0TB4UNfkC56iYBUCv4rtGGO/k1y erU+372l4SPZGXGl3BKo+VEZu0oD2FcWAlLmRfbo4KaX5DTr6k6bCOlBud5QoQPW e19D2lOhO+kGI1Y84q3udxxp7Wbu7B+SMbhxyHzGLE1GVuP+SyshbUGwippWsHkk 6eUSEvT36aROwxh150K9CJYWq8zDdd2/m2+iFCy5dWlTNIjSY5Tj/0rn03bNQs/7 Ofh0c0Jx5j5V0nkD8T9o8DbgpcW5oAeWKfgevhuz/AnaQO7RBfcjgQ8G9CmrlKcq cGyTANacukf6+4hDCgMhcFd6TBH9gITjkcfi2FxJ1ny4zfwRr0gzAXv09tK4JkWB VJX8xQh2+W5hZwVMSVf0EWm0xm14vg+G/Ev/2lMalsCYkiekkZqJGAGJ2Boaqkql fnEbILC5m8B0dwJcTDuKqXlqJRWc7Rat0AWlflmnbjR4wPb965o5QIH387xj4hKI Wrn9fnPvX8WASxId9Em1wqYgRRdJkb22UmNUc4kk/pd1yXzS0xp0KXX64Ht88ipm Oso15mW9Aaud5w== =qmNJ -----END PGP SIGNATURE----- Merge tag 'drm/tegra/for-6.1-rc6' of https://gitlab.freedesktop.org/drm/tegra into drm-fixes drm/tegra: Fixes for v6.1-rc6 This contains a single fix that avoids using the GART on Tegra20 because it doesn't work well with the way the Tegra DRM driver tries to use it. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thierry Reding <thierry.reding@gmail.com> Link: https://patchwork.freedesktop.org/patch/msgid/20221118121614.3511110-1-thierry.reding@gmail.com |
||
|
Linus Torvalds
|
950a9f564a |
USB driver fixes for 6.1-rc6
Here are a number of USB driver fixes and new device ids for 6.1-rc6.
Included in here are:
- new usb-serial device ids
- dwc3 driver fixes for reported problems
- cdns3 driver fixes
- new USB device quirks
- typec driver fixes
- extcon USB typec driver fix
All of these have been in linux-next with no reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCY3fKhQ8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ykJGwCdFCXb2WsirujH/kXjcDqo0XfkBLUAn0H6RTq7
IzrOoiq2+LMZoLLvetar
=llI7
-----END PGP SIGNATURE-----
Merge tag 'usb-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB driver fixes from Greg KH:
"Here are a number of USB driver fixes and new device ids for 6.1-rc6.
Included in here are:
- new usb-serial device ids
- dwc3 driver fixes for reported problems
- cdns3 driver fixes
- new USB device quirks
- typec driver fixes
- extcon USB typec driver fix
All of these have been in linux-next with no reported issues"
* tag 'usb-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
USB: serial: option: add u-blox LARA-L6 modem
USB: serial: option: add u-blox LARA-R6 00B modem
USB: serial: option: remove old LARA-R6 PID
USB: serial: option: add Fibocom FM160 0x0111 composition
usb: add NO_LPM quirk for Realforce 87U Keyboard
usb: cdns3: host: fix endless superspeed hub port reset
usb: chipidea: fix deadlock in ci_otg_del_timer
usb: dwc3: Do not get extcon device when usb-role-switch is used
usb: typec: tipd: Prevent uninitialized event{1,2} in IRQ handler
usb: typec: mux: Enter safe mode only when pins need to be reconfigured
extcon: usbc-tusb320: Call the Type-C IRQ handler only if a port is registered
Revert "usb: dwc3: disable USB core PHY management"
usb: dwc3: gadget: Return -ESHUTDOWN on ep disable
USB: bcma: Make GPIO explicitly optional
USB: serial: option: add Sierra Wireless EM9191
|
||
|
Linus Torvalds
|
12fe29ee25 |
Staging driver fix for 6.1-rc6
Here is a single staging driver fix for 6.1-rc6. It resolves a bogus signed character test as pointed out, and fixed by, Jason in the rtl8192e driver It has been in linux-next for a few weeks now with no reported problems. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCY3fI1w8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ynGdwCgjKQt3hdUQDeEcrVgpwENWwhDYS8AoJZJCUnX dYYnhb73rYZAbTBeS3sS =VuS/ -----END PGP SIGNATURE----- Merge tag 'staging-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fix from Greg KH: "Here is a single staging driver fix for 6.1-rc6. It resolves a bogus signed character test as pointed out, and fixed by, Jason in the rtl8192e driver It has been in linux-next for a few weeks now with no reported problems" * tag 'staging-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8192e: remove bogus ssid character sign test |
||
|
Liu Shixin
|
5b47348fc0 |
arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud
The page table check trigger BUG_ON() unexpectedly when collapse hugepage:
------------[ cut here ]------------
kernel BUG at mm/page_table_check.c:82!
