)]}' { "log": [ { "commit": "c9e6606c7fe92b50a02ce51dda82586ebdf99b48", "tree": "3d65a8d77615d3401b0f86cf3afb9519e31fa296", "parents": [ "24a0b2206134e17ec99d212c776f08f75a4bec23" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 14:23:25 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 14:23:25 2022 -0800" }, "message": "Linux 5.16-rc8\n" }, { "commit": "24a0b2206134e17ec99d212c776f08f75a4bec23", "tree": "4c4d4b6760d92c688e3db2baf671b5c9a0c74c6c", "parents": [ "859431ac11aef9b4cd7ffa75e94a92a6a41c8623", "64f18d2d043015b3f835ce4c9f3beb97cfd19b6e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 14:09:03 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 14:09:03 2022 -0800" }, "message": "Merge tag \u0027perf-tools-fixes-for-v5.16-2022-01-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux\n\nPull perf tools fixes from Arnaldo Carvalho de Melo:\n\n - Fix TUI exit screen refresh race condition in \u0027perf top\u0027.\n\n - Fix parsing of Intel PT VM time correlation arguments.\n\n - Honour CPU filtering command line request of a script\u0027s switch events\n in \u0027perf script\u0027.\n\n - Fix printing of switch events in Intel PT python script.\n\n - Fix duplicate alias events list printing in \u0027perf list\u0027, noticed on\n heterogeneous arm64 systems.\n\n - Fix return value of ids__new(), users expect NULL for failure, not\n ERR_PTR(-ENOMEM).\n\n* tag \u0027perf-tools-fixes-for-v5.16-2022-01-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:\n perf top: Fix TUI exit screen refresh race condition\n perf pmu: Fix alias events list\n perf scripts python: intel-pt-events.py: Fix printing of switch events\n perf script: Fix CPU filtering of a script\u0027s switch events\n perf intel-pt: Fix parsing of VM time correlation arguments\n perf expr: Fix return value of ids__new()\n" }, { "commit": "859431ac11aef9b4cd7ffa75e94a92a6a41c8623", "tree": "b2b6b812e7aba7c0159e05cfc972edde5e00658f", "parents": [ "1286cc4893cf356ad6c3a042116981e827dd3680", "c116fe1e1883ad3eda0a1938a9e3275a98aa51a5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 10:36:09 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 10:36:09 2022 -0800" }, "message": "Merge branch \u0027i2c/for-current\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"Better input validation for compat ioctls and a documentation bugfix\n for 5.16\"\n\n* \u0027i2c/for-current\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n Docs: Fixes link to I2C specification\n i2c: validate user data in compat ioctl\n" }, { "commit": "1286cc4893cf356ad6c3a042116981e827dd3680", "tree": "d7dbb6724a3c4b1cf35eb37e2855be312a09a8d8", "parents": [ "278218f6778bc7d6f8b67199446c56cec7ebb841", "d6f12f83989bb356ac6880a954f62c7667e35066" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 09:02:54 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 09:02:54 2022 -0800" }, "message": "Merge tag \u0027x86_urgent_for_v5.16_rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Borislav Petkov:\n\n - Use the proper CONFIG symbol in a preprocessor check.\n\n* tag \u0027x86_urgent_for_v5.16_rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/build: Use the proper name CONFIG_FW_LOADER\n" }, { "commit": "64f18d2d043015b3f835ce4c9f3beb97cfd19b6e", "tree": "1462ec323da2f6b057091b2866100b4bf9d00842", "parents": [ "e0257a01d6689c273a019756ed5e13911cc1bfed" ], "author": { "name": "yaowenbin", "email": "yaowenbin1@huawei.com", "time": "Wed Dec 29 16:55:19 2021 +0800" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Sun Jan 02 11:46:44 2022 -0300" }, "message": "perf top: Fix TUI exit screen refresh race condition\n\nWhen the following command is executed several times, a coredump file is\ngenerated.\n\n\t$ timeout -k 9 5 perf top -e task-clock\n\t*******\n\t*******\n\t*******\n\t0.01% [kernel] [k] __do_softirq\n\t0.01% libpthread-2.28.so [.] __pthread_mutex_lock\n\t0.01% [kernel] [k] __ll_sc_atomic64_sub_return\n\tdouble free or corruption (!prev) perf top --sort comm,dso\n\ttimeout: the monitored command dumped core\n\nWhen we terminate \"perf top\" using sending signal method,\nSLsmg_reset_smg() called. SLsmg_reset_smg() resets the SLsmg screen\nmanagement routines by freeing all memory allocated while it was active.\n\nHowever SLsmg_reinit_smg() maybe be called by another thread.\n\nSLsmg_reinit_smg() will free the same memory accessed by\nSLsmg_reset_smg(), thus it results in a double free.\n\nSLsmg_reinit_smg() is called already protected by ui__lock, so we fix\nthe problem by adding pthread_mutex_trylock of ui__lock when calling\nSLsmg_reset_smg().\n\nSigned-off-by: Wenyu Liu \u003cliuwenyu7@huawei.com\u003e\nTested-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: wuxu.wu@huawei.com\nLink: http://lore.kernel.org/lkml/a91e3943-7ddc-f5c0-a7f5-360f073c20e6@huawei.com\nSigned-off-by: Hewenliang \u003chewenliang4@huawei.com\u003e\nSigned-off-by: yaowenbin \u003cyaowenbin1@huawei.com\u003e\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "e0257a01d6689c273a019756ed5e13911cc1bfed", "tree": "5bdfcd017a55043e9816f95cfb3cd16703a35a30", "parents": [ "0f80bfbf4919e32f52fe1312c3900ff4fbb7eeb9" ], "author": { "name": "John Garry", "email": "john.garry@huawei.com", "time": "Wed Dec 22 00:11:30 2021 +0800" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Sun Jan 02 11:29:05 2022 -0300" }, "message": "perf pmu: Fix alias events list\n\nCommit 0e0ae8742207c3b4 (\"perf list: Display hybrid PMU events with cpu\ntype\") changes the event list for uncore PMUs or arm64 heterogeneous CPU\nsystems, such that duplicate aliases are incorrectly listed per PMU\n(which they should not be), like:\n\n # perf list\n ...\n unc_cbo_cache_lookup.any_es\n [Unit: uncore_cbox L3 Lookup any request that access cache and found\n line in E or S-state]\n unc_cbo_cache_lookup.any_es\n [Unit: uncore_cbox L3 Lookup any request that access cache and found\n line in E or S-state]\n unc_cbo_cache_lookup.any_i\n [Unit: uncore_cbox L3 Lookup any request that access cache and found\n line in I-state]\n unc_cbo_cache_lookup.any_i\n [Unit: uncore_cbox L3 Lookup any request that access cache and found\n line in I-state]\n ...\n\nNotice how the events are listed twice.\n\nThe named commit changed how we remove duplicate events, in that events\nfor different PMUs are not treated as duplicates. I suppose this is to\nhandle how \"Each hybrid pmu event has been assigned with a pmu name\".\n\nFix PMU alias listing by restoring behaviour to remove duplicates for\nnon-hybrid PMUs.\n\nFixes: 0e0ae8742207c3b4 (\"perf list: Display hybrid PMU events with cpu type\")\nSigned-off-by: John Garry \u003cjohn.garry@huawei.com\u003e\nTested-by: Zhengjun Xing \u003czhengjun.xing@linux.intel.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Ian Rogers \u003cirogers@google.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Kan Liang \u003ckan.liang@linux.intel.com\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: https://lore.kernel.org/r/1640103090-140490-1-git-send-email-john.garry@huawei.