1. 02 Jun, 2020 8 commits
    • Dongli Zhang's avatar
      mm/slub.c: fix corrupted freechain in deactivate_slab() · 52f23478
      Dongli Zhang authored
      The slub_debug is able to fix the corrupted slab freelist/page.
      However, alloc_debug_processing() only checks the validity of current
      and next freepointer during allocation path.  As a result, once some
      objects have their freepointers corrupted, deactivate_slab() may lead to
      page fault.
      
      Below is from a test kernel module when 'slub_debug=PUF,kmalloc-128
      slub_nomerge'.  The test kernel corrupts the freepointer of one free
      object on purpose.  Unfortunately, deactivate_slab() does not detect it
      when iterating the freechain.
      
        BUG: unable to handle page fault for address: 00000000123456f8
        #PF: supervisor read access in kernel mode
        #PF: error_code(0x0000) - not-present page
        PGD 0 P4D 0
        Oops: 0000 [#1] SMP PTI
        ... ...
        RIP: 0010:deactivate_slab.isra.92+0xed/0x490
        ... ...
        Call Trace:
         ___slab_alloc+0x536/0x570
         __slab_alloc+0x17/0x30
         __kmalloc+0x1d9/0x200
         ext4_htree_store_dirent+0x30/0xf0
         htree_dirblock_to_tree+0xcb/0x1c0
         ext4_htree_fill_tree+0x1bc/0x2d0
         ext4_readdir+0x54f/0x920
         iterate_dir+0x88/0x190
         __x64_sys_getdents+0xa6/0x140
         do_syscall_64+0x49/0x170
         entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Therefore, this patch adds extra consistency check in deactivate_slab().
      Once an object's freepointer is corrupted, all following objects
      starting at this object are isolated.
      
      [akpm@linux-foundation.org: fix build with CONFIG_SLAB_DEBUG=n]
      Signed-off-by: default avatarDongli Zhang <dongli.zhang@oracle.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Joe Jin <joe.jin@oracle.com>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Link: http://lkml.kernel.org/r/20200331031450.12182-1-dongli.zhang@oracle.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      52f23478
    • Vlastimil Babka's avatar
      usercopy: mark dma-kmalloc caches as usercopy caches · 49f2d241
      Vlastimil Babka authored
      We have seen a "usercopy: Kernel memory overwrite attempt detected to
      SLUB object 'dma-kmalloc-1 k' (offset 0, size 11)!" error on s390x, as
      IUCV uses kmalloc() with __GFP_DMA because of memory address
      restrictions.  The issue has been discussed [2] and it has been noted
      that if all the kmalloc caches are marked as usercopy, there's little
      reason not to mark dma-kmalloc caches too.  The 'dma' part merely means
      that __GFP_DMA is used to restrict memory address range.
      
      As Jann Horn put it [3]:
       "I think dma-kmalloc slabs should be handled the same way as normal
        kmalloc slabs. When a dma-kmalloc allocation is freshly created, it is
        just normal kernel memory - even if it might later be used for DMA -,
        and it should be perfectly fine to copy_from_user() into such
        allocations at that point, and to copy_to_user() out of them at the
        end. If you look at the places where such allocations are created, you
        can see things like kmemdup(), memcpy() and so on - all normal
        operations that shouldn't conceptually be different from usercopy in
        any relevant way."
      
      Thus this patch marks the dma-kmalloc-* caches as usercopy.
      
      [1] https://bugzilla.suse.com/show_bug.cgi?id=1156053
      [2] https://lore.kernel.org/kernel-hardening/bfca96db-bbd0-d958-7732-76e36c667c68@suse.cz/
      [3] https://lore.kernel.org/kernel-hardening/CAG48ez1a4waGk9kB0WLaSbs4muSoK0AYAVk8=XYaKj4_+6e6Hg@mail.gmail.com/Signed-off-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Acked-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Acked-by: default avatarJiri Slaby <jslaby@suse.cz>
      Cc: Jann Horn <jannh@google.com>
      Cc: Christoph Hellwig <hch@infradead.org>
      Cc: Christopher Lameter <cl@linux.com>
      Cc: Julian Wiedmann <jwi@linux.ibm.com>
      Cc: Ursula Braun <ubraun@linux.ibm.com>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: David Windsor <dave@nullcore.net>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Laura Abbott <labbott@redhat.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Christoffer Dall <christoffer.dall@linaro.org>
      Cc: Dave Kleikamp <dave.kleikamp@oracle.com>
      Cc: Jan Kara <jack@suse.cz>
      Cc: Luis de Bethencourt <luisbg@kernel.org>
      Cc: Marc Zyngier <marc.zyngier@arm.com>
      Cc: Rik van Riel <riel@surriel.com>
      Cc: Matthew Garrett <mjg59@google.com>
      Cc: Michal Kubecek <mkubecek@suse.cz>
      Link: http://lkml.kernel.org/r/7d810f6d-8085-ea2f-7805-47ba3842dc50@suse.czSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      49f2d241
    • Jeff Layton's avatar
      fs/buffer.c: record blockdev write errors in super_block that it backs · 485e9605
      Jeff Layton authored
      When syncing out a block device (a'la __sync_blockdev), any error
      encountered will only be recorded in the bd_inode's mapping.  When the
      blockdev contains a filesystem however, we'd like to also record the
      error in the super_block that's stored there.
      
      Make mark_buffer_write_io_error also record the error in the
      corresponding super_block when a writeback error occurs and the block
      device contains a mounted superblock.
      