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 6 PID: 68 Comm: khugepaged Not tainted 6.1.0-rc3+ #750
Hardware name: linux,dummy-virt (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : page_table_check_clear.isra.0+0x258/0x3f0
lr : page_table_check_clear.isra.0+0x240/0x3f0
[...]
Call trace:
page_table_check_clear.isra.0+0x258/0x3f0
__page_table_check_pmd_clear+0xbc/0x108
pmdp_collapse_flush+0xb0/0x160
collapse_huge_page+0xa08/0x1080
hpage_collapse_scan_pmd+0xf30/0x1590
khugepaged_scan_mm_slot.constprop.0+0x52c/0xac8
khugepaged+0x338/0x518
kthread+0x278/0x2f8
ret_from_fork+0x10/0x20
[...]
Since pmd_user_accessible_page() doesn't check if a pmd is leaf, it
decrease file_map_count for a non-leaf pmd comes from collapse_huge_page().
and so trigger BUG_ON() unexpectedly.
Fix this problem by using pmd_leaf() insteal of pmd_present() in
pmd_user_accessible_page(). Moreover, use pud_leaf() for
pud_user_accessible_page() too.
Fixes:
|
||
|
Linus Torvalds
|
09389357e9 |
TTY/Serial driver fixes for 6.1-rc6
Here are a number of small tty and serial driver fixes for 6.1-rc6.
They all resolve reported problems:
- kernel doc build problems with the -rc1 serial driver
documentation update
- n_gsm reported problems
- imx serial driver missing callback
- lots of tiny 8250 driver fixes for reported issues.
All of these have been in linux-next for over a week with no reported
problems.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCY3fJoQ8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ynycACgozhFjiUOjim8J0qUR943mlhTp/kAn0BVsKSk
PD8gi6Wk5SAybCpHxpsD
=Bqke
-----END PGP SIGNATURE-----
Merge tag 'tty-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty/serial driver fixes from Greg KH:
"Here are a number of small tty and serial driver fixes for 6.1-rc6.
They all resolve reported problems:
- kernel doc build problems with the -rc1 serial driver documentation
update
- n_gsm reported problems
- imx serial driver missing callback
- lots of tiny 8250 driver fixes for reported issues.
All of these have been in linux-next for over a week with no reported
problems"
* tag 'tty-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
docs/driver-api/miscellaneous: Remove kernel-doc of serial_core.c
serial: 8250: Flush DMA Rx on RLSI
serial: 8250_lpss: Use 16B DMA burst with Elkhart Lake
serial: 8250_lpss: Configure DMA also w/o DMA filter
serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
Revert "tty: n_gsm: replace kicktimer with delayed_work"
Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
serial: imx: Add missing .thaw_noirq hook
tty: serial: fsl_lpuart: don't break the on-going transfer when global reset
serial: 8250: omap: Flush PM QOS work on remove
serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove()
serial: 8250_omap: remove wait loop from Errata i202 workaround
serial: 8250: omap: Fix missing PM runtime calls for omap8250_set_mctrl()
serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
|
||
|
Linus Torvalds
|
63c8c0d7dc |
Driver core fixes for 6.1-rc6
Here are 2 small driver core fixes for 6.1-rc6:
- utsname fix, this one should already be in your tree as it
came from a different tree earlier.
- kernfs bugfix for a much reported syzbot report that seems to
keep getting triggered.
Both of these have been in linux-next for a while with no reported
issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCY3dPug8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ynaxgCfbhh4z3ARWRl1L5H+vtnH+MeaLsoAnRBKQ2yv
GUXBXpiyz5TSzfGiP/Im
=80uW
-----END PGP SIGNATURE-----
Merge tag 'driver-core-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull driver core fixes from Greg KH:
"Here are two small driver core fixes for 6.1-rc6:
- utsname fix, this one should already be in your tree as it came
from a different tree earlier.
- kernfs bugfix for a much reported syzbot report that seems to keep
getting triggered.
