)]}' { "log": [ { "commit": "816d650c9e42ae300db5477c326c6668220819ce", "tree": "fcc6073739968a360441abe34a0c2ea1f40ba9f7", "parents": [ "ca7bdb1b511e9fd887b7710bfec756f21c4e83c4" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Sep 10 10:54:00 2020 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 13:11:03 2020 +0200" }, "message": "um: time-travel: return the sequence number in ACK messages\n\nFor external time travel, the protocol says to return the\nincoming sequence number in the ACK message to aid debugging,\nso do that.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "ca7bdb1b511e9fd887b7710bfec756f21c4e83c4", "tree": "e91b640b233abfc994c654c043b52e024504aa67", "parents": [ "6e9ad48d7c56cf22e6a29c6775c3e37dcd2bb88d" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Sep 08 23:06:02 2020 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 13:10:54 2020 +0200" }, "message": "um: time-travel: fix IRQ handling in time_travel_handle_message()\n\nAs the comment here indicates, we need to do the polling in the\nidle loop without blocking interrupts, since interrupts can be\nvhost-user messages that we must process even while in our idle\nloop.\n\nI don\u0027t know why I explained one thing and implemented another,\nbut we have indeed observed random hangs due to this, depending\non the timing of the messages.\n\nFixes: 88ce64249233 (\"um: Implement time-travel\u003dext\")\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "6e9ad48d7c56cf22e6a29c6775c3e37dcd2bb88d", "tree": "af489c6a5f846a5c9992090c5856ca0f182c74bc", "parents": [ "cc15faee6e0562c4a0aeda0ee81b0a7f26026923" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Jun 08 14:57:58 2020 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 13:10:51 2020 +0200" }, "message": "ld-version: don\u0027t hardcode awk in #!-line\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "cc15faee6e0562c4a0aeda0ee81b0a7f26026923", "tree": "908297c7d50b329bb2b1c89593944127767b8581", "parents": [ "794f99906963fb774216eaeaabc3835282f30a0c" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jun 04 13:23:17 2020 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 13:10:49 2020 +0200" }, "message": "um: change sigio_spinlock to a mutex\n\nLockdep complains at boot:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ BUG: Invalid wait context ]\n5.7.0-05093-g46d91ecd597b #98 Not tainted\n-----------------------------\nswapper/1 is trying to lock:\n0000000060931b98 (\u0026desc[i].request_mutex){+.+.}-{3:3}, at: __setup_irq+0x11d/0x623\nother info that might help us debug this:\ncontext-{4:4}\n1 lock held by swapper/1:\n #0: 000000006074fed8 (sigio_spinlock){+.+.}-{2:2}, at: sigio_lock+0x1a/0x1c\nstack backtrace:\nCPU: 0 PID: 1 Comm: swapper Not tainted 5.7.0-05093-g46d91ecd597b #98\nStack:\n 7fa4fab0 6028dfd1 0000002a 6008bea5\n 7fa50700 7fa50040 7fa4fac0 6028e016\n 7fa4fb50 6007f6da 60959c18 00000000\nCall Trace:\n [\u003c60023a0e\u003e] show_stack+0x13b/0x155\n [\u003c6028e016\u003e] dump_stack+0x2a/0x2c\n [\u003c6007f6da\u003e] __lock_acquire+0x515/0x15f2\n [\u003c6007eb50\u003e] lock_acquire+0x245/0x273\n [\u003c6050d9f1\u003e] __mutex_lock+0xbd/0x325\n [\u003c6050dc76\u003e] mutex_lock_nested+0x1d/0x1f\n [\u003c6008e27e\u003e] __setup_irq+0x11d/0x623\n [\u003c6008e8ed\u003e] request_threaded_irq+0x169/0x1a6\n [\u003c60021eb0\u003e] um_request_irq+0x1ee/0x24b\n [\u003c600234ee\u003e] write_sigio_irq+0x3b/0x76\n [\u003c600383ca\u003e] sigio_broken+0x146/0x2e4\n [\u003c60020bd8\u003e] do_one_initcall+0xde/0x281\n\nBecause we hold sigio_spinlock and then get into requesting\nan interrupt with a mutex.\n\nChange the spinlock to a mutex to avoid that.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "794f99906963fb774216eaeaabc3835282f30a0c", "tree": "651d4a86462eb3db8276b0af33790dcfb91b8e74", "parents": [ "bcf876870b95592b52519ed4aafcf9d95999bc9c" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jun 04 13:37:52 2020 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Sep 14 13:10:45 2020 +0200" }, "message": "um: remove mmap_sem usage from activate_mm()\n\nLockdep complains about the mmap_sem because we try to\ndown_write() it while we already hold the task (spin)lock.\n\nSince commit 9bfb23fc4a48 (\"sys_unshare: remove the dead\nCLONE_THREAD/SIGHAND/VM code\") this is no longer called\nby sys_unshare(), and thus the only caller of this is\nexec_mmap() in fs/exec.c. But in this case, the new mm\nis completely new, so it shouldn\u0027t be possible to change\nit concurrently.\n\nRemove the mmap_sem handling completely.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "bcf876870b95592b52519ed4aafcf9d95999bc9c", "tree": "73b13881e29f6c2bec1c56571f613fed0e59de9f", "parents": [ "5a30a78924ecd97b0335d2e1d3e01a5023c1a3d8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 02 14:21:45 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 02 14:21:45 2020 -0700" }, "message": "Linux 5.8\n" }, { "commit": "5a30a78924ecd97b0335d2e1d3e01a5023c1a3d8", "tree": "7c31e09a571450d6303468ad28f736ae42cc27b9", "parents": [ "142c3326b055a278c303bfef8dc6a105fff18ca6", "bdd65589593edd79b6a12ce86b3b7a7c6dae5208" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 02 13:10:42 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 02 13:10:42 2020 -0700" }, "message": "Merge tag \u0027x86-urgent-2020-08-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n \"A single fix for a potential deadlock when printing a message about\n spurious interrupts\"\n\n* tag \u0027x86-urgent-2020-08-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/i8259: Use printk_deferred() to prevent deadlock\n" }, { "commit": "142c3326b055a278c303bfef8dc6a105fff18ca6", "tree": "036cba1082183aa17c669073d81e3bf614c83b44", "parents": [ "628e04dfeb4f66635c0d22cf1ad0cf427406e129", "28ab576ba8de934ee3145b6d75119f016de567cb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 02 11:23:51 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 02 11:23:51 2020 -0700" }, "message": "Merge tag \u0027kbuild-fixes-v5.8-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild\n\nPull Kbuild fixes from Masahiro Yamada:\n\n - clean the generated moc file for xconfig\n\n - fix xconfig bugs, and revert some bad commits\n\n* tag \u0027kbuild-fixes-v5.8-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:\n kbuild: remove redundant FORCE definition in scripts/Makefile.modpost\n kconfig: qconf: remove wrong ConfigList::firstChild()\n Revert \"kconfig: qconf: don\u0027t show goback button on splitMode\"\n Revert \"kconfig: qconf: Change title for the item window\"\n kconfig: qconf: remove \"goBack\" debug message\n kconfig: qconf: use delete[] instead of delete to free array\n kconfig: qconf: compile moc object separately\n kconfig: qconf: use if_changed for qconf.moc rule\n modpost: explain why we can\u0027t use strsep\n" }, { "commit": "628e04dfeb4f66635c0d22cf1ad0cf427406e129", "tree": "e6e84cbaf7c88fde2445116aae044d5ca912fb1c", "parents": [ "ac3a0c8472969a03c0496ae774b3a29eb26c8d5a", "830f01b089b12bbe93bd55f2d62837253012a30e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 02 10:41:00 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 02 10:41:00 2020 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull KVM fixes from Paolo Bonzini:\n \"Bugfixes and strengthening the validity checks on inputs from new\n userspace APIs.\n\n Now I know why I shouldn\u0027t prepare pull requests on the weekend, it\u0027s\n hard to concentrate if your son is shouting about his latest Minecraft\n builds in your ear. Fortunately all the patches were ready and I just\n had to check the test results...\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: SVM: Fix disable pause loop exit/pause filtering capability on SVM\n KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled\n KVM: arm64: Don\u0027t inherit exec permission across page-table levels\n KVM: arm64: Prevent vcpu_has_ptrauth from generating OOL functions\n KVM: nVMX: check for invalid hdr.vmx.flags\n KVM: nVMX: check for required but missing VMCS12 in KVM_SET_NESTED_STATE\n selftests: kvm: do not set guest mode flag\n" }, { "commit": "28ab576ba8de934ee3145b6d75119f016de567cb", "tree": "f9e01017c9db66d22b45f1f183fbe8f858478fd2", "parents": [ "ccf56e5fe3d208883cd6db982197eac9b70a0bf9" ], "author": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sun Aug 02 22:54:40 2020 +0900" }, "committer": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sun Aug 02 23:09:16 2020 +0900" }, "message": "kbuild: remove redundant FORCE definition in scripts/Makefile.modpost\n\nThe same code exists a few lines above.\n\nFixes: 436b2ac603d5 (\"modpost: invoke modpost only when input files are updated\")\nSigned-off-by: Masahiro Yamada \u003cmasahiroy@kernel.org\u003e\n" }, { "commit": "ccf56e5fe3d208883cd6db982197eac9b70a0bf9", "tree": "3b1e6b16b55c293cfa278d21c1e2073122dfef05", "parents": [ "4b20e103a63d056fb7a594b23d42ef8e0dbfc5ff" ], "author": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sat Aug 01 16:08:50 2020 +0900" }, "committer": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sun Aug 02 23:09:10 2020 +0900" }, "message": "kconfig: qconf: remove wrong ConfigList::firstChild()\n\nThis function returns the first child object, but the returned pointer\nis not compatible with (ConfigItem *).\n\nCommit cc1c08edccaf (\"kconfig: qconf: don\u0027t show goback button on\nsplitMode\") uncovered this issue because using the pointer from this\nfunction would make qconf crash. (https://lkml.org/lkml/2020/7/18/411)\n\nThis function does not work. Remove.\n\nSigned-off-by: Masahiro Yamada \u003cmasahiroy@kernel.org\u003e\n" }, { "commit": "ac3a0c8472969a03c0496ae774b3a29eb26c8d5a", "tree": "76e80aef974c34140055d0015fca6e6f7c85722e", "parents": [ "0ae3495b6502cf93634cbd027cb2f6f9f83a406f", "fda2ec62cf1aa7cbee52289dc8059cd3662795da" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 01 16:47:24 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 01 16:47:24 2020 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from David Miller:\n\n 1) Encap offset calculation is incorrect in esp6, from Sabrina Dubroca.\n\n 2) Better parameter validation in pfkey_dump(), from Mark Salyzyn.\n\n 3) Fix several clang issues on powerpc in selftests, from Tanner Love.\n\n 4) cmsghdr_from_user_compat_to_kern() uses the wrong length, from Al\n Viro.\n\n 5) Out of bounds access in mlx5e driver, from Raed Salem.\n\n 6) Fix transfer buffer memleak in lan78xx, from Johan Havold.\n\n 7) RCU fixups in rhashtable, from Herbert Xu.\n\n 8) Fix ipv6 nexthop refcnt leak, from Xiyu Yang.\n\n 9) vxlan FDB dump must be done under RCU, from Ido Schimmel.\n\n10) Fix use after free in mlxsw, from Ido Schimmel.\n\n11) Fix map leak in HASH_OF_MAPS bpf code, from Andrii Nakryiko.\n\n12) Fix bug in mac80211 Tx ack status reporting, from Vasanthakumar\n Thiagarajan.\n\n13) Fix memory leaks in IPV6_ADDRFORM code, from Cong Wang.\n\n14) Fix bpf program reference count leaks in mlx5 during\n mlx5e_alloc_rq(), from Xin Xiong.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (86 commits)\n vxlan: fix memleak of fdb\n rds: Prevent kernel-infoleak in rds_notify_queue_get()\n net/sched: The error lable position is corrected in ct_init_module\n net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq\n net/mlx5e: E-Switch, Specify flow_source for rule with no in_port\n net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring\n net/mlx5e: CT: Support restore ipv6 tunnel\n net: gemini: Fix missing clk_disable_unprepare() in error path of gemini_ethernet_port_probe()\n ionic: unlock queue mutex in error path\n atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent\n net: ethernet: mtk_eth_soc: fix MTU warnings\n net: nixge: fix potential memory leak in nixge_probe()\n devlink: ignore -EOPNOTSUPP errors on dumpit\n rxrpc: Fix race between recvmsg and sendmsg on immediate call failure\n MAINTAINERS: Replace Thor Thayer as Altera Triple Speed Ethernet maintainer\n selftests/bpf: fix netdevsim trap_flow_action_cookie read\n ipv6: fix memory leaks on IPV6_ADDRFORM path\n net/bpfilter: Initialize pos in __bpfilter_process_sockopt\n igb: reinit_locked() should be called with rtnl_lock\n e1000e: continue to init PHY even when failed to disable ULP\n ...\n" }, { "commit": "0ae3495b6502cf93634cbd027cb2f6f9f83a406f", "tree": "d51bab1ae0b2d78f427c8e7c64e9ca1c1a6a1d4d", "parents": [ "bf121a0bda29daa67a1fcedbdf479f6b03c9f977", "7665a47f70b3f64bf09c233cc7df73fde9e506f1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 01 16:40:59 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 01 16:40:59 2020 -0700" }, "message": "Merge tag \u0027for-linus-2020-08-01\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux\n\nPull thread fix from Christian Brauner:\n \"A simple spelling fix for dequeue_synchronous_signal()\"\n\n* tag \u0027for-linus-2020-08-01\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux:\n signal: fix typo in dequeue_synchronous_signal()\n" }, { "commit": "bf121a0bda29daa67a1fcedbdf479f6b03c9f977", "tree": "7c86d9ce1e2b80d1de381b3afcfcbca17467626a", "parents": [ "d52daa8620c65960e1ef882adc1f92061326bd7a", "39efdd94e314336f4acbac4c07e0f37bdc3bef71" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 01 13:08:50 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 01 13:08:50 2020 -0700" }, "message": "Merge tag \u0027perf-tools-fixes-2020-08-01\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux\n\nPull perf tooling fixes from Arnaldo Carvalho de Melo:\n\n - Fix libtraceevent build with binutils 2.35\n\n - Fix memory leak in process_dynamic_array_len in libtraceevent\n\n - Fix \u0027perf test 68\u0027 zstd compression for s390\n\n - Fix record failure when mixed with ARM SPE event\n\n* tag \u0027perf-tools-fixes-2020-08-01\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:\n libtraceevent: Fix build with binutils 2.35\n perf tools: Fix record failure when mixed with ARM SPE event\n perf tests: Fix test 68 zstd compression for s390\n tools lib traceevent: Fix memory leak in process_dynamic_array_len\n" }, { "commit": "fda2ec62cf1aa7cbee52289dc8059cd3662795da", "tree": "5d21677c838744ef3660dabea1eefcd8f870143a", "parents": [ "69138b34a7248d2396ab85c8652e20c0c39beaba" ], "author": { "name": "Taehee Yoo", "email": "ap420073@gmail.com", "time": "Sat Aug 01 07:07:50 2020 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Aug 01 11:49:18 2020 -0700" }, "message": "vxlan: fix memleak of fdb\n\nWhen vxlan interface is deleted, all fdbs are deleted by vxlan_flush().\nvxlan_flush() flushes fdbs but it doesn\u0027t delete fdb, which contains\nall-zeros-mac because it is deleted by vxlan_uninit().\nBut vxlan_uninit() deletes only the fdb, which contains both all-zeros-mac\nand default vni.\nSo, the fdb, which contains both all-zeros-mac and non-default vni\nwill not be deleted.\n\nTest commands:\n ip link add vxlan0 type vxlan dstport 4789 external\n ip link set vxlan0 up\n bridge fdb add to 00:00:00:00:00:00 dst 172.0.0.1 dev vxlan0 via lo \\\n\t src_vni 10000 self permanent\n ip link del vxlan0\n\nkmemleak reports as follows:\nunreferenced object 0xffff9486b25ced88 (size 96):\n comm \"bridge\", pid 2151, jiffies 4294701712 (age 35506.901s)\n hex dump (first 32 bytes):\n 02 00 00 00 ac 00 00 01 40 00 09 b1 86 94 ff ff ........@.......\n 46 02 00 00 00 00 00 00 a7 03 00 00 12 b5 6a 6b F.............jk\n backtrace:\n [\u003c00000000c10cf651\u003e] vxlan_fdb_append.part.51+0x3c/0xf0 [vxlan]\n [\u003c000000006b31a8d9\u003e] vxlan_fdb_create+0x184/0x1a0 [vxlan]\n [\u003c0000000049399045\u003e] vxlan_fdb_update+0x12f/0x220 [vxlan]\n [\u003c0000000090b1ef00\u003e] vxlan_fdb_add+0x12a/0x1b0 [vxlan]\n [\u003c0000000056633c2c\u003e] rtnl_fdb_add+0x187/0x270\n [\u003c00000000dd5dfb6b\u003e] rtnetlink_rcv_msg+0x264/0x490\n [\u003c00000000fc44dd54\u003e] netlink_rcv_skb+0x4a/0x110\n [\u003c00000000dff433e7\u003e] netlink_unicast+0x18e/0x250\n [\u003c00000000b87fb421\u003e] netlink_sendmsg+0x2e9/0x400\n [\u003c000000002ed55153\u003e] ____sys_sendmsg+0x237/0x260\n [\u003c00000000faa51c66\u003e] ___sys_sendmsg+0x88/0xd0\n [\u003c000000006c3982f1\u003e] __sys_sendmsg+0x4e/0x80\n [\u003c00000000a8f875d2\u003e] do_syscall_64+0x56/0xe0\n [\u003c000000003610eefa\u003e] entry_SYSCALL_64_after_hwframe+0x44/0xa9\nunreferenced object 0xffff9486b1c40080 (size 128):\n comm \"bridge\", pid 2157, jiffies 4294701754 (age 35506.866s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 f8 dc 42 b2 86 94 ff ff ..........B.....