      Since superblocks are RCU freed, hold the rcu_read_lock to ensure that
      the superblock doesn't go away while we're marking it.
      Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Andres Freund <andres@anarazel.de>
      Cc: Matthew Wilcox <willy@infradead.org>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Christoph Hellwig <hch@infradead.org>
      Cc: Dave Chinner <david@fromorbit.com>
      Link: http://lkml.kernel.org/r/20200428135155.19223-3-jlayton@kernel.orgSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      485e9605
    • Jeff Layton's avatar
      vfs: track per-sb writeback errors and report them to syncfs · 735e4ae5
      Jeff Layton authored
      Patch series "vfs: have syncfs() return error when there are writeback
      errors", v6.
      
      Currently, syncfs does not return errors when one of the inodes fails to
      be written back.  It will return errors based on the legacy AS_EIO and
      AS_ENOSPC flags when syncing out the block device fails, but that's not
      particularly helpful for filesystems that aren't backed by a blockdev.
      It's also possible for a stray sync to lose those errors.
      
      The basic idea in this set is to track writeback errors at the
      superblock level, so that we can quickly and easily check whether
      something bad happened without having to fsync each file individually.
      syncfs is then changed to reliably report writeback errors after they
      occur, much in the same fashion as fsync does now.
      
      This patch (of 2):
      
      Usually we suggest that applications call fsync when they want to ensure
      that all data written to the file has made it to the backing store, but
      that can be inefficient when there are a lot of open files.
      
      Calling syncfs on the filesystem can be more efficient in some
      situations, but the error reporting doesn't currently work the way most
      people expect.  If a single inode on a filesystem reports a writeback
      error, syncfs won't necessarily return an error.  syncfs only returns an
      error if __sync_blockdev fails, and on some filesystems that's a no-op.
      
      It would be better if syncfs reported an error if there were any
      writeback failures.  Then applications could call syncfs to see if there
      are any errors on any open files, and could then call fsync on all of
      the other descriptors to figure out which one failed.
      
      This patch adds a new errseq_t to struct super_block, and has
      mapping_set_error also record writeback errors there.
      
      To report those errors, we also need to keep an errseq_t in struct file
      to act as a cursor.  This patch adds a dedicated field for that purpose,
      which slots nicely into 4 bytes of padding at the end of struct file on
      x86_64.
      
      An earlier version of this patch used an O_PATH file descriptor to cue
      the kernel that the open file should track the superblock error and not
      the inode's writeback error.
      
      I think that API is just too weird though.  This is simpler and should
      make syncfs error reporting "just work" even if someone is multiplexing
      fsync and syncfs on the same fds.
      Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Cc: Andres Freund <andres@anarazel.de>
      Cc: Matthew Wilcox <willy@infradead.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Christoph Hellwig <hch@infradead.org>
      Cc: Dave Chinner <david@fromorbit.com>
      Cc: David Howells <dhowells@redhat.com>
      Link: http://lkml.kernel.org/r/20200428135155.19223-1-jlayton@kernel.org
      Link: http://lkml.kernel.org/r/20200428135155.19223-2-jlayton@kernel.orgSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      735e4ae5
    • Andrew Morton's avatar
      arch/parisc/include/asm/pgtable.h: remove unused `old_pte' · 78128fab
      Andrew Morton authored
      parisc's set_pte_at() macro has set-but-not-used variable:
      
        include/linux/pgtable.h: In function 'pte_clear_not_present_full':
        arch/parisc/include/asm/pgtable.h:96:9: warning: variable 'old_pte' set but not used [-Wunused-but-set-variable]
      Reported-by: default avatarkbuild test robot <lkp@intel.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
      Cc: Helge Deller <deller@gmx.de>
      Cc: Mike Rapoport <rppt@linux.ibm.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      78128fab
    • Gang He's avatar
      ocfs2: mount shared volume without ha stack · 912f655d
      Gang He authored
      Usually we create and use a ocfs2 shared volume on the top of ha stack.
      For pcmk based ha stack, which includes DLM, corosync and pacemaker
      services.
      
      The customers complained they could not mount existent ocfs2 volume in
      the single node without ha stack, e.g.  single node backup/restore
      scenario.
      
      Like this case, the customers just want to access the data from the
      existent ocfs2 volume quickly, but do not want to restart or setup ha
      stack.
      
      Then, I'd like to add a mount option "nocluster", if the users use this
      option to mount a ocfs2 shared volume, the whole mount will not depend
      on the ha related services.  the command will mount the existent ocfs2
      volume directly (like local mount), for avoiding setup the ha stack.
      Signed-off-by: default avatarGang He <ghe@suse.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Mark Fasheh <mark@fasheh.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Junxiao Bi <junxiao.bi@oracle.com>
      Cc: Joseph Qi <jiangqi903@gmail.com>
      Cc: Changwei Ge <gechangwei@live.cn>
      Cc: Jun Piao <piaojun@huawei.com>
      Link: http://lkml.kernel.org/r/20200423053300.22661-1-ghe@suse.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      912f655d
    • Jules Irenge's avatar
      ocfs2: add missing annotation for dlm_empty_lockres() · 8f745e62
      Jules Irenge authored
      Sparse reports a warning at dlm_empty_lockres()
      
        warning: context imbalance in dlm_purge_lockres() - unexpected unlock
      
      The root cause is the missing annotation at dlm_purge_lockres()
      
      Add the missing __must_hold(&dlm->spinlock)
      Signed-off-by: default avatarJules Irenge <jbi.octave@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Cc: Mark Fasheh <mark@fasheh.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Junxiao Bi <junxiao.bi@oracle.com>
      Cc: Joseph Qi <jiangqi903@gmail.com>
      Cc: Changwei Ge <gechangwei@live.cn>
      Cc: Gang He <ghe@suse.com>
      Cc: Jun Piao <piaojun@huawei.com>
      Link: http://lkml.kernel.org/r/20200403160505.2832-4-jbi.octave@gmail.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8f745e62
    • Philippe Liard's avatar
      squashfs: migrate from ll_rw_block usage to BIO · 93e72b3c
      Philippe Liard authored
      ll_rw_block() function has been deprecated in favor of BIO which appears
      to come with large performance improvements.
      