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "278218f6778bc7d6f8b67199446c56cec7ebb841", "tree": "89438cfa6feb54021ba70f72d3013b81b1583b7f", "parents": [ "8008293888188c3923f5bd8a69370dae25ed14e5", "bc7ec91718c49d938849697cfad98fcd9877cc26" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 01 10:21:49 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 01 10:21:49 2022 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n \"Two small fixups for spaceball joystick driver and appletouch touchpad\n driver\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: spaceball - fix parsing of movement data packets\n Input: appletouch - initialize work before device registration\n" }, { "commit": "8008293888188c3923f5bd8a69370dae25ed14e5", "tree": "4ddefd2eb46ae893bbf9a58fcf4b1b1747e80c65", "parents": [ "1b4e3f26f9f7553b260b8aed43967500961448a6" ], "author": { "name": "Mel Gorman", "email": "mgorman@techsingularity.net", "time": "Fri Dec 31 13:10:09 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 13:12:55 2021 -0800" }, "message": "mm: vmscan: reduce throttling due to a failure to make progress -fix\n\nHugh Dickins reported the following\n\n\tMy tmpfs swapping load (tweaked to use huge pages more heavily\n\tthan in real life) is far from being a realistic load: but it was\n\tnotably slowed down by your throttling mods in 5.16-rc, and this\n\tpatch makes it well again - thanks.\n\n\tBut: it very quickly hit NULL pointer until I changed that last\n\tline to\n\n if (first_pgdat)\n consider_reclaim_throttle(first_pgdat, sc);\n\nThe likely issue is that huge pages are a major component of the test\nworkload. When this is the case, first_pgdat may never get set if\ncompaction is ready to continue due to this check\n\n if (IS_ENABLED(CONFIG_COMPACTION) \u0026\u0026\n sc-\u003eorder \u003e PAGE_ALLOC_COSTLY_ORDER \u0026\u0026\n compaction_ready(zone, sc)) {\n sc-\u003ecompaction_ready \u003d true;\n continue;\n }\n\nIf this was true for every zone in the zonelist, first_pgdat would never\nget set resulting in a NULL pointer exception.\n\nLink: https://lkml.kernel.org/r/20211209095453.GM3366@techsingularity.net\nFixes: 1b4e3f26f9f75 (\"mm: vmscan: Reduce throttling due to a failure to make progress\")\nSigned-off-by: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nReported-by: Hugh Dickins \u003chughd@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: Rik van Riel \u003criel@surriel.com\u003e\nCc: Mike Galbraith \u003cefault@gmx.de\u003e\nCc: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nCc: Shakeel Butt \u003cshakeelb@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "1b4e3f26f9f7553b260b8aed43967500961448a6", "tree": "5e5875dee79302caf399f3f01a40a3f1ba071ee4", "parents": [ "f87bcc88f3028af584b0820bdf6e0e4cdc759d26" ], "author": { "name": "Mel Gorman", "email": "mgorman@techsingularity.net", "time": "Thu Dec 02 15:06:14 2021 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 11:17:07 2021 -0800" }, "message": "mm: vmscan: Reduce throttling due to a failure to make progress\n\nMike Galbraith, Alexey Avramov and Darrick Wong all reported similar\nproblems due to reclaim throttling for excessive lengths of time. In\nAlexey\u0027s case, a memory hog that should go OOM quickly stalls for\nseveral minutes before stalling. In Mike and Darrick\u0027s cases, a small\nmemcg environment stalled excessively even though the system had enough\nmemory overall.\n\nCommit 69392a403f49 (\"mm/vmscan: throttle reclaim when no progress is\nbeing made\") introduced the problem although commit a19594ca4a8b\n(\"mm/vmscan: increase the timeout if page reclaim is not making\nprogress\") made it worse. Systems at or near an OOM state that cannot\nbe recovered must reach OOM quickly and memcg should kill tasks if a\nmemcg is near OOM.\n\nTo address this, only stall for the first zone in the zonelist, reduce\nthe timeout to 1 tick for VMSCAN_THROTTLE_NOPROGRESS and only stall if\nthe scan control nr_reclaimed is 0, kswapd is still active and there\nwere excessive pages pending for writeback. If kswapd has stopped\nreclaiming due to excessive failures, do not stall at all so that OOM\ntriggers relatively quickly. Similarly, if an LRU is simply congested,\nonly lightly throttle similar to NOPROGRESS.\n\nAlexey\u0027s original case was the most straight forward\n\n\tfor i in {1..3}; do tail /dev/zero; done\n\nOn vanilla 5.16-rc1, this test stalled heavily, after the patch the test\ncompletes in a few seconds similar to 5.15.\n\nAlexey\u0027s second test case added watching a youtube video while tail runs\n10 times. On 5.15, playback only jitters slightly, 5.16-rc1 stalls a\nlot with lots of frames missing and numerous audio glitches. With this\npatch applies, the video plays similarly to 5.15.\n\n[lkp@intel.com: Fix W\u003d1 build warning]\n\nLink: https://lore.kernel.org/r/99e779783d6c7fce96448a3402061b9dc1b3b602.camel@gmx.de\nLink: https://lore.kernel.org/r/20211124011954.7cab9bb4@mail.inbox.lv\nLink: https://lore.kernel.org/r/20211022144651.19914-1-mgorman@techsingularity.net\nLink: https://lore.kernel.org/r/20211202150614.22440-1-mgorman@techsingularity.net\nLink: https://linux-regtracking.leemhuis.info/regzbot/regression/20211124011954.7cab9bb4@mail.inbox.lv/\nReported-and-tested-by: Alexey Avramov \u003chakavlad@inbox.lv\u003e\nReported-and-tested-by: Mike Galbraith \u003cefault@gmx.de\u003e\nReported-and-tested-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nAcked-by: Hugh Dickins \u003chughd@google.com\u003e\nTracked-by: Thorsten Leemhuis \u003cregressions@leemhuis.info\u003e\nFixes: 69392a403f49 (\"mm/vmscan: throttle reclaim when no progress is being made\")\nSigned-off-by: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f87bcc88f3028af584b0820bdf6e0e4cdc759d26", "tree": "fcca87bc48bd442275f135e3216acab269ef2873", "parents": [ "e46227bf3899eb21d738aa8ef2ec0f598dc70f7a", "ebb3f994dd92f8fb4d70c7541091216c1e10cb71" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:28:48 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:28:48 2021 -0800" }, "message": "Merge branch \u0027akpm\u0027 (patches from Andrew)\n\nMerge misc mm fixes from Andrew Morton:\n \"2 patches.\n\n Subsystems affected by this patch series: mm (userfaultfd and damon)\"\n\n* akpm:\n mm/damon/dbgfs: fix \u0027struct pid\u0027 leaks in \u0027dbgfs_target_ids_write()\u0027\n userfaultfd/selftests: fix hugetlb area allocations\n" }, { "commit": "e46227bf3899eb21d738aa8ef2ec0f598dc70f7a", "tree": "3f1e662c9ace7392dc1090409de615d3b8b47647", "parents": [ "4f3d93c6eaff6b84e43b63e0d7a119c5920e1020", "142c779d05d1fef75134c3cb63f52ccbc96d9e1f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:22:25 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:22:25 2021 -0800" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Three fixes, all in drivers. The lpfc one doesn\u0027t look exploitable,\n but nasty things could happen in string operations if mybuf ends up\n with an on stack unterminated string\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: vmw_pvscsi: Set residual data length conditionally\n scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()\n scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()\n" }, { "commit": "ebb3f994dd92f8fb4d70c7541091216c1e10cb71", "tree": "4b76bd68efb70f32a1f9b88935019d9070e2bc11", "parents": [ "f5c73297181c6b3ad76537bad98eaad6d29b9333" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Thu Dec 30 20:12:34 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:20:12 2021 -0800" }, "message": "mm/damon/dbgfs: fix \u0027struct pid\u0027 leaks in \u0027dbgfs_target_ids_write()\u0027\n\nDAMON debugfs interface increases the reference counts of \u0027struct pid\u0027s\nfor targets from the \u0027target_ids\u0027 file write callback\n(\u0027dbgfs_target_ids_write()\u0027), but decreases the counts only in DAMON\nmonitoring termination callback (\u0027dbgfs_before_terminate()\u0027).