\n 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk\n backtrace:\n [\u003c00000000a2981b60\u003e] vxlan_fdb_create+0x67/0x1a0 [vxlan]\n [\u003c0000000049399045\u003e] vxlan_fdb_update+0x12f/0x220 [vxlan]\n [\u003c0000000090b1ef00\u003e] vxlan_fdb_add+0x12a/0x1b0 [vxlan]\n [\u003c0000000056633c2c\u003e] rtnl_fdb_add+0x187/0x270\n [\u003c00000000dd5dfb6b\u003e] rtnetlink_rcv_msg+0x264/0x490\n [\u003c00000000fc44dd54\u003e] netlink_rcv_skb+0x4a/0x110\n [\u003c00000000dff433e7\u003e] netlink_unicast+0x18e/0x250\n [\u003c00000000b87fb421\u003e] netlink_sendmsg+0x2e9/0x400\n [\u003c000000002ed55153\u003e] ____sys_sendmsg+0x237/0x260\n [\u003c00000000faa51c66\u003e] ___sys_sendmsg+0x88/0xd0\n [\u003c000000006c3982f1\u003e] __sys_sendmsg+0x4e/0x80\n [\u003c00000000a8f875d2\u003e] do_syscall_64+0x56/0xe0\n [\u003c000000003610eefa\u003e] entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFixes: 3ad7a4b141eb (\"vxlan: support fdb and learning in COLLECT_METADATA mode\")\nSigned-off-by: Taehee Yoo \u003cap420073@gmail.com\u003e\nAcked-by: Roopa Prabhu \u003croopa@cumulusnetworks.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d52daa8620c65960e1ef882adc1f92061326bd7a", "tree": "1d3fdc8db25c5a247142a5ea8f053bf22241ad4c", "parents": [ "7dc6fd0f3b8404542718039f5de19fe56e474578", "c3c0c2e18d943ec4a84162ac679970b592555a4a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 01 10:11:42 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 01 10:11:42 2020 -0700" }, "message": "Merge tag \u0027pinctrl-v5.8-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fix from Linus Walleij:\n \"A single last minute pin control fix to the Qualcomm driver fixing\n missing dual edge PCH interrupts\"\n\n* tag \u0027pinctrl-v5.8-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl: qcom: Handle broken/missing PDC dual edge IRQs on sc7180\n" }, { "commit": "4b20e103a63d056fb7a594b23d42ef8e0dbfc5ff", "tree": "ccf6f187f87caceeda477abc1df6b6c2fb66b9f6", "parents": [ "97bebbcd8b9368212e08913461bb511e35b46627" ], "author": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sat Aug 01 16:08:49 2020 +0900" }, "committer": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sat Aug 01 20:54:39 2020 +0900" }, "message": "Revert \"kconfig: qconf: don\u0027t show goback button on splitMode\"\n\nThis reverts commit cc1c08edccaf5317d99a17a3231fe06381044e83.\n\nMaxim Levitsky reports \u0027make xconfig\u0027 crashes since that commit\n(https://lkml.org/lkml/2020/7/18/411)\n\nOr, the following is simple test code that makes it crash:\n\n menu \"Menu\"\n\n config FOO\n bool \"foo\"\n default y\n\n menuconfig BAR\n bool \"bar\"\n depends on FOO\n\n endmenu\n\nSelect the Split View mode, and double-click \"bar\" in the right\nwindow, then you will see Segmentation fault.\n\nWhen \u0027last\u0027 is not set for symbolMode, the following code in\nConfigList::updateList() calls firstChild().\n\n item \u003d last ? last-\u003enextSibling() : firstChild();\n\nHowever, the pointer returned by ConfigList::firstChild() does not\nseem to be compatible with (ConfigItem *), which seems another bug.\n\nI\u0027d rather want to reconsider whether hiding the goback icon is the\nright thing to do.\n\nIn the following test code, the Split View shows \"Menu2\" and \"Menu3\"\nin the right window. You can descend into \"Menu3\", but there is no way\nto ascend back to \"Menu2\" from \"Menu3\".\n\n menu \"Menu1\"\n\n config FOO\n bool \"foo\"\n default y\n\n menu \"Menu2\"\n depends on FOO\n\n menu \"Menu3\"\n\n config BAZ\n bool \"baz\"\n\n endmenu\n\n endmenu\n\n endmenu\n\nIt is true that the goback button is currently not functional due to\nyet another bug, but hiding the problem is not the right way to go.\n\nAnyway, Segmentation fault is fatal. Revert the offending commit for\nnow, and we should find the right solution.\n\nReported-by: Maxim Levitsky \u003cmlevitsk@redhat.com\u003e\nSigned-off-by: Masahiro Yamada \u003cmasahiroy@kernel.org\u003e\n" }, { "commit": "97bebbcd8b9368212e08913461bb511e35b46627", "tree": "f113179717ea39bb7a219b90d141de3b742e461e", "parents": [ "ce02397f44e9ad36b14a29f3eeef252a6a8575c4" ], "author": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Thu Jul 30 02:46:17 2020 +0900" }, "committer": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sat Aug 01 20:54:39 2020 +0900" }, "message": "Revert \"kconfig: qconf: Change title for the item window\"\n\nThis reverts commit 5752ff07fd90d764d96e3c586cc95c09598abfdd.\n\nIt added dead code to ConfigList:ConfigList().\n\nThe constructor of ConfigList has the initializer, mode(singleMode).\n\n if (mode \u003d\u003d symbolMode)\n setHeaderLabels(QStringList() \u003c\u003c \"Item\" \u003c\u003c \"Name\" \u003c\u003c \"N\" \u003c\u003c \"M\" \u003c\u003c \"Y\" \u003c\u003c \"Value\");\n else\n setHeaderLabels(QStringList() \u003c\u003c \"Option\" \u003c\u003c \"Name\" \u003c\u003c \"N\" \u003c\u003c \"M\" \u003c\u003c \"Y\" \u003c\u003c \"Value\");\n\n... always takes the else part.\n\nThe change to ConfigList::updateSelection() is strange too.\nWhen you click the split view icon for the first time, the titles in\nboth windows show \"Option\". After you click something in the right\nwindow, the title suddenly changes to \"Item\".\n\nConfigList::updateSelection() is not the right place to do this,\nat least. It was not a good idea, I think.\n\nSigned-off-by: Masahiro Yamada \u003cmasahiroy@kernel.org\u003e\n" }, { "commit": "ce02397f44e9ad36b14a29f3eeef252a6a8575c4", "tree": "2616286b3dd6cbbe5143b3d735f51fae584b74dd", "parents": [ "c9b09a9249e6db802013c37a24af1fe45824cd3a" ], "author": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Thu Jul 30 02:12:40 2020 +0900" }, "committer": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sat Aug 01 20:54:39 2020 +0900" }, "message": "kconfig: qconf: remove \"goBack\" debug message\n\nEvery time the goback icon is clicked, the annoying message \"goBack\"\nis displayed on the console.\n\nI guess this line is the left-over debug code of commit af737b4defe1\n(\"kconfig: qconf: simplify the goBack() logic\").\n\nSigned-off-by: Masahiro Yamada \u003cmasahiroy@kernel.org\u003e\n" }, { "commit": "c9b09a9249e6db802013c37a24af1fe45824cd3a", "tree": "6369277764d776835409ff4e7def61de12a6c650", "parents": [ "0e912c03208075b95ea726076bf1b45db8419bc2" ], "author": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Thu Jul 30 02:02:39 2020 +0900" }, "committer": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sat Aug 01 20:54:39 2020 +0900" }, "message": "kconfig: qconf: use delete[] instead of delete to free array\n\ncppcheck reports \"Mismatching allocation and deallocation\".\n\n$ cppcheck scripts/kconfig/qconf.cc\nChecking scripts/kconfig/qconf.cc ...\nscripts/kconfig/qconf.cc:1242:10: error: Mismatching allocation and deallocation: data [mismatchAllocDealloc]\n delete data;\n ^\nscripts/kconfig/qconf.cc:1236:15: note: Mismatching allocation and deallocation: data\n char *data \u003d new char[count + 1];\n ^\nscripts/kconfig/qconf.cc:1242:10: note: Mismatching allocation and deallocation: data\n delete data;\n ^\nscripts/kconfig/qconf.cc:1255:10: error: Mismatching allocation and deallocation: data [mismatchAllocDealloc]\n delete data;\n ^\nscripts/kconfig/qconf.cc:1236:15: note: Mismatching allocation and deallocation: data\n char *data \u003d new char[count + 1];\n ^\nscripts/kconfig/qconf.cc:1255:10: note: Mismatching allocation and deallocation: data\n delete data;\n ^\n\nFixes: c4f7398bee9c (\"kconfig: qconf: make debug links work again\")\nReported-by: David Binderman \u003cdcb314@hotmail.com\u003e\nSigned-off-by: Masahiro Yamada \u003cmasahiroy@kernel.org\u003e\n" }, { "commit": "0e912c03208075b95ea726076bf1b45db8419bc2", "tree": "5c3dcf854004a244aafe3abe49714f19620d48ec", "parents": [ "c3cd7cfad51ab521bf4c3edd050f3dcf275e9ee8" ], "author": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Thu Jul 30 02:02:38 2020 +0900" }, "committer": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sat Aug 01 20:54:39 2020 +0900" }, "message": "kconfig: qconf: compile moc object separately\n\nCurrently, qconf.moc is included from qconf.cc but they can be compiled\nindependently.\n\nWhen you modify qconf.cc, qconf.moc does not need recompiling.\n\nRename qconf.moc to qconf-moc.cc, and split it out as an independent\ncompilation unit.\n\nSigned-off-by: Masahiro Yamada \u003cmasahiroy@kernel.org\u003e\n" }, { "commit": "c3cd7cfad51ab521bf4c3edd050f3dcf275e9ee8", "tree": "abb0b224ef6bd0e568e408155ac79572f4e88142", "parents": [ "6020db504cece0d93cc31c6f73609ef1304607e2" ], "author": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Thu Jul 30 02:02:37 2020 +0900" }, "committer": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Sat Aug 01 20:54:39 2020 +0900" }, "message": "kconfig: qconf: use if_changed for qconf.moc rule\n\nRegenerate qconf.moc when the moc command is changed.\n\nThis also allows \u0027make mrproper\u0027 to clean it up. Previously, it was\nnot cleaned up because \u0027clean-files +\u003d qconf.moc\u0027 was missing.\nNow \u0027make mrproper\u0027 correctly cleans it up because files listed in\n\u0027targets\u0027 are cleaned.\n\nSigned-off-by: Masahiro Yamada \u003cmasahiroy@kernel.org\u003e\n" }, { "commit": "69138b34a7248d2396ab85c8652e20c0c39beaba", "tree": "5bf07d6e0376efc134983bef3719eeb7fa03c4e4", "parents": [ "8d46215a1ff37b83e80e573563066548fc82084d", "4f010246b4087ab931b060481014ec110e6a8a46" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jul 31 17:19:47 2020 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jul 31 17:19:47 2020 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nDaniel Borkmann says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: bpf 2020-07-31\n\nThe following pull-request contains BPF updates for your *net* tree.\n\nWe\u0027ve added 5 non-merge commits during the last 21 day(s) which contain\na total of 5 files changed, 126 insertions(+), 18 deletions(-).\n\nThe main changes are:\n\n1) Fix a map element leak in HASH_OF_MAPS map type, from Andrii Nakryiko.\n\n2) Fix a NULL pointer dereference in __btf_resolve_helper_id() when no\n btf_vmlinux is available, from Peilin Ye.\n\n3) Init pos variable in __bpfilter_process_sockopt(), from Christoph Hellwig.\n\n4) Fix a cgroup sockopt verifier test by specifying expected attach type,\n from Jean-Philippe Brucker.\n\nNote that when net gets merged into net-next later on, there is a small\nmerge conflict in kernel/bpf/btf.c between commit 5b801dfb7feb (\"bpf: Fix\nNULL pointer dereference in __btf_resolve_helper_id()\") from the bpf tree\nand commit 138b9a0511c7 (\"bpf: Remove btf_id helpers resolving\") from the\nnet-next tree.\n\nResolve as follows: remove the old hunk with the __btf_resolve_helper_id()\nfunction. Change the btf_resolve_helper_id() so it actually tests for a\nNULL btf_vmlinux and bails out:\n\nint btf_resolve_helper_id(struct bpf_verifier_log *log,\n const struct bpf_func_proto *fn, int arg)\n{\n int id;\n\n if (fn-\u003earg_type[arg] !\u003d ARG_PTR_TO_BTF_ID || !btf_vmlinux)\n return -EINVAL;\n id \u003d fn-\u003ebtf_id[arg];\n if (!id || id \u003e btf_vmlinux-\u003enr_types)\n return -EINVAL;\n return id;\n}\n\nLet me know if you run into any others issues (CC\u0027ing Jiri Olsa so he\u0027s in\nthe loop with regards to merge conflict resolution).\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8d46215a1ff37b83e80e573563066548fc82084d", "tree": "7b94ac7a2938bcf7155d0dd70a7c9cedf0ab234c", "parents": [ "e535d87d8b4f85fe1659aa38c8fb75226b56eec5", "71b59bf482b2dd662774f34108c5b904efa9e02b" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jul 31 17:10:53 2020 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jul 31 17:10:53 2020 -0700" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2020-07-31\n\n1) Fix policy matching with mark and mask on userspace interfaces.\n From Xin Long.\n\n2) Several fixes for the new ESP in TCP encapsulation.\n From Sabrina Dubroca.\n\n3) Fix crash when the hold queue is used. The assumption that\n xdst-\u003epath and dst-\u003echild are not a NULL pointer only if dst-\u003exfrm\n is not a NULL pointer is true with the exception of using the\n hold queue. Fix this by checking for hold queue usage before\n dereferencing xdst-\u003epath or dst-\u003echild.\n\n4) Validate pfkey_dump parameter before sending them.\n From Mark Salyzyn.\n\n5) Fix the location of the transport header with ESP in UDPv6\n encapsulation. From Sabrina Dubroca.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e535d87d8b4f85fe1659aa38c8fb75226b56eec5", "tree": "f1aa5f4c78806b559c9221855a698b5051dd73c1", "parents": [ "bbc8a99e952226c585ac17477a85ef1194501762", "e692139e6af339a1495ef401b2d95f7f9d1c7a44" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jul 31 17:05:54 2020 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jul 31 17:05:54 2020 -0700" }, "message": "Merge tag \u0027mlx5-fixes-2020-07-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux\n\nSaeed Mahameed says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMellanox, mlx5 fixes 2020-07-30\n\nThis small patchset introduces some fixes to mlx5 driver.\n\nPlease pull and let me know if there is any problem.\n\nFor -stable v4.18:\n (\u0027net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq\u0027)\n\nFor -stable v5.7:\n (\u0027net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring\u0027)\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "bbc8a99e952226c585ac17477a85ef1194501762", "tree": "6e62fbfef1f8f51b488c3be4af8599b48f2cfefc", "parents": [ "dc096288d579c82efbf6f82a5d895fed6e41e5a6" ], "author": { "name": "Peilin Ye", "email": "yepeilin.cs@gmail.com", "time": "Thu Jul 30 15:20:26 2020 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jul 31 16:52:48 2020 -0700" }, "message": "rds: Prevent kernel-infoleak in rds_notify_queue_get()\n\nrds_notify_queue_get() is potentially copying uninitialized kernel stack\nmemory to userspace since the compiler may leave a 4-byte hole at the end\nof `cmsg`.\n\nIn 2016 we tried to fix this issue by doing `\u003d { 0 };` on `cmsg`, which\nunfortunately does not always initialize that 4-byte hole. Fix it by using\nmemset() instead.\n\nCc: stable@vger.kernel.org\nFixes: f037590fff30 (\"rds: fix a leak of kernel memory\")\nFixes: bdbe6fbc6a2f (\"RDS: recv.c\")\nSuggested-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Peilin Ye \u003cyepeilin.cs@gmail.com\u003e\nAcked-by: Santosh Shilimkar \u003csantosh.shilimkar@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "dc096288d579c82efbf6f82a5d895fed6e41e5a6", "tree": "243e841a540feffb3d8b07b76513db2a923c1961", "parents": [ "8c5c51f5cac676e9065cb6de9feaa3a16a462675", "024a8168b749db7a4aa40a5fbdfa04bf7e77c1c0" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jul 31 16:51:58 2020 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jul 31 16:51:58 2020 -0700" }, "message": "Merge branch \u00271GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2020-07-30\n\nThis series contains updates to the e1000e and igb drivers.\n\nAaron Ma allows PHY initialization to continue if ULP disable failed for\ne1000e.\n\nFrancesco Ruggeri fixes race conditions in igb reset that could cause panics.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8c5c51f5cac676e9065cb6de9feaa3a16a462675", "tree": "b26941890ccb5884ddda04d37e26b64f0ae62e50", "parents": [ "d0c3c75d5d8911b0e92e48ce79b827ad869d5c93" ], "author": { "name": "liujian", "email": "liujian56@huawei.com", "time": "Thu Jul 30 16:14:28 2020 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jul 31 16:35:39 2020 -0700" }, "message": "net/sched: The error lable position is corrected in ct_init_module\n\nExchange the positions of the err_tbl_init and err_register labels in\nct_init_module function.\n\nFixes: c34b961a2492 (\"net/sched: act_ct: Create nf flow table per zone\")\nSigned-off-by: liujian \u003cliujian56@huawei.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7dc6fd0f3b8404542718039f5de19fe56e474578", "tree": "f97b54bdb21ffa69e1fe8f4c049f762ada6cc479", "parents": [ "deacdb3e3979979016fcd0ffd518c320a62ad166", "8808981baf96e1b3dea1f08461e4d958aa0dbde1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 12:50:54 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 12:50:54 2020 -0700" }, "message": "Merge branch \u0027i2c/for-current\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"Some I2C core improvements to prevent NULL pointer usage and a\n MAINTAINERS update\"\n\n* \u0027i2c/for-current\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: slave: add sanity check when unregistering\n i2c: slave: improve sanity check when registering\n MAINTAINERS: Update GENI I2C maintainers list\n i2c: also convert placeholder function to return errno\n" }, { "commit": "deacdb3e3979979016fcd0ffd518c320a62ad166", "tree": "963f252cf86dd1163d8df4b241d8b539df23e82d", "parents": [ "14aab7eeb9f0b9c424aab0f07eb82b1baf2e5bbd", "909adfc66b9a1db21b5e8733e9ebfa6cd5135d74" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 09:38:39 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 09:38:39 2020 -0700" }, "message": "Merge tag \u0027powerpc-5.8-8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fix from Michael Ellerman:\n \"Fix a bug introduced by the changes we made to lockless page table\n walking this cycle.\n\n When using the hash MMU, and perf with callchain recording, we can\n deadlock if the PMI interrupts a hash fault, and the callchain\n recording then takes a hash fault on the same page.