      This patch decreases boot time by close to 40% when using squashfs for
      the root file-system.  This is observed at least in the context of
      starting an Android VM on Chrome OS using crosvm.  The patch was tested
      on 4.19 as well as master.
      
      This patch is largely based on Adrien Schildknecht's patch that was
      originally sent as https://lkml.org/lkml/2017/9/22/814 though with some
      significant changes and simplifications while also taking Phillip
      Lougher's feedback into account, around preserving support for
      FILE_CACHE in particular.
      
      [akpm@linux-foundation.org: fix build error reported by Randy]
        Link: http://lkml.kernel.org/r/319997c2-5fc8-f889-2ea3-d913308a7c1f@infradead.orgSigned-off-by: default avatarPhilippe Liard <pliard@google.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Cc: Adrien Schildknecht <adrien+dev@schischi.me>
      Cc: Phillip Lougher <phillip@squashfs.org.uk>
      Cc: Guenter Roeck <groeck@chromium.org>
      Cc: Daniel Rosenberg <drosen@google.com>
      Link: https://chromium.googlesource.com/chromiumos/platform/crosvm
      Link: http://lkml.kernel.org/r/20191106074238.186023-1-pliard@google.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      93e72b3c
  2. 01 Jun, 2020 26 commits
    • Linus Torvalds's avatar
      Merge tag 'x86_cache_updates_for_5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 9bf9511e
      Linus Torvalds authored
      Pull x86 cache resource control updates from Borislav Petkov:
       "Add support for wider Memory Bandwidth Monitoring counters by querying
        their width from CPUID.
      
        As a prerequsite for that, streamline and unify the CPUID detection of
        the respective resource control attributes.
      
        By Reinette Chatre"
      
      * tag 'x86_cache_updates_for_5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/resctrl: Support wider MBM counters
        x86/resctrl: Support CPUID enumeration of MBM counter width
        x86/resctrl: Maintain MBM counter width per resource
        x86/resctrl: Query LLC monitoring properties once during boot
        x86/resctrl: Remove unnecessary RMID checks
        x86/cpu: Move resctrl CPUID code to resctrl/
        x86/resctrl: Rename asm/resctrl_sched.h to asm/resctrl.h
      9bf9511e
    • Linus Torvalds's avatar
      Merge tag 'x86_microcode_for_5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · ef34ba6d
      Linus Torvalds authored
      Pull x86 microcode update from Borislav Petkov:
       "A single fix for late microcode loading to handle the correct return
        value from stop_machine(), from Mihai Carabas"
      
      * tag 'x86_microcode_for_5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/microcode: Fix return value for microcode late loading
      ef34ba6d
    • Linus Torvalds's avatar
      Merge tag 'edac_updates_for_5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras · 8b11dd54
      Linus Torvalds authored
      Pull EDAC updates from Borislav Petkov:
      
       - Fix i10nm_edac loading on some Ice Lake and Tremont/Jacobsville
         steppings due to the offset change of the bus number configuration
         register, by Qiuxu Zhuo.
      
       - The usual cleanups and fixes all over the place.
      
      * tag 'edac_updates_for_5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
        EDAC/amd64: Remove redundant assignment to variable ret in hw_info_get()
        EDAC/skx: Use the mcmtr register to retrieve close_pg/bank_xor_enable
        EDAC/i10nm: Update driver to support different bus number config register offsets
        EDAC, {skx,i10nm}: Make some configurations CPU model specific
        EDAC/amd8131: Remove defined but not used bridge_str
        EDAC/thunderx: Make symbols static
        MAINTAINERS: Remove sifive_l2_cache.c from EDAC-SIFIVE pattern
        EDAC/xgene: Remove set but not used address local var
        EDAC/armada_xp: Fix some log messages
      8b11dd54
    • Linus Torvalds's avatar
      Merge tag 'printk-for-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux · ca1f5df2
      Linus Torvalds authored
      Pull printk updates from Petr Mladek:
      
       - Benjamin Herrenschmidt solved a problem with non-matched console
         aliases by first checking consoles defined on the command line. It is
         a more conservative approach than the previous attempts.
      
       - Benjamin also made sure that the console accessible via /dev/console
         always has CON_CONSDEV flag.
      
       - Andy Shevchenko added the %ptT modifier for printing struct time64_t.
         It extends the existing %ptR handling for struct rtc_time.
      
       - Bruno Meneguele fixed /dev/kmsg error value returned by unsupported
         SEEK_CUR.
      
       - Tetsuo Handa removed unused pr_cont_once().
      
      ... and a few small fixes.
      
      * tag 'printk-for-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
        printk: Remove pr_cont_once()
        printk: handle blank console arguments passed in.
        kernel/printk: add kmsg SEEK_CUR handling
        printk: Fix a typo in comment "interator"->"iterator"
        usb: pulse8-cec: Switch to use %ptT
        ARM: bcm2835: Switch to use %ptT
        lib/vsprintf: Print time64_t in human readable format
        lib/vsprintf: update comment about simple_strto<foo>() functions
        printk: Correctly set CON_CONSDEV even when preferred console was not registered
        printk: Fix preferred console selection with multiple matches
        printk: Move console matching logic into a separate function
        printk: Convert a use of sprintf to snprintf in console_unlock
      ca1f5df2
    • Linus Torvalds's avatar
      Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt · 4d67829e
      Linus Torvalds authored
      Pull fsverity updates from Eric Biggers:
       "Fix kerneldoc warnings and some coding style inconsistencies.
      