\n\nTherefore, when \u0027target_ids\u0027 file is repeatedly written without DAMON\nmonitoring start/termination, the reference count is not decreased and\ntherefore memory for the \u0027struct pid\u0027 cannot be freed. This commit\nfixes this issue by decreasing the reference counts when \u0027target_ids\u0027 is\nwritten.\n\nLink: https://lkml.kernel.org/r/20211229124029.23348-1-sj@kernel.org\nFixes: 4bc05954d007 (\"mm/damon: implement a debugfs-based user space interface\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[5.15+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f5c73297181c6b3ad76537bad98eaad6d29b9333", "tree": "6a53493290234ff078b9306372ae3e13ff4b129e", "parents": [ "4f3d93c6eaff6b84e43b63e0d7a119c5920e1020" ], "author": { "name": "Mike Kravetz", "email": "mike.kravetz@oracle.com", "time": "Thu Dec 30 20:12:31 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:20:12 2021 -0800" }, "message": "userfaultfd/selftests: fix hugetlb area allocations\n\nCurrently, userfaultfd selftest for hugetlb as run from run_vmtests.sh\nor any environment where there are \u0027just enough\u0027 hugetlb pages will\nalways fail with:\n\n testing events (fork, remap, remove):\n\t\tERROR: UFFDIO_COPY error: -12 (errno\u003d12, line\u003d616)\n\nThe ENOMEM error code implies there are not enough hugetlb pages.\nHowever, there are free hugetlb pages but they are all reserved. There\nis a basic problem with the way the test allocates hugetlb pages which\nhas existed since the test was originally written.\n\nDue to the way \u0027cleanup\u0027 was done between different phases of the test,\nthis issue was masked until recently. The issue was uncovered by commit\n8ba6e8640844 (\"userfaultfd/selftests: reinitialize test context in each\ntest\").\n\nFor the hugetlb test, src and dst areas are allocated as PRIVATE\nmappings of a hugetlb file. This means that at mmap time, pages are\nreserved for the src and dst areas. At the start of event testing (and\nother tests) the src area is populated which results in allocation of\nhuge pages to fill the area and consumption of reserves associated with\nthe area. Then, a child is forked to fault in the dst area. Note that\nthe dst area was allocated in the parent and hence the parent owns the\nreserves associated with the mapping. The child has normal access to\nthe dst area, but can not use the reserves created/owned by the parent.\nThus, if there are no other huge pages available allocation of a page\nfor the dst by the child will fail.\n\nFix by not creating reserves for the dst area. In this way the child\ncan use free (non-reserved) pages.\n\nAlso, MAP_PRIVATE of a file only makes sense if you are interested in\nthe contents of the file before making a COW copy. The test does not do\nthis. So, just use MAP_ANONYMOUS | MAP_HUGETLB to create an anonymous\nhugetlb mapping. There is no need to create a hugetlb file in the\nnon-shared case.\n\nLink: https://lkml.kernel.org/r/20211217172919.7861-1-mike.kravetz@oracle.com\nSigned-off-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Axel Rasmussen \u003caxelrasmussen@google.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Mina Almasry \u003calmasrymina@google.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c116fe1e1883ad3eda0a1938a9e3275a98aa51a5", "tree": "74e0ad49c0d338477bbf1a2a6b32b76950ffd7d9", "parents": [ "bb436283e25aaf1533ce061605d23a9564447bdf" ], "author": { "name": "Deep Majumder", "email": "deep@fastmail.in", "time": "Fri Nov 19 11:44:01 2021 +0530" }, "committer": { "name": "Wolfram Sang", "email": "wsa@kernel.org", "time": "Fri Dec 31 14:39:28 2021 +0100" }, "message": "Docs: Fixes link to I2C specification\n\nThe link to the I2C specification is broken. Although\n\"https://www.nxp.com\" hosts Rev 7 (2021) of this specification, it is\nbehind a login-wall. Thus, an additional link has been added (which\ndoesn\u0027t require a login) and the NXP official docs link has been\nupdated.\n\nSigned-off-by: Deep Majumder \u003cdeep@fastmail.in\u003e\n[wsa: minor updates to text and commit message]\nSigned-off-by: Wolfram Sang \u003cwsa@kernel.org\u003e\n" }, { "commit": "bb436283e25aaf1533ce061605d23a9564447bdf", "tree": "e8680ff3596ee9b7f53dc4fbcaeca7d40d98ab07", "parents": [ "fc74e0a40e4f9fd0468e34045b0c45bba11dcbb2" ], "author": { "name": "Pavel Skripkin", "email": "paskripkin@gmail.com", "time": "Fri Dec 31 01:47:50 2021 +0300" }, "committer": { "name": "Wolfram Sang", "email": "wsa@kernel.org", "time": "Fri Dec 31 14:28:22 2021 +0100" }, "message": "i2c: validate user data in compat ioctl\n\nWrong user data may cause warning in i2c_transfer(), ex: zero msgs.\nUserspace should not be able to trigger warnings, so this patch adds\nvalidation checks for user data in compact ioctl to prevent reported\nwarnings\n\nReported-and-tested-by: syzbot+e417648b303855b91d8a@syzkaller.appspotmail.com\nFixes: 7d5cb45655f2 (\"i2c compat ioctls: move to -\u003ecompat_ioctl()\")\nSigned-off-by: Pavel Skripkin \u003cpaskripkin@gmail.com\u003e\nSigned-off-by: Wolfram Sang \u003cwsa@kernel.org\u003e\n" }, { "commit": "bc7ec91718c49d938849697cfad98fcd9877cc26", "tree": "bceeff1678637822caf77d00c30f752535dfb710", "parents": [ "9f3ccdc3f6ef10084ceb3a47df0961bec6196fd0" ], "author": { "name": "Leo L. Schwab", "email": "ewhac@ewhac.org", "time": "Thu Dec 30 21:05:00 2021 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Thu Dec 30 21:09:29 2021 -0800" }, "message": "Input: spaceball - fix parsing of movement data packets\n\nThe spaceball.c module was not properly parsing the movement reports\ncoming from the device. The code read axis data as signed 16-bit\nlittle-endian values starting at offset 2.\n\nIn fact, axis data in Spaceball movement reports are signed 16-bit\nbig-endian values starting at offset 3. This was determined first by\nvisually inspecting the data packets, and later verified by consulting:\nhttp://spacemice.org/pdf/SpaceBall_2003-3003_Protocol.pdf\n\nIf this ever worked properly, it was in the time before Git...\n\nSigned-off-by: Leo L. Schwab \u003cewhac@ewhac.org\u003e\nLink: https://lore.kernel.org/r/20211221101630.1146385-1-ewhac@ewhac.org\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "9f3ccdc3f6ef10084ceb3a47df0961bec6196fd0", "tree": "5547c3618de935c018b3bf30d1f502eba14d650c", "parents": [ "4ebfee2bbc1a9c343dd50565ba5ae249fac32267" ], "author": { "name": "Pavel Skripkin", "email": "paskripkin@gmail.com", "time": "Thu Dec 30 20:57:46 2021 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Thu Dec 30 21:04:04 2021 -0800" }, "message": "Input: appletouch - initialize work before device registration\n\nSyzbot has reported warning in __flush_work(). This warning is caused by\nwork-\u003efunc \u003d\u003d NULL, which means missing work initialization.