1. 17 Jun, 2022 15 commits
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.19-2022-06-16' of git://git.kernel.dk/linux-block · f8e174c3
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "Bigger than usual at this time, both because we missed -rc2, but also
        because of some reverts that we chose to do. In detail:
      
         - Adjust mapped buffer API while we still can (Dylan)
      
         - Mapped buffer fixes (Dylan, Hao, Pavel, me)
      
         - Fix for uring_cmd wrong API usage for task_work (Dylan)
      
         - Fix for bug introduced in fixed file closing (Hao)
      
         - Fix race in buffer/file resource handling (Pavel)
      
         - Revert the NOP support for CQE32 and buffer selection that was
           brought up during the merge window (Pavel)
      
         - Remove IORING_CLOSE_FD_AND_FILE_SLOT introduced in this merge
           window. The API needs further refining, so just yank it for now and
           we'll revisit for a later kernel.
      
         - Series cleaning up the CQE32 support added in this merge window,
           making it more integrated rather than sitting on the side (Pavel)"
      
      * tag 'io_uring-5.19-2022-06-16' of git://git.kernel.dk/linux-block: (21 commits)
        io_uring: recycle provided buffer if we punt to io-wq
        io_uring: do not use prio task_work_add in uring_cmd
        io_uring: commit non-pollable provided mapped buffers upfront
        io_uring: make io_fill_cqe_aux honour CQE32
        io_uring: remove __io_fill_cqe() helper
        io_uring: fix ->extra{1,2} misuse
        io_uring: fill extra big cqe fields from req
        io_uring: unite fill_cqe and the 32B version
        io_uring: get rid of __io_fill_cqe{32}_req()
        io_uring: remove IORING_CLOSE_FD_AND_FILE_SLOT
        Revert "io_uring: add buffer selection support to IORING_OP_NOP"
        Revert "io_uring: support CQE32 for nop operation"
        io_uring: limit size of provided buffer ring
        io_uring: fix types in provided buffer ring
        io_uring: fix index calculation
        io_uring: fix double unlock for pbuf select
        io_uring: kbuf: fix bug of not consuming ring buffer in partial io case
        io_uring: openclose: fix bug of closing wrong fixed file
        io_uring: fix not locked access to fixed buf table
        io_uring: fix races with buffer table unregister
        ...
      f8e174c3
    • Linus Torvalds's avatar
      Merge tag 'fs_for_v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · 5c0cd3d4
      Linus Torvalds authored
      Pull writeback and ext2 fixes from Jan Kara:
       "A fix for writeback bug which prevented machines with kdevtmpfs from
        booting and also one small ext2 bugfix in IO error handling"
      
      * tag 'fs_for_v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        init: Initialize noop_backing_dev_info early
        ext2: fix fs corruption when trying to remove a non-empty directory with IO error
      5c0cd3d4
    • Linus Torvalds's avatar
      Merge tag 'for-5.19/dm-fixes-3' of... · 274295c6
      Linus Torvalds authored
      Merge tag 'for-5.19/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - Fix a race in DM core's dm_start_io_acct that could result in double
         accounting for abnormal IO (e.g. discards, write zeroes, etc).
      
       - Fix a use-after-free in DM core's dm_put_live_table_bio.
      
       - Fix a race for REQ_NOWAIT bios being issued despite no support from
         underlying DM targets (due to DM table reload at an "unlucky" time)
      
       - Fix access beyond allocated bitmap in DM mirror's log.
      