        This mirrors the similar cleanups being done in fs/crypto/"
      
      * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt:
        fs-verity: remove unnecessary extern keywords
        fs-verity: fix all kerneldoc warnings
      4d67829e
    • Linus Torvalds's avatar
      Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt · afdb0f2e
      Linus Torvalds authored
      Pull fscrypt updates from Eric Biggers:
      
       - Add the IV_INO_LBLK_32 encryption policy flag which modifies the
         encryption to be optimized for eMMC inline encryption hardware.
      
       - Make the test_dummy_encryption mount option for ext4 and f2fs support
         v2 encryption policies.
      
       - Fix kerneldoc warnings and some coding style inconsistencies.
      
      * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt:
        fscrypt: add support for IV_INO_LBLK_32 policies
        fscrypt: make test_dummy_encryption use v2 by default
        fscrypt: support test_dummy_encryption=v2
        fscrypt: add fscrypt_add_test_dummy_key()
        linux/parser.h: add include guards
        fscrypt: remove unnecessary extern keywords
        fscrypt: name all function parameters
        fscrypt: fix all kerneldoc warnings
      afdb0f2e
    • Linus Torvalds's avatar
      Merge tag 'pstore-v5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · 829f3b94
      Linus Torvalds authored
      Pull pstore updates from Kees Cook:
       "Fixes and new features for pstore.
      
        This is a pretty big set of changes (relative to past pstore pulls),
        but it has been in -next for a while. The biggest change here is the
        ability to support a block device as a pstore backend, which has been
        desired for a while. A lot of additional fixes and refactorings are
        also included, mostly in support of the new features.
      
         - refactor pstore locking for safer module unloading (Kees Cook)
      
         - remove orphaned records from pstorefs when backend unloaded (Kees
           Cook)
      
         - refactor dump_oops parameter into max_reason (Pavel Tatashin)
      
         - introduce pstore/zone for common code for contiguous storage
           (WeiXiong Liao)
      
         - introduce pstore/blk for block device backend (WeiXiong Liao)
      
         - introduce mtd backend (WeiXiong Liao)"
      
      * tag 'pstore-v5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (35 commits)
        mtd: Support kmsg dumper based on pstore/blk
        pstore/blk: Introduce "best_effort" mode
        pstore/blk: Support non-block storage devices
        pstore/blk: Provide way to query pstore configuration
        pstore/zone: Provide way to skip "broken" zone for MTD devices
        Documentation: Add details for pstore/blk
        pstore/zone,blk: Add ftrace frontend support
        pstore/zone,blk: Add console frontend support
        pstore/zone,blk: Add support for pmsg frontend
        pstore/blk: Introduce backend for block devices
        pstore/zone: Introduce common layer to manage storage zones
        ramoops: Add "max-reason" optional field to ramoops DT node
        pstore/ram: Introduce max_reason and convert dump_oops
        pstore/platform: Pass max_reason to kmesg dump
        printk: Introduce kmsg_dump_reason_str()
        printk: honor the max_reason field in kmsg_dumper
        printk: Collapse shutdown types into a single dump reason
        pstore/ftrace: Provide ftrace log merging routine
        pstore/ram: Refactor ftrace buffer merging
        pstore/ram: Refactor DT size parsing
        ...
      829f3b94
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · 81e8c10d
      Linus Torvalds authored
      Pull crypto updates from Herbert Xu:
       "API:
         - Introduce crypto_shash_tfm_digest() and use it wherever possible.
         - Fix use-after-free and race in crypto_spawn_alg.
         - Add support for parallel and batch requests to crypto_engine.
      
        Algorithms:
         - Update jitter RNG for SP800-90B compliance.
         - Always use jitter RNG as seed in drbg.
      
        Drivers:
         - Add Arm CryptoCell driver cctrng.
         - Add support for SEV-ES to the PSP driver in ccp"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (114 commits)
        crypto: hisilicon - fix driver compatibility issue with different versions of devices
        crypto: engine - do not requeue in case of fatal error
        crypto: cavium/nitrox - Fix a typo in a comment
        crypto: hisilicon/qm - change debugfs file name from qm_regs to regs
        crypto: hisilicon/qm - add DebugFS for xQC and xQE dump
        crypto: hisilicon/zip - add debugfs for Hisilicon ZIP
        crypto: hisilicon/hpre - add debugfs for Hisilicon HPRE
        crypto: hisilicon/sec2 - add debugfs for Hisilicon SEC
        crypto: hisilicon/qm - add debugfs to the QM state machine
        crypto: hisilicon/qm - add debugfs for QM
        crypto: stm32/crc32 - protect from concurrent accesses
        crypto: stm32/crc32 - don't sleep in runtime pm
        crypto: stm32/crc32 - fix multi-instance
        crypto: stm32/crc32 - fix run-time self test issue.
        crypto: stm32/crc32 - fix ext4 chksum BUG_ON()
        crypto: hisilicon/zip - Use temporary sqe when doing work
        crypto: hisilicon - add device error report through abnormal irq
        crypto: hisilicon - remove codes of directly report device errors through MSI
        crypto: hisilicon - QM memory management optimization
        crypto: hisilicon - unify initial value assignment into QM
        ...
      81e8c10d
    • Linus Torvalds's avatar
      Merge tag 'i3c/for-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux · 729ea4e0
      Linus Torvalds authored
      Pull i3c update from Boris Brezillon:
       "Fix GETMRL's logic"
      
      * tag 'i3c/for-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux:
        i3c master: GETMRL's 3rd byte is optional even with BCR_IBI_PAYLOAD
      729ea4e0
    • Linus Torvalds's avatar
      Merge tag 'regulator-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator · d30fc97c
      Linus Torvalds authored
      Pull regulator updates from Mark Brown:
       "The big change in this release is that Matti Vaittinen has factored
        out the linear ranges support into a separate library in lib/ since it
        is also useful for at least the power subsystem (and most likely
        others too), it helps subsystems which need to map register values
        into more useful real world values do so with minimal per-driver code.
      