\n\nThis may happen, since input_dev-\u003eclose() calls\ncancel_work_sync(\u0026dev-\u003ework), but dev-\u003ework initalization happens _after_\ninput_register_device() call.\n\nSo this patch moves dev-\u003ework initialization before registering input\ndevice\n\nFixes: 5a6eb676d3bc (\"Input: appletouch - improve powersaving for Geyser3 devices\")\nReported-and-tested-by: syzbot+b88c5eae27386b252bbd@syzkaller.appspotmail.com\nSigned-off-by: Pavel Skripkin \u003cpaskripkin@gmail.com\u003e\nLink: https://lore.kernel.org/r/20211230141151.17300-1-paskripkin@gmail.com\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "4f3d93c6eaff6b84e43b63e0d7a119c5920e1020", "tree": "ae0073845780e5945a1fdedb71f5b0cb2ea2a429", "parents": [ "012e332286e2bb9f6ac77d195f17e74b2963d663", "ce9b333c73a5a8707f2f446a837a6ca743ddcffd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 30 18:25:43 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 30 18:25:43 2021 -0800" }, "message": "Merge tag \u0027drm-fixes-2021-12-31\u0027 of git://anongit.freedesktop.org/drm/drm\n\nPull drm fixes from Dave Airlie:\n \"This is a bit bigger than I\u0027d like, however it has two weeks of amdgpu\n fixes in it, since they missed last week, which was very small.\n\n The nouveau regression is probably the biggest fix in here, and it\n needs to go into 5.15 as well, two i915 fixes, and then a scattering\n of amdgpu fixes. The biggest fix in there is for a fencing NULL\n pointer dereference, the rest are pretty minor.\n\n For the misc team, I\u0027ve pulled the two misc fixes manually since I\u0027m\n not sure what is happening at this time of year!\n\n The amdgpu maintainers have the outstanding runpm regression to fix\n still, they are just working through the last bits of it now.\n\n Summary:\n\n nouveau:\n - fencing regression fix\n\n i915:\n - Fix possible uninitialized variable\n - Fix composite fence seqno icrement on each fence creation\n\n amdgpu:\n - Fencing fix\n - XGMI fix\n - VCN regression fix\n - IP discovery regression fixes\n - Fix runpm documentation\n - Suspend/resume fixes\n - Yellow Carp display fixes\n - MCLK power management fix\n - dma-buf fix\"\n\n* tag \u0027drm-fixes-2021-12-31\u0027 of git://anongit.freedesktop.org/drm/drm:\n drm/amd/display: Changed pipe split policy to allow for multi-display pipe split\n drm/amd/display: Fix USB4 null pointer dereference in update_psp_stream_config\n drm/amd/display: Set optimize_pwr_state for DCN31\n drm/amd/display: Send s0i2_rdy in stream_count \u003d\u003d 0 optimization\n drm/amd/display: Added power down for DCN10\n drm/amd/display: fix B0 TMDS deepcolor no dislay issue\n drm/amdgpu: no DC support for headless chips\n drm/amdgpu: put SMU into proper state on runpm suspending for BOCO capable platform\n drm/amdgpu: always reset the asic in suspend (v2)\n drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume\n drm/i915: Increment composite fence seqno\n drm/i915: Fix possible uninitialized variable in parallel extension\n drm/amdgpu: fix runpm documentation\n drm/nouveau: wait for the exclusive fence after the shared ones v2\n drm/amdgpu: add support for IP discovery gc_info table v2\n drm/amdgpu: When the VCN(1.0) block is suspended, powergating is explicitly enabled\n drm/amd/pm: Fix xgmi link control on aldebaran\n drm/amdgpu: introduce new amdgpu_fence object to indicate the job embedded fence\n drm/amdgpu: fix dropped backing store handling in amdgpu_dma_buf_move_notify\n" }, { "commit": "ce9b333c73a5a8707f2f446a837a6ca743ddcffd", "tree": "34658a5bc4ee0f676149a031d9b7e083650c97b7", "parents": [ "aeeb82fd6147b65689f0f1e5aaa389d34212a3c7", "67f74302f45d5d862f22ced3297624e50ac352f0" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Dec 31 11:40:29 2021 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Dec 31 11:40:29 2021 +1000" }, "message": "Merge branch \u0027drm-misc-fixes\u0027 of ssh://git.freedesktop.org/git/drm/drm-misc into drm-fixes\n\nThis merges two fixes that haven\u0027t been sent to me yet, but I wanted to get in.\n\nOne amdgpu fix, but one nouveau regression fixer.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n" }, { "commit": "012e332286e2bb9f6ac77d195f17e74b2963d663", "tree": "498edad3b725579e666efa4bec12762c9a071a13", "parents": [ "74c78b4291b4466b44a57b3b7c3b98ad02628686" ], "author": { "name": "Christian Brauner", "email": "christian.brauner@ubuntu.com", "time": "Thu Dec 30 20:23:09 2021 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 30 15:12:13 2021 -0800" }, "message": "fs/mount_setattr: always cleanup mount_kattr\n\nMake sure that finish_mount_kattr() is called after mount_kattr was\nsuccesfully built in both the success and failure case to prevent\nleaking any references we took when we built it. We returned early if\npath lookup failed thereby risking to leak an additional reference we\ntook when building mount_kattr when an idmapped mount was requested.\n\nCc: linux-fsdevel@vger.kernel.org\nCc: stable@vger.kernel.org\nFixes: 9caccd41541a (\"fs: introduce MOUNT_ATTR_IDMAP\")\nSigned-off-by: Christian Brauner \u003cchristian.brauner@ubuntu.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "74c78b4291b4466b44a57b3b7c3b98ad02628686", "tree": "56ce20b0f82e52645e42b8afc84f61bea6d63bd1", "parents": [ "9bad743e8d221c1be8fa80f0e76102234e472ac3", "bf2b09fedc17248b315f80fb249087b7d28a69a6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 30 11:12:12 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 30 11:12:12 2021 -0800" }, "message": "Merge tag \u0027net-5.16-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from.. Santa?\n\n No regressions on our radar at this point. The igc problem fixed here\n was the last one I was tracking but it was broken in previous\n releases, anyway. Mostly driver fixes and a couple of largish SMC\n fixes.