Both of these have been in linux-next for a while with no reported
issues"
* tag 'driver-core-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
kernfs: Fix spurious lockdep warning in kernfs_find_and_get_node_by_id()
kernel/utsname_sysctl.c: Add missing enum uts_proc value
|
||
|
Linus Torvalds
|
1f63d1a106 |
Char/Misc driver fixes for 6.1-rc6
Here are some small char/misc and other driver fixes for 6.1-rc6 to resolve some reported problems. Included in here are: - iio driver fixes - binder driver fix - nvmem driver fix - vme_vmci information leak fix - parport fix - slimbus configuration fix - coreboot firmware bugfix - speakup build fix and crash fix All of these have been in linux-next for a while with no reported issues Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCY3dKsA8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ylGbACgiR6Eq+qo8A1GWq5nb5LN0LQyj4EAn1C8ra8B 4r8su1o5PKEJgr2AvTYb =4U4M -----END PGP SIGNATURE----- Merge tag 'char-misc-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc and other driver fixes for 6.1-rc6 to resolve some reported problems. Included in here are: - iio driver fixes - binder driver fix - nvmem driver fix - vme_vmci information leak fix - parport fix - slimbus configuration fix - coreboot firmware bugfix - speakup build fix and crash fix All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (22 commits) firmware: coreboot: Register bus in module init nvmem: u-boot-env: fix crc32_data_offset on redundant u-boot-env slimbus: qcom-ngd: Fix build error when CONFIG_SLIM_QCOM_NGD_CTRL=y && CONFIG_QCOM_RPROC_COMMON=m docs: update mediator contact information in CoC doc slimbus: stream: correct presence rate frequencies nvmem: lan9662-otp: Fix compatible string binder: validate alloc->mm in ->mmap() handler parport_pc: Avoid FIFO port location truncation siox: fix possible memory leak in siox_device_add() misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() speakup: replace utils' u_char with unsigned char speakup: fix a segfault caused by switching consoles tools: iio: iio_generic_buffer: Fix read size iio: imu: bno055: uninitialized variable bug in bno055_trigger_handler() iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() iio: adc: mp2629: fix potential array out of bound access iio: adc: mp2629: fix wrong comparison of channel iio: pressure: ms5611: changed hardcoded SPI speed to value limited iio: pressure: ms5611: fixed value compensation bug iio: accel: bma400: Ensure VDDIO is enable defore reading the chip ID. ... |
||
|
Linus Torvalds
|
ae55826837 |
sound fixes for 6.1-rc6
A fair amount of commits at this time due to ASoC PR merge, but all look small and easy, mostly device-specific fixes spanned in various drivers. Hopefully this should be the last big chunk for 6.1. -----BEGIN PGP SIGNATURE----- iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmN3UiAOHHRpd2FpQHN1 c2UuZGUACgkQLtJE4w1nLE9BNQ//Tt4ucuRh2nbnr0CTBT50DHthPYNT00Avh3pe XgIEkBKlYsd5b7bRMIsal1hksKHRzM0cgIMPh6qGDI9DJJd9hf9ADfwJlWj5l31g brjvWtbELZoSUjsEthubNWFcsPhjrRN+t8MKGqoFg/H80tMy5hIBr/0bJuO909HH QXJ0NbeWXi6sLBMI2QWSijO7SYRofTplCn6/8QlGIdJpogGzlNo7xHv3E+I58Ipk 9uZWYOOB/9NPN5zopRpDrb7ZMiWOfTfPBDEB3CgIi0RbEpyInhnueG1MchwGi14n DgDWFf5UbjCCEEv5uFgaicnTBSM2x+Lv92WnQbL3075QtxNJFyi0UPGRRkia3IP/ 3xY70jiNJ4gQOFgXGWF0T4yIAHdBt7E7EfrmmTzackToRhQUa78RsCN6VmZFCJLN Y8PtvEz7q+8GRNIUgz70b0t1S3u/EexCtzsoAwH2AfpdfGVBEfn37e0eAaWQDmP3 s2LPk43RcFPJgszdHUuOMXsueM2/dJ82dYSqyVhv4+lgn2pH8tUGAA6waBRYr9m4 xcoSQ/1Tb1XokJ+/SJK4NcVejDc5ubkzZgzuD+fRFmtOkSvOb43rq7SUl9XUydA1 YTPsQlqqcs0wt0bVTRq8P3nWh0B4bKIcqfdLEk60MWN7JFrCtulp75vaD4ypMGpN Sh21L48= =FU82 -----END PGP SIGNATURE----- Merge tag 'sound-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A fair amount of commits at this time due to ASoC PR merge, but all look small and easy, mostly device-specific fixes spanned in various drivers. Hopefully this should be the last big chunk for 6.1" * tag 'sound-6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (21 commits) ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() ASoC: stm32: dfsdm: manage cb buffers cleanup ASoC: sof_es8336: reduce pop noise on speaker ASoC: SOF: topology: No need to assign core ID if token parsing failed ASoC: soc-utils: Remove __exit for snd_soc_util_exit() ASoC: rt5677: fix legacy dai naming ASoC: rt5514: fix legacy dai naming ASoC: SOF: ipc3-topology: use old pipeline teardown flow with SOF2.1 and older ASoC: hda: intel-dsp-config: add ES83x6 quirk for IceLake ASoC: Intel: soc-acpi: add ES83x6 support to IceLake ASoC: tas2780: Fix set_tdm_slot in case of single slot ASoC: tas2764: Fix set_tdm_slot in case of single slot ASoC: tas2770: Fix set_tdm_slot in case of single slot ASoC: fsl_asrc fsl_esai fsl_sai: allow CONFIG_PM=N ASoC: core: Fix use-after-free in snd_soc_exit() MAINTAINERS: update Tzung-Bi's email address ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 ASoC: amd: yc: Add Alienware m17 R5 AMD into DMI table ... |