         - Factoring out of the linear ranges support into a library in lib/
           from Matti Vaittinen.
      
         - Trace points for bypass mode.
      
         - Use the consumer name in debugfs to make it easier to understand.
      
         - New drivers for Maxim MAX77826 and MAX8998"
      
      * tag 'regulator-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (23 commits)
        regulator: max8998: max8998_set_current_limit() can be static
        dt-bindings: regulator: Convert anatop regulator to json-schema
        regulator: core: Add regulator bypass trace points
        regulator: extract voltage balancing code to the separate function
        regulator/mfd: max8998: Document charger regulator
        regulator: max8998: Add charger regulator
        MAINTAINERS: Add maintainer entry for linear ranges helper
        regulator: bd718x7: remove voltage change restriction from BD71847 LDOs
        lib: linear_ranges: Add missing MODULE_LICENSE()
        regulator: use linear_ranges helper
        power: supply: bd70528: rename linear_range to avoid collision
        lib/test_linear_ranges: add a test for the 'linear_ranges'
        lib: add linear ranges helpers
        regulator: db8500-prcmu: Use true,false for bool variable
        regulator: bd718x7: remove voltage change restriction from BD71847
        regulator: max77826: Remove erroneous additionalProperties
        regulator: qcom-rpmh: Fix typos in pm8150 and pm8150l
        regulator: Document bindings for max77826
        regulator: max77826: Add max77826 regulator driver
        regulator: tps80031: remove redundant assignment to variables ret and val
        ...
      d30fc97c
    • Linus Torvalds's avatar
      Merge tag 'spi-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · a36de5eb
      Linus Torvalds authored
      Pull spi updates from Mark Brown:
       "This has been a very active release for the DesignWare driver in
        particular - after a long period of inactivity we have had a lot of
        people actively working on it for unrelated reasons this cycle with
        some of that work still not landed.
      
        Otherwise it's been fairly quiet for the subsystem.
      
        Highlights include:
      
         - Lots of performance improvements and fixes for the DesignWare
           driver from Serge Semin, Andy Shevchenko, Wan Ahmad Zainie, Clement
           Leger, Dinh Nguyen and Jarkko Nikula.
      
         - Support for octal mode transfers in spidev.
      
         - Slave mode support for the Rockchip drivers.
      
         - Support for AMD controllers, Broadcom mspi and Raspberry Pi 4, and
           Intel Elkhart Lake"
      
      * tag 'spi-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (125 commits)
        spi: spi-fsl-dspi: fix native data copy
        spi: Convert DW SPI binding to DT schema
        spi: dw: Refactor mid_spi_dma_setup() to separate DMA and IRQ config
        spi: dw: Make DMA request line assignments explicit for Intel Medfield
        spi: bcm2835: Remove shared interrupt support
        dt-bindings: snps,dw-apb-ssi: add optional reset property
        spi: dw: add reset control
        spi: bcm2835: Enable shared interrupt support
        spi: bcm2835: Implement shutdown callback
        spi: dw: Use regset32 DebugFS method to create regdump file
        spi: dw: Add DMA support to the DW SPI MMIO driver
        spi: dw: Cleanup generic DW DMA code namings
        spi: dw: Add DW SPI DMA/PCI/MMIO dependency on the DW SPI core
        spi: dw: Remove DW DMA code dependency from DW_DMAC_PCI
        spi: dw: Move Non-DMA code to the DW PCIe-SPI driver
        spi: dw: Add core suffix to the DW APB SSI core source file
        spi: dw: Fix Rx-only DMA transfers
        spi: dw: Use DMA max burst to set the request thresholds
        spi: dw: Parameterize the DMA Rx/Tx burst length
        spi: dw: Add SPI Rx-done wait method to DMA-based transfer
        ...
      a36de5eb
    • Linus Torvalds's avatar
      Merge tag 'regmap-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap · 213fd09e
      Linus Torvalds authored
      Pull regmap updates from Mark Brown:
       "This has been a very active release for the regmap API for some
        reason, a lot of it due to new devices with odd requirements that can
        sensibly be handled here.
      
         - Add support for buses implementing a custom reg_update_bits()
           method in case the bus has a native operation for this.
      
         - Support 16 bit register addresses in SMBus.
      
         - Allow customization of the device attached to regmap-irq.
      
         - Helpers for bitfield operations and per-port field initializations"
      
      * tag 'regmap-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
        regmap: provide helpers for simple bit operations
        regmap: add helper for per-port regfield initialization
        regmap-i2c: add 16-bit width registers support
        regmap: Simplify implementation of the regmap_field_read_poll_timeout() macro
        regmap: Simplify implementation of the regmap_read_poll_timeout() macro
        regmap: add reg_sequence helpers
        regmap-irq: make it possible to add irq_chip do a specific device node
        regmap: Add bus reg_update_bits() support
        regmap: debugfs: check count when read regmap file
      213fd09e
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging · 129b9a5c
      Linus Torvalds authored
      Pull hwmon updates from Guenter Roeck:
       "Infrastructure:
         - Add notification support
      
        New drivers:
         - Baikal-T1 PVT sensor driver
         - amd_energy driver to report energy counters
         - Driver for Maxim MAX16601
         - Gateworks System Controller
      
        Various:
         - applesmc: avoid overlong udelay()
         - dell-smm: Use one DMI match for all XPS models
         - ina2xx: Implement alert functions
         - lm70: Add support for ACPI
         - lm75: Fix coding-style warnings
         - lm90: Add max6654 support to lm90 driver
         - nct7802: Replace container_of() API
         - nct7904: Set default timeout
         - nct7904: Add watchdog function
         - pmbus: Improve initialization of 'currpage' and 'currphase'"
      