\n\n Current release - regressions:\n\n - xsk: initialise xskb free_list_node, fixup for a -rc7 fix\n\n Current release - new code bugs:\n\n - mlx5: handful of minor fixes:\n\n - use first online CPU instead of hard coded CPU\n\n - fix some error handling paths in \u0027mlx5e_tc_add_fdb_flow()\u0027\n\n - fix skb memory leak when TC classifier action offloads are disabled\n\n - fix memory leak with rules with internal OvS port\n\n Previous releases - regressions:\n\n - igc: do not enable crosstimestamping for i225-V models\n\n Previous releases - always broken:\n\n - udp: use datalen to cap ipv6 udp max gso segments\n\n - fix use-after-free in tw_timer_handler due to early free of stats\n\n - smc: fix kernel panic caused by race of smc_sock\n\n - smc: don\u0027t send CDC/LLC message if link not ready, avoid timeouts\n\n - sctp: use call_rcu to free endpoint, avoid UAF in sock diag\n\n - bridge: mcast: add and enforce query interval minimum\n\n - usb: pegasus: do not drop long Ethernet frames\n\n - mlx5e: fix ICOSQ recovery flow for XSK\n\n - nfc: uapi: use kernel size_t to fix user-space builds\"\n\n* tag \u0027net-5.16-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)\n fsl/fman: Fix missing put_device() call in fman_port_probe\n selftests: net: using ping6 for IPv6 in udpgro_fwd.sh\n Documentation: fix outdated interpretation of ip_no_pmtu_disc\n net/ncsi: check for error return from call to nla_put_u32\n net: bridge: mcast: fix br_multicast_ctx_vlan_global_disabled helper\n net: fix use-after-free in tw_timer_handler\n selftests: net: Fix a typo in udpgro_fwd.sh\n selftests/net: udpgso_bench_tx: fix dst ip argument\n net: bridge: mcast: add and enforce startup query interval minimum\n net: bridge: mcast: add and enforce query interval minimum\n ipv6: raw: check passed optlen before reading\n xsk: Initialise xskb free_list_node\n net/mlx5e: Fix wrong features assignment in case of error\n net/mlx5e: TC, Fix memory leak with rules with internal port\n ionic: Initialize the \u0027lif-\u003edbid_inuse\u0027 bitmap\n igc: Fix TX timestamp support for non-MSI-X platforms\n igc: Do not enable crosstimestamping for i225-V models\n net/smc: fix kernel panic caused by race of smc_sock\n net/smc: don\u0027t send CDC/LLC message if link not ready\n NFC: st21nfca: Fix memory leak in device probe and remove\n ...\n" }, { "commit": "9bad743e8d221c1be8fa80f0e76102234e472ac3", "tree": "8ecd904aeb7d27edf1f85516f837b3617e5fd5d1", "parents": [ "2d40060bb51fb3b571b57aa9d823ab7fe55b4280", "3a0152b219523227c2a62a0a122cf99608287176" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 30 09:52:32 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 30 09:52:32 2021 -0800" }, "message": "Merge tag \u0027char-misc-5.16\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc fixes from Greg KH:\n \"Here are two misc driver fixes for 5.16-final:\n\n - binder accounting fix to resolve reported problem\n\n - nitro_enclaves fix for mmap assert warning output\n\n Both of these have been for over a week with no reported issues\"\n\n* tag \u0027char-misc-5.16\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:\n nitro_enclaves: Use get_user_pages_unlocked() call to handle mmap assert\n binder: fix async_free_space accounting for empty parcels\n" }, { "commit": "2d40060bb51fb3b571b57aa9d823ab7fe55b4280", "tree": "8aa3afec61ad098a8df2c527ba62e290d9980218", "parents": [ "eec4df26e24e978e49ccf9bcf49ca0f2ccdaeffe", "3f345e907a8e7c56fdebf7231cd67afc85d02aaa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 30 09:49:54 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 30 09:49:54 2021 -0800" }, "message": "Merge tag \u0027usb-5.16\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB fixes from Greg KH:\n \"Here are some small USB driver fixes for 5.16 to resolve some reported\n problems:\n\n - mtu3 driver fixes\n\n - typec ucsi driver fix\n\n - xhci driver quirk added\n\n - usb gadget f_fs fix for reported crash\n\n All of these have been in linux-next for a while with no reported\n problems\"\n\n* tag \u0027usb-5.16\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n usb: typec: ucsi: Only check the contract if there is a connection\n xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.\n usb: mtu3: set interval of FS intr and isoc endpoint\n usb: mtu3: fix list_head check warning\n usb: mtu3: add memory barrier before set GPD\u0027s HWO\n usb: mtu3: fix interval value for intr and isoc\n usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.\n" }, { "commit": "bf2b09fedc17248b315f80fb249087b7d28a69a6", "tree": "446674700927f6db3fb07eeeb2646a7ed3376dcf", "parents": [ "8b3170e07539855ee91bc5e2fa7780a4c9b5c7aa" ], "author": { "name": "Miaoqian Lin", "email": "linmq006@gmail.com", "time": "Thu Dec 30 12:26:27 2021 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 30 13:34:06 2021 +0000" }, "message": "fsl/fman: Fix missing put_device() call in fman_port_probe\n\nThe reference taken by \u0027of_find_device_by_node()\u0027 must be released when\nnot needed anymore.\nAdd the corresponding \u0027put_device()\u0027 in the and error handling paths.\n\nFixes: 18a6c85fcc78 (\"fsl/fman: Add FMan Port Support\")\nSigned-off-by: Miaoqian Lin \u003clinmq006@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8b3170e07539855ee91bc5e2fa7780a4c9b5c7aa", "tree": "d04ffb6af6507f3916a5d3450b1e65792fbda179", "parents": [ "be1c5b53227ba8280f1ebb01c6f5da3c9eebdaad" ], "author": { "name": "Jianguo Wu", "email": "wujianguo@chinatelecom.cn", "time": "Thu Dec 30 18:40:29 2021 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 30 13:31:48 2021 +0000" }, "message": "selftests: net: using ping6 for IPv6 in udpgro_fwd.sh\n\nudpgro_fwd.sh output following message:\n ping: 2001:db8:1::100: Address family for hostname not supported\n\nUsing ping6 when pinging IPv6 addresses.\n\nFixes: a062260a9d5f (\"selftests: net: add UDP GRO forwarding self-tests\")\nSigned-off-by: Jianguo Wu \u003cwujianguo@chinatelecom.cn\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "be1c5b53227ba8280f1ebb01c6f5da3c9eebdaad", "tree": "950702710e8c58a71e859d0110c5408b359d94ca", "parents": [ "ccc0c9be75cf27f415d50fecf1a57b650defe39d" ], "author": { "name": "xu xin", "email": "xu.xin16@zte.com.cn", "time": "Thu Dec 30 03:28:56 2021 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Dec 30 13:28:04 2021 +0000" }, "message": "Documentation: fix outdated interpretation of ip_no_pmtu_disc\n\nThe updating way of pmtu has changed, but documentation is still in the\nold way. So this patch updates the interpretation of ip_no_pmtu_disc and\nmin_pmtu.\n\nSee commit 28d35bcdd3925 (\"net: ipv4: don\u0027t let PMTU updates increase\nroute MTU\")\n\nReported-by: Zeal Robot \u003czealci@zte.com.cn\u003e\nSigned-off-by: xu xin \u003cxu.xin16@zte.com.cn\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "aeeb82fd6147b65689f0f1e5aaa389d34212a3c7", "tree": "61190d59f1599ff4774c795f51d25a7d3234a534", "parents": [ "05097b19a900dcdac338b70d30e5bd8eaf1fb0e3", "ee2698cf79cc759a397c61086c758d4cc85938bf" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Dec 30 13:55:47 2021 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Dec 30 13:55:48 2021 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-5.16-2021-12-29\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-5.16-2021-12-29:\n\namdgpu:\n- Fencing fix\n- XGMI fix\n- VCN regression fix\n- IP discovery regression fixes\n- Fix runpm documentation\n- Suspend/resume fixes\n- Yellow Carp display fixes\n- MCLK power management fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20211229155129.5789-1-alexander.deucher@amd.com\n" }, { "commit": "ccc0c9be75cf27f415d50fecf1a57b650defe39d", "tree": "e559acd4526494abdf339e11565063ee109e4f3d", "parents": [ "92a34ab169f9eefe29cd420ce96b0a0a2a1da853", "992d8a4e38f0527f24e273ce3a9cd6dea1a6a436" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 18:19:01 2021 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 18:19:01 2021 -0800" }, "message": "Merge tag \u0027mlx5-fixes-2021-12-28\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux\n\nSaeed Mahameed says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmlx5 fixes 2021-12-28\n\nThis series provides bug fixes to mlx5 driver.