||
|
Linus Torvalds
|
4ab9ffda3f |
MMC core:
- Fixup VDD/VMMC voltage-range negotiation MMC host: - sdhci-pci: Fix memory leak by adding a missing pci_dev_put() - sdhci-pci-o2micro: Fix card detect by tuning the debounce timeout -----BEGIN PGP SIGNATURE----- iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmN3UeEXHHVsZi5oYW5z c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjClj3A//b4VXX1fPotwwkoKM9uzoHZg7 u+b/TYp5Xw65z9FUxJedbdA3vlTz9dCh3J7yIADiA1sO62zDn9r0b0dD2q774EiM q8TbL9PK0Hxrn7tBFp9wZePDsWQ/nPNk+vA6ZHqYedG0PYcctzuQvPdTl7/8XsKt QJ2EonP0GGtjwiXOSUBC8K54P2ayOEhMtygZXljIbzhICDUXZoM39tWX2GhgT1SL 8q8CxFDWetzYaasvAOfluExfr0h/kyoRBfWssqTS/2158zomECOy0FyiEM6Bb7tT jAx7Z0f0/oquGSpAB6nzwvuUIsD4J+vU/6vYems8/1HwDhBXvQkvWMZJXY6t8R00 0OV5JxhIiKldyTHNGRD+KlpR7LcTiIU1W/bvJ8ES6KEyePf1m57bnBMZ2P3MiUuA sijrnWPQ3CVqNZPE4NmdpY0Pk5uByCKd+5AVU/hcOLdxr1UjBiVZxI6Zw0vXxwBV 35PtbzQ5Fnt82MkcUhzE4c7RZYV4pBVbsqnWSsOftIZpa+pWKy7d0zorkeKJIsJZ clwYpf5fbB4oqpJzmQ+pUZfEtYR6tPjEm+Qp4K4JwVIDhwwsi2Md6H61TC2m+mJi WsLwR7AGpOahQ+PWYKnbHEaoY4H31JIALpjs88yu8QtREEZzIsU36KHwQLgax6tB fcywxvEcAyDTbAj707c= =IFr1 -----END PGP SIGNATURE----- Merge tag 'mmc-v6.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fixup VDD/VMMC voltage-range negotiation MMC host: - sdhci-pci: Fix memory leak by adding a missing pci_dev_put() - sdhci-pci-o2micro: Fix card detect by tuning the debounce timeout" * tag 'mmc-v6.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout mmc: core: properly select voltage range without power cycle |
||
|
Pavel Begunkov
|
7fdbc5f014 |
io_uring: disallow self-propelled ring polling
When we post a CQE we wake all ring pollers as it normally should be.
However, if a CQE was generated by a multishot poll request targeting
its own ring, it'll wake that request up, which will make it to post
a new CQE, which will wake the request and so on until it exhausts all
CQ entries.
Don't allow multishot polling io_uring files but downgrade them to
oneshots, which was always stated as a correct behaviour that the
userspace should check for.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Mikulas Patocka
|
984bf2cc53 |
dm integrity: clear the journal on suspend
There was a problem that a user burned a dm-integrity image on CDROM and could not activate it because it had a non-empty journal. Fix this problem by flushing the journal (done by the previous commit) and clearing the journal (done by this commit). Once the journal is cleared, dm-integrity won't attempt to replay it on the next activation. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@kernel.org> |
||
|
Mikulas Patocka
|
5e5dab5ec7 |
dm integrity: flush the journal on suspend
This commit flushes the journal on suspend. It is prerequisite for the next commit that enables activating dm integrity devices in read-only mode. Note that we deliberately didn't flush the journal on suspend, so that the journal replay code would be tested. However, the dm-integrity code is 5 years old now, so that journal replay is well-tested, and we can make this change now. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@kernel.org> |
||
|
Zhihao Cheng
|
0dfc1f4cea |
dm bufio: Fix missing decrement of no_sleep_enabled if dm_bufio_client_create failed
The 'no_sleep_enabled' should be decreased in error handling path
in dm_bufio_client_create() when the DM_BUFIO_CLIENT_NO_SLEEP flag
is set, otherwise static_branch_unlikely() will always return true
even if no dm_bufio_client instances have DM_BUFIO_CLIENT_NO_SLEEP
flag set.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Mikulas Patocka
|
4fe1ec9954 |
dm ioctl: fix misbehavior if list_versions races with module loading