      * tag 'for-5.19/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm mirror log: round up region bitmap size to BITS_PER_LONG
        dm: fix narrow race for REQ_NOWAIT bios being issued despite no support
        dm: fix use-after-free in dm_put_live_table_bio
        dm: fix race in dm_start_io_acct
      274295c6
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-v5.19-rc3' of... · a96e902b
      Linus Torvalds authored
      Merge tag 'hwmon-for-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fixes from Guenter Roeck:
      
       - Add missing lock protection in occ driver
      
       - Add missing comma in board name list in asus-ec-sensors driver
      
       - Fix devicetree bindings for ti,tmp401
      
      * tag 'hwmon-for-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (asus-ec-sensors) add missing comma in board name list.
        hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active
        dt-bindings: hwmon: ti,tmp401: Drop 'items' from 'ti,n-factor' property
      a96e902b
    • Linus Torvalds's avatar
      Merge tag 'linux-watchdog-5.19-rc3' of git://www.linux-watchdog.org/linux-watchdog · 7c2d03f1
      Linus Torvalds authored
      Pull watchdog fix from Wim Van Sebroeck:
       "Add missing MODULE_LICENSE in gxp driver"
      
      * tag 'linux-watchdog-5.19-rc3' of git://www.linux-watchdog.org/linux-watchdog:
        watchdog: gxp: Add missing MODULE_LICENSE
      7c2d03f1
    • Linus Torvalds's avatar
      Merge tag 'v5.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · 79fe0f86
      Linus Torvalds authored
      Pull crypto fix from Herbert Xu:
       "This fixes a potential build failure when CRYPTO=m"
      
      * tag 'v5.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: memneq - move into lib/
      79fe0f86
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · f0ec9c65
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small char/misc driver fixes for 5.19-rc3 that resolve
        some reported issues.
      
        They include:
      
         - mei driver fixes
      
         - comedi driver fix
      
         - rtsx build warning fix
      
         - fsl-mc-bus driver fix
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'char-misc-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        eeprom: at25: Split reads into chunks and cap write size
        misc: atmel-ssc: Fix IRQ check in ssc_probe
        char: lp: remove redundant initialization of err
      f0ec9c65
    • Linus Torvalds's avatar
      Merge tag 'staging-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 9afc441c
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are some small staging driver fixes for 5.19-rc3 that resolve
        reported issues:
      
         - remove visorbus.h which was forgotten in the -rc1 merge where the
           code that used it was removed
      
         - olpc_dcon: mark as broken to allow the DRM developers to evolve the
           fbdev api properly without having to deal with this obsolete
           driver. It will be removed soon if no one steps up to adopt it and
           fix the issues with it.
      
         - rtl8723bs driver fix
      
         - r8188eu driver fix to resolve many reports of the driver being
           broken with -rc1.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'staging-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: Also remove the Unisys visorbus.h
        staging: rtl8723bs: Allocate full pwep structure
        staging: olpc_dcon: mark driver as broken
        staging: r8188eu: Fix warning of array overflow in ioctl_linux.c
        staging: r8188eu: fix rtw_alloc_hwxmits error detection for now
      9afc441c
    • Linus Torvalds's avatar
      Merge tag 'tty-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 62dcd5e1
      Linus Torvalds authored
      Pull tty/serial driver fixes from Greg KH:
       "Here are some small tty and serial driver fixes for 5.19-rc3 to
        resolve some reported problems:
      
         - 8250 lsr read bugfix
      
         - n_gsm line discipline allocation fix
      
         - qcom serial driver fix for reported lockups that happened in -rc1
      
         - goldfish tty driver fix
      
        All have been in linux-next for a while now with no reported issues"
      
      * tag 'tty-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: 8250: Store to lsr_save_flags after lsr read
        tty: goldfish: Fix free_irq() on remove
        tty: serial: qcom-geni-serial: Implement start_rx callback
        serial: core: Introduce callback for start_rx and do stop_rx in suspend only if this callback implementation is present.
        tty: n_gsm: Debug output allocation must use GFP_ATOMIC
      62dcd5e1
    • Linus Torvalds's avatar
      Merge tag 'usb-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 9057a646
      Linus Torvalds authored
      Pull USB driver fixes from Greg KH:
       "Here are some small USB driver fixes and new device ids for 5.19-rc3
      
        They include:
      