\n\n* tag \u0027mlx5-fixes-2021-12-28\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux:\n net/mlx5e: Fix wrong features assignment in case of error\n net/mlx5e: TC, Fix memory leak with rules with internal port\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20211229065352.30178-1-saeed@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "05097b19a900dcdac338b70d30e5bd8eaf1fb0e3", "tree": "f2b8cdbfde81aaa5a06756e21b59524287506c41", "parents": [ "fc74e0a40e4f9fd0468e34045b0c45bba11dcbb2", "d46f329a3f6048e04736e86cb13c880645048792" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Dec 30 12:12:40 2021 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Dec 30 12:12:40 2021 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2021-12-29\u0027 of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes\n\ndrm/i915 fixes for v5.16:\n- Fix possible uninitialized variable\n- Fix composite fence seqno icrement on each fence creation\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/87h7ark5r5.fsf@intel.com\n" }, { "commit": "92a34ab169f9eefe29cd420ce96b0a0a2a1da853", "tree": "e29ba093f8eecd7ecaac4103aba985787ec58e01", "parents": [ "168fed986b3a7ec7b98cab1fe84e2f282b9e6a8f" ], "author": { "name": "Jiasheng Jiang", "email": "jiasheng@iscas.ac.cn", "time": "Wed Dec 29 11:21:18 2021 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 17:53:24 2021 -0800" }, "message": "net/ncsi: check for error return from call to nla_put_u32\n\nAs we can see from the comment of the nla_put() that it could return\n-EMSGSIZE if the tailroom of the skb is insufficient.\nTherefore, it should be better to check the return value of the\nnla_put_u32 and return the error code if error accurs.\nAlso, there are many other functions have the same problem, and if this\npatch is correct, I will commit a new version to fix all.\n\nFixes: 955dc68cb9b2 (\"net/ncsi: Add generic netlink family\")\nSigned-off-by: Jiasheng Jiang \u003cjiasheng@iscas.ac.cn\u003e\nLink: https://lore.kernel.org/r/20211229032118.1706294-1-jiasheng@iscas.ac.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "168fed986b3a7ec7b98cab1fe84e2f282b9e6a8f", "tree": "559d70617e072067cb48073d22dd99a6b87f0339", "parents": [ "e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0" ], "author": { "name": "Nikolay Aleksandrov", "email": "nikolay@nvidia.com", "time": "Tue Dec 28 17:31:42 2021 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 17:49:45 2021 -0800" }, "message": "net: bridge: mcast: fix br_multicast_ctx_vlan_global_disabled helper\n\nWe need to first check if the context is a vlan one, then we need to\ncheck the global bridge multicast vlan snooping flag, and finally the\nvlan\u0027s multicast flag, otherwise we will unnecessarily enable vlan mcast\nprocessing (e.g. querier timers).\n\nFixes: 7b54aaaf53cb (\"net: bridge: multicast: add vlan state initialization and control\")\nSigned-off-by: Nikolay Aleksandrov \u003cnikolay@nvidia.com\u003e\nLink: https://lore.kernel.org/r/20211228153142.536969-1-nikolay@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0", "tree": "ecd2af6d9656f5b1faa73d1c7d45104b1e5e7e2d", "parents": [ "add25d6d6c85f7b6d00a055ee0a4169acf845681" ], "author": { "name": "Muchun Song", "email": "songmuchun@bytedance.com", "time": "Tue Dec 28 18:41:45 2021 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 17:46:43 2021 -0800" }, "message": "net: fix use-after-free in tw_timer_handler\n\nA real world panic issue was found as follow in Linux 5.4.\n\n BUG: unable to handle page fault for address: ffffde49a863de28\n PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0\n RIP: 0010:tw_timer_handler+0x20/0x40\n Call Trace:\n \u003cIRQ\u003e\n call_timer_fn+0x2b/0x120\n run_timer_softirq+0x1ef/0x450\n __do_softirq+0x10d/0x2b8\n irq_exit+0xc7/0xd0\n smp_apic_timer_interrupt+0x68/0x120\n apic_timer_interrupt+0xf/0x20\n\nThis issue was also reported since 2017 in the thread [1],\nunfortunately, the issue was still can be reproduced after fixing\nDCCP.\n\nThe ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net\nnamespace is destroyed since tcp_sk_ops is registered befrore\nipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops\nin the list of pernet_list. There will be a use-after-free on\nnet-\u003emib.net_statistics in tw_timer_handler after ipv4_mib_exit_net\nif there are some inflight time-wait timers.\n\nThis bug is not introduced by commit f2bf415cfed7 (\"mib: add net to\nNET_ADD_STATS_BH\") since the net_statistics is a global variable\ninstead of dynamic allocation and freeing. Actually, commit\n61a7e26028b9 (\"mib: put net statistics on struct net\") introduces\nthe bug since it put net statistics on struct net and free it when\nnet namespace is destroyed.\n\nMoving init_ipv4_mibs() to the front of tcp_init() to fix this bug\nand replace pr_crit() with panic() since continuing is meaningless\nwhen init_ipv4_mibs() fails.\n\n[1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli\u003d1\n\nFixes: 61a7e26028b9 (\"mib: put net statistics on struct net\")\nSigned-off-by: Muchun Song \u003csongmuchun@bytedance.com\u003e\nCc: Cong Wang \u003ccong.wang@bytedance.com\u003e\nCc: Fam Zheng \u003cfam.zheng@bytedance.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nLink: https://lore.kernel.org/r/20211228104145.9426-1-songmuchun@bytedance.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "add25d6d6c85f7b6d00a055ee0a4169acf845681", "tree": "8add213bda2a693ca68e826ad5fcbd8f6a77d444", "parents": [ "9c1952aeaa98b3cfc49e2a79cb2c7d6a674213e9" ], "author": { "name": "Jianguo Wu", "email": "wujianguo@chinatelecom.cn", "time": "Wed Dec 29 15:27:30 2021 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 17:33:48 2021 -0800" }, "message": "selftests: net: Fix a typo in udpgro_fwd.sh\n\n$rvs -\u003e $rcv\n\nFixes: a062260a9d5f (\"selftests: net: add UDP GRO forwarding self-tests\")\nSigned-off-by: Jianguo Wu \u003cwujianguo@chinatelecom.cn\u003e\nLink: https://lore.kernel.org/r/d247d7c8-a03a-0abf-3c71-4006a051d133@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9c1952aeaa98b3cfc49e2a79cb2c7d6a674213e9", "tree": "6e57d5886fe13c83e4938639a8365b8284a8b964", "parents": [ "f7397cd24c5967d24615a28433bbdc9e7e7d57a8" ], "author": { "name": "wujianguo", "email": "wujianguo@chinatelecom.cn", "time": "Wed Dec 29 18:58:10 2021 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 17:29:50 2021 -0800" }, "message": "selftests/net: udpgso_bench_tx: fix dst ip argument\n\nudpgso_bench_tx call setup_sockaddr() for dest address before\nparsing all arguments, if we specify \"-p ${dst_port}\" after \"-D ${dst_ip}\",\nthen ${dst_port} will be ignored, and using default cfg_port 8000.\n\nThis will cause test case \"multiple GRO socks\" failed in udpgro.sh.\n\nSetup sockaddr after parsing all arguments.