      * tag 'hwmon-for-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (24 commits)
        hwmon: Add Baikal-T1 PVT sensor driver
        hwmon: Add notification support
        dt-bindings: hwmon: Add Baikal-T1 PVT sensor binding
        hwmon: (applesmc) avoid overlong udelay()
        hwmon: (nct7904) Set default timeout
        hwmon: (amd_energy) Missing platform_driver_unregister() on error in amd_energy_init()
        MAINTAINERS: add entry for AMD energy driver
        hwmon: (amd_energy) Add documentation
        hwmon: Add amd_energy driver to report energy counters
        hwmon: (nct7802) Replace container_of() API
        hwmon: (lm90) Add max6654 support to lm90 driver
        hwmon : (nct6775) Use kobj_to_dev() API
        hwmon: (pmbus) Driver for Maxim MAX16601
        hwmon: (pmbus) Improve initialization of 'currpage' and 'currphase'
        hwmon: (adt7411) update contact email
        hwmon: (lm75) Fix all coding-style warnings on lm75 driver
        hwmon: Reduce indentation level in __hwmon_device_register()
        hwmon: (ina2xx) Implement alert functions
        hwmon: (lm70) Add support for ACPI
        hwmon: (dell-smm) Use one DMI match for all XPS models
        ...
      129b9a5c
    • Linus Torvalds's avatar
      Merge tag 'tpmdd-next-20200522' of git://git.infradead.org/users/jjs/linux-tpmdd · b6f91ab6
      Linus Torvalds authored
      Pull tpm updates from Jarkko Sakkinen.
      
      * tag 'tpmdd-next-20200522' of git://git.infradead.org/users/jjs/linux-tpmdd:
        tpm: eventlog: Replace zero-length array with flexible-array member
        tpm/tpm_ftpm_tee: Use UUID API for exporting the UUID
      b6f91ab6
    • Mark Brown's avatar
    • Mark Brown's avatar
    • kbuild test robot's avatar
      0b0c0bd8
    • Borislav Petkov's avatar
    • Petr Mladek's avatar
      8b390ab7
    • Petr Mladek's avatar
      Merge branch 'for-5.8' into for-linus · d053cf0d
      Petr Mladek authored
      d053cf0d
    • Petr Mladek's avatar
      6a0af9fc
    • WeiXiong Liao's avatar
      mtd: Support kmsg dumper based on pstore/blk · 78c08247
      WeiXiong Liao authored
      This introduces mtdpstore, which is similar to mtdoops but more
      powerful. It uses pstore/blk, and aims to store panic and oops logs to
      a flash partition, where pstore can later read back and present as files
      in the mounted pstore filesystem.
      
      To make mtdpstore work, the "blkdev" of pstore/blk should be set
      as MTD device name or MTD device number. For more details, see
      Documentation/admin-guide/pstore-blk.rst
      
      This solves a number of issues:
      - Work duplication: both of pstore and mtdoops do the same job storing
        panic/oops log. They have very similar logic, registering to kmsg
        dumper and storing logs to several chunks one by one.
      - Layer violations: drivers should provides methods instead of polices.
        MTD should provide read/write/erase operations, and allow a higher
        level drivers to provide the chunk management, kmsg dump
        configuration, etc.
      - Missing features: pstore provides many additional features, including
        presenting the logs as files, logging dump time and count, and
        supporting other frontends like pmsg, console, etc.
      Signed-off-by: default avatarWeiXiong Liao <liaoweixiong@allwinnertech.com>
      Link: https://lore.kernel.org/lkml/20200511233229.27745-11-keescook@chromium.org/
      Link: https://lore.kernel.org/r/1589266715-4168-1-git-send-email-liaoweixiong@allwinnertech.comSigned-off-by: default avatarKees Cook <keescook@chromium.org>
      78c08247
    • Kees Cook's avatar
      pstore/blk: Introduce "best_effort" mode · f8feafea
      Kees Cook authored
      In order to use arbitrary block devices as a pstore backend, provide a
      new module param named "best_effort", which will allow using any block
      device, even if it has not provided a panic_write callback.
      
      Link: https://lore.kernel.org/lkml/20200511233229.27745-12-keescook@chromium.org/Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      f8feafea
    • WeiXiong Liao's avatar
      pstore/blk: Support non-block storage devices · 7dcb7848
      WeiXiong Liao authored
      Add support for non-block devices (e.g. MTD). A non-block driver calls
      pstore_blk_register_device() to register iself.
      
      In addition, pstore/zone is updated to handle non-block devices,
      where an erase must be done before a write. Without this, there is no
      way to remove records stored to an MTD.
      Signed-off-by: default avatarWeiXiong Liao <liaoweixiong@allwinnertech.com>
      Link: https://lore.kernel.org/lkml/20200511233229.27745-10-keescook@chromium.org/Co-developed-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      7dcb7848
    • WeiXiong Liao's avatar
      pstore/blk: Provide way to query pstore configuration · 1525fb3b
      WeiXiong Liao authored
      In order to configure itself, the MTD backend needs to be able to query
      the current pstore configuration. Introduce pstore_blk_get_config() for
      this purpose.
      Signed-off-by: default avatarWeiXiong Liao <liaoweixiong@allwinnertech.com>
      Link: https://lore.kernel.org/lkml/20200511233229.27745-9-keescook@chromium.org/Co-developed-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      1525fb3b
    • WeiXiong Liao's avatar
      pstore/zone: Provide way to skip "broken" zone for MTD devices · 335426c6
      WeiXiong Liao authored
      One requirement to support MTD devices in pstore/zone is having a
      way to declare certain regions as broken. Add this support to
      pstore/zone.
      