\n\n Thanks to Nicholas Piggin, Aneesh Kumar K.V, Anton Blanchard, and\n Athira Rajeev\"\n\n* tag \u0027powerpc-5.8-8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/64s/hash: Fix hash_preload running with interrupts enabled\n" }, { "commit": "14aab7eeb9f0b9c424aab0f07eb82b1baf2e5bbd", "tree": "be629804c8172588aa9402ececd1b866588b5880", "parents": [ "c1954ca6abdc69a02a768368eb31882e92cf5bfa", "6a7389f0312f01bb6641d37b395548a2922a057c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 09:36:03 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 09:36:03 2020 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"The main one is to fix the build after Willy\u0027s per-cpu entropy changes\n this week. Although that was already resolved elsewhere, the arm64 fix\n here is useful cleanup anyway.\n\n Other than that, we\u0027ve got a fix for building with Clang\u0027s integrated\n assembler and a fix to make our IPv4 checksumming robust against\n invalid header lengths (this only seems to be triggerable by injected\n errors).\n\n - Fix build breakage due to circular headers\n\n - Fix build regression when using Clang\u0027s integrated assembler\n\n - Fix IPv4 header checksum code to deal with invalid length field\n\n - Fix broken path for Arm PMU entry in MAINTAINERS\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n MAINTAINERS: Include drivers subdirs for ARM PMU PROFILING AND DEBUGGING entry\n arm64: csum: Fix handling of bad packets\n arm64: Drop unnecessary include from asm/smp.h\n arm64/alternatives: move length validation inside the subsection\n" }, { "commit": "c1954ca6abdc69a02a768368eb31882e92cf5bfa", "tree": "1138c65f49c19b8e45352645a43cdada944bfbd6", "parents": [ "ae2911de2eb5dc9ccb88c6502c776a8fbb7acc67", "5c6360ee4a0e7f62de34341ad5d3c936f49b391d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 09:33:45 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 09:33:45 2020 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm\n\nPull ARM fixes from Russell King:\n\n - avoid invoking overflow handler for uaccess watchpoints\n\n - fix incorrect clock_gettime64 availability\n\n - fix EFI crash in create_mapping_late()\n\n* tag \u0027for-linus\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm:\n ARM: 8988/1: mmu: fix crash in EFI calls due to p4d typo in create_mapping_late()\n ARM: 8987/1: VDSO: Fix incorrect clock_gettime64\n ARM: 8986/1: hw_breakpoint: Don\u0027t invoke overflow handler on uaccess watchpoints\n" }, { "commit": "ae2911de2eb5dc9ccb88c6502c776a8fbb7acc67", "tree": "9d97502145717932e0e00671bd4081e0290a268b", "parents": [ "78431ab723aa6f10258979acf88d9aaac2462cbe", "fb448ce87a4a9482b084e67faf804aec79ed9b43" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 09:22:10 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 09:22:10 2020 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma\n\nPull rdma fixes from Jason Gunthorpe:\n \"Two more merge window regressions, a corruption bug in hfi1 and a few\n other small fixes.\n\n - Missing user input validation regression in ucma\n\n - Disallowing a previously allowed user combination regression in\n mlx5\n\n - ODP prefetch memory leaking triggerable by userspace\n\n - Memory corruption in hf1 due to faulty ring buffer logic\n\n - Missed mutex initialization crash in mlx5\n\n - Two small defects with RDMA DIM\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:\n RDMA/core: Free DIM memory in error unwind\n RDMA/core: Stop DIM before destroying CQ\n RDMA/mlx5: Initialize QP mutex for the debug kernels\n IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE\n RDMA/mlx5: Allow providing extra scatter CQE QP flag\n RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails\n RDMA/cm: Add min length checks to user structure copies\n" }, { "commit": "78431ab723aa6f10258979acf88d9aaac2462cbe", "tree": "67ff189a9e82eb0e9b0bd24821035ca5af7bbba8", "parents": [ "d8b9faec54ae4bc2fff68bcd0befa93ace8256ce", "5649625344fe1f4695eace7c37d011e317bf66d5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 09:17:24 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 31 09:17:24 2020 -0700" }, "message": "Merge tag \u0027sound-5.8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A few wrap-up small fixes for the usual HD-audio and USB-audio stuff:\n\n - A regression fix for S3 suspend on old Intel platforms\n\n - A fix for possible Oops in ASoC HD-audio binding\n\n - Trivial quirks for various devices\"\n\n* tag \u0027sound-5.8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: hda/realtek - Fixed HP right speaker no sound\n ALSA: hda: fix NULL pointer dereference during suspend\n ALSA: hda/hdmi: Fix keep_power assignment for non-component devices\n ALSA: hda: Workaround for spurious wakeups on some Intel platforms\n ALSA: hda/realtek: Fix add a \"ultra_low_power\" function for intel reference board (alc256)\n ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus G14(GA401) series with ALC289\n ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289\n ALSA: usb-audio: Add implicit feedback quirk for SSL2\n" }, { "commit": "39efdd94e314336f4acbac4c07e0f37bdc3bef71", "tree": "76f6abb5719d0b91b8d53b64c9f3aa8c97123d31", "parents": [ "bd3c628f8fafa6cbd6a1ca440034b841f0080160" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Sat Jul 25 02:06:23 2020 +0100" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Fri Jul 31 09:31:55 2020 -0300" }, "message": "libtraceevent: Fix build with binutils 2.35\n\nIn binutils 2.35, \u0027nm -D\u0027 changed to show symbol versions along with\nsymbol names, with the usual @@ separator. When generating\nlibtraceevent-dynamic-list we need just the names, so strip off the\nversion suffix if present.\n\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: linux-trace-devel@vger.kernel.org\nCc: stable@vger.kernel.org\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "bd3c628f8fafa6cbd6a1ca440034b841f0080160", "tree": "1d74bcb2f6251973cf28c39e4a2d6344ecd469f2", "parents": [ "463538a383a27337cb83ae195e432a839a52d639" ], "author": { "name": "Wei Li", "email": "liwei391@huawei.com", "time": "Fri Jul 24 15:11:10 2020 +0800" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Fri Jul 31 09:29:01 2020 -0300" }, "message": "perf tools: Fix record failure when mixed with ARM SPE event\n\nWhen recording with cache-misses and arm_spe_x event, I found that it\nwill just fail without showing any error info if i put cache-misses\nafter \u0027arm_spe_x\u0027 event.\n\n [root@localhost 0620]# perf record -e cache-misses \\\n\t\t\t\t-e arm_spe_0/ts_enable\u003d1,pct_enable\u003d1,pa_enable\u003d1,load_filter\u003d1,jitter\u003d1,store_filter\u003d1,min_latency\u003d0/ sleep 1\n [ perf record: Woken up 1 times to write data ]\n [ perf record: Captured and wrote 0.067 MB perf.data ]\n [root@localhost 0620]#\n [root@localhost 0620]# perf record -e arm_spe_0/ts_enable\u003d1,pct_enable\u003d1,pa_enable\u003d1,load_filter\u003d1,jitter\u003d1,store_filter\u003d1,min_latency\u003d0/ \\\n\t\t\t\t -e cache-misses sleep 1\n [root@localhost 0620]#\n\nThe current code can only work if the only event to be traced is an\n\u0027arm_spe_x\u0027, or if it is the last event to be specified. Otherwise the\nlast event type will be checked against all the arm_spe_pmus[i]-\u003etypes,\nnone will match and an out of bound \u0027i\u0027 index will be used in\narm_spe_recording_init().\n\nWe don\u0027t support concurrent multiple arm_spe_x events currently, that\nis checked in arm_spe_recording_options(), and it will show the relevant\ninfo. So add the check and record of the first found \u0027arm_spe_pmu\u0027 to\nfix this issue here.\n\nFixes: ffd3d18c20b8 (\"perf tools: Add ARM Statistical Profiling Extensions (SPE) support\")\nSigned-off-by: Wei Li \u003cliwei391@huawei.com\u003e\nReviewed-by: Mathieu Poirier \u003cmathieu.poirier@linaro.org\u003e\nTested-by-by: Leo Yan \u003cleo.yan@linaro.org\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Hanjun Guo \u003cguohanjun@huawei.com\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Kim Phillips \u003ckim.phillips@arm.com\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: Mike Leach \u003cmike.leach@linaro.org\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Suzuki Poulouse \u003csuzuki.poulose@arm.com\u003e\nCc: linux-arm-kernel@lists.infradead.org\nLink: http://lore.kernel.org/lkml/20200724071111.35593-2-liwei391@huawei.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "463538a383a27337cb83ae195e432a839a52d639", "tree": "2d8c575903577281417643e746a873c8f1a0eace", "parents": [ "e24c6447ccb7b1a01f9bf0aec94939e6450c0b4d" ], "author": { "name": "Thomas Richter", "email": "tmricht@linux.ibm.com", "time": "Wed Jul 29 15:53:14 2020 +0200" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Fri Jul 31 09:27:32 2020 -0300" }, "message": "perf tests: Fix test 68 zstd compression for s390\n\nCommit 5aa98879efe7 (\"s390/cpum_sf: prohibit callchain data collection\")\nprohibits call graph sampling for hardware events on s390. The\ninformation recorded is out of context and does not match.\n\nOn s390 this commit now breaks test case 68 Zstd perf.data\ncompression/decompression.\n\nTherefore omit call graph sampling on s390 in this test.\n\nOutput before:\n [root@t35lp46 perf]# ./perf test -Fv 68\n 68: Zstd perf.data compression/decompression :\n --- start ---\n Collecting compressed record file:\n Error:\n cycles: PMU Hardware doesn\u0027t support sampling/overflow-interrupts.\n Try \u0027perf stat\u0027\n ---- end ----\n Zstd perf.data compression/decompression: FAILED!\n [root@t35lp46 perf]#\n\nOutput after:\n[root@t35lp46 perf]# ./perf test -Fv 68\n 68: Zstd perf.data compression/decompression :\n --- start ---\n Collecting compressed record file:\n 500+0 records in\n 500+0 records out\n 256000 bytes (256 kB, 250 KiB) copied, 0.00615638 s, 41.6 MB/s\n [ perf record: Woken up 1 times to write data ]\n [ perf record: Captured and wrote 0.004 MB /tmp/perf.data.X3M,\n compressed (original 0.002 MB, ratio is 3.609) ]\n Checking compressed events stats:\n # compressed : Zstd, level \u003d 1, ratio \u003d 4\n COMPRESSED events: 1\n 2ELIFREPh---- end ----\n Zstd perf.data compression/decompression: Ok\n [root@t35lp46 perf]#\n\nSigned-off-by: Thomas Richter \u003ctmricht@linux.ibm.com\u003e\nReviewed-by: Sumanth Korikkar \u003csumanthk@linux.ibm.com\u003e\nCc: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nCc: Sven Schnelle \u003csvens@linux.ibm.com\u003e\nCc: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nLink: http://lore.kernel.org/lkml/20200729135314.91281-1-tmricht@linux.ibm.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "e24c6447ccb7b1a01f9bf0aec94939e6450c0b4d", "tree": "68f7c683e225a59a745211a84e6091de4b909b70", "parents": [ "d8b9faec54ae4bc2fff68bcd0befa93ace8256ce" ], "author": { "name": "Philippe Duplessis-Guindon", "email": "pduplessis@efficios.com", "time": "Thu Jul 30 11:02:36 2020 -0400" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Fri Jul 31 09:23:13 2020 -0300" }, "message": "tools lib traceevent: Fix memory leak in process_dynamic_array_len\n\nI compiled with AddressSanitizer and I had these memory leaks while I\nwas using the tep_parse_format function:\n\n Direct leak of 28 byte(s) in 4 object(s) allocated from:\n #0 0x7fb07db49ffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)\n #1 0x7fb07a724228 in extend_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:985\n #2 0x7fb07a724c21 in __read_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1140\n #3 0x7fb07a724f78 in read_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1206\n #4 0x7fb07a725191 in __read_expect_type /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1291\n #5 0x7fb07a7251df in read_expect_type /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1299\n #6 0x7fb07a72e6c8 in process_dynamic_array_len /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:2849\n #7 0x7fb07a7304b8 in process_function /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3161\n #8 0x7fb07a730900 in process_arg_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3207\n #9 0x7fb07a727c0b in process_arg /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1786\n #10 0x7fb07a731080 in event_read_print_args /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3285\n #11 0x7fb07a731722 in event_read_print /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3369\n #12 0x7fb07a740054 in __tep_parse_format /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6335\n #13 0x7fb07a74047a in __parse_event /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6389\n #14 0x7fb07a740536 in tep_parse_format /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6431\n #15 0x7fb07a785acf in parse_event ../../../src/fs-src/fs.c:251\n #16 0x7fb07a785ccd in parse_systems ../../../src/fs-src/fs.c:284\n #17 0x7fb07a786fb3 in read_metadata ../../../src/fs-src/fs.c:593\n #18 0x7fb07a78760e in ftrace_fs_source_init ../../../src/fs-src/fs.c:727\n #19 0x7fb07d90c19c in add_component_with_init_method_data ../../../../src/lib/graph/graph.c:1048\n #20 0x7fb07d90c87b in add_source_component_with_initialize_method_data ../../../../src/lib/graph/graph.c:1127\n #21 0x7fb07d90c92a in bt_graph_add_source_component ../../../../src/lib/graph/graph.c:1152\n #22 0x55db11aa632e in cmd_run_ctx_create_components_from_config_components ../../../src/cli/babeltrace2.c:2252\n #23 0x55db11aa6fda in cmd_run_ctx_create_components ../../../src/cli/babeltrace2.c:2347\n #24 0x55db11aa780c in cmd_run ../../../src/cli/babeltrace2.c:2461\n #25 0x55db11aa8a7d in main ../../../src/cli/babeltrace2.c:2673\n #26 0x7fb07d5460b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)\n\nThe token variable in the process_dynamic_array_len function is\nallocated in the read_expect_type function, but is not freed before\ncalling the read_token function.\n\nFree the token variable before calling read_token in order to plug the\nleak.\n\nSigned-off-by: Philippe Duplessis-Guindon \u003cpduplessis@efficios.com\u003e\nReviewed-by: Steven Rostedt (VMware) \u003crostedt@goodmis.org\u003e\nLink: https://lore.kernel.org/linux-trace-devel/20200730150236.5392-1-pduplessis@efficios.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "830f01b089b12bbe93bd55f2d62837253012a30e", "tree": "48d121bf78b7dfa495a3efc9797479f8cb11a82d", "parents": [ "d2286ba7d574ba3103a421a2f9ec17cb5b0d87a1" ], "author": { "name": "Wanpeng Li", "email": "wanpengli@tencent.com", "time": "Fri Jul 31 11:12:21 2020 +0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Jul 31 03:20:32 2020 -0400" }, "message": "KVM: SVM: Fix disable pause loop exit/pause filtering capability on SVM\n\n\u0027Commit 8566ac8b8e7c (\"KVM: SVM: Implement pause loop exit logic in SVM\")\u0027\ndrops disable pause loop exit/pause filtering capability completely, I\nguess it is a merge fault by Radim since disable vmexits capabilities and\npause loop exit for SVM patchsets are merged at the same time. This patch\nreintroduces the disable pause loop exit/pause filtering capability support.\n\nReported-by: Haiwei Li \u003clihaiwei@tencent.com\u003e\nTested-by: Haiwei Li \u003clihaiwei@tencent.com\u003e\nFixes: 8566ac8b (\"KVM: SVM: Implement pause loop exit logic in SVM\")\nSigned-off-by: Wanpeng Li \u003cwanpengli@tencent.com\u003e\nMessage-Id: \u003c1596165141-28874-3-git-send-email-wanpengli@tencent.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "d2286ba7d574ba3103a421a2f9ec17cb5b0d87a1", "tree": "d32d8f9ff743ae542cbb7d527b9115bd2cea99af", "parents": [ "d741dcae5562259841bd2211a0bd7e6c0f909f1e" ], "author": { "name": "Wanpeng Li", "email": "wanpengli@tencent.com", "time": "Fri Jul 31 11:12:19 2020 +0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Jul 31 03:20:15 2020 -0400" }, "message": "KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled\n\nPrevent setting the tscdeadline timer if the lapic is hw disabled.\n\nFixes: bce87cce88 (KVM: x86: consolidate different ways to test for in-kernel LAPIC)\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Wanpeng Li \u003cwanpengli@tencent.com\u003e\nMessage-Id: \u003c1596165141-28874-1-git-send-email-wanpengli@tencent.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "d8b9faec54ae4bc2fff68bcd0befa93ace8256ce", "tree": "fe3c9f5ecf0c2e105d236f1257edbc3df536d74d", "parents": [ "a2ec905d1e160a33b2e210e45ad30445ef26ce0e", "887c909dd5d557c203a233ebbe238c18438a680a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 21:26:42 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 21:26:42 2020 -0700" }, "message": "Merge tag \u0027drm-fixes-2020-07-31\u0027 of git://anongit.freedesktop.org/drm/drm\n\nPull more drm fixes from Dave Airlie:\n \"As mentioned previously this contains the nouveau regression fix.\n\n amdgpu had three fixes outstanding as well, one revert, an info leak\n and use after free. The use after free is a bit trickier than I\u0027d\n like, and I\u0027ve personally gone over it to confirm I\u0027m happy that it is\n doing what it says.