\n\nFixes: 3a687bef148d (\"selftests: udp gso benchmark\")\nSigned-off-by: Jianguo Wu \u003cwujianguo@chinatelecom.cn\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://lore.kernel.org/r/ff620d9f-5b52-06ab-5286-44b945453002@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d6f12f83989bb356ac6880a954f62c7667e35066", "tree": "dc86614c7af94b93651b9d47178841964b78c4ff", "parents": [ "fc74e0a40e4f9fd0468e34045b0c45bba11dcbb2" ], "author": { "name": "Lukas Bulwahn", "email": "lukas.bulwahn@gmail.com", "time": "Wed Dec 29 12:15:53 2021 +0100" }, "committer": { "name": "Borislav Petkov", "email": "bp@suse.de", "time": "Wed Dec 29 22:20:38 2021 +0100" }, "message": "x86/build: Use the proper name CONFIG_FW_LOADER\n\nCommit in Fixes intends to add the expression regex only when FW_LOADER\nis enabled - not FW_LOADER_BUILTIN. Latter is a leftover from a previous\npatchset and not a valid config item.\n\nSo, adjust the condition to the actual name of the config.\n\n [ bp: Cleanup commit message. ]\n\nFixes: c8dcf655ec81 (\"x86/build: Tuck away built-in firmware under FW_LOADER\")\nSigned-off-by: Lukas Bulwahn \u003clukas.bulwahn@gmail.com\u003e\nSigned-off-by: Borislav Petkov \u003cbp@suse.de\u003e\nReviewed-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nLink: https://lore.kernel.org/r/20211229111553.5846-1-lukas.bulwahn@gmail.com\n" }, { "commit": "f7397cd24c5967d24615a28433bbdc9e7e7d57a8", "tree": "d28b66672917adc72af376b2e1a64b1c1f0e8fa8", "parents": [ "fb7bc9204095090731430c8921f9e629740c110a", "f83a112bd91a494cdee671aec74e777470fb4a07" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 12:59:43 2021 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 12:59:44 2021 -0800" }, "message": "Merge branch \u0027net-bridge-mcast-add-and-enforce-query-interval-minimum\u0027\n\nNikolay Aleksandrov says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: bridge: mcast: add and enforce query interval minimum\n\nThis set adds and enforces 1 second minimum value for bridge multicast\nquery and startup query intervals in order to avoid rearming the timers\ntoo often which could lock and crash the host. I doubt anyone is using\nsuch low values or anything lower than 1 second, so it seems like a good\nminimum. In order to be compatible if the value is lower then it is\noverwritten and a log message is emitted, since we can\u0027t return an error\nat this point.\n\nEric, I looked for the syzbot reports in its dashboard but couldn\u0027t find\nthem so I\u0027ve added you as the reporter.\n\nI\u0027ve prepared a global bridge igmp rate limiting patch but wasn\u0027t\nsure if it\u0027s ok for -net. It adds a static limit of 32k packets per\nsecond, I plan to send it for net-next with added drop counters for\neach bridge so it can be easily debugged.\n\nOriginal report can be seen at:\nhttps://lore.kernel.org/netdev/e8b9ce41-57b9-b6e2-a46a-ff9c791cf0ba@gmail.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20211227172116.320768-1-nikolay@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f83a112bd91a494cdee671aec74e777470fb4a07", "tree": "d28b66672917adc72af376b2e1a64b1c1f0e8fa8", "parents": [ "99b40610956a8a8755653a67392e2a8b772453be" ], "author": { "name": "Nikolay Aleksandrov", "email": "nikolay@nvidia.com", "time": "Mon Dec 27 19:21:16 2021 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 12:59:38 2021 -0800" }, "message": "net: bridge: mcast: add and enforce startup query interval minimum\n\nAs reported[1] if startup query interval is set too low in combination with\nlarge number of startup queries and we have multiple bridges or even a\nsingle bridge with multiple querier vlans configured we can crash the\nmachine. Add a 1 second minimum which must be enforced by overwriting the\nvalue if set lower (i.e. without returning an error) to avoid breaking\nuser-space. If that happens a log message is emitted to let the admin know\nthat the startup interval has been set to the minimum. It doesn\u0027t make\nsense to make the startup interval lower than the normal query interval\nso use the same value of 1 second. The issue has been present since these\nintervals could be user-controlled.\n\n[1] https://lore.kernel.org/netdev/e8b9ce41-57b9-b6e2-a46a-ff9c791cf0ba@gmail.com/\n\nFixes: d902eee43f19 (\"bridge: Add multicast count/interval sysfs entries\")\nReported-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Nikolay Aleksandrov \u003cnikolay@nvidia.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "99b40610956a8a8755653a67392e2a8b772453be", "tree": "53c62e4e8b7202de4f28fc10af540f87de143ce1", "parents": [ "fb7bc9204095090731430c8921f9e629740c110a" ], "author": { "name": "Nikolay Aleksandrov", "email": "nikolay@nvidia.com", "time": "Mon Dec 27 19:21:15 2021 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 12:59:37 2021 -0800" }, "message": "net: bridge: mcast: add and enforce query interval minimum\n\nAs reported[1] if query interval is set too low and we have multiple\nbridges or even a single bridge with multiple querier vlans configured\nwe can crash the machine. Add a 1 second minimum which must be enforced\nby overwriting the value if set lower (i.e. without returning an error) to\navoid breaking user-space. If that happens a log message is emitted to let\nthe administrator know that the interval has been set to the minimum.\nThe issue has been present since these intervals could be user-controlled.\n\n[1] https://lore.kernel.org/netdev/e8b9ce41-57b9-b6e2-a46a-ff9c791cf0ba@gmail.com/\n\nFixes: d902eee43f19 (\"bridge: Add multicast count/interval sysfs entries\")\nReported-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Nikolay Aleksandrov \u003cnikolay@nvidia.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fb7bc9204095090731430c8921f9e629740c110a", "tree": "99f8bb92eacdd49acda31dd0c5c8dc8f5827f4f3", "parents": [ "5bec7ca2be6955ca1aa0d7bae2b981de9b1c9844" ], "author": { "name": "Tamir Duberstein", "email": "tamird@gmail.com", "time": "Wed Dec 29 15:09:47 2021 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 12:32:56 2021 -0800" }, "message": "ipv6: raw: check passed optlen before reading\n\nAdd a check that the user-provided option is at least as long as the\nnumber of bytes we intend to read. Before this patch we would blindly\nread sizeof(int) bytes even in cases where the user passed\noptlen\u003csizeof(int), which would potentially read garbage or fault.\n\nDiscovered by new tests in https://github.com/google/gvisor/pull/6957 .\n\nThe original get_user call predates history in the git repo.