         - new usb-serial driver device ids
      
         - usb gadget driver fixes for reported problems
      
         - cdnsp driver fix
      
         - dwc3 driver fixes for reported problems
      
         - dwc3 driver fix for merge problem that I caused in 5.18
      
         - xhci driver fixes
      
         - dwc2 memory leak fix
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'usb-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io()
        usb: gadget: f_fs: change ep->status safe in ffs_epfile_io()
        xhci: Fix null pointer dereference in resume if xhci has only one roothub
        USB: fixup for merge issue with "usb: dwc3: Don't switch OTG -> peripheral if extcon is present"
        usb: cdnsp: Fixed setting last_trb incorrectly
        usb: gadget: u_ether: fix regression in setting fixed MAC address
        usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe
        usb: dwc2: Fix memory leak in dwc2_hcd_init
        usb: dwc3: pci: Restore line lost in merge conflict resolution
        usb: dwc3: gadget: Fix IN endpoint max packet size allocation
        USB: serial: option: add support for Cinterion MV31 with new baseline
        USB: serial: io_ti: add Agilent E5805A support
      9057a646
    • Jens Axboe's avatar
      io_uring: recycle provided buffer if we punt to io-wq · 6436c770
      Jens Axboe authored
      io_arm_poll_handler() will recycle the buffer appropriately if we end
      up arming poll (or if we're ready to retry), but not for the io-wq case
      if we have attempted poll first.
      
      Explicitly recycle the buffer to avoid both hanging on to it too long,
      but also to avoid multiple reads grabbing the same one. This can happen
      for ring mapped buffers, since it hasn't necessarily been committed.
      
      Fixes: c7fb1942 ("io_uring: add support for ring mapped supplied buffers")
      Link: https://github.com/axboe/liburing/issues/605Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      6436c770
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2022-06-17' of git://anongit.freedesktop.org/drm/drm · 47700948
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Regular drm fixes for rc3. Nothing too serious, i915, amdgpu and
        exynos all have a few small driver fixes, and two ttm fixes, and one
        compiler warning.
      
        atomic:
         - fix spurious compiler warning
      
        ttm:
         - add NULL ptr check in swapout code
         - fix bulk move handling
      
        i915:
         - Fix page fault on error state read
         - Fix memory leaks in per-gt sysfs
         - Fix multiple fence handling
         - Remove accidental static from a local variable
      
        amdgpu:
         - Fix regression in GTT size reporting
         - OLED backlight fix
      
        exynos:
         - Check a null pointer instead of IS_ERR()
         - Rework initialization code of Exynos MIC driver"
      
      * tag 'drm-fixes-2022-06-17' of git://anongit.freedesktop.org/drm/drm:
        drm/amd/display: Cap OLED brightness per max frame-average luminance
        drm/amdgpu: Fix GTT size reporting in amdgpu_ioctl
        drm/exynos: mic: Rework initialization
        drm/exynos: fix IS_ERR() vs NULL check in probe
        drm/ttm: fix bulk move handling v2
        drm/i915/uc: remove accidental static from a local variable
        drm/i915: Individualize fences before adding to dma_resv obj
        drm/i915/gt: Fix memory leaks in per-gt sysfs
        drm/i915/reset: Fix error_state_read ptr + offset use
        drm/ttm: fix missing NULL check in ttm_device_swapout
        drm/atomic: fix warning of unused variable
      47700948
    • Dave Airlie's avatar
      Merge tag 'exynos-drm-fixes-v5.19-rc3' of... · 65cf7c02
      Dave Airlie authored
      Merge tag 'exynos-drm-fixes-v5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes
      
      two regression fixups
      - Check a null pointer instead of IS_ERR().
      - Rework initialization code of Exynos MIC driver.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Inki Dae <inki.dae@samsung.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220614141336.88614-1-inki.dae@samsung.com
      65cf7c02
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.19-2022-06-15' of... · d08227a8
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.19-2022-06-15' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
      
      amd-drm-fixes-5.19-2022-06-15:
      