      The MTD driver should return -ENOMSG when encountering a bad region,
      which tells pstore/zone to skip and try the next one.
      Signed-off-by: default avatarWeiXiong Liao <liaoweixiong@allwinnertech.com>
      Link: https://lore.kernel.org/lkml/20200511233229.27745-8-keescook@chromium.org/Co-developed-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Link: //lore.kernel.org/lkml/20200512173801.222666-1-colin.king@canonical.com
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      335426c6
  3. 31 May, 2020 6 commits
    • Linus Torvalds's avatar
      Linux 5.7 · 3d77e6a8
      Linus Torvalds authored
      3d77e6a8
    • Joe Perches's avatar
      checkpatch/coding-style: deprecate 80-column warning · bdc48fa1
      Joe Perches authored
      Yes, staying withing 80 columns is certainly still _preferred_.  But
      it's not the hard limit that the checkpatch warnings imply, and other
      concerns can most certainly dominate.
      
      Increase the default limit to 100 characters.  Not because 100
      characters is some hard limit either, but that's certainly a "what are
      you doing" kind of value and less likely to be about the occasional
      slightly longer lines.
      
      Miscellanea:
      
       - to avoid unnecessary whitespace changes in files, checkpatch will no
         longer emit a warning about line length when scanning files unless
         --strict is also used
      
       - Add a bit to coding-style about alignment to open parenthesis
      Signed-off-by: default avatarJoe Perches <joe@perches.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bdc48fa1
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2020-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 8fc984ae
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A pile of x86 fixes:
      
         - Prevent a memory leak in ioperm which was caused by the stupid
           assumption that the exit cleanup is always called for current,
           which is not the case when fork fails after taking a reference on
           the ioperm bitmap.
      
         - Fix an arithmething overflow in the DMA code on 32bit systems
      
         - Fill gaps in the xstate copy with defaults instead of leaving them
           uninitialized
      
         - Revert: "Make __X32_SYSCALL_BIT be unsigned long" as it turned out
           that existing user space fails to build"
      
      * tag 'x86-urgent-2020-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/ioperm: Prevent a memory leak when fork fails
        x86/dma: Fix max PFN arithmetic overflow on 32 bit systems
        copy_xstate_to_kernel(): don't leave parts of destination uninitialized
        x86/syscalls: Revert "x86/syscalls: Make __X32_SYSCALL_BIT be unsigned long"
      8fc984ae
    • Linus Torvalds's avatar
      Merge tag 'sched-urgent-2020-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 3d042823
      Linus Torvalds authored
      Pull scheduler fix from Thomas Gleixner:
       "A single scheduler fix preventing a crash in NUMA balancing.
      
        The current->mm check is not reliable as the mm might be temporary due
        to use_mm() in a kthread. Check for PF_KTHREAD explictly"
      
      * tag 'sched-urgent-2020-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/fair: Don't NUMA balance for kthreads
      3d042823
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 19835b1b
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "Another week, another set of bug fixes:
      
         1) Fix pskb_pull length in __xfrm_transport_prep(), from Xin Long.
      
         2) Fix double xfrm_state put in esp{4,6}_gro_receive(), also from Xin
            Long.
      
         3) Re-arm discovery timer properly in mac80211 mesh code, from Linus
            Lüssing.
      
         4) Prevent buffer overflows in nf_conntrack_pptp debug code, from
            Pablo Neira Ayuso.
      
         5) Fix race in ktls code between tls_sw_recvmsg() and
            tls_decrypt_done(), from Vinay Kumar Yadav.
      
         6) Fix crashes on TCP fallback in MPTCP code, from Paolo Abeni.
      
         7) More validation is necessary of untrusted GSO packets coming from
            virtualization devices, from Willem de Bruijn.
      
         8) Fix endianness of bnxt_en firmware message length accesses, from
            Edwin Peer.
      
         9) Fix infinite loop in sch_fq_pie, from Davide Caratti.
      
        10) Fix lockdep splat in DSA by setting lockless TX in netdev features
            for slave ports, from Vladimir Oltean.
      
        11) Fix suspend/resume crashes in mlx5, from Mark Bloch.
      
        12) Fix use after free in bpf fmod_ret, from Alexei Starovoitov.
      
        13) ARP retransmit timer guard uses wrong offset, from Hongbin Liu.
      
        14) Fix leak in inetdev_init(), from Yang Yingliang.
      
        15) Don't try to use inet hash and unhash in l2tp code, results in
            crashes. From Eric Dumazet"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (77 commits)
        l2tp: add sk_family checks to l2tp_validate_socket
        l2tp: do not use inet_hash()/inet_unhash()
        net: qrtr: Allocate workqueue before kernel_bind
        mptcp: remove msk from the token container at destruction time.
        mptcp: fix race between MP_JOIN and close
        mptcp: fix unblocking connect()
        net/sched: act_ct: add nat mangle action only for NAT-conntrack
        devinet: fix memleak in inetdev_init()
        virtio_vsock: Fix race condition in virtio_transport_recv_pkt
        drivers/net/ibmvnic: Update VNIC protocol version reporting
        NFC: st21nfca: add missed kfree_skb() in an error path
        neigh: fix ARP retransmit timer guard
        bpf, selftests: Add a verifier test for assigning 32bit reg states to 64bit ones
        bpf, selftests: Verifier bounds tests need to be updated
        bpf: Fix a verifier issue when assigning 32bit reg states to 64bit ones
        bpf: Fix use-after-free in fmod_ret check
        net/mlx5e: replace EINVAL in mlx5e_flower_parse_meta()
        net/mlx5e: Fix MLX5_TC_CT dependencies
        net/mlx5e: Properly set default values when disabling adaptive moderation
        net/mlx5e: Fix arch depending casting issue in FEC
        ...
      19835b1b
    • Eric Dumazet's avatar
      l2tp: add sk_family checks to l2tp_validate_socket · d9a81a22
      Eric Dumazet authored
      syzbot was able to trigger a crash after using an ISDN socket
      and fool l2tp.
      
      Fix this by making sure the UDP socket is of the proper family.
      