__list_versions will first estimate the required space using the "dm_target_iterate(list_version_get_needed, &needed)" call and then will fill the space using the "dm_target_iterate(list_version_get_info, &iter_info)" call. Each of these calls locks the targets using the "down_read(&_lock)" and "up_read(&_lock)" calls, however between the first and second "dm_target_iterate" there is no lock held and the target modules can be loaded at this point, so the second "dm_target_iterate" call may need more space than what was the first "dm_target_iterate" returned. The code tries to handle this overflow (see the beginning of list_version_get_info), however this handling is incorrect. The code sets "param->data_size = param->data_start + needed" and "iter_info.end = (char *)vers+len" - "needed" is the size returned by the first dm_target_iterate call; "len" is the size of the buffer allocated by userspace. "len" may be greater than "needed"; in this case, the code will write up to "len" bytes into the buffer, however param->data_size is set to "needed", so it may write data past the param->data_size value. The ioctl interface copies only up to param->data_size into userspace, thus part of the result will be truncated. Fix this bug by setting "iter_info.end = (char *)vers + needed;" - this guarantees that the second "dm_target_iterate" call will write only up to the "needed" buffer and it will exit with "DM_BUFFER_FULL_FLAG" if it overflows the "needed" space - in this case, userspace will allocate a larger buffer and retry. Note that there is also a bug in list_version_get_needed - we need to add "strlen(tt->name) + 1" to the needed size, not "strlen(tt->name)". Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@kernel.org> |
||
|
Jens Axboe
|
5c59789ce7 |
nvme fixes for Linux 6.1
- two more bogus nid quirks (Bean Huo, Tiago Dias Ferreira) - memory leak fix in nvmet (Sagi Grimberg) -----BEGIN PGP SIGNATURE----- iQI/BAABCgApFiEEgdbnc3r/njty3Iq9D55TZVIEUYMFAmN3ensLHGhjaEBsc3Qu ZGUACgkQD55TZVIEUYOFAw/+K1XKCv82DuY7I8NXfxYLP4DtusCjHXnWaVfJGd+m N+aRHl03+ePmAZD93z89uFAL5cFsuL+kAF4jpGniIPG2iV/gleXaDrWmY42oLk5v JZQ8CWxt6PGuhv0AT9JGrlmluzj1MZ1kX8cBZMuLoIBiEPYxvwlBP1PaC8IPtqsN 8SD3yEQa/RIzt104egBAczUqiemIYdbZWIy51B0dh+2vklJtz4t5zwEb2n4PMROp VENQ6I2ba4A1k0M2EhKZRbWSas65RfKTSBOnzrM0Neek2o4t5H/Z6iBAieXEgo2n auqtgrXCZePTYDzlnhSa+/H4DF6v1HVbKtmZFLrVxh8l3d/MRjQfdePPtzssTVYv pGHIGEKIP4i918Kn/0BYcXS4aXA4GuJiLJPwn2eqDKlum1ohWwMLD/efW1AZckIj wXcNvuOJXpE1cA8e40NsBWC1ELSpsNPwoNpMFgAqmiq74N6UZXDXUvA7RgBhFytt sj9uqw3FsIOHr9hBKnpC4Xz9SNhOjLhJuwPnlW64NxjoYmo84UlqcFU6Cvv6kbkP EA9DgCQVNqETRVFL0ynbjzWposZleC3r6QyLpcm0RxxMKs595Ut29xxbwgMV+NXE 8C1OvbfXFfH3X2hAt4rKB/aMslaJk3Igd1AqHwJ/TeXAbTD7qMMbl4sw0iHSbAqt D+4= =9CR/ -----END PGP SIGNATURE----- Merge tag 'nvme-6.1-2022-11-18' of git://git.infradead.org/nvme into block-6.1 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.1 - two more bogus nid quirks (Bean Huo, Tiago Dias Ferreira) - memory leak fix in nvmet (Sagi Grimberg)" * tag 'nvme-6.1-2022-11-18' of git://git.infradead.org/nvme: nvmet: fix a memory leak in nvmet_auth_set_key nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV7000 nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro |
||
|
Robin Murphy
|
c2418f911a |
gpu: host1x: Avoid trying to use GART on Tegra20
Since commit |
||
|
Zheng Yejian
|
067df9e0ad |
tracing: Fix potential null-pointer-access of entry in list 'tr->err_log'
Entries in list 'tr->err_log' will be reused after entry number
exceed TRACING_LOG_ERRS_MAX.
The cmd string of the to be reused entry will be freed first then
allocated a new one. If the allocation failed, then the entry will
still be in list 'tr->err_log' but its 'cmd' field is set to be NULL,
later access of 'cmd' is risky.
Currently above problem can cause the loss of 'cmd' information of first
entry in 'tr->err_log'. When execute `cat /sys/kernel/tracing/error_log`,
reproduce logs like:
[ 37.495100] trace_kprobe: error: Maxactive is not for kprobe(null) ^
[ 38.412517] trace_kprobe: error: Maxactive is not for kprobe
Command: p4:myprobe2 do_sys_openat2
^
Link: https://lore.kernel.org/linux-trace-kernel/20221114104632.3547266-1-zhengyejian1@huawei.com
Fixes:
|
||
|
Qiujun Huang
|
b8752064e3 |
tracing: Remove unused __bad_type_size() method
__bad_type_size() is unused after
commit 04ae87a52074("ftrace: Rework event_create_dir()").
So, remove it.
Link: https://lkml.kernel.org/r/D062EC2E-7DB7-4402-A67E-33C3577F551E@gmail.com
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
|
||
|
Masami Hiramatsu (Google)
|
40adaf51cb |
tracing/eprobe: Fix eprobe filter to make a filter correctly
Since the eprobe filter was defined based on the eprobe's trace event
itself, it doesn't work correctly. Use the original trace event of
the eprobe when making the filter so that the filter works correctly.