\n\n nouveau:\n - final modifiers regression fix\n\n amdgpu:\n - Revert a fix which caused other regressions\n - Fix potential kernel info leak\n - Fix a use-after-free bug that was uncovered by another change in 5.7\"\n\n* tag \u0027drm-fixes-2020-07-31\u0027 of git://anongit.freedesktop.org/drm/drm:\n drm/nouveau: Accept \u0027legacy\u0027 format modifiers\n Revert \"drm/amdgpu: Fix NULL dereference in dpm sysfs handlers\"\n drm/amd/display: Clear dm_state for fast updates\n drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()\n" }, { "commit": "887c909dd5d557c203a233ebbe238c18438a680a", "tree": "0038667b3959037fdc53bcc06f7879c91109fca2", "parents": [ "faa0fcf943d2d53992b3c73752df9a0547cb4797", "87004abfbc27261edd15716515d89ab42198b405" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 31 13:04:00 2020 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 31 13:04:00 2020 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-5.8-2020-07-30\u0027 of git://people.freedesktop.org/~agd5f/linux into drm-fixes\n\namd-drm-fixes-5.8-2020-07-30:\n\namdgpu:\n- Revert a fix which caused other regressions\n- Fix potential kernel info leak\n- Fix a use-after-free bug that was uncovered by another change in 5.7\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Alex Deucher \u003calexdeucher@gmail.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20200730154338.244104-1-alexander.deucher@amd.com\n" }, { "commit": "faa0fcf943d2d53992b3c73752df9a0547cb4797", "tree": "dbdd64149678a113919012c59bcddda8d04b9add", "parents": [ "a4a2739beb8933a19281bca077fdb852598803ed" ], "author": { "name": "James Jones", "email": "jajones@nvidia.com", "time": "Thu Jul 30 16:58:23 2020 -0700" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 31 12:24:51 2020 +1000" }, "message": "drm/nouveau: Accept \u0027legacy\u0027 format modifiers\n\nAccept the DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK()\nfamily of modifiers to handle broken userspace\nXorg modesetting and Mesa drivers. Existing Mesa\ndrivers are still aware of only these older\nformat modifiers which do not differentiate\nbetween different variations of the block linear\nlayout. When the format modifier support flag was\nflipped in the nouveau kernel driver, the X.org\nmodesetting driver began attempting to use its\nformat modifier-enabled framebuffer path. Because\nthe set of format modifiers advertised by the\nkernel prior to this change do not intersect with\nthe set of format modifiers advertised by Mesa,\nallocating GBM buffers using format modifiers\nfails and the modesetting driver falls back to\nnon-modifier allocation. However, it still later\nqueries the modifier of the GBM buffer when\ncreating its DRM-KMS framebuffer object, receives\nthe old-format modifier from Mesa, and attempts\nto create a framebuffer with it. Since the kernel\nis still not aware of these formats, this fails.\n\nUserspace should not be attempting to query format\nmodifiers of GBM buffers allocated with a non-\nformat-modifier-aware allocation path, but to\navoid breaking existing userspace behavior, this\nchange accepts the old-style format modifiers when\ncreating framebuffers and applying them to planes\nby translating them to the equivalent new-style\nmodifier. To accomplish this, some layout\nparameters must be assumed to match properties of\nthe device targeted by the relevant ioctls. To\navoid perpetuating misuse of the old-style\nmodifiers, this change does not advertise support\nfor them. Doing so would imply compatibility\nbetween devices with incompatible memory layouts.\n\nTested with Xorg 1.20 modesetting driver,\nweston@c46c70dac84a4b3030cd05b380f9f410536690fc,\ngnome \u0026 KDE wayland desktops from Ubuntu 18.04,\nand sway 1.5\n\nReported-by: Kirill A. Shutemov \u003ckirill@shutemov.name\u003e\nFixes: fa4f4c213f5f (\"drm/nouveau/kms: Support NVIDIA format modifiers\")\nLink: https://lkml.org/lkml/2020/6/30/1251\nSigned-off-by: James Jones \u003cjajones@nvidia.com\u003e\nAcked-by: Ben Skeggs \u003cbskeggs@redhat.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n" }, { "commit": "e692139e6af339a1495ef401b2d95f7f9d1c7a44", "tree": "6f6da114c96b9222e23777edb4034de0407d3a81", "parents": [ "6f7bbad18e8343da6318654f408dea0ccd6efb00" ], "author": { "name": "Xin Xiong", "email": "xiongx18@fudan.edu.cn", "time": "Thu Jul 30 18:29:41 2020 +0800" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@mellanox.com", "time": "Thu Jul 30 18:53:55 2020 -0700" }, "message": "net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq\n\nThe function invokes bpf_prog_inc(), which increases the reference\ncount of a bpf_prog object \"rq-\u003exdp_prog\" if the object isn\u0027t NULL.\n\nThe refcount leak issues take place in two error handling paths. When\neither mlx5_wq_ll_create() or mlx5_wq_cyc_create() fails, the function\nsimply returns the error code and forgets to drop the reference count\nincreased earlier, causing a reference count leak of \"rq-\u003exdp_prog\".\n\nFix this issue by jumping to the error handling path err_rq_wq_destroy\nwhile either function fails.\n\nFixes: 422d4c401edd (\"net/mlx5e: RX, Split WQ objects for different RQ types\")\nSigned-off-by: Xin Xiong \u003cxiongx18@fudan.edu.cn\u003e\nSigned-off-by: Xiyu Yang \u003cxiyuyang19@fudan.edu.cn\u003e\nSigned-off-by: Xin Tan \u003ctanxin.ctf@gmail.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\n" }, { "commit": "6f7bbad18e8343da6318654f408dea0ccd6efb00", "tree": "c7ca5617fb33dba2eca388186b44f3abd642d6fc", "parents": [ "0faddfe6b7953e224a1283f89f671ef6a9ba73de" ], "author": { "name": "Jianbo Liu", "email": "jianbol@mellanox.com", "time": "Fri Jul 03 02:34:23 2020 +0000" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@mellanox.com", "time": "Thu Jul 30 18:53:53 2020 -0700" }, "message": "net/mlx5e: E-Switch, Specify flow_source for rule with no in_port\n\nThe flow_source must be specified, even for rule without matching\nsource vport, because some actions are only allowed in uplink.\nOtherwise, rule can\u0027t be offloaded and firmware syndrome happens.\n\nFixes: 6fb0701a9cfa (\"net/mlx5: E-Switch, Add support for offloading rules with no in_port\")\nSigned-off-by: Jianbo Liu \u003cjianbol@mellanox.com\u003e\nReviewed-by: Chris Mi \u003cchrism@mellanox.com\u003e\nReviewed-by: Roi Dayan \u003croid@mellanox.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\n" }, { "commit": "0faddfe6b7953e224a1283f89f671ef6a9ba73de", "tree": "d4b29e24b4d27ad41c59d0031b0f4b3a2009add5", "parents": [ "01cefbbe2c51fa94d4221ca63d236907c5e19fe3" ], "author": { "name": "Jianbo Liu", "email": "jianbol@mellanox.com", "time": "Thu Jul 02 01:06:37 2020 +0000" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@mellanox.com", "time": "Thu Jul 30 18:53:50 2020 -0700" }, "message": "net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring\n\nThe modified flow_context fields in FTE must be indicated in\nmodify_enable bitmask. Previously, the misc bit in modify_enable is\nalways set as source vport must be set for each rule. So, when parsing\nvxlan/gre/geneve/qinq rules, this bit is not set because those are all\nfrom the same misc fileds that source vport fields are located at, and\nwe don\u0027t need to set the indicator twice.\n\nAfter adding per vport tables for mirroring, misc bit is not set, then\nfirmware syndrome happens. To fix it, set the bit wherever misc fileds\nare changed. This also makes it unnecessary to check misc fields and set\nthe misc bit accordingly in metadata matching, so here remove it.\n\nBesides, flow_source must be specified for uplink because firmware\nwill check it and some actions are only allowed for packets received\nfrom uplink.\n\nFixes: 96e326878fa5 (\"net/mlx5e: Eswitch, Use per vport tables for mirroring\")\nSigned-off-by: Jianbo Liu \u003cjianbol@mellanox.com\u003e\nReviewed-by: Chris Mi \u003cchrism@mellanox.com\u003e\nReviewed-by: Roi Dayan \u003croid@mellanox.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\n" }, { "commit": "01cefbbe2c51fa94d4221ca63d236907c5e19fe3", "tree": "33965545d965cd60fd600b145c68958466c697fa", "parents": [ "85496a29224188051b6135eb38da8afd4c584765" ], "author": { "name": "Jianbo Liu", "email": "jianbol@mellanox.com", "time": "Mon Jul 20 01:36:45 2020 +0000" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@mellanox.com", "time": "Thu Jul 30 18:53:47 2020 -0700" }, "message": "net/mlx5e: CT: Support restore ipv6 tunnel\n\nCurrently the driver restores only IPv4 tunnel headers.\nAdd support for restoring IPv6 tunnel header.\n\nFixes: b8ce90370977 (\"net/mlx5e: Restore tunnel metadata on miss\")\nSigned-off-by: Jianbo Liu \u003cjianbol@mellanox.com\u003e\nReviewed-by: Roi Dayan \u003croid@mellanox.com\u003e\nReviewed-by: Oz Shlomo \u003cozsh@mellanox.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\n" }, { "commit": "d0c3c75d5d8911b0e92e48ce79b827ad869d5c93", "tree": "4c4eb2947cd7a46d929640cffa5b553b205c19e7", "parents": [ "85496a29224188051b6135eb38da8afd4c584765", "04e35caa32ec9aae6b306d07f07dc2ee6d69166c" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 17:47:34 2020 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 17:47:34 2020 -0700" }, "message": "Merge tag \u0027mac80211-for-davem-2020-07-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nA couple of more changes:\n * remove a warning that can trigger in certain races\n * check a function pointer before using it\n * check before adding 6 GHz to avoid a warning in mesh\n * fix two memory leaks in mesh\n * fix a TX status bug leading to a memory leak\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "85496a29224188051b6135eb38da8afd4c584765", "tree": "dd76c3d2809eaa8ca3be4316060ddb159821cd0f", "parents": [ "59929fbb45e06da7d501d3a97f10a91912181f7c" ], "author": { "name": "Wang Hai", "email": "wanghai38@huawei.com", "time": "Thu Jul 30 15:30:00 2020 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 17:45:13 2020 -0700" }, "message": "net: gemini: Fix missing clk_disable_unprepare() in error path of gemini_ethernet_port_probe()\n\nFix the missing clk_disable_unprepare() before return\nfrom gemini_ethernet_port_probe() in the error handling case.\n\nFixes: 4d5ae32f5e1e (\"net: ethernet: Add a driver for Gemini gigabit ethernet\")\nReported-by: Hulk Robot \u003chulkci@huawei.com\u003e\nSigned-off-by: Wang Hai \u003cwanghai38@huawei.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "59929fbb45e06da7d501d3a97f10a91912181f7c", "tree": "c1b549fc1ea0c7697b76aaa16b6fc9e0ae1e9de8", "parents": [ "51875dad43b44241b46a569493f1e4bfa0386d86" ], "author": { "name": "Shannon Nelson", "email": "snelson@pensando.io", "time": "Wed Jul 29 10:52:17 2020 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 17:37:16 2020 -0700" }, "message": "ionic: unlock queue mutex in error path\n\nOn an error return, jump to the unlock at the end to be sure\nto unlock the queue_lock mutex.\n\nFixes: 0925e9db4dc8 (\"ionic: use mutex to protect queue operations\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nReported-by: Julia Lawall \u003cjulia.lawall@lip6.fr\u003e\nSigned-off-by: Shannon Nelson \u003csnelson@pensando.io\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "51875dad43b44241b46a569493f1e4bfa0386d86", "tree": "31e2041f798d1a07bc34de829316aac83526cc41", "parents": [ "555a893303872e044fb86f0a5834ce78d41ad2e2" ], "author": { "name": "Xin Xiong", "email": "xiongx18@fudan.edu.cn", "time": "Wed Jul 29 21:06:59 2020 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 17:35:53 2020 -0700" }, "message": "atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent\n\natmtcp_remove_persistent() invokes atm_dev_lookup(), which returns a\nreference of atm_dev with increased refcount or NULL if fails.\n\nThe refcount leaks issues occur in two error handling paths. If\ndev_data-\u003epersist is zero or PRIV(dev)-\u003evcc isn\u0027t NULL, the function\nreturns 0 without decreasing the refcount kept by a local variable,\nresulting in refcount leaks.\n\nFix the issue by adding atm_dev_put() before returning 0 both when\ndev_data-\u003epersist is zero or PRIV(dev)-\u003evcc isn\u0027t NULL.\n\nSigned-off-by: Xin Xiong \u003cxiongx18@fudan.edu.cn\u003e\nSigned-off-by: Xiyu Yang \u003cxiyuyang19@fudan.edu.cn\u003e\nSigned-off-by: Xin Tan \u003ctanxin.ctf@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "555a893303872e044fb86f0a5834ce78d41ad2e2", "tree": "750fec0aaec40ea3c08897797f1917b6ea9abfbc", "parents": [ "366228ed01f6882cc203e3d5b40010dfae0be1c3" ], "author": { "name": "Landen Chao", "email": "landen.chao@mediatek.com", "time": "Wed Jul 29 10:15:17 2020 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 16:56:30 2020 -0700" }, "message": "net: ethernet: mtk_eth_soc: fix MTU warnings\n\nin recent kernel versions there are warnings about incorrect MTU size\nlike these:\n\neth0: mtu greater than device maximum\nmtk_soc_eth 1b100000.ethernet eth0: error -22 setting MTU to include DSA overhead\n\nFixes: bfcb813203e6 (\"net: dsa: configure the MTU for switch ports\")\nFixes: 72579e14a1d3 (\"net: dsa: don\u0027t fail to probe if we couldn\u0027t set the MTU\")\nFixes: 7a4c53bee332 (\"net: report invalid mtu value via netlink extack\")\nSigned-off-by: Landen Chao \u003clanden.chao@mediatek.com\u003e\nSigned-off-by: Frank Wunderlich \u003cfrank-w@public-files.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "366228ed01f6882cc203e3d5b40010dfae0be1c3", "tree": "f41f4ea9d59f4373389670359cc35a3720306855", "parents": [ "82274d075536322368ce710b211c41c37c4740b9" ], "author": { "name": "Lu Wei", "email": "luwei32@huawei.com", "time": "Wed Jul 29 11:50:05 2020 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 16:55:39 2020 -0700" }, "message": "net: nixge: fix potential memory leak in nixge_probe()\n\nIf some processes in nixge_probe() fail, free_netdev(dev)\nneeds to be called to aviod a memory leak.\n\nFixes: 87ab207981ec (\"net: nixge: Separate ctrl and dma resources\")\nFixes: abcd3d6fc640 (\"net: nixge: Fix error path for obtaining mac address\")\nReported-by: Hulk Robot \u003chulkci@huawei.com\u003e\nSigned-off-by: Lu Wei \u003cluwei32@huawei.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "82274d075536322368ce710b211c41c37c4740b9", "tree": "45413c09e352562570d5ec21ad37441e117bc3c3", "parents": [ "65550098c1c4db528400c73acf3e46bfa78d9264" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jul 28 16:15:07 2020 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 16:51:53 2020 -0700" }, "message": "devlink: ignore -EOPNOTSUPP errors on dumpit\n\nNumber of .dumpit functions try to ignore -EOPNOTSUPP errors.\nRecent change missed that, and started reporting all errors\nbut -EMSGSIZE back from dumps. This leads to situation like\nthis:\n\n$ devlink dev info\ndevlink answers: Operation not supported\n\nDump should not report an error just because the last device\nto be queried could not provide an answer.\n\nTo fix this and avoid similar confusion make sure we clear\nerr properly, and not leave it set to an error if we don\u0027t\nterminate the iteration.\n\nFixes: c62c2cfb801b (\"net: devlink: don\u0027t ignore errors during dumpit\")\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "65550098c1c4db528400c73acf3e46bfa78d9264", "tree": "a2395038071fde9b06e78294920cecfd564484d9", "parents": [ "591eee6d0783d4a0d7f0e7c4effdba9cf6c1e2c5" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Jul 29 00:03:56 2020 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 16:50:20 2020 -0700" }, "message": "rxrpc: Fix race between recvmsg and sendmsg on immediate call failure\n\nThere\u0027s a race between rxrpc_sendmsg setting up a call, but then failing to\nsend anything on it due to an error, and recvmsg() seeing the call\ncompletion occur and trying to return the state to the user.\n\nAn assertion fails in rxrpc_recvmsg() because the call has already been\nreleased from the socket and is about to be released again as recvmsg deals\nwith it. (The recvmsg_q queue on the socket holds a ref, so there\u0027s no\nproblem with use-after-free.)\n\nWe also have to be careful not to end up reporting an error twice, in such\na way that both returns indicate to userspace that the user ID supplied\nwith the call is no longer in use - which could cause the client to\nmalfunction if it recycles the user ID fast enough.\n\nFix this by the following means:\n\n (1) When sendmsg() creates a call after the point that the call has been\n successfully added to the socket, don\u0027t return any errors through\n sendmsg(), but rather complete the call and let recvmsg() retrieve\n them. Make sendmsg() return 0 at this point. Further calls to\n sendmsg() for that call will fail with ESHUTDOWN.\n\n Note that at this point, we haven\u0027t send any packets yet, so the\n server doesn\u0027t yet know about the call.\n\n (2) If sendmsg() returns an error when it was expected to create a new\n call, it means that the user ID wasn\u0027t used.\n\n (3) Mark the call disconnected before marking it completed to prevent an\n oops in rxrpc_release_call().