      amdgpu:
      - Fix regression in GTT size reporting
      - OLED backlight fix
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220615205609.28763-1-alexander.deucher@amd.com
      d08227a8
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2022-06-16' of... · 3f0acf25
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2022-06-16' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      drm/i915 fixes for v5.19-rc3:
      - Fix page fault on error state read
      - Fix memory leaks in per-gt sysfs
      - Fix multiple fence handling
      - Remove accidental static from a local variable
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Jani Nikula <jani.nikula@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/8735g5xd25.fsf@intel.com
      3f0acf25
  2. 16 Jun, 2022 14 commits
    • Mikulas Patocka's avatar
      dm mirror log: round up region bitmap size to BITS_PER_LONG · 85e123c2
      Mikulas Patocka authored
      The code in dm-log rounds up bitset_size to 32 bits. It then uses
      find_next_zero_bit_le on the allocated region. find_next_zero_bit_le
      accesses the bitmap using unsigned long pointers. So, on 64-bit
      architectures, it may access 4 bytes beyond the allocated size.
      
      Fix this bug by rounding up bitset_size to BITS_PER_LONG.
      
      This bug was found by running the lvm2 testsuite with kasan.
      
      Fixes: 29121bd0 ("[PATCH] dm mirror log: bitset_size fix")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@kernel.org>
      85e123c2
    • Mikulas Patocka's avatar
      dm: fix narrow race for REQ_NOWAIT bios being issued despite no support · 1ee88de3
      Mikulas Patocka authored
      Starting with the commit 63a225c9fd20, device mapper has an optimization
      that it will take cheaper table lock (dm_get_live_table_fast instead of
      dm_get_live_table) if the bio has REQ_NOWAIT. The bios with REQ_NOWAIT
      must not block in the target request routine, if they did, we would be
      blocking while holding rcu_read_lock, which is prohibited.
      
      The targets that are suitable for REQ_NOWAIT optimization (and that don't
      block in the map routine) have the flag DM_TARGET_NOWAIT set. Device
      mapper will test if all the targets and all the devices in a table
      support nowait (see the function dm_table_supports_nowait) and it will set
      or clear the QUEUE_FLAG_NOWAIT flag on its request queue according to
      this check.
      
      There's a test in submit_bio_noacct: "if ((bio->bi_opf & REQ_NOWAIT) &&
      !blk_queue_nowait(q)) goto not_supported" - this will make sure that
      REQ_NOWAIT bios can't enter a request queue that doesn't support them.
      
      This mechanism works to prevent REQ_NOWAIT bios from reaching dm targets
      that don't support the REQ_NOWAIT flag (and that may block in the map
      routine) - except that there is a small race condition:
      
      submit_bio_noacct checks if the queue has the QUEUE_FLAG_NOWAIT without
      holding any locks. Immediatelly after this check, the device mapper table
      may be reloaded with a table that doesn't support REQ_NOWAIT (for example,
      if we start moving the logical volume or if we activate a snapshot).
      However the REQ_NOWAIT bio that already passed the check in
      submit_bio_noacct would be sent to device mapper, where it could be
      redirected to a dm target that doesn't support REQ_NOWAIT - the result is
      sleeping while we hold rcu_read_lock.
      
      In order to fix this race, we double-check if the target supports
      REQ_NOWAIT while we hold the table lock (so that the table can't change
      under us).
      
      Fixes: 563a225c ("dm: introduce dm_{get,put}_live_table_bio called from dm_submit_bio")
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@kernel.org>
      1ee88de3
    • Mikulas Patocka's avatar
      dm: fix use-after-free in dm_put_live_table_bio · 5d7362d0
      Mikulas Patocka authored
      dm_put_live_table_bio is called from the end of dm_submit_bio.
      However, at this point, the bio may be already finished and the caller
      may have freed the bio. Consequently, dm_put_live_table_bio accesses
      the stale "bio" pointer.
      
      Fix this bug by loading the bi_opf value and passing it to
      dm_get_live_table_bio and dm_put_live_table_bio instead of the bio.
      
      This bug was found by running the lvm2 testsuite with kasan.
      