Without this fix:
# echo 'e syscalls/sys_enter_openat \
flags_rename=$flags:u32 if flags < 1000' >> dynamic_events
# echo 1 > events/eprobes/sys_enter_openat/enable
[ 114.551550] event trace: Could not enable event sys_enter_openat
-bash: echo: write error: Invalid argument
With this fix:
# echo 'e syscalls/sys_enter_openat \
flags_rename=$flags:u32 if flags < 1000' >> dynamic_events
# echo 1 > events/eprobes/sys_enter_openat/enable
# tail trace
cat-241 [000] ...1. 266.498449: sys_enter_openat: (syscalls.sys_enter_openat) flags_rename=0
cat-242 [000] ...1. 266.977640: sys_enter_openat: (syscalls.sys_enter_openat) flags_rename=0
Link: https://lore.kernel.org/all/166823166395.1385292.8931770640212414483.stgit@devnote3/
Fixes:
|
||
|
Rafael Mendonca
|
342a4a2f99 |
tracing/eprobe: Fix warning in filter creation
The filter pointer (filterp) passed to create_filter() function must be a
pointer that references a NULL pointer, otherwise, we get a warning when
adding a filter option to the event probe:
root@localhost:/sys/kernel/tracing# echo 'e:egroup/stat_runtime_4core sched/sched_stat_runtime \
runtime=$runtime:u32 if cpu < 4' >> dynamic_events
[ 5034.340439] ------------[ cut here ]------------
[ 5034.341258] WARNING: CPU: 0 PID: 223 at kernel/trace/trace_events_filter.c:1939 create_filter+0x1db/0x250
[...] stripped
[ 5034.345518] RIP: 0010:create_filter+0x1db/0x250
[...] stripped
[ 5034.351604] Call Trace:
[ 5034.351803] <TASK>
[ 5034.351959] ? process_preds+0x1b40/0x1b40
[ 5034.352241] ? rcu_read_lock_bh_held+0xd0/0xd0
[ 5034.352604] ? kasan_set_track+0x29/0x40
[ 5034.352904] ? kasan_save_alloc_info+0x1f/0x30
[ 5034.353264] create_event_filter+0x38/0x50
[ 5034.353573] __trace_eprobe_create+0x16f4/0x1d20
[ 5034.353964] ? eprobe_dyn_event_release+0x360/0x360
[ 5034.354363] ? mark_held_locks+0xa6/0xf0
[ 5034.354684] ? _raw_spin_unlock_irqrestore+0x35/0x60
[ 5034.355105] ? trace_hardirqs_on+0x41/0x120
[ 5034.355417] ? _raw_spin_unlock_irqrestore+0x35/0x60
[ 5034.355751] ? __create_object+0x5b7/0xcf0
[ 5034.356027] ? lock_is_held_type+0xaf/0x120
[ 5034.356362] ? rcu_read_lock_bh_held+0xb0/0xd0
[ 5034.356716] ? rcu_read_lock_bh_held+0xd0/0xd0
[ 5034.357084] ? kasan_set_track+0x29/0x40
[ 5034.357411] ? kasan_save_alloc_info+0x1f/0x30
[ 5034.357715] ? __kasan_kmalloc+0xb8/0xc0
[ 5034.357985] ? write_comp_data+0x2f/0x90
[ 5034.358302] ? __sanitizer_cov_trace_pc+0x25/0x60
[ 5034.358691] ? argv_split+0x381/0x460
[ 5034.358949] ? write_comp_data+0x2f/0x90
[ 5034.359240] ? eprobe_dyn_event_release+0x360/0x360
[ 5034.359620] trace_probe_create+0xf6/0x110
[ 5034.359940] ? trace_probe_match_command_args+0x240/0x240
[ 5034.360376] eprobe_dyn_event_create+0x21/0x30
[ 5034.360709] create_dyn_event+0xf3/0x1a0
[ 5034.360983] trace_parse_run_command+0x1a9/0x2e0
[ 5034.361297] ? dyn_event_release+0x500/0x500
[ 5034.361591] dyn_event_write+0x39/0x50
[ 5034.361851] vfs_write+0x311/0xe50
[ 5034.362091] ? dyn_event_seq_next+0x40/0x40
[ 5034.362376] ? kernel_write+0x5b0/0x5b0
[ 5034.362637] ? write_comp_data+0x2f/0x90
[ 5034.362937] ? __sanitizer_cov_trace_pc+0x25/0x60
[ 5034.363258] ? ftrace_syscall_enter+0x544/0x840
[ 5034.363563] ? write_comp_data+0x2f/0x90
[ 5034.363837] ? __sanitizer_cov_trace_pc+0x25/0x60
[ 5034.364156] ? write_comp_data+0x2f/0x90
[ 5034.364468] ? write_comp_data+0x2f/0x90
[ 5034.364770] ksys_write+0x158/0x2a0
[ 5034.365022] ? __ia32_sys_read+0xc0/0xc0
[ 5034.365344] __x64_sys_write+0x7c/0xc0
[ 5034.365669] ? syscall_enter_from_user_mode+0x53/0x70
[ 5034.366084] do_syscall_64+0x60/0x90
[ 5034.366356] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 5034.366767] RIP: 0033:0x7ff0b43938f3
[...] stripped
[ 5034.371892] </TASK>
[ 5034.374720] ---[ end trace 0000000000000000 ]---
Link: https://lore.kernel.org/all/20221108202148.1020111-1-rafaelmendsr@gmail.com/
Fixes:
|
||
|
Li Huafei
|
5dd7caf0bd |
kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case
In __unregister_kprobe_top(), if the currently unregistered probe has
post_handler but other child probes of the aggrprobe do not have
post_handler, the post_handler of the aggrprobe is cleared. If this is
a ftrace-based probe, there is a problem. In later calls to
disarm_kprobe(), we will use kprobe_ftrace_ops because post_handler is
NULL. But we're armed with kprobe_ipmodify_ops. This triggers a WARN in
__disarm_kprobe_ftrace() and may even cause use-after-free:
Failed to disarm kprobe-ftrace at kernel_clone+0x0/0x3c0 (error -2)
WARNING: CPU: 5 PID: 137 at kernel/kprobes.c:1135 __disarm_kprobe_ftrace.isra.21+0xcf/0xe0
Modules linked in: testKprobe_007(-)
CPU: 5 PID: 137 Comm: rmmod Not tainted 6.1.0-rc4-dirty #18
[...]