\n\n (4) recvmsg() will then retrieve the error and set MSG_EOR to indicate\n that the user ID is no longer known by the kernel.\n\nAn oops like the following is produced:\n\n\tkernel BUG at net/rxrpc/recvmsg.c:605!\n\t...\n\tRIP: 0010:rxrpc_recvmsg+0x256/0x5ae\n\t...\n\tCall Trace:\n\t ? __init_waitqueue_head+0x2f/0x2f\n\t ____sys_recvmsg+0x8a/0x148\n\t ? import_iovec+0x69/0x9c\n\t ? copy_msghdr_from_user+0x5c/0x86\n\t ___sys_recvmsg+0x72/0xaa\n\t ? __fget_files+0x22/0x57\n\t ? __fget_light+0x46/0x51\n\t ? fdget+0x9/0x1b\n\t do_recvmmsg+0x15e/0x232\n\t ? _raw_spin_unlock+0xa/0xb\n\t ? vtime_delta+0xf/0x25\n\t __x64_sys_recvmmsg+0x2c/0x2f\n\t do_syscall_64+0x4c/0x78\n\t entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFixes: 357f5ef64628 (\"rxrpc: Call rxrpc_release_call() on error in rxrpc_new_client_call()\")\nReported-by: syzbot+b54969381df354936d96@syzkaller.appspotmail.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "591eee6d0783d4a0d7f0e7c4effdba9cf6c1e2c5", "tree": "fe282141c68241bdeed140d77256feb5cf7f4c3b", "parents": [ "4bbca662df2523ff7ad3224463f1f28e6a118044" ], "author": { "name": "Joyce Ooi", "email": "joyce.ooi@intel.com", "time": "Mon Jul 27 17:46:41 2020 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 16:34:04 2020 -0700" }, "message": "MAINTAINERS: Replace Thor Thayer as Altera Triple Speed Ethernet maintainer\n\nThis patch is to replace Thor Thayer as Altera Triple Speed Ethernet\nmaintainer as he is moving to a different role.\n\nSigned-off-by: Joyce Ooi \u003cjoyce.ooi@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4bbca662df2523ff7ad3224463f1f28e6a118044", "tree": "0c8aff68b72c586ef7b71262351e545260975dde", "parents": [ "8c0de6e96c9794cb523a516c465991a70245da1c" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@gmail.com", "time": "Mon Jul 27 19:04:55 2020 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 16:33:07 2020 -0700" }, "message": "selftests/bpf: fix netdevsim trap_flow_action_cookie read\n\nWhen read netdevsim trap_flow_action_cookie, we need to init it first,\nor we will get \"Invalid argument\" error.\n\nFixes: d3cbb907ae57 (\"netdevsim: add ACL trap reporting cookie as a metadata\")\nSigned-off-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8c0de6e96c9794cb523a516c465991a70245da1c", "tree": "d103a45583a4e140dc2053a65ccaa3409eb066c6", "parents": [ "27a2145d6f826d1fad9de06ac541b1016ced3427" ], "author": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Sat Jul 25 15:40:53 2020 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jul 30 16:30:55 2020 -0700" }, "message": "ipv6: fix memory leaks on IPV6_ADDRFORM path\n\nIPV6_ADDRFORM causes resource leaks when converting an IPv6 socket\nto IPv4, particularly struct ipv6_ac_socklist. Similar to\nstruct ipv6_mc_socklist, we should just close it on this path.\n\nThis bug can be easily reproduced with the following C program:\n\n #include \u003cstdio.h\u003e\n #include \u003cstring.h\u003e\n #include \u003csys/types.h\u003e\n #include \u003csys/socket.h\u003e\n #include \u003carpa/inet.h\u003e\n\n int main()\n {\n int s, value;\n struct sockaddr_in6 addr;\n struct ipv6_mreq m6;\n\n s \u003d socket(AF_INET6, SOCK_DGRAM, 0);\n addr.sin6_family \u003d AF_INET6;\n addr.sin6_port \u003d htons(5000);\n inet_pton(AF_INET6, \"::ffff:192.168.122.194\", \u0026addr.sin6_addr);\n connect(s, (struct sockaddr *)\u0026addr, sizeof(addr));\n\n inet_pton(AF_INET6, \"fe80::AAAA\", \u0026m6.ipv6mr_multiaddr);\n m6.ipv6mr_interface \u003d 5;\n setsockopt(s, SOL_IPV6, IPV6_JOIN_ANYCAST, \u0026m6, sizeof(m6));\n\n value \u003d AF_INET;\n setsockopt(s, SOL_IPV6, IPV6_ADDRFORM, \u0026value, sizeof(value));\n\n close(s);\n return 0;\n }\n\nReported-by: ch3332xr@gmail.com\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4f010246b4087ab931b060481014ec110e6a8a46", "tree": "e454d2a5f3dad27c81eaaba95127c681cdb6cce4", "parents": [ "0ba58348414eb10249480635545758b40b3c33b6" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Thu Jul 30 18:09:00 2020 +0200" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Fri Jul 31 01:07:32 2020 +0200" }, "message": "net/bpfilter: Initialize pos in __bpfilter_process_sockopt\n\n__bpfilter_process_sockopt never initialized the pos variable passed\nto the pipe write. This has been mostly harmless in the past as pipes\nignore the offset, but the switch to kernel_write now verified the\nposition, which can lead to a failure depending on the exact stack\ninitialization pattern. Initialize the variable to zero to make\nrw_verify_area happy.\n\nFixes: 6955a76fbcd5 (\"bpfilter: switch to kernel_write\")\nReported-by: Christian Brauner \u003cchristian.brauner@ubuntu.com\u003e\nReported-by: Rodrigo Madera \u003crodrigo.madera@gmail.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nTested-by: Rodrigo Madera \u003crodrigo.madera@gmail.com\u003e\nTested-by: Christian Brauner \u003cchristian.brauner@ubuntu.com\u003e\nReviewed-by: Christian Brauner \u003cchristian.brauner@ubuntu.com\u003e\nLink: https://lore.kernel.org/bpf/20200730160900.187157-1-hch@lst.de\n" }, { "commit": "d741dcae5562259841bd2211a0bd7e6c0f909f1e", "tree": "efb7fec1fa847c1eb98bd900a144b73c39bbc39a", "parents": [ "5e105c88ab4859bc1aedd29e8d2f55e599427035", "b757b47a2fcba584d4a32fd7ee68faca510ab96f" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Thu Jul 30 18:10:26 2020 -0400" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Thu Jul 30 18:10:26 2020 -0400" }, "message": "Merge tag \u0027kvmarm-fixes-5.8-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master\n\nKVM/arm64 fixes for Linux 5.8, take #3\n\n- Fix a corner case of a new mapping inheriting exec permission without\n and yet bypassing invalidation of the I-cache\n- Make sure PtrAuth predicates oinly generate inline code for the\n non-VHE hypervisor code\n" }, { "commit": "a2ec905d1e160a33b2e210e45ad30445ef26ce0e", "tree": "523b2ceb4958b380b66fa49a554ed949067ad15e", "parents": [ "417385c47ef7ee0d4f48f63f70cca6c1ed6355f4" ], "author": { "name": "Alain Michaud", "email": "alainm@chromium.org", "time": "Mon Jul 27 20:48:55 2020 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 13:54:04 2020 -0700" }, "message": "Bluetooth: fix kernel oops in store_pending_adv_report\n\nFix kernel oops observed when an ext adv data is larger than 31 bytes.\n\nThis can be reproduced by setting up an advertiser with advertisement\nlarger than 31 bytes. The issue is not sensitive to the advertisement\ncontent. In particular, this was reproduced with an advertisement of\n229 bytes filled with \u0027A\u0027. See stack trace below.\n\nThis is fixed by not catching ext_adv as legacy adv are only cached to\nbe able to concatenate a scanable adv with its scan response before\nsending it up through mgmt.\n\nWith ext_adv, this is no longer necessary.\n\n general protection fault: 0000 [#1] SMP PTI\n CPU: 6 PID: 205 Comm: kworker/u17:0 Not tainted 5.4.0-37-generic #41-Ubuntu\n Hardware name: Dell Inc. XPS 15 7590/0CF6RR, BIOS 1.7.0 05/11/2020\n Workqueue: hci0 hci_rx_work [bluetooth]\n RIP: 0010:hci_bdaddr_list_lookup+0x1e/0x40 [bluetooth]\n Code: ff ff e9 26 ff ff ff 0f 1f 44 00 00 0f 1f 44 00 00 55 48 8b 07 48 89 e5 48 39 c7 75 0a eb 24 48 8b 00 48 39 f8 74 1c 44 8b 06 \u003c44\u003e 39 40 10 75 ef 44 0f b7 4e 04 66 44 39 48 14 75 e3 38 50 16 75\n RSP: 0018:ffffbc6a40493c70 EFLAGS: 00010286\n RAX: 4141414141414141 RBX: 000000000000001b RCX: 0000000000000000\n RDX: 0000000000000000 RSI: ffff9903e76c100f RDI: ffff9904289d4b28\n RBP: ffffbc6a40493c70 R08: 0000000093570362 R09: 0000000000000000\n R10: 0000000000000000 R11: ffff9904344eae38 R12: ffff9904289d4000\n R13: 0000000000000000 R14: 00000000ffffffa3 R15: ffff9903e76c100f\n FS: 0000000000000000(0000) GS:ffff990434580000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007feed125a000 CR3: 00000001b860a003 CR4: 00000000003606e0\n Call Trace:\n process_adv_report+0x12e/0x560 [bluetooth]\n hci_le_meta_evt+0x7b2/0xba0 [bluetooth]\n hci_event_packet+0x1c29/0x2a90 [bluetooth]\n hci_rx_work+0x19b/0x360 [bluetooth]\n process_one_work+0x1eb/0x3b0\n worker_thread+0x4d/0x400\n kthread+0x104/0x140\n\nFixes: c215e9397b00 (\"Bluetooth: Process extended ADV report event\")\nReported-by: Andy Nguyen \u003ctheflow@google.com\u003e\nReported-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nReported-by: Balakrishna Godavarthi \u003cbgodavar@codeaurora.org\u003e\nSigned-off-by: Alain Michaud \u003calainm@chromium.org\u003e\nTested-by: Sonny Sasaka \u003csonnysasaka@chromium.org\u003e\nAcked-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "417385c47ef7ee0d4f48f63f70cca6c1ed6355f4", "tree": "b8c43a030e9bc0d9fee2978e8ecaa94bacf5490f", "parents": [ "aa54ea903abb02303bf55855fb51e3fcee135d70", "a96b0d061d476093cf86ca1c2de06fc57163588d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 13:34:07 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 13:34:07 2020 -0700" }, "message": "Merge tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost\n\nPull virtio fixes from Michael Tsirkin:\n \"A couple of last minute bugfixes\"\n\n* tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:\n virtio-mem: Fix build error due to improper use \u0027select\u0027\n virtio_balloon: fix up endian-ness for free cmd id\n virtio-balloon: Document byte ordering of poison_val\n vhost/scsi: fix up req type endian-ness\n firmware: Fix a reference count leak.\n" }, { "commit": "aa54ea903abb02303bf55855fb51e3fcee135d70", "tree": "5b2e4af2283a9bccd049d40de118f9545e75ded4", "parents": [ "d9644712a243ac47af4fe9cf65472d85c57753c7" ], "author": { "name": "Grygorii Strashko", "email": "grygorii.strashko@ti.com", "time": "Thu Jul 30 22:05:01 2020 +0300" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 13:01:04 2020 -0700" }, "message": "ARM: percpu.h: fix build error\n\nFix build error for the case:\n defined(CONFIG_SMP) \u0026\u0026 !defined(CONFIG_CPU_V6)\n\nconfig: keystone_defconfig\n\n CC arch/arm/kernel/signal.o\n In file included from ../include/linux/random.h:14,\n from ../arch/arm/kernel/signal.c:8:\n ../arch/arm/include/asm/percpu.h: In function ‘__my_cpu_offset’:\n ../arch/arm/include/asm/percpu.h:29:34: error: ‘current_stack_pointer’ undeclared (first use in this function); did you mean ‘user_stack_pointer’?\n : \"Q\" (*(const unsigned long *)current_stack_pointer));\n ^~~~~~~~~~~~~~~~~~~~~\n user_stack_pointer\n\nFixes: f227e3ec3b5c (\"random32: update the net random state on interrupt and activity\")\nSigned-off-by: Grygorii Strashko \u003cgrygorii.strashko@ti.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d9644712a243ac47af4fe9cf65472d85c57753c7", "tree": "c8de085e46fa5a1ac8f2f25f567e9f0d7e59704c", "parents": [ "e2c46b5762c616c249201688d3b9846627f78d2c", "b361663c5a40c8bc758b7f7f2239f7a192180e7c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 12:01:42 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 12:01:42 2020 -0700" }, "message": "Merge tag \u0027pci-v5.8-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci\n\nPull PCI fix from Bjorn Helgaas:\n \"Disable ASPM on ASM1083/1085 PCIe-to-PCI bridge (Robert Hancock)\"\n\n* tag \u0027pci-v5.8-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:\n PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge\n" }, { "commit": "024a8168b749db7a4aa40a5fbdfa04bf7e77c1c0", "tree": "bc56cfed6f2c7804f242f4e7c4d6eff41d3fdaf7", "parents": [ "1050242fa657093d3788c3ffa0bd9b42e4d7d1ab" ], "author": { "name": "Francesco Ruggeri", "email": "fruggeri@arista.com", "time": "Thu Jul 02 15:39:06 2020 -0700" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Thu Jul 30 10:05:14 2020 -0700" }, "message": "igb: reinit_locked() should be called with rtnl_lock\n\nWe observed two panics involving races with igb_reset_task.\nThe first panic is caused by this race condition:\n\n\tkworker\t\t\treboot -f\n\n\tigb_reset_task\n\tigb_reinit_locked\n\tigb_down\n\tnapi_synchronize\n\t\t\t\t__igb_shutdown\n\t\t\t\tigb_clear_interrupt_scheme\n\t\t\t\tigb_free_q_vectors\n\t\t\t\tigb_free_q_vector\n\t\t\t\tadapter-\u003eq_vector[v_idx] \u003d NULL;\n\tnapi_disable\n\tPanics trying to access\n\tadapter-\u003eq_vector[v_idx].napi_state\n\nThe second panic (a divide error) is caused by this race:\n\nkworker\t\treboot -f\ttx packet\n\nigb_reset_task\n\t\t__igb_shutdown\n\t\trtnl_lock()\n\t\t...\n\t\tigb_clear_interrupt_scheme\n\t\tigb_free_q_vectors\n\t\tadapter-\u003enum_tx_queues \u003d 0\n\t\t...\n\t\trtnl_unlock()\nrtnl_lock()\nigb_reinit_locked\nigb_down\nigb_up\nnetif_tx_start_all_queues\n\t\t\t\tdev_hard_start_xmit\n\t\t\t\tigb_xmit_frame\n\t\t\t\tigb_tx_queue_mapping\n\t\t\t\tPanics on\n\t\t\t\tr_idx % adapter-\u003enum_tx_queues\n\nThis commit applies to igb_reset_task the same changes that\nwere applied to ixgbe in commit 2f90b8657ec9 (\"ixgbe: this patch\nadds support for DCB to the kernel and ixgbe driver\"),\ncommit 8f4c5c9fb87a (\"ixgbe: reinit_locked() should be called with\nrtnl_lock\") and commit 88adce4ea8f9 (\"ixgbe: fix possible race in\nreset subtask\").\n\nSigned-off-by: Francesco Ruggeri \u003cfruggeri@arista.com\u003e\nTested-by: Aaron Brown \u003caaron.f.brown@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "1050242fa657093d3788c3ffa0bd9b42e4d7d1ab", "tree": "8517ad32b0962c33039312adbaa57e540e5fb152", "parents": [ "27a2145d6f826d1fad9de06ac541b1016ced3427" ], "author": { "name": "Aaron Ma", "email": "aaron.ma@canonical.com", "time": "Thu Jun 18 14:54:53 2020 +0800" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Thu Jul 30 10:04:54 2020 -0700" }, "message": "e1000e: continue to init PHY even when failed to disable ULP\n\nAfter \u0027commit e086ba2fccda4 (\"e1000e: disable s0ix entry and exit flows\n for ME systems\")\u0027,\nThinkPad P14s always failed to disable ULP by ME.\n\u0027commit 0c80cdbf3320 (\"e1000e: Warn if disabling ULP failed\")\u0027\nbreak out of init phy:\n\nerror log:\n[ 42.364753] e1000e 0000:00:1f.6 enp0s31f6: Failed to disable ULP\n[ 42.524626] e1000e 0000:00:1f.6 enp0s31f6: PHY Wakeup cause - Unicast Packet\n[ 42.822476] e1000e 0000:00:1f.6 enp0s31f6: Hardware Error\n\nWhen disable s0ix, E1000_FWSM_ULP_CFG_DONE will never be 1.\nIf continue to init phy like before, it can work as before.\niperf test result good too.\n\nFixes: 0c80cdbf3320 (\"e1000e: Warn if disabling ULP failed\")\nSigned-off-by: Aaron Ma \u003caaron.ma@canonical.com\u003e\nTested-by: Aaron Brown \u003caaron.f.brown@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "e2c46b5762c616c249201688d3b9846627f78d2c", "tree": "966ae8c6c65e93d4e5c2067f5358e5a736e0d0e0", "parents": [ "0513b9d75c07cbcdfda3778b636d3d131d679eb1", "d6364a867ccbf34a6afe0d57721ff64aa43befcd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 09:48:51 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 09:48:51 2020 -0700" }, "message": "Merge tag \u0027block-5.8-2020-07-30\u0027 of git://git.kernel.dk/linux-block\n\nPull block fixes from Jens Axboe:\n \"Three NVMe fixes\"\n\n* tag \u0027block-5.8-2020-07-30\u0027 of git://git.kernel.dk/linux-block:\n nvme: add a Identify Namespace Identification Descriptor list quirk\n nvme-pci: prevent SK hynix PC400 from using Write Zeroes command\n nvme-tcp: fix possible hang waiting for icresp response\n" }, { "commit": "0513b9d75c07cbcdfda3778b636d3d131d679eb1", "tree": "4f7df6b3f4d68047e0b22b5cffc31a4efea7917e", "parents": [ "1c9df907da83812e4f33b59d3d142c864d9da57f", "4ae6dbd683860b9edc254ea8acf5e04b5ae242e5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 09:47:07 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 09:47:07 2020 -0700" }, "message": "Merge tag \u0027io_uring-5.8-2020-07-30\u0027 of git://git.kernel.dk/linux-block\n\nPull io_uring fixes from Jens Axboe:\n \"Two small fixes for corner/error cases\"\n\n* tag \u0027io_uring-5.8-2020-07-30\u0027 of git://git.kernel.dk/linux-block:\n io_uring: fix lockup in io_fail_links()\n io_uring: fix -\u003ework corruption with poll_add\n" }, { "commit": "1c9df907da83812e4f33b59d3d142c864d9da57f", "tree": "0ac3de1c64e2e7008b6a0b17751d81d70a88d34e", "parents": [ "83bdc7275e6206f560d247be856bceba3e1ed8f2" ], "author": { "name": "Willy Tarreau", "email": "w@1wt.eu", "time": "Thu Jul 30 07:59:24 2020 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 30 09:15:17 2020 -0700" }, "message": "random: fix circular include dependency on arm64 after addition of percpu.h\n\nDaniel Díaz and Kees Cook independently reported that commit\nf227e3ec3b5c (\"random32: update the net random state on interrupt and\nactivity\") broke arm64 due to a circular dependency on include files\nsince the addition of percpu.h in random.h.\n\nThe correct fix would definitely be to move all the prandom32 stuff out\nof random.h but for backporting, a smaller solution is preferred.\n\nThis one replaces linux/percpu.h with asm/percpu.h, and this fixes the\nproblem on x86_64, arm64, arm, and mips. Note that moving percpu.h\naround didn\u0027t change anything and that removing it entirely broke\ndifferently. When backporting, such options might still be considered\nif this patch fails to help.