      BUG: KASAN: slab-out-of-bounds in setup_udp_tunnel_sock+0x465/0x540 net/ipv4/udp_tunnel.c:78
      Write of size 1 at addr ffff88808ed0c590 by task syz-executor.5/3018
      
      CPU: 0 PID: 3018 Comm: syz-executor.5 Not tainted 5.7.0-rc6-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x188/0x20d lib/dump_stack.c:118
       print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:382
       __kasan_report.cold+0x20/0x38 mm/kasan/report.c:511
       kasan_report+0x33/0x50 mm/kasan/common.c:625
       setup_udp_tunnel_sock+0x465/0x540 net/ipv4/udp_tunnel.c:78
       l2tp_tunnel_register+0xb15/0xdd0 net/l2tp/l2tp_core.c:1523
       l2tp_nl_cmd_tunnel_create+0x4b2/0xa60 net/l2tp/l2tp_netlink.c:249
       genl_family_rcv_msg_doit net/netlink/genetlink.c:673 [inline]
       genl_family_rcv_msg net/netlink/genetlink.c:718 [inline]
       genl_rcv_msg+0x627/0xdf0 net/netlink/genetlink.c:735
       netlink_rcv_skb+0x15a/0x410 net/netlink/af_netlink.c:2469
       genl_rcv+0x24/0x40 net/netlink/genetlink.c:746
       netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
       netlink_unicast+0x537/0x740 net/netlink/af_netlink.c:1329
       netlink_sendmsg+0x882/0xe10 net/netlink/af_netlink.c:1918
       sock_sendmsg_nosec net/socket.c:652 [inline]
       sock_sendmsg+0xcf/0x120 net/socket.c:672
       ____sys_sendmsg+0x6e6/0x810 net/socket.c:2352
       ___sys_sendmsg+0x100/0x170 net/socket.c:2406
       __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439
       do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
       entry_SYSCALL_64_after_hwframe+0x49/0xb3
      RIP: 0033:0x45ca29
      Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007effe76edc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      RAX: ffffffffffffffda RBX: 00000000004fe1c0 RCX: 000000000045ca29
      RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005
      RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
      R13: 000000000000094e R14: 00000000004d5d00 R15: 00007effe76ee6d4
      
      Allocated by task 3018:
       save_stack+0x1b/0x40 mm/kasan/common.c:49
       set_track mm/kasan/common.c:57 [inline]
       __kasan_kmalloc mm/kasan/common.c:495 [inline]
       __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468
       __do_kmalloc mm/slab.c:3656 [inline]
       __kmalloc+0x161/0x7a0 mm/slab.c:3665
       kmalloc include/linux/slab.h:560 [inline]
       sk_prot_alloc+0x223/0x2f0 net/core/sock.c:1612
       sk_alloc+0x36/0x1100 net/core/sock.c:1666
       data_sock_create drivers/isdn/mISDN/socket.c:600 [inline]
       mISDN_sock_create+0x272/0x400 drivers/isdn/mISDN/socket.c:796
       __sock_create+0x3cb/0x730 net/socket.c:1428
       sock_create net/socket.c:1479 [inline]
       __sys_socket+0xef/0x200 net/socket.c:1521
       __do_sys_socket net/socket.c:1530 [inline]
       __se_sys_socket net/socket.c:1528 [inline]
       __x64_sys_socket+0x6f/0xb0 net/socket.c:1528
       do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
       entry_SYSCALL_64_after_hwframe+0x49/0xb3
      
      Freed by task 2484:
       save_stack+0x1b/0x40 mm/kasan/common.c:49
       set_track mm/kasan/common.c:57 [inline]
       kasan_set_free_info mm/kasan/common.c:317 [inline]
       __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456
       __cache_free mm/slab.c:3426 [inline]
       kfree+0x109/0x2b0 mm/slab.c:3757
       kvfree+0x42/0x50 mm/util.c:603
       __free_fdtable+0x2d/0x70 fs/file.c:31
       put_files_struct fs/file.c:420 [inline]
       put_files_struct+0x248/0x2e0 fs/file.c:413
       exit_files+0x7e/0xa0 fs/file.c:445
       do_exit+0xb04/0x2dd0 kernel/exit.c:791
       do_group_exit+0x125/0x340 kernel/exit.c:894
       get_signal+0x47b/0x24e0 kernel/signal.c:2739
       do_signal+0x81/0x2240 arch/x86/kernel/signal.c:784
       exit_to_usermode_loop+0x26c/0x360 arch/x86/entry/common.c:161
       prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline]
       syscall_return_slowpath arch/x86/entry/common.c:279 [inline]
       do_syscall_64+0x6b1/0x7d0 arch/x86/entry/common.c:305
       entry_SYSCALL_64_after_hwframe+0x49/0xb3
      
      The buggy address belongs to the object at ffff88808ed0c000
       which belongs to the cache kmalloc-2k of size 2048
      The buggy address is located 1424 bytes inside of
       2048-byte region [ffff88808ed0c000, ffff88808ed0c800)
      The buggy address belongs to the page:
      page:ffffea00023b4300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0
      flags: 0xfffe0000000200(slab)
      raw: 00fffe0000000200 ffffea0002838208 ffffea00015ba288 ffff8880aa000e00
      raw: 0000000000000000 ffff88808ed0c000 0000000100000001 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
       ffff88808ed0c480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       ffff88808ed0c500: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
      >ffff88808ed0c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                               ^
       ffff88808ed0c600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
       ffff88808ed0c680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      
      Fixes: 6b9f3423 ("l2tp: fix races in tunnel creation")
      Fixes: fd558d18 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: James Chapman <jchapman@katalix.com>
      Cc: Guillaume Nault <gnault@redhat.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Acked-by: default avatarGuillaume Nault <gnault@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d9a81a22