Call Trace:
<TASK>
__disable_kprobe+0xcd/0xe0
__unregister_kprobe_top+0x12/0x150
? mutex_lock+0xe/0x30
unregister_kprobes.part.23+0x31/0xa0
unregister_kprobe+0x32/0x40
__x64_sys_delete_module+0x15e/0x260
? do_user_addr_fault+0x2cd/0x6b0
do_syscall_64+0x3a/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
[...]
For the kprobe-on-ftrace case, we keep the post_handler setting to
identify this aggrprobe armed with kprobe_ipmodify_ops. This way we
can disarm it correctly.
Link: https://lore.kernel.org/all/20221112070000.35299-1-lihuafei1@huawei.com/
Fixes:
|
||
|
Yi Yang
|
0a1ebe35cb |
rethook: fix a potential memleak in rethook_alloc()
In rethook_alloc(), the variable rh is not freed or passed out
if handler is NULL, which could lead to a memleak, fix it.
Link: https://lore.kernel.org/all/20221110104438.88099-1-yiyang13@huawei.com/
[Masami: Add "rethook:" tag to the title.]
Fixes:
|
||
|
Rafael Mendonca
|
d1776c0202 |
tracing/eprobe: Fix memory leak of filter string
The filter string doesn't get freed when a dynamic event is deleted. If a
filter is set, then memory is leaked:
root@localhost:/sys/kernel/tracing# echo 'e:egroup/stat_runtime_4core \
sched/sched_stat_runtime runtime=$runtime:u32 if cpu < 4' >> dynamic_events
root@localhost:/sys/kernel/tracing# echo "-:egroup/stat_runtime_4core" >> dynamic_events
root@localhost:/sys/kernel/tracing# echo scan > /sys/kernel/debug/kmemleak
[ 224.416373] kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
root@localhost:/sys/kernel/tracing# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff88810156f1b8 (size 8):
comm "bash", pid 224, jiffies 4294935612 (age 55.800s)
hex dump (first 8 bytes):
63 70 75 20 3c 20 34 00 cpu < 4.
backtrace:
[<000000009f880725>] __kmem_cache_alloc_node+0x18e/0x720
[<0000000042492946>] __kmalloc+0x57/0x240
[<0000000034ea7995>] __trace_eprobe_create+0x1214/0x1d30
[<00000000d70ef730>] trace_probe_create+0xf6/0x110
[<00000000915c7b16>] eprobe_dyn_event_create+0x21/0x30
[<000000000d894386>] create_dyn_event+0xf3/0x1a0
[<00000000e9af57d5>] trace_parse_run_command+0x1a9/0x2e0
[<0000000080777f18>] dyn_event_write+0x39/0x50
[<0000000089f0ec73>] vfs_write+0x311/0xe50
[<000000003da1bdda>] ksys_write+0x158/0x2a0
[<00000000bb1e616e>] __x64_sys_write+0x7c/0xc0
[<00000000e8aef1f7>] do_syscall_64+0x60/0x90
[<00000000fe7fe8ba>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Additionally, in __trace_eprobe_create() function, if an error occurs after
the call to trace_eprobe_parse_filter(), which allocates the filter string,
then memory is also leaked. That can be reproduced by creating the same
event probe twice:
root@localhost:/sys/kernel/tracing# echo 'e:egroup/stat_runtime_4core \
sched/sched_stat_runtime runtime=$runtime:u32 if cpu < 4' >> dynamic_events
root@localhost:/sys/kernel/tracing# echo 'e:egroup/stat_runtime_4core \
sched/sched_stat_runtime runtime=$runtime:u32 if cpu < 4' >> dynamic_events
-bash: echo: write error: File exists
root@localhost:/sys/kernel/tracing# echo scan > /sys/kernel/debug/kmemleak
[ 207.871584] kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
root@localhost:/sys/kernel/tracing# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff8881020d17a8 (size 8):
comm "bash", pid 223, jiffies 4294938308 (age 31.000s)
hex dump (first 8 bytes):
63 70 75 20 3c 20 34 00 cpu < 4.