      Fixes: 563a225c ("dm: introduce dm_{get,put}_live_table_bio called from dm_submit_bio")
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@kernel.org>
      5d7362d0
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2022-06-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · 2f90ec12
      Dave Airlie authored
      Two fixes for TTM, one for a NULL pointer dereference and one to make sure
      the buffer is pinned prior to a bulk move, and a fix for a spurious
      compiler warning.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Maxime Ripard <maxime@cerno.tech>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220616072519.qwrsefsemejefowu@houat
      2f90ec12
    • Linus Torvalds's avatar
      Merge tag 'audit-pr-20220616' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit · 0639b599
      Linus Torvalds authored
      Pull audit fix from Paul Moore:
       "A single audit patch to fix a problem where we were not properly
        freeing memory allocated when recording information related to a
        module load"
      
      * tag 'audit-pr-20220616' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
        audit: free module name
      0639b599
    • Linus Torvalds's avatar
      Merge tag 'selinux-pr-20220616' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux · 6decbf75
      Linus Torvalds authored
      Pull selinux fix from Paul Moore:
       "A single SELinux patch to fix memory leaks when mounting filesystems
        with SELinux mount options"
      
      * tag 'selinux-pr-20220616' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
        selinux: free contexts previously transferred in selinux_add_opt()
      6decbf75
    • Linus Torvalds's avatar
      Merge tag 'net-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 48a23ec6
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Mostly driver fixes.
      
        Current release - regressions:
      
         - Revert "net: Add a second bind table hashed by port and address",
           needs more work
      
         - amd-xgbe: use platform_irq_count(), static setup of IRQ resources
           had been removed from DT core
      
         - dts: at91: ksz9477_evb: add phy-mode to fix port/phy validation
      
        Current release - new code bugs:
      
         - hns3: modify the ring param print info
      
        Previous releases - always broken:
      
         - axienet: make the 64b addressable DMA depends on 64b architectures
      
         - iavf: fix issue with MAC address of VF shown as zero
      
         - ice: fix PTP TX timestamp offset calculation
      
         - usb: ax88179_178a needs FLAG_SEND_ZLP
      
        Misc:
      
         - document some net.sctp.* sysctls"
      
      * tag 'net-5.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (31 commits)
        net: axienet: add missing error return code in axienet_probe()
        Revert "net: Add a second bind table hashed by port and address"
        net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg
        net: usb: ax88179_178a needs FLAG_SEND_ZLP
        MAINTAINERS: add include/dt-bindings/net to NETWORKING DRIVERS
        ARM: dts: at91: ksz9477_evb: fix port/phy validation
        net: bgmac: Fix an erroneous kfree() in bgmac_remove()
        ice: Fix memory corruption in VF driver
        ice: Fix queue config fail handling
        ice: Sync VLAN filtering features for DVM
        ice: Fix PTP TX timestamp offset calculation
        mlxsw: spectrum_cnt: Reorder counter pools
        docs: networking: phy: Fix a typo
        amd-xgbe: Use platform_irq_count()
        octeontx2-vf: Add support for adaptive interrupt coalescing
        xilinx:  Fix build on x86.
        net: axienet: Use iowrite64 to write all 64b descriptor pointers
        net: axienet: make the 64b addresable DMA depends on 64b archectures
        net: hns3: fix tm port shapping of fibre port is incorrect after driver initialization
        net: hns3: fix PF rss size initialization bug
        ...
      48a23ec6
    • Yang Yingliang's avatar
      net: axienet: add missing error return code in axienet_probe() · 2e7bf4a6
      Yang Yingliang authored
      It should return error code in error path in axienet_probe().
      
      Fixes: 00be43a7 ("net: axienet: make the 64b addresable DMA depends on 64b archectures")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
      Link: https://lore.kernel.org/r/20220616062917.3601-1-yangyingliang@huawei.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      2e7bf4a6
    • Joanne Koong's avatar
      Revert "net: Add a second bind table hashed by port and address" · 593d1ebe
      Joanne Koong authored
      This reverts:
      
      commit d5a42de8 ("net: Add a second bind table hashed by port and address")
      commit 538aaf9b ("selftests: Add test for timing a bind request to a port with a populated bhash entry")
      Link: https://lore.kernel.org/netdev/20220520001834.2247810-1-kuba@kernel.org/
      