\n\n[ It turns out that an alternate fix seems to be to just remove the\n troublesome \u003casm/pointer_auth.h\u003e remove from the arm64 \u003casm/smp.h\u003e\n that causes the circular dependency.\n\n But we might as well do the whole belt-and-suspenders thing, and\n minimize inclusion in \u003clinux/random.h\u003e too. Either will fix the\n problem, and both are good changes. - Linus ]\n\nReported-by: Daniel Díaz \u003cdaniel.diaz@linaro.org\u003e\nReported-by: Kees Cook \u003ckeescook@chromium.org\u003e\nTested-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nFixes: f227e3ec3b5c\nCc: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nSigned-off-by: Willy Tarreau \u003cw@1wt.eu\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6a7389f0312f01bb6641d37b395548a2922a057c", "tree": "8f11295e77913c36d14bf658572063f85b577d56", "parents": [ "05fb3dbda187bbd9cc1cd0e97e5d6595af570ac6" ], "author": { "name": "John Garry", "email": "john.garry@huawei.com", "time": "Wed Jun 17 19:17:28 2020 +0800" }, "committer": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Thu Jul 30 17:05:34 2020 +0100" }, "message": "MAINTAINERS: Include drivers subdirs for ARM PMU PROFILING AND DEBUGGING entry\n\nEnsure that the ARM PMU PROFILING AND DEBUGGING maintainers are included\nfor the HiSilicon PMU driver.\n\nSigned-off-by: John Garry \u003cjohn.garry@huawei.com\u003e\nLink: https://lore.kernel.org/r/1592392648-128331-1-git-send-email-john.garry@huawei.com\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n" }, { "commit": "05fb3dbda187bbd9cc1cd0e97e5d6595af570ac6", "tree": "6997394455a6b7db8d4617380a8a52ca79f4ac9b", "parents": [ "835d1c3a98799914db8aee0973018af21128cd1e" ], "author": { "name": "Robin Murphy", "email": "robin.murphy@arm.com", "time": "Thu Jul 30 10:56:49 2020 +0100" }, "committer": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Thu Jul 30 17:01:38 2020 +0100" }, "message": "arm64: csum: Fix handling of bad packets\n\nAlthough iph is expected to point to at least 20 bytes of valid memory,\nihl may be bogus, for example on reception of a corrupt packet. If it\nhappens to be less than 5, we really don\u0027t want to run away and\ndereference 16GB worth of memory until it wraps back to exactly zero...\n\nFixes: 0e455d8e80aa (\"arm64: Implement optimised IP checksum helpers\")\nReported-by: guodeqing \u003cgeffrey.guo@huawei.com\u003e\nSigned-off-by: Robin Murphy \u003crobin.murphy@arm.com\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n" }, { "commit": "835d1c3a98799914db8aee0973018af21128cd1e", "tree": "6a3a47f1973bd71503c1b3926c065b95b09482aa", "parents": [ "966a0acce2fca776391823381dba95c40e03c339" ], "author": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Thu Jul 30 10:53:05 2020 +0100" }, "committer": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Thu Jul 30 16:55:32 2020 +0100" }, "message": "arm64: Drop unnecessary include from asm/smp.h\n\nasm/pointer_auth.h is not needed anymore in asm/smp.h, as 62a679cb2825\n(\"arm64: simplify ptrauth initialization\") removed the keys from the\nsecondary_data structure.\n\nThis also cures a compilation issue introduced by f227e3ec3b5c\n(\"random32: update the net random state on interrupt and activity\").\n\nFixes: 62a679cb2825 (\"arm64: simplify ptrauth initialization\")\nFixes: f227e3ec3b5c (\"random32: update the net random state on interrupt and activity\")\nAcked-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n" }, { "commit": "966a0acce2fca776391823381dba95c40e03c339", "tree": "ea0efd25c696862436ebf2a5c21d032fc161ec35", "parents": [ "7b7891c7bdfd61fc9ed6747a0a05efe2394dddc6" ], "author": { "name": "Sami Tolvanen", "email": "samitolvanen@google.com", "time": "Thu Jul 30 08:37:01 2020 -0700" }, "committer": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Thu Jul 30 16:50:14 2020 +0100" }, "message": "arm64/alternatives: move length validation inside the subsection\n\nCommit f7b93d42945c (\"arm64/alternatives: use subsections for replacement\nsequences\") breaks LLVM\u0027s integrated assembler, because due to its\none-pass design, it cannot compute instruction sequence lengths before the\nlayout for the subsection has been finalized. This change fixes the build\nby moving the .org directives inside the subsection, so they are processed\nafter the subsection layout is known.\n\nFixes: f7b93d42945c (\"arm64/alternatives: use subsections for replacement sequences\")\nSigned-off-by: Sami Tolvanen \u003csamitolvanen@google.com\u003e\nLink: https://github.com/ClangBuiltLinux/linux/issues/1078\nLink: https://lore.kernel.org/r/20200730153701.3892953-1-samitolvanen@google.com\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n" }, { "commit": "a96b0d061d476093cf86ca1c2de06fc57163588d", "tree": "56b833a7534a95a8cf95835261d893bd4d84324a", "parents": [ "168c358af2f8c5a37f8b5f877ba2cc93995606ee" ], "author": { "name": "Weilong Chen", "email": "chenweilong@huawei.com", "time": "Fri Jun 19 16:03:33 2020 +0800" }, "committer": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Thu Jul 30 11:28:17 2020 -0400" }, "message": "virtio-mem: Fix build error due to improper use \u0027select\u0027\n\nAs noted in:\nhttps://www.kernel.org/doc/Documentation/kbuild/kconfig-language.txt\n\"select should be used with care. select will force a symbol to a\nvalue without visiting the dependencies.\"\nConfig VIRTIO_MEM should not select CONTIG_ALLOC directly.\nOtherwise it will cause an error:\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d208245\n\nSigned-off-by: Weilong Chen \u003cchenweilong@huawei.com\u003e\nLink: https://lore.kernel.org/r/20200619080333.194753-1-chenweilong@huawei.com\nAcked-by: Randy Dunlap \u003crdunlap@infradead.org\u003e # build-tested\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nAcked-by: Jason Wang \u003cjasowang@redhat.com\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\n" }, { "commit": "87004abfbc27261edd15716515d89ab42198b405", "tree": "7a6d63d31c795e8559dab82df5ebc85abb29595d", "parents": [ "fde9f39ac7f1ffd799a96ffa1e06b2051f0898f1" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Jul 30 11:02:30 2020 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Jul 30 11:03:28 2020 -0400" }, "message": "Revert \"drm/amdgpu: Fix NULL dereference in dpm sysfs handlers\"\n\nThis regressed some working configurations so revert it. Will\nfix this properly for 5.9 and backport then.\n\nThis reverts commit 38e0c89a19fd13f28d2b4721035160a3e66e270b.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "fde9f39ac7f1ffd799a96ffa1e06b2051f0898f1", "tree": "5b042a4d4ec57c6c3a2f3be163a4ed7b0adad9fa", "parents": [ "543e8669ed9bfb30545fd52bc0e047ca4df7fb31" ], "author": { "name": "Mazin Rezk", "email": "mnrzk@protonmail.com", "time": "Mon Jul 27 05:40:46 2020 +0000" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Jul 30 11:02:10 2020 -0400" }, "message": "drm/amd/display: Clear dm_state for fast updates\n\nThis patch fixes a race condition that causes a use-after-free during\namdgpu_dm_atomic_commit_tail. This can occur when 2 non-blocking commits\nare requested and the second one finishes before the first. Essentially,\nthis bug occurs when the following sequence of events happens:\n\n1. Non-blocking commit #1 is requested w/ a new dm_state #1 and is\ndeferred to the workqueue.\n\n2. Non-blocking commit #2 is requested w/ a new dm_state #2 and is\ndeferred to the workqueue.\n\n3. Commit #2 starts before commit #1, dm_state #1 is used in the\ncommit_tail and commit #2 completes, freeing dm_state #1.\n\n4. Commit #1 starts after commit #2 completes, uses the freed dm_state\n1 and dereferences a freelist pointer while setting the context.\n\nSince this bug has only been spotted with fast commits, this patch fixes\nthe bug by clearing the dm_state instead of using the old dc_state for\nfast updates. In addition, since dm_state is only used for its dc_state\nand amdgpu_dm_atomic_commit_tail will retain the dc_state if none is found,\nremoving the dm_state should not have any consequences in fast updates.\n\nThis use-after-free bug has existed for a while now, but only caused a\nnoticeable issue starting from 5.7-rc1 due to 3202fa62f (\"slub: relocate\nfreelist pointer to middle of object\") moving the freelist pointer from\ndm_state-\u003ebase (which was unused) to dm_state-\u003econtext (which is\ndereferenced).\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d207383\nFixes: bd200d190f45 (\"drm/amd/display: Don\u0027t replace the dc_state for fast updates\")\nReported-by: Duncan \u003c1i5t5.duncan@cox.net\u003e\nSigned-off-by: Mazin Rezk \u003cmnrzk@protonmail.com\u003e\nReviewed-by: Nicholas Kazlauskas \u003cnicholas.kazlauskas@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "543e8669ed9bfb30545fd52bc0e047ca4df7fb31", "tree": "e502dbbf069cf1c50d65f41cced3fbda1fe68345", "parents": [ "a4a2739beb8933a19281bca077fdb852598803ed" ], "author": { "name": "Peilin Ye", "email": "yepeilin.cs@gmail.com", "time": "Tue Jul 28 15:29:24 2020 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Jul 30 11:02:10 2020 -0400" }, "message": "drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()\n\nCompiler leaves a 4-byte hole near the end of `dev_info`, causing\namdgpu_info_ioctl() to copy uninitialized kernel stack memory to userspace\nwhen `size` is greater than 356.\n\nIn 2015 we tried to fix this issue by doing `\u003d {};` on `dev_info`, which\nunfortunately does not initialize that 4-byte hole. Fix it by using\nmemset() instead.\n\nCc: stable@vger.kernel.org\nFixes: c193fa91b918 (\"drm/amdgpu: information leak in amdgpu_info_ioctl()\")\nFixes: d38ceaf99ed0 (\"drm/amdgpu: add core driver (v4)\")\nSuggested-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Peilin Ye \u003cyepeilin.cs@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "fb448ce87a4a9482b084e67faf804aec79ed9b43", "tree": "59d9c6a8888601f619e5812638a0086483ac3f7a", "parents": [ "5d46b289d04b98eb992b2f8b67745cc0953e16b1" ], "author": { "name": "Leon Romanovsky", "email": "leonro@mellanox.com", "time": "Thu Jul 30 11:27:19 2020 +0300" }, "committer": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Thu Jul 30 11:03:33 2020 -0300" }, "message": "RDMA/core: Free DIM memory in error unwind\n\nThe memory allocated for the DIM wasn\u0027t freed in in error unwind path, fix\nit by calling to rdma_dim_destroy().\n\nFixes: da6629793aa6 (\"RDMA/core: Provide RDMA DIM support for ULPs\")\nLink: https://lore.kernel.org/r/20200730082719.1582397-4-leon@kernel.org\nSigned-off-by: Leon Romanovsky \u003cleonro@mellanox.com\u003e\nReviewed-by: Max Gurtovoy \u003cmaxg@mellanox.com \u003cmailto:maxg@mellanox.com\u003e\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "5d46b289d04b98eb992b2f8b67745cc0953e16b1", "tree": "2f79c730b0a88de45761c391723027dbc78d95ca", "parents": [ "7fa84b5708cf359efe43ce99fd1f3c8765cacd23" ], "author": { "name": "Leon Romanovsky", "email": "leonro@mellanox.com", "time": "Thu Jul 30 11:27:18 2020 +0300" }, "committer": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Thu Jul 30 11:03:33 2020 -0300" }, "message": "RDMA/core: Stop DIM before destroying CQ\n\nHW destroy operation should be last operation after all possible CQ users\ncompleted their work, so move DIM work cancellation before such destroy\ncall.\n\nFixes: da6629793aa6 (\"RDMA/core: Provide RDMA DIM support for ULPs\")\nLink: https://lore.kernel.org/r/20200730082719.1582397-3-leon@kernel.org\nReviewed-by: Max Gurtovoy \u003cmaxg@mellanox.com\u003e\nSigned-off-by: Leon Romanovsky \u003cleonro@mellanox.com\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "7fa84b5708cf359efe43ce99fd1f3c8765cacd23", "tree": "0e0476a78cca87ed5a15bae8d7b4fc2d4cfa0514", "parents": [ "54a485e9ec084da1a4b32dcf7749c7d760ed8aa5" ], "author": { "name": "Leon Romanovsky", "email": "leonro@mellanox.com", "time": "Thu Jul 30 11:27:17 2020 +0300" }, "committer": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Thu Jul 30 11:03:33 2020 -0300" }, "message": "RDMA/mlx5: Initialize QP mutex for the debug kernels\n\nIn DCT and RSS RAW QP creation flows, the QP mutex wasn\u0027t initialized and\nthe magic field inside lock was missing. This caused to the following\nkernel warning for kernels build with CONFIG_DEBUG_MUTEXES.\n\n DEBUG_LOCKS_WARN_ON(lock-\u003emagic !\u003d lock)\n WARNING: CPU: 3 PID: 16261 at kernel/locking/mutex.c:938 __mutex_lock+0x60e/0x940\n Modules linked in: bonding nf_tables ipip tunnel4 geneve ip6_udp_tunnel udp_tunnel ip6_gre ip6_tunnel tunnel6 ip_gre gre ip_tunnel mlx5_ib mlx5_core mlxfw ptp pps_core rdma_ucm ib_uverbs ib_ipoib ib_umad openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter overlay ib_srp scsi_transport_srp rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core [last unloaded: mlxfw]\n CPU: 3 PID: 16261 Comm: ib_send_bw Not tainted 5.8.0-rc4_for_upstream_min_debug_2020_07_08_22_04 #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__mutex_lock+0x60e/0x940\n Code: c0 0f 84 6d fa ff ff 44 8b 15 4e 9d ba 00 45 85 d2 0f 85 5d fa ff ff 48 c7 c6 f2 de 2b 82 48 c7 c7 f1 8a 2b 82 e8 d2 4d 72 ff \u003c0f\u003e 0b 4c 8b 4d 88 e9 3f fa ff ff f6 c2 04 0f 84 37 fe ff ff 48 89\n RSP: 0018:ffff88810bb8b870 EFLAGS: 00010286\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: ffff88829f1dd880 RSI: 0000000000000000 RDI: ffffffff81192afa\n RBP: ffff88810bb8b910 R08: 0000000000000000 R09: 0000000000000028\n R10: 0000000000000000 R11: 0000000000003f85 R12: 0000000000000002\n R13: ffff88827d8d3ce0 R14: ffffffffa059f615 R15: ffff8882a4d02610\n FS: 00007f3f6988e740(0000) GS:ffff8882f5b80000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000556556158000 CR3: 000000010a63c005 CR4: 0000000000360ea0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n ? cmd_exec+0x947/0xe60 [mlx5_core]\n ? __mutex_lock+0x76/0x940\n ? mlx5_ib_qp_set_counter+0x25/0xa0 [mlx5_ib]\n mlx5_ib_qp_set_counter+0x25/0xa0 [mlx5_ib]\n mlx5_ib_counter_bind_qp+0x9b/0xe0 [mlx5_ib]\n __rdma_counter_bind_qp+0x6b/0xa0 [ib_core]\n rdma_counter_bind_qp_auto+0x363/0x520 [ib_core]\n _ib_modify_qp+0x316/0x580 [ib_core]\n ib_modify_qp_with_udata+0x19/0x30 [ib_core]\n modify_qp+0x4c4/0x600 [ib_uverbs]\n ib_uverbs_ex_modify_qp+0x87/0xe0 [ib_uverbs]\n ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x129/0x1c0 [ib_uverbs]\n ib_uverbs_cmd_verbs.isra.5+0x5d5/0x11f0 [ib_uverbs]\n ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x120/0x120 [ib_uverbs]\n ? lock_acquire+0xb9/0x3a0\n ? ib_uverbs_ioctl+0xd0/0x210 [ib_uverbs]\n ? ib_uverbs_ioctl+0x175/0x210 [ib_uverbs]\n ib_uverbs_ioctl+0x14b/0x210 [ib_uverbs]\n ? ib_uverbs_ioctl+0xd0/0x210 [ib_uverbs]\n ksys_ioctl+0x234/0x7d0\n ? exc_page_fault+0x202/0x640\n ? do_syscall_64+0x1f/0x2e0\n __x64_sys_ioctl+0x16/0x20\n do_syscall_64+0x59/0x2e0\n ? asm_exc_page_fault+0x8/0x30\n ? rcu_read_lock_sched_held+0x52/0x60\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFixes: b4aaa1f0b415 (\"IB/mlx5: Handle type IB_QPT_DRIVER when creating a QP\")\nLink: https://lore.kernel.org/r/20200730082719.1582397-2-leon@kernel.org\nReviewed-by: Maor Gottlieb \u003cmaorg@mellanox.com\u003e\nSigned-off-by: Leon Romanovsky \u003cleonro@mellanox.com\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "04e35caa32ec9aae6b306d07f07dc2ee6d69166c", "tree": "d4ead8e8d91da65ed75ea569c55ed7e3d3b2d897", "parents": [ "e61fbfca8055eef18f11727f431e1e3e5221291e" ], "author": { "name": "Felix Fietkau", "email": "nbd@nbd.name", "time": "Sat Jul 25 10:45:33 2020 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jul 30 10:26:04 2020 +0200" }, "message": "mac80211: remove STA txq pending airtime underflow warning\n\nThis warning can trigger if there is a mismatch between frames that were\nsent with the sta pointer set vs tx status frames reported for the sta address.\n\nThis can happen due to race conditions on re-creating stations, or even\nin the case of .sta_add/remove being used instead of .sta_state, which can cause\nframes to be sent to a station that has not been uploaded yet.\n\nIf there is an actual underflow issue, it should show up in the device airtime\nwarning below, so it is better to remove this one.\n\nSigned-off-by: Felix Fietkau \u003cnbd@nbd.name\u003e\nLink: https://lore.kernel.org/r/20200725084533.13829-1-nbd@nbd.name\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "e61fbfca8055eef18f11727f431e1e3e5221291e", "tree": "f640d81f69b4a48591c1b6c2e98bb1eca2968d1e", "parents": [ "4052d3d2e8f47a15053320bbcbe365d15610437d" ], "author": { "name": "Vasanthakumar Thiagarajan", "email": "vthiagar@codeaurora.org", "time": "Wed Jul 22 19:50:17 2020 +0530" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jul 30 10:25:17 2020 +0200" }, "message": "mac80211: Fix bug in Tx ack status reporting in 802.3 xmit path\n\nAllocated ack_frame id from local-\u003eack_status_frames is not really\nstored in the tx_info for 802.3 Tx path. Due to this, tx ack status\nis not reported and ack_frame id is not freed for the buffers requiring\ntx ack status. Also move the memset to 0 of tx_info before\nIEEE80211_TX_CTL_REQ_TX_STATUS flag assignment.