backtrace:
[<000000000e4f5f31>] __kmem_cache_alloc_node+0x18e/0x720
[<0000000024f0534b>] __kmalloc+0x57/0x240
[<000000002930a28e>] __trace_eprobe_create+0x1214/0x1d30
[<0000000028387903>] trace_probe_create+0xf6/0x110
[<00000000a80d6a9f>] eprobe_dyn_event_create+0x21/0x30
[<000000007168698c>] create_dyn_event+0xf3/0x1a0
[<00000000f036bf6a>] trace_parse_run_command+0x1a9/0x2e0
[<00000000014bde8b>] dyn_event_write+0x39/0x50
[<0000000078a097f7>] vfs_write+0x311/0xe50
[<00000000996cb208>] ksys_write+0x158/0x2a0
[<00000000a3c2acb0>] __x64_sys_write+0x7c/0xc0
[<0000000006b5d698>] do_syscall_64+0x60/0x90
[<00000000780e8ecf>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fix both issues by releasing the filter string in
trace_event_probe_cleanup().
Link: https://lore.kernel.org/all/20221108235738.1021467-1-rafaelmendsr@gmail.com/
Fixes:
|
||
|
Shang XiaoJing
|
22ea4ca963 |
tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit()
When test_gen_kprobe_cmd() failed after kprobe_event_gen_cmd_end(), it
will goto delete, which will call kprobe_event_delete() and release the
corresponding resource. However, the trace_array in gen_kretprobe_test
will point to the invalid resource. Set gen_kretprobe_test to NULL
after called kprobe_event_delete() to prevent null-ptr-deref.
BUG: kernel NULL pointer dereference, address: 0000000000000070
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 0 PID: 246 Comm: modprobe Tainted: G W
6.1.0-rc1-00174-g9522dc5c87da-dirty #248
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:__ftrace_set_clr_event_nolock+0x53/0x1b0
Code: e8 82 26 fc ff 49 8b 1e c7 44 24 0c ea ff ff ff 49 39 de 0f 84 3c
01 00 00 c7 44 24 18 00 00 00 00 e8 61 26 fc ff 48 8b 6b 10 <44> 8b 65
70 4c 8b 6d 18 41 f7 c4 00 02 00 00 75 2f
RSP: 0018:ffffc9000159fe00 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88810971d268 RCX: 0000000000000000
RDX: ffff8881080be600 RSI: ffffffff811b48ff RDI: ffff88810971d058
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: ffffc9000159fe58 R11: 0000000000000001 R12: ffffffffa0001064
R13: ffffffffa000106c R14: ffff88810971d238 R15: 0000000000000000
FS: 00007f89eeff6540(0000) GS:ffff88813b600000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000070 CR3: 000000010599e004 CR4: 0000000000330ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__ftrace_set_clr_event+0x3e/0x60
trace_array_set_clr_event+0x35/0x50
? 0xffffffffa0000000
kprobe_event_gen_test_exit+0xcd/0x10b [kprobe_event_gen_test]
__x64_sys_delete_module+0x206/0x380
? lockdep_hardirqs_on_prepare+0xd8/0x190
? syscall_enter_from_user_mode+0x1c/0x50
do_syscall_64+0x3f/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f89eeb061b7
Link: https://lore.kernel.org/all/20221108015130.28326-3-shangxiaojing@huawei.com/
Fixes:
|
||
|
Shang XiaoJing
|
e0d75267f5 |
tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit()
When trace_get_event_file() failed, gen_kretprobe_test will be assigned
as the error code. If module kprobe_event_gen_test is removed now, the
null pointer dereference will happen in kprobe_event_gen_test_exit().
Check if gen_kprobe_test or gen_kretprobe_test is error code or NULL
before dereference them.
BUG: kernel NULL pointer dereference, address: 0000000000000012
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 3 PID: 2210 Comm: modprobe Not tainted
6.1.0-rc1-00171-g2159299a3b74-dirty #217
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:kprobe_event_gen_test_exit+0x1c/0xb5 [kprobe_event_gen_test]
Code: Unable to access opcode bytes at 0xffffffff9ffffff2.
RSP: 0018:ffffc900015bfeb8 EFLAGS: 00010246
RAX: ffffffffffffffea RBX: ffffffffa0002080 RCX: 0000000000000000
RDX: ffffffffa0001054 RSI: ffffffffa0001064 RDI: ffffffffdfc6349c
RBP: ffffffffa0000000 R08: 0000000000000004 R09: 00000000001e95c0
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000800
R13: ffffffffa0002420 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f56b75be540(0000) GS:ffff88813bc00000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff9ffffff2 CR3: 000000010874a006 CR4: 0000000000330ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__x64_sys_delete_module+0x206/0x380
? lockdep_hardirqs_on_prepare+0xd8/0x190
? syscall_enter_from_user_mode+0x1c/0x50
do_syscall_64+0x3f/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Link: https://lore.kernel.org/all/20221108015130.28326-2-shangxiaojing@huawei.com/
Fixes:
|