      There are a few things that need to be fixed here:
      * Updating bhash2 in cases where the socket's rcv saddr changes
      * Adding bhash2 hashbucket locks
      
      Links to syzbot reports:
      https://lore.kernel.org/netdev/00000000000022208805e0df247a@google.com/
      https://lore.kernel.org/netdev/0000000000003f33bc05dfaf44fe@google.com/
      
      Fixes: d5a42de8 ("net: Add a second bind table hashed by port and address")
      Reported-by: syzbot+015d756bbd1f8b5c8f09@syzkaller.appspotmail.com
      Reported-by: syzbot+98fd2d1422063b0f8c44@syzkaller.appspotmail.com
      Reported-by: syzbot+0a847a982613c6438fba@syzkaller.appspotmail.com
      Signed-off-by: default avatarJoanne Koong <joannelkoong@gmail.com>
      Link: https://lore.kernel.org/r/20220615193213.2419568-1-joannelkoong@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      593d1ebe
    • Dylan Yudaken's avatar
      io_uring: do not use prio task_work_add in uring_cmd · 32fc810b
      Dylan Yudaken authored
      io_req_task_prio_work_add has a strict assumption that it will only be
      used with io_req_task_complete. There is a codepath that assumes this is
      the case and will not even call the completion function if it is hit.
      
      For uring_cmd with an arbitrary completion function change the call to the
      correct non-priority version.
      
      Fixes: ee692a21 ("fs,io_uring: add infrastructure for uring-cmd")
      Signed-off-by: default avatarDylan Yudaken <dylany@fb.com>
      Reviewed-by: default avatarPavel Begunkov <asml.silence@gmail.com>
      Link: https://lore.kernel.org/r/20220616135011.441980-1-dylany@fb.comSigned-off-by: default avatarJens Axboe <axboe@kernel.dk>
      32fc810b
    • Jens Axboe's avatar
      io_uring: commit non-pollable provided mapped buffers upfront · a76c0b31
      Jens Axboe authored
      For recv/recvmsg, IO either completes immediately or gets queued for a
      retry. This isn't the case for read/readv, if eg a normal file or a block
      device is used. Here, an operation can get queued with the block layer.
      If this happens, ring mapped buffers must get committed immediately to
      avoid that the next read can consume the same buffer.
      
      Check if we're dealing with pollable file, when getting a new ring mapped
      provided buffer. If it's not, commit it immediately rather than wait post
      issue. If we don't wait, we can race with completions coming in, or just
      plain buffer reuse by committing after a retry where others could have
      grabbed the same buffer.
      
      Fixes: c7fb1942 ("io_uring: add support for ring mapped supplied buffers")
      Reviewed-by: default avatarHao Xu <howeyxu@tencent.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      a76c0b31
    • Jan Kara's avatar
      init: Initialize noop_backing_dev_info early · 4bca7e80
      Jan Kara authored
      noop_backing_dev_info is used by superblocks of various
      pseudofilesystems such as kdevtmpfs. After commit 10e14073
      ("writeback: Fix inode->i_io_list not be protected by inode->i_lock
      error") this broke because __mark_inode_dirty() started to access more
      fields from noop_backing_dev_info and this led to crashes inside
      locked_inode_to_wb_and_lock_list() called from __mark_inode_dirty().
      Fix the problem by initializing noop_backing_dev_info before the
      filesystems get mounted.
      