\n\nFixes: 50ff477a8639 (\"mac80211: add 802.11 encapsulation offloading support\")\nSigned-off-by: Vasanthakumar Thiagarajan \u003cvthiagar@codeaurora.org\u003e\nLink: https://lore.kernel.org/r/1595427617-1713-1-git-send-email-vthiagar@codeaurora.org\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "4052d3d2e8f47a15053320bbcbe365d15610437d", "tree": "7e71b33bfcd5c53830921859b0748e0da77ed67a", "parents": [ "5e43540c2af0a0c0a18e39579b1ad49541f87506" ], "author": { "name": "Julian Squires", "email": "julian@cipht.net", "time": "Mon Jul 06 17:13:53 2020 -0400" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jul 30 10:24:01 2020 +0200" }, "message": "cfg80211: check vendor command doit pointer before use\n\nIn the case where a vendor command does not implement doit, and has no\nflags set, doit would not be validated and a NULL pointer dereference\nwould occur, for example when invoking the vendor command via iw.\n\nI encountered this while developing new vendor commands. Perhaps in\npractice it is advisable to always implement doit along with dumpit,\nbut it seems reasonable to me to always check doit anyway, not just\nwhen NEED_WDEV.\n\nSigned-off-by: Julian Squires \u003cjulian@cipht.net\u003e\nLink: https://lore.kernel.org/r/20200706211353.2366470-1-julian@cipht.net\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "5e43540c2af0a0c0a18e39579b1ad49541f87506", "tree": "23cabb931f03f82105b1554d4c2d0a06e8b682e3", "parents": [ "6a01afcf8468d3ca2bd8bbb27503f60dcf643b20" ], "author": { "name": "Remi Pommarel", "email": "repk@triplefau.lt", "time": "Sat Jul 04 15:54:19 2020 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jul 30 10:23:48 2020 +0200" }, "message": "mac80211: mesh: Free pending skb when destroying a mpath\n\nA mpath object can hold reference on a list of skb that are waiting for\nmpath resolution to be sent. When destroying a mpath this skb list\nshould be cleaned up in order to not leak memory.\n\nFixing that kind of leak:\n\nunreferenced object 0xffff0000181c9300 (size 1088):\n comm \"openvpn\", pid 1782, jiffies 4295071698 (age 80.416s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 f9 80 36 00 00 00 00 00 ..........6.....\n 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............\n backtrace:\n [\u003c000000004bc6a443\u003e] kmem_cache_alloc+0x1a4/0x2f0\n [\u003c000000002caaef13\u003e] sk_prot_alloc.isra.39+0x34/0x178\n [\u003c00000000ceeaa916\u003e] sk_alloc+0x34/0x228\n [\u003c00000000ca1f1d04\u003e] inet_create+0x198/0x518\n [\u003c0000000035626b1c\u003e] __sock_create+0x134/0x328\n [\u003c00000000a12b3a87\u003e] __sys_socket+0xb0/0x158\n [\u003c00000000ff859f23\u003e] __arm64_sys_socket+0x40/0x58\n [\u003c00000000263486ec\u003e] el0_svc_handler+0xd0/0x1a0\n [\u003c0000000005b5157d\u003e] el0_svc+0x8/0xc\nunreferenced object 0xffff000012973a40 (size 216):\n comm \"openvpn\", pid 1782, jiffies 4295082137 (age 38.660s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 c0 06 16 00 00 ff ff 00 93 1c 18 00 00 ff ff ................\n backtrace:\n [\u003c000000004bc6a443\u003e] kmem_cache_alloc+0x1a4/0x2f0\n [\u003c0000000023c8c8f9\u003e] __alloc_skb+0xc0/0x2b8\n [\u003c000000007ad950bb\u003e] alloc_skb_with_frags+0x60/0x320\n [\u003c00000000ef90023a\u003e] sock_alloc_send_pskb+0x388/0x3c0\n [\u003c00000000104fb1a3\u003e] sock_alloc_send_skb+0x1c/0x28\n [\u003c000000006919d2dd\u003e] __ip_append_data+0xba4/0x11f0\n [\u003c0000000083477587\u003e] ip_make_skb+0x14c/0x1a8\n [\u003c0000000024f3d592\u003e] udp_sendmsg+0xaf0/0xcf0\n [\u003c000000005aabe255\u003e] inet_sendmsg+0x5c/0x80\n [\u003c000000008651ea08\u003e] __sys_sendto+0x15c/0x218\n [\u003c000000003505c99b\u003e] __arm64_sys_sendto+0x74/0x90\n [\u003c00000000263486ec\u003e] el0_svc_handler+0xd0/0x1a0\n [\u003c0000000005b5157d\u003e] el0_svc+0x8/0xc\n\nFixes: 2bdaf386f99c (mac80211: mesh: move path tables into if_mesh)\nSigned-off-by: Remi Pommarel \u003crepk@triplefau.lt\u003e\nLink: https://lore.kernel.org/r/20200704135419.27703-1-repk@triplefau.lt\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "6a01afcf8468d3ca2bd8bbb27503f60dcf643b20", "tree": "dcb7f4db4717d8471cdce4acb7edb4730034a33c", "parents": [ "65ad3ef9fced4062dfd74e2f89443fb5ce184321" ], "author": { "name": "Remi Pommarel", "email": "repk@triplefau.lt", "time": "Sat Jul 04 15:50:07 2020 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jul 30 10:23:35 2020 +0200" }, "message": "mac80211: mesh: Free ie data when leaving mesh\n\nAt ieee80211_join_mesh() some ie data could have been allocated (see\ncopy_mesh_setup()) and need to be cleaned up when leaving the mesh.\n\nThis fixes the following kmemleak report:\n\nunreferenced object 0xffff0000116bc600 (size 128):\n comm \"wpa_supplicant\", pid 608, jiffies 4294898983 (age 293.484s)\n hex dump (first 32 bytes):\n 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 0...............\n 00 0f ac 08 00 00 00 00 c4 65 40 00 00 00 00 00 .........e@.....\n backtrace:\n [\u003c00000000bebe439d\u003e] __kmalloc_track_caller+0x1c0/0x330\n [\u003c00000000a349dbe1\u003e] kmemdup+0x28/0x50\n [\u003c0000000075d69baa\u003e] ieee80211_join_mesh+0x6c/0x3b8 [mac80211]\n [\u003c00000000683bb98b\u003e] __cfg80211_join_mesh+0x1e8/0x4f0 [cfg80211]\n [\u003c0000000072cb507f\u003e] nl80211_join_mesh+0x520/0x6b8 [cfg80211]\n [\u003c0000000077e9bcf9\u003e] genl_family_rcv_msg+0x374/0x680\n [\u003c00000000b1bd936d\u003e] genl_rcv_msg+0x78/0x108\n [\u003c0000000022c53788\u003e] netlink_rcv_skb+0xb0/0x1c0\n [\u003c0000000011af8ec9\u003e] genl_rcv+0x34/0x48\n [\u003c0000000069e41f53\u003e] netlink_unicast+0x268/0x2e8\n [\u003c00000000a7517316\u003e] netlink_sendmsg+0x320/0x4c0\n [\u003c0000000069cba205\u003e] ____sys_sendmsg+0x354/0x3a0\n [\u003c00000000e06bab0f\u003e] ___sys_sendmsg+0xd8/0x120\n [\u003c0000000037340728\u003e] __sys_sendmsg+0xa4/0xf8\n [\u003c000000004fed9776\u003e] __arm64_sys_sendmsg+0x44/0x58\n [\u003c000000001c1e5647\u003e] el0_svc_handler+0xd0/0x1a0\n\nFixes: c80d545da3f7 (mac80211: Let userspace enable and configure vendor specific path selection.)\nSigned-off-by: Remi Pommarel \u003crepk@triplefau.lt\u003e\nLink: https://lore.kernel.org/r/20200704135007.27292-1-repk@triplefau.lt\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "65ad3ef9fced4062dfd74e2f89443fb5ce184321", "tree": "6bcb8a0fe845bab3e7f6406a68e7afc34acd6bcd", "parents": [ "27a2145d6f826d1fad9de06ac541b1016ced3427" ], "author": { "name": "Rajkumar Manoharan", "email": "rmanohar@codeaurora.org", "time": "Wed Jul 01 19:20:24 2020 -0700" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jul 30 10:20:37 2020 +0200" }, "message": "mac80211: fix warning in 6 GHz IE addition in mesh mode\n\nThe commit 24a2042cb22f (\"mac80211: add HE 6 GHz Band Capability\nelement\") failed to check device capability before adding HE 6 GHz\ncapability element. Below warning is reported in 11ac device in mesh.\nFix that by checking device capability at HE 6 GHz cap IE addition\nin mesh beacon and association request.\n\nWARNING: CPU: 1 PID: 1897 at net/mac80211/util.c:2878\nieee80211_ie_build_he_6ghz_cap+0x149/0x150 [mac80211]\n[ 3138.720358] Call Trace:\n[ 3138.720361] ieee80211_mesh_build_beacon+0x462/0x530 [mac80211]\n[ 3138.720363] ieee80211_start_mesh+0xa8/0xf0 [mac80211]\n[ 3138.720365] __cfg80211_join_mesh+0x122/0x3e0 [cfg80211]\n[ 3138.720368] nl80211_join_mesh+0x3d3/0x510 [cfg80211]\n\nFixes: 24a2042cb22f (\"mac80211: add HE 6 GHz Band Capability element\")\nReported-by: Markus Theil \u003cmarkus.theil@tu-ilmenau.de\u003e\nSigned-off-by: Rajkumar Manoharan \u003crmanohar@codeaurora.org\u003e\nLink: https://lore.kernel.org/r/1593656424-18240-1-git-send-email-rmanohar@codeaurora.org\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "5649625344fe1f4695eace7c37d011e317bf66d5", "tree": "7ce9d750031f7c02135d830cd3d6c485044a1ddc", "parents": [ "7fcd9bb5acd01250bcae1ecc0cb8b8d4bb5b7e63" ], "author": { "name": "Kailang Yang", "email": "kailang@realtek.com", "time": "Wed Jul 29 15:09:27 2020 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jul 30 10:15:51 2020 +0200" }, "message": "ALSA: hda/realtek - Fixed HP right speaker no sound\n\nHP NB right speaker had no sound output.\nThis platform was connected to I2S Amp for speaker out.(None Realtek I2S Amp IC)\nEC need to check codec GPIO1 pin to initial I2S Amp.\n\nSigned-off-by: Kailang Yang \u003ckailang@realtek.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nLink: https://lore.kernel.org/r/01285f623ac7447187482fb4a8ecaa7c@realtek.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "71b59bf482b2dd662774f34108c5b904efa9e02b", "tree": "cad6ddb9845476777f642be53f8a4ac1a065b17a", "parents": [ "fadd1a63a7b4df295a01fa50b2f4e447542bee59" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Wed Jul 29 18:38:43 2020 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Thu Jul 30 06:51:36 2020 +0200" }, "message": "espintcp: count packets dropped in espintcp_rcv\n\nCurrently, espintcp_rcv drops packets silently, which makes debugging\nissues difficult. Count packets as either XfrmInHdrError (when the\npacket was too short or contained invalid data) or XfrmInError (for\nother issues).\n\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "fadd1a63a7b4df295a01fa50b2f4e447542bee59", "tree": "062191bcf5afdb2bb7e24f707b6021cecf3abb2e", "parents": [ "d5dba1376e2bafec0f4408dc65706c5908964083" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Wed Jul 29 18:38:42 2020 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Thu Jul 30 06:51:35 2020 +0200" }, "message": "espintcp: handle short messages instead of breaking the encap socket\n\nCurrently, short messages (less than 4 bytes after the length header)\nwill break the stream of messages. This is unnecessary, since we can\nstill parse messages even if they\u0027re too short to contain any usable\ndata. This is also bogus, as keepalive messages (a single 0xff byte),\nthough not needed with TCP encapsulation, should be allowed.\n\nThis patch changes the stream parser so that short messages are\naccepted and dropped in the kernel. Messages that contain a valid SPI\nor non-ESP header are processed as before.\n\nFixes: e27cca96cd68 (\"xfrm: add espintcp (RFC 8229)\")\nReported-by: Andrew Cagney \u003ccagney@libreswan.org\u003e\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "83bdc7275e6206f560d247be856bceba3e1ed8f2", "tree": "334162ffd17ddfbeebc390e4e480d6c7137eaf6a", "parents": [ "d3590ebf6f91350192737dd1d1b219c05277f067" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 29 19:11:00 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 29 19:11:00 2020 -0700" }, "message": "random32: remove net_rand_state from the latent entropy gcc plugin\n\nIt turns out that the plugin right now ends up being really unhappy\nabout the change from \u0027static\u0027 to \u0027extern\u0027 storage that happened in\ncommit f227e3ec3b5c (\"random32: update the net random state on interrupt\nand activity\").\n\nThis is probably a trivial fix for the latent_entropy plugin, but for\nnow, just remove net_rand_state from the list of things the plugin\nworries about.\n\nReported-by: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nCc: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Willy Tarreau \u003cw@1wt.eu\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "b361663c5a40c8bc758b7f7f2239f7a192180e7c", "tree": "051730f839c53269a6d9f86a37c46bfd200a5a4c", "parents": [ "d08c30d7a0d1826f771f16cde32bd86e48401791" ], "author": { "name": "Robert Hancock", "email": "hancockrwd@gmail.com", "time": "Tue Jul 21 20:18:03 2020 -0600" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Wed Jul 29 18:35:45 2020 -0500" }, "message": "PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge\n\nRecently ASPM handling was changed to allow ASPM on PCIe-to-PCI/PCI-X\nbridges. Unfortunately the ASMedia ASM1083/1085 PCIe to PCI bridge device\ndoesn\u0027t seem to function properly with ASPM enabled. On an Asus PRIME\nH270-PRO motherboard, it causes errors like these:\n\n pcieport 0000:00:1c.0: AER: PCIe Bus Error: severity\u003dCorrected, type\u003dData Link Layer, (Transmitter ID)\n pcieport 0000:00:1c.0: AER: device [8086:a292] error status/mask\u003d00003000/00002000\n pcieport 0000:00:1c.0: AER: [12] Timeout\n pcieport 0000:00:1c.0: AER: Corrected error received: 0000:00:1c.0\n pcieport 0000:00:1c.0: AER: can\u0027t find device of ID00e0\n\nIn addition to flooding the kernel log, this also causes the machine to\nwake up immediately after suspend is initiated.\n\nThe device advertises ASPM L0s and L1 support in the Link Capabilities\nregister, but the ASMedia web page for ASM1083 [1] claims \"No PCIe ASPM\nsupport\".\n\nWindows 10 (build 2004) enables L0s, but it also logs correctable PCIe\nerrors.\n\nAdd a quirk to disable ASPM for this device.\n\n[1] https://www.asmedia.com.tw/eng/e_show_products.php?cate_index\u003d169\u0026item\u003d114\n\n[bhelgaas: commit log]\nFixes: 66ff14e59e8a (\"PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges\")\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d208667\nLink: https://lore.kernel.org/r/20200722021803.17958-1-hancockrwd@gmail.com\nSigned-off-by: Robert Hancock \u003chancockrwd@gmail.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\n" }, { "commit": "0ba58348414eb10249480635545758b40b3c33b6", "tree": "cb6f2183d57cb567b728fb8583efa0009089196b", "parents": [ "1d4e1eab456e1ee92a94987499b211db05f900ea" ], "author": { "name": "Andrii Nakryiko", "email": "andriin@fb.com", "time": "Tue Jul 28 21:09:13 2020 -0700" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Thu Jul 30 01:30:26 2020 +0200" }, "message": "selftests/bpf: Extend map-in-map selftest to detect memory leaks\n\nAdd test validating that all inner maps are released properly after skeleton\nis destroyed. To ensure determinism, trigger kernel-side synchronize_rcu()\nbefore checking map existence by their IDs.\n\nSigned-off-by: Andrii Nakryiko \u003candriin@fb.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Song Liu \u003csongliubraving@fb.com\u003e\nLink: https://lore.kernel.org/bpf/20200729040913.2815687-2-andriin@fb.com\n" }, { "commit": "1d4e1eab456e1ee92a94987499b211db05f900ea", "tree": "5b82ae2c43008bf5b78126fad7b2762c1d1514b8", "parents": [ "5b801dfb7feb2738975d80223efc2fc193e55573" ], "author": { "name": "Andrii Nakryiko", "email": "andriin@fb.com", "time": "Tue Jul 28 21:09:12 2020 -0700" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Thu Jul 30 01:30:22 2020 +0200" }, "message": "bpf: Fix map leak in HASH_OF_MAPS map\n\nFix HASH_OF_MAPS bug of not putting inner map pointer on bpf_map_elem_update()\noperation. This is due to per-cpu extra_elems optimization, which bypassed\nfree_htab_elem() logic doing proper clean ups. Make sure that inner map is put\nproperly in optimized case as well.\n\nFixes: 8c290e60fa2a (\"bpf: fix hashmap extra_elems logic\")\nSigned-off-by: Andrii Nakryiko \u003candriin@fb.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Song Liu \u003csongliubraving@fb.com\u003e\nLink: https://lore.kernel.org/bpf/20200729040913.2815687-1-andriin@fb.com\n" }, { "commit": "27a2145d6f826d1fad9de06ac541b1016ced3427", "tree": "f50140e1c475709d4ec6af5767548408b8fd4104", "parents": [ "5d104a5f325e16ef92ffc05b93eabdf6f0818c9f" ], "author": { "name": "Thomas Falcon", "email": "tlfalcon@linux.ibm.com", "time": "Wed Jul 29 16:36:32 2020 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jul 29 15:35:55 2020 -0700" }, "message": "ibmvnic: Fix IRQ mapping disposal in error path\n\nRX queue IRQ mappings are disposed in both the TX IRQ and RX IRQ\nerror paths. Fix this and dispose of TX IRQ mappings correctly in\ncase of an error.\n\nFixes: ea22d51a7831 (\"ibmvnic: simplify and improve driver probe function\")\nSigned-off-by: Thomas Falcon \u003ctlfalcon@linux.ibm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d3590ebf6f91350192737dd1d1b219c05277f067", "tree": "cd2b4d9f397caa173558f5987af6e980f34334e5", "parents": [ "21391520cbb597823050ac1bc343a0df3222ac90", "8ac68dc455d9d18241d44b96800d73229029ed34" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 29 12:35:36 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 29 12:35:36 2020 -0700" }, "message": "Merge tag \u0027audit-pr-20200729\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit\n\nPull audit fixes from Paul Moore:\n \"One small audit fix that you can hopefully merge before v5.8 is\n released. Unfortunately it is a revert of a patch that went in during\n the v5.7 window and we just recently started to see some bug reports\n relating to that commit.