      Fixes: 10e14073 ("writeback: Fix inode->i_io_list not be protected by inode->i_lock error")
      Reported-and-tested-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
      Reported-and-tested-by: default avatarAlexandru Elisei <alexandru.elisei@arm.com>
      Reported-and-tested-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarJan Kara <jack@suse.cz>
      4bca7e80
    • Ye Bin's avatar
      ext2: fix fs corruption when trying to remove a non-empty directory with IO error · 27cfa258
      Ye Bin authored
      We got issue as follows:
      [home]# mount  /dev/sdd  test
      [home]# cd test
      [test]# ls
      dir1  lost+found
      [test]# rmdir  dir1
      ext2_empty_dir: inject fault
      [test]# ls
      lost+found
      [test]# cd ..
      [home]# umount test
      [home]# fsck.ext2 -fn  /dev/sdd
      e2fsck 1.42.9 (28-Dec-2013)
      Pass 1: Checking inodes, blocks, and sizes
      Inode 4065, i_size is 0, should be 1024.  Fix? no
      
      Pass 2: Checking directory structure
      Pass 3: Checking directory connectivity
      Unconnected directory inode 4065 (/???)
      Connect to /lost+found? no
      
      '..' in ... (4065) is / (2), should be <The NULL inode> (0).
      Fix? no
      
      Pass 4: Checking reference counts
      Inode 2 ref count is 3, should be 4.  Fix? no
      
      Inode 4065 ref count is 2, should be 3.  Fix? no
      
      Pass 5: Checking group summary information
      
      /dev/sdd: ********** WARNING: Filesystem still has errors **********
      
      /dev/sdd: 14/128016 files (0.0% non-contiguous), 18477/512000 blocks
      
      Reason is same with commit 7aab5c84. We can't assume directory
      is empty when read directory entry failed.
      
      Link: https://lore.kernel.org/r/20220615090010.1544152-1-yebin10@huawei.comSigned-off-by: default avatarYe Bin <yebin10@huawei.com>
      Signed-off-by: default avatarJan Kara <jack@suse.cz>
      27cfa258
    • Christian Göttsche's avatar
      selinux: free contexts previously transferred in selinux_add_opt() · cad140d0
      Christian Göttsche authored
      `selinux_add_opt()` stopped taking ownership of the passed context since
      commit 70f4169a ("selinux: parse contexts for mount options early").
      
          unreferenced object 0xffff888114dfd140 (size 64):
            comm "mount", pid 15182, jiffies 4295687028 (age 796.340s)
            hex dump (first 32 bytes):
              73 79 73 74 65 6d 5f 75 3a 6f 62 6a 65 63 74 5f  system_u:object_
              72 3a 74 65 73 74 5f 66 69 6c 65 73 79 73 74 65  r:test_filesyste
            backtrace:
              [<ffffffffa07dbef4>] kmemdup_nul+0x24/0x80
              [<ffffffffa0d34253>] selinux_sb_eat_lsm_opts+0x293/0x560
              [<ffffffffa0d13f08>] security_sb_eat_lsm_opts+0x58/0x80
              [<ffffffffa0af1eb2>] generic_parse_monolithic+0x82/0x180
              [<ffffffffa0a9c1a5>] do_new_mount+0x1f5/0x550
              [<ffffffffa0a9eccb>] path_mount+0x2ab/0x1570
              [<ffffffffa0aa019e>] __x64_sys_mount+0x20e/0x280
              [<ffffffffa1f47124>] do_syscall_64+0x34/0x80
              [<ffffffffa200007e>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
      
          unreferenced object 0xffff888108e71640 (size 64):
            comm "fsmount", pid 7607, jiffies 4295044974 (age 1601.016s)
            hex dump (first 32 bytes):
              73 79 73 74 65 6d 5f 75 3a 6f 62 6a 65 63 74 5f  system_u:object_
              72 3a 74 65 73 74 5f 66 69 6c 65 73 79 73 74 65  r:test_filesyste
            backtrace:
              [<ffffffff861dc2b1>] memdup_user+0x21/0x90
              [<ffffffff861dc367>] strndup_user+0x47/0xa0
              [<ffffffff864f6965>] __do_sys_fsconfig+0x485/0x9f0
              [<ffffffff87940124>] do_syscall_64+0x34/0x80
              [<ffffffff87a0007e>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
      
      Cc: stable@vger.kernel.org
      Fixes: 70f4169a ("selinux: parse contexts for mount options early")
      Signed-off-by: default avatarChristian Göttsche <cgzones@googlemail.com>
      Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
      cad140d0
  3. 15 Jun, 2022 11 commits