\n\n We are working on a proper fix, but I\u0027m not yet clear on when that\n will be ready and we need to fix the v5.7 kernels anyway, so in the\n interest of time a revert seemed like the best solution right now\"\n\n* tag \u0027audit-pr-20200729\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:\n revert: 1320a4052ea1 (\"audit: trigger accompanying records when no rules present\")\n" }, { "commit": "21391520cbb597823050ac1bc343a0df3222ac90", "tree": "88da45922be57cf407dbf74b3b7c296cfe490922", "parents": [ "c2f3850df7f95537e79c561f7be49df2e4ad8060", "74d6a5d5662975aed7f25952f62efbb6f6dadd29" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 29 12:29:24 2020 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 29 12:29:24 2020 -0700" }, "message": "Merge tag \u00279p-for-5.8-2\u0027 of git://github.com/martinetd/linux into master\n\nPull 9p fixes from Dominique Martinet:\n \"A couple of syzcaller fixes for 5.8\n\n The first one in particular has been quite noisy (\"broke\" in -rc5) so\n this would be worth landing even this late even if users likely won\u0027t\n see a difference\"\n\n* tag \u00279p-for-5.8-2\u0027 of git://github.com/martinetd/linux:\n 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work\n net/9p: validate fds in p9_fd_open\n" }, { "commit": "5d104a5f325e16ef92ffc05b93eabdf6f0818c9f", "tree": "bb7d75ce89ffd1845ae8f48e0d730c62226a12c4", "parents": [ "83f3522860f702748143e022f1a546547314c715", "10fef9ca6a879e7bee090b8e51c9812d438d3fb1" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jul 29 12:16:21 2020 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jul 29 12:16:21 2020 -0700" }, "message": "Merge branch \u0027mlxsw-fixes\u0027\n\nIdo Schimmel says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmlxsw fixes\n\nThis patch set contains various fixes for mlxsw.\n\nPatches #1-#2 fix two trap related issues introduced in previous cycle.\n\nPatches #3-#5 fix rare use-after-frees discovered by syzkaller. After\nover a week of fuzzing with the fixes, the bugs did not reproduce.\n\nPatch #6 from Amit fixes an issue in the ethtool selftest that was\nrecently discovered after running the test on a new platform that\nsupports only 1Gbps and 10Gbps speeds.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "10fef9ca6a879e7bee090b8e51c9812d438d3fb1", "tree": "bb7d75ce89ffd1845ae8f48e0d730c62226a12c4", "parents": [ "5515c3448d55bdcb5ff8a1778aa84f34e4205596" ], "author": { "name": "Amit Cohen", "email": "amitc@mellanox.com", "time": "Wed Jul 29 12:26:48 2020 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jul 29 12:16:21 2020 -0700" }, "message": "selftests: ethtool: Fix test when only two speeds are supported\n\nThe test case check_highest_speed_is_chosen() configures $h1 to\nadvertise a subset of its supported speeds and checks that $h2 chooses\nthe highest speed from the subset.\n\nTo find the common advertised speeds between $h1 and $h2,\ncommon_speeds_get() is called.\n\nCurrently, the first speed returned from common_speeds_get() is removed\nclaiming \"h1 does not advertise this speed\". The claim is wrong because\nthe function is called after $h1 already advertised a subset of speeds.\n\nIn case $h1 supports only two speeds, it will advertise a single speed\nwhich will be later removed because of previously mentioned bug. This\nresults in the test needlessly failing. When more than two speeds are\nsupported this is not an issue because the first advertised speed\nis the lowest one.\n\nFix this by not removing any speed from the list of commonly advertised\nspeeds.\n\nFixes: 64916b57c0b1 (\"selftests: forwarding: Add speed and auto-negotiation test\")\nReported-by: Danielle Ratson \u003cdanieller@mellanox.com\u003e\nSigned-off-by: Amit Cohen \u003camitc@mellanox.com\u003e\nSigned-off-by: Ido Schimmel \u003cidosch@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5515c3448d55bdcb5ff8a1778aa84f34e4205596", "tree": "274239974f4eb1ae7e7ea05796a802dce57395bd", "parents": [ "3c8ce24b037648a5a15b85888b259a74b05ff97d" ], "author": { "name": "Ido Schimmel", "email": "idosch@mellanox.com", "time": "Wed Jul 29 12:26:47 2020 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jul 29 12:16:21 2020 -0700" }, "message": "mlxsw: spectrum_router: Fix use-after-free in router init / de-init\n\nSeveral notifiers are registered as part of router initialization.\nSince some of these notifiers are registered before the end of the\ninitialization, it is possible for them to access uninitialized or freed\nmemory when processing notifications [1].\n\nAdditionally, some of these notifiers queue work items on a workqueue.\nIf these work items are executed after the router was de-initialized,\nthey will access freed memory.\n\nFix both problems by moving the registration of the notifiers to the end\nof the router initialization and flush the work queue after they are\nunregistered.\n\n[1]\nBUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:938 [inline]\nBUG: KASAN: use-after-free in __mutex_lock+0xeea/0x1340 kernel/locking/mutex.c:1103\nRead of size 8 at addr ffff888038c3a6e0 by task kworker/u4:1/61\n\nCPU: 1 PID: 61 Comm: kworker/u4:1 Not tainted 5.8.0-rc2+ #36\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\nWorkqueue: mlxsw_core_ordered mlxsw_sp_inet6addr_event_work\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0xf6/0x16e lib/dump_stack.c:118\n print_address_description.constprop.0+0x1c/0x250 mm/kasan/report.c:383\n __kasan_report mm/kasan/report.c:513 [inline]\n kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530\n __mutex_lock_common kernel/locking/mutex.c:938 [inline]\n __mutex_lock+0xeea/0x1340 kernel/locking/mutex.c:1103\n mlxsw_sp_inet6addr_event_work+0xb3/0x1b0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7123\n process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269\n worker_thread+0x9e/0x1050 kernel/workqueue.c:2415\n kthread+0x355/0x470 kernel/kthread.c:291\n ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293\n\nAllocated by task 1298:\n save_stack+0x1b/0x40 mm/kasan/common.c:48\n set_track mm/kasan/common.c:56 [inline]\n __kasan_kmalloc mm/kasan/common.c:494 [inline]\n __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:467\n kmalloc include/linux/slab.h:555 [inline]\n kzalloc include/linux/slab.h:669 [inline]\n mlxsw_sp_router_init+0xb2/0x1d20 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:8074\n mlxsw_sp_init+0xbd8/0x3ac0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2932\n __mlxsw_core_bus_device_register+0x657/0x10d0 drivers/net/ethernet/mellanox/mlxsw/core.c:1375\n mlxsw_core_bus_device_register drivers/net/ethernet/mellanox/mlxsw/core.c:1436 [inline]\n mlxsw_devlink_core_bus_device_reload_up+0xcd/0x150 drivers/net/ethernet/mellanox/mlxsw/core.c:1133\n devlink_reload net/core/devlink.c:2959 [inline]\n devlink_reload+0x281/0x3b0 net/core/devlink.c:2944\n devlink_nl_cmd_reload+0x2f1/0x7c0 net/core/devlink.c:2987\n genl_family_rcv_msg_doit net/netlink/genetlink.c:691 [inline]\n genl_family_rcv_msg net/netlink/genetlink.c:736 [inline]\n genl_rcv_msg+0x611/0x9d0 net/netlink/genetlink.c:753\n netlink_rcv_skb+0x152/0x440 net/netlink/af_netlink.c:2469\n genl_rcv+0x24/0x40 net/netlink/genetlink.c:764\n netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]\n netlink_unicast+0x53a/0x750 net/netlink/af_netlink.c:1329\n netlink_sendmsg+0x850/0xd90 net/netlink/af_netlink.c:1918\n sock_sendmsg_nosec net/socket.c:652 [inline]\n sock_sendmsg+0x150/0x190 net/socket.c:672\n ____sys_sendmsg+0x6d8/0x840 net/socket.c:2363\n ___sys_sendmsg+0xff/0x170 net/socket.c:2417\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2450\n do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:359\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFreed by task 1348:\n save_stack+0x1b/0x40 mm/kasan/common.c:48\n set_track mm/kasan/common.c:56 [inline]\n kasan_set_free_info mm/kasan/common.c:316 [inline]\n __kasan_slab_free+0x12c/0x170 mm/kasan/common.c:455\n slab_free_hook mm/slub.c:1474 [inline]\n slab_free_freelist_hook mm/slub.c:1507 [inline]\n slab_free mm/slub.c:3072 [inline]\n kfree+0xe6/0x320 mm/slub.c:4063\n mlxsw_sp_fini+0x340/0x4e0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3132\n mlxsw_core_bus_device_unregister+0x16c/0x6d0 drivers/net/ethernet/mellanox/mlxsw/core.c:1474\n mlxsw_devlink_core_bus_device_reload_down+0x8e/0xc0 drivers/net/ethernet/mellanox/mlxsw/core.c:1123\n devlink_reload+0xc6/0x3b0 net/core/devlink.c:2952\n devlink_nl_cmd_reload+0x2f1/0x7c0 net/core/devlink.c:2987\n genl_family_rcv_msg_doit net/netlink/genetlink.c:691 [inline]\n genl_family_rcv_msg net/netlink/genetlink.c:736 [inline]\n genl_rcv_msg+0x611/0x9d0 net/netlink/genetlink.c:753\n netlink_rcv_skb+0x152/0x440 net/netlink/af_netlink.c:2469\n genl_rcv+0x24/0x40 net/netlink/genetlink.c:764\n netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]\n netlink_unicast+0x53a/0x750 net/netlink/af_netlink.c:1329\n netlink_sendmsg+0x850/0xd90 net/netlink/af_netlink.c:1918\n sock_sendmsg_nosec net/socket.c:652 [inline]\n sock_sendmsg+0x150/0x190 net/socket.c:672\n ____sys_sendmsg+0x6d8/0x840 net/socket.c:2363\n ___sys_sendmsg+0xff/0x170 net/socket.c:2417\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2450\n do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:359\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nThe buggy address belongs to the object at ffff888038c3a000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 1760 bytes inside of\n 2048-byte region [ffff888038c3a000, ffff888038c3a800)\nThe buggy address belongs to the page:\npage:ffffea0000e30e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea0000e30e00 order:3 compound_mapcount:0 compound_pincount:0\nflags: 0x100000000010200(slab|head)\nraw: 0100000000010200 dead000000000100 dead000000000122 ffff88806c40c000\nraw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff888038c3a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff888038c3a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff888038c3a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff888038c3a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff888038c3a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\nFixes: 965fa8e600d2 (\"mlxsw: spectrum_router: Make RIF deletion more robust\")\nSigned-off-by: Ido Schimmel \u003cidosch@mellanox.com\u003e\nReviewed-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3c8ce24b037648a5a15b85888b259a74b05ff97d", "tree": "afa9da8a34286d5e6416b5084659cbb4b9f5e6b7", "parents": [ "7d8e8f3433dc8d1dc87c1aabe73a154978fb4c4d" ], "author": { "name": "Ido Schimmel", "email": "idosch@mellanox.com", "time": "Wed Jul 29 12:26:46 2020 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jul 29 12:16:21 2020 -0700" }, "message": "mlxsw: core: Free EMAD transactions using kfree_rcu()\n\nThe lifetime of EMAD transactions (i.e., \u0027struct mlxsw_reg_trans\u0027) is\nmanaged using RCU. They are freed using kfree_rcu() once the transaction\nends.\n\nHowever, in case the transaction failed it is freed immediately after being\nremoved from the active transactions list. This is problematic because it is\nstill possible for a different CPU to dereference the transaction from an RCU\nread-side critical section while traversing the active transaction list in\nmlxsw_emad_rx_listener_func(). In which case, a use-after-free is triggered\n[1].\n\nFix this by freeing the transaction after a grace period by calling\nkfree_rcu().\n\n[1]\nBUG: KASAN: use-after-free in mlxsw_emad_rx_listener_func+0x969/0xac0 drivers/net/ethernet/mellanox/mlxsw/core.c:671\nRead of size 8 at addr ffff88800b7964e8 by task syz-executor.2/2881\n\nCPU: 0 PID: 2881 Comm: syz-executor.2 Not tainted 5.8.0-rc4+ #44\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0xf6/0x16e lib/dump_stack.c:118\n print_address_description.constprop.0+0x1c/0x250 mm/kasan/report.c:383\n __kasan_report mm/kasan/report.c:513 [inline]\n kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530\n mlxsw_emad_rx_listener_func+0x969/0xac0 drivers/net/ethernet/mellanox/mlxsw/core.c:671\n mlxsw_core_skb_receive+0x571/0x700 drivers/net/ethernet/mellanox/mlxsw/core.c:2061\n mlxsw_pci_cqe_rdq_handle drivers/net/ethernet/mellanox/mlxsw/pci.c:595 [inline]\n mlxsw_pci_cq_tasklet+0x12a6/0x2520 drivers/net/ethernet/mellanox/mlxsw/pci.c:651\n tasklet_action_common.isra.0+0x13f/0x3e0 kernel/softirq.c:550\n __do_softirq+0x223/0x964 kernel/softirq.c:292\n asm_call_on_stack+0x12/0x20 arch/x86/entry/entry_64.S:711\n \u003c/IRQ\u003e\n __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]\n run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]\n do_softirq_own_stack+0x109/0x140 arch/x86/kernel/irq_64.c:77\n invoke_softirq kernel/softirq.c:387 [inline]\n __irq_exit_rcu kernel/softirq.c:417 [inline]\n irq_exit_rcu+0x16f/0x1a0 kernel/softirq.c:429\n sysvec_apic_timer_interrupt+0x4e/0xd0 arch/x86/kernel/apic/apic.c:1091\n asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:587\nRIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]\nRIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]\nRIP: 0010:_raw_spin_unlock_irqrestore+0x3b/0x40 kernel/locking/spinlock.c:191\nCode: e8 2a c3 f4 fc 48 89 ef e8 12 96 f5 fc f6 c7 02 75 11 53 9d e8 d6 db 11 fd 65 ff 0d 1f 21 b3 56 5b 5d c3 e8 a7 d7 11 fd 53 9d \u003ceb\u003e ed 0f 1f 00 55 48 89 fd 65 ff 05 05 21 b3 56 ff 74 24 08 48 8d\nRSP: 0018:ffff8880446ffd80 EFLAGS: 00000286\nRAX: 0000000000000006 RBX: 0000000000000286 RCX: 0000000000000006\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffa94ecea9\nRBP: ffff888012934408 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000001 R11: fffffbfff57be301 R12: 1ffff110088dffc1\nR13: ffff888037b817c0 R14: ffff88802442415a R15: ffff888024424000\n __do_sys_perf_event_open+0x1b5d/0x2bd0 kernel/events/core.c:11874\n do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:384\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\nRIP: 0033:0x473dbd\nCode: Bad RIP value.\nRSP: 002b:00007f21e5e9cc28 EFLAGS: 00000246 ORIG_RAX: 000000000000012a\nRAX: ffffffffffffffda RBX: 000000000057bf00 RCX: 0000000000473dbd\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040\nRBP: 000000000057bf00 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000003 R11: 0000000000000246 R12: 000000000057bf0c\nR13: 00007ffd0493503f R14: 00000000004d0f46 R15: 00007f21e5e9cd80\n\nAllocated by task 871:\n save_stack+0x1b/0x40 mm/kasan/common.c:48\n set_track mm/kasan/common.c:56 [inline]\n __kasan_kmalloc mm/kasan/common.c:494 [inline]\n __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:467\n kmalloc include/linux/slab.h:555 [inline]\n kzalloc include/linux/slab.h:669 [inline]\n mlxsw_core_reg_access_emad+0x70/0x1410 drivers/net/ethernet/mellanox/mlxsw/core.c:1812\n mlxsw_core_reg_access+0xeb/0x540 drivers/net/ethernet/mellanox/mlxsw/core.c:1991\n mlxsw_sp_port_get_hw_xstats+0x335/0x7e0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1130\n update_stats_cache+0xf4/0x140 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1173\n process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269\n worker_thread+0x9e/0x1050 kernel/workqueue.c:2415\n kthread+0x355/0x470 kernel/kthread.c:291\n ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293\n\nFreed by task 871:\n save_stack+0x1b/0x40 mm/kasan/common.c:48\n set_track mm/kasan/common.c:56 [inline]\n kasan_set_free_info mm/kasan/common.c:316 [inline]\n __kasan_slab_free+0x12c/0x170 mm/kasan/common.c:455\n slab_free_hook mm/slub.c:1474 [inline]\n slab_free_freelist_hook mm/slub.c:1507 [inline]\n slab_free mm/slub.c:3072 [inline]\n kfree+0xe6/0x320 mm/slub.c:4052\n mlxsw_core_reg_access_emad+0xd45/0x1410 drivers/net/ethernet/mellanox/mlxsw/core.c:1819\n mlxsw_core_reg_access+0xeb/0x540 drivers/net/ethernet/mellanox/mlxsw/core.c:1991\n mlxsw_sp_port_get_hw_xstats+0x335/0x7e0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1130\n update_stats_cache+0xf4/0x140 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1173\n process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269\n worker_thread+0x9e/0x1050 kernel/workqueue.c:2415\n kthread+0x355/0x470 kernel/kthread.c:291\n ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293\n\nThe buggy address belongs to the object at ffff88800b796400\n which belongs to the cache kmalloc-512 of size 512\nThe buggy address is located 232 bytes inside of\n 512-byte region [ffff88800b796400, ffff88800b796600)\nThe buggy address belongs to the page:\npage:ffffea00002de500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea00002de500 order:2 compound_mapcount:0 compound_pincount:0\nflags: 0x100000000010200(slab|head)\nraw: 0100000000010200 dead000000000100 dead000000000122 ffff88806c402500\nraw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff88800b796380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff88800b796400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff88800b796480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff88800b796500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff88800b796580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\nFixes: caf7297e7ab5 (\"mlxsw: core: Introduce support for asynchronous EMAD register access\")\nSigned-off-by: Ido Schimmel \u003cidosch@mellanox.com\u003e\nReviewed-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" } ], "next": "7d8e8f3433dc8d1dc87c1aabe73a154978fb4c4d" }