\n\nSigned-off-by: Tamir Duberstein \u003ctamird@gmail.com\u003e\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://lore.kernel.org/r/20211229200947.2862255-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "eec4df26e24e978e49ccf9bcf49ca0f2ccdaeffe", "tree": "8fa5dca929e3e5dd4100490cce251844a56c3559", "parents": [ "e7c124bd04631973a3cc0df19ab881b56d8a2d50", "4eb1782eaa9fa1c224ad1fa0d13a9f09c3ab2d80" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Dec 29 10:07:20 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Dec 29 10:07:20 2021 -0800" }, "message": "Merge tag \u0027s390-5.16-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fix from Heiko Carstens:\n\n - fix s390 mcount regex typo in recordmcount.pl\n\n* tag \u0027s390-5.16-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n recordmcount.pl: fix typo in s390 mcount regex\n" }, { "commit": "5bec7ca2be6955ca1aa0d7bae2b981de9b1c9844", "tree": "111f439b749a4b85c14f701a0957b73a7b212f11", "parents": [ "9665e03a8de5df719904611e03f908cd5b9f52f6" ], "author": { "name": "Ciara Loftus", "email": "ciara.loftus@intel.com", "time": "Mon Dec 20 15:52:50 2021 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Dec 29 10:00:18 2021 -0800" }, "message": "xsk: Initialise xskb free_list_node\n\nThis commit initialises the xskb\u0027s free_list_node when the xskb is\nallocated. This prevents a potential false negative returned from a call\nto list_empty for that node, such as the one introduced in commit\n199d983bc015 (\"xsk: Fix crash on double free in buffer pool\")\n\nIn my environment this issue caused packets to not be received by\nthe xdpsock application if the traffic was running prior to application\nlaunch. This happened when the first batch of packets failed the xskmap\nlookup and XDP_PASS was returned from the bpf program. This action is\nhandled in the i40e zc driver (and others) by allocating an skbuff,\nfreeing the xdp_buff and adding the associated xskb to the\nxsk_buff_pool\u0027s free_list if it hadn\u0027t been added already. Without this\nfix, the xskb is not added to the free_list because the check to determine\nif it was added already returns an invalid positive result. Later, this\ncaused allocation errors in the driver and the failure to receive packets.\n\nFixes: 199d983bc015 (\"xsk: Fix crash on double free in buffer pool\")\nFixes: 2b43470add8c (\"xsk: Introduce AF_XDP buffer allocation API\")\nSigned-off-by: Ciara Loftus \u003cciara.loftus@intel.com\u003e\nAcked-by: Magnus Karlsson \u003cmagnus.karlsson@intel.com\u003e\nLink: https://lore.kernel.org/r/20211220155250.2746-1-ciara.loftus@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "992d8a4e38f0527f24e273ce3a9cd6dea1a6a436", "tree": "a0ef3b96b3ebf86bd954300b9d8504936bf0266f", "parents": [ "077cdda764c7f147e03e6065ba0cd1dbc1bf00d1" ], "author": { "name": "Gal Pressman", "email": "gal@nvidia.com", "time": "Mon Nov 29 11:08:41 2021 +0200" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Tue Dec 28 22:42:50 2021 -0800" }, "message": "net/mlx5e: Fix wrong features assignment in case of error\n\nIn case of an error in mlx5e_set_features(), \u0027netdev-\u003efeatures\u0027 must be\nupdated with the correct state of the device to indicate which features\nwere updated successfully.\nTo do that we maintain a copy of \u0027netdev-\u003efeatures\u0027 and update it after\nsuccessful feature changes, so we can assign it to back to\n\u0027netdev-\u003efeatures\u0027 if needed.\n\nHowever, since not all netdev features are handled by the driver (e.g.\nGRO/TSO/etc), some features may not be updated correctly in case of an\nerror updating another feature.\n\nFor example, while requesting to disable TSO (feature which is not\nhandled by the driver) and enable HW-GRO, if an error occurs during\nHW-GRO enable, \u0027oper_features\u0027 will be assigned with \u0027netdev-\u003efeatures\u0027\nand HW-GRO turned off. TSO will remain enabled in such case, which is a\nbug.\n\nTo solve that, instead of using \u0027netdev-\u003efeatures\u0027 as the baseline of\n\u0027oper_features\u0027 and changing it on set feature success, use \u0027features\u0027\ninstead and update it in case of errors.\n\nFixes: 75b81ce719b7 (\"net/mlx5e: Don\u0027t override netdev features field unless in error flow\")\nSigned-off-by: Gal Pressman \u003cgal@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "077cdda764c7f147e03e6065ba0cd1dbc1bf00d1", "tree": "5f808bff57962926d3595919cbc64651372eb6cc", "parents": [ "9665e03a8de5df719904611e03f908cd5b9f52f6" ], "author": { "name": "Roi Dayan", "email": "roid@nvidia.com", "time": "Wed Dec 22 09:20:58 2021 +0200" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Tue Dec 28 22:42:50 2021 -0800" }, "message": "net/mlx5e: TC, Fix memory leak with rules with internal port\n\nFix a memory leak with decap rule with internal port as destination\ndevice. The driver allocates a modify hdr action but doesn\u0027t set\nthe flow attr modify hdr action which results in skipping releasing\nthe modify hdr action when releasing the flow.\n\nbacktrace:\n [\u003c000000005f8c651c\u003e] krealloc+0x83/0xd0\n [\u003c000000009f59b143\u003e] alloc_mod_hdr_actions+0x156/0x310 [mlx5_core]\n [\u003c000000002257f342\u003e] mlx5e_tc_match_to_reg_set_and_get_id+0x12a/0x360 [mlx5_core]\n [\u003c00000000b44ea75a\u003e] mlx5e_tc_add_fdb_flow+0x962/0x1470 [mlx5_core]\n [\u003c0000000003e384a0\u003e] __mlx5e_add_fdb_flow+0x54c/0xb90 [mlx5_core]\n [\u003c00000000ed8b22b6\u003e] mlx5e_configure_flower+0xe45/0x4af0 [mlx5_core]\n [\u003c00000000024f4ab5\u003e] mlx5e_rep_indr_offload.isra.0+0xfe/0x1b0 [mlx5_core]\n [\u003c000000006c3bb494\u003e] mlx5e_rep_indr_setup_tc_cb+0x90/0x130 [mlx5_core]\n [\u003c00000000d3dac2ea\u003e] tc_setup_cb_add+0x1d2/0x420\n\nFixes: b16eb3c81fe2 (\"net/mlx5: Support internal port as decap route device\")\nSigned-off-by: Roi Dayan \u003croid@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "9665e03a8de5df719904611e03f908cd5b9f52f6", "tree": "979bfbafb9c63f64be2887d96efab15f823935df", "parents": [ "140c7bc7d1195750342ea0e6ab76179499ae7cd7", "f85846bbf43de38fb2c89fe7d2a085608c4eb25a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Dec 28 16:19:09 2021 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Dec 28 16:19:10 2021 -0800" }, "message": "Merge branch \u00271GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2021-12-28\n\nThis series contains updates to igc driver only.\n\nVinicius disables support for crosstimestamp on i225-V as lockups are being\nobserved.\n\nJames McLaughlin fixes Tx timestamping support on non-MSI-X platforms.\n\n* \u00271GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n igc: Fix TX timestamp support for non-MSI-X platforms\n igc: Do not enable crosstimestamping for i225-V models\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20211228182421.340354-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "140c7bc7d1195750342ea0e6ab76179499ae7cd7", "tree": "fa0c0aaa014392448ee955be79c64a1e39bec6e8", "parents": [ "16fa29aef7963293f8792789210002ec9f9607ac" ], "author": { "name": "Christophe JAILLET", "email": "christophe.jaillet@wanadoo.fr", "time": "Sun Dec 26 15:06:17 2021 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Dec 28 16:07:35 2021 -0800" }, "message": "ionic: Initialize the \u0027lif-\u003edbid_inuse\u0027 bitmap\n\nWhen allocated, this bitmap is not initialized. Only the first bit is set a\nfew lines below.\n\nUse bitmap_zalloc() to make sure that it is cleared before being used.\n\nFixes: 6461b446f2a0 (\"ionic: Add interrupts and doorbells\")\nSigned-off-by: Christophe JAILLET \u003cchristophe.jaillet@wanadoo.fr\u003e\nSigned-off-by: Shannon Nelson \u003csnelson@pensando.io\u003e\nLink: https://lore.kernel.org/r/6a478eae0b5e6c63774e1f0ddb1a3f8c38fa8ade.1640527506.git.christophe.jaillet@wanadoo.fr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ee2698cf79cc759a397c61086c758d4cc85938bf", "tree": "95c999ac51c8621f7926897a63a60522945b9dca", "parents": [ "33bb63915fee190102cae7d6576bc51a0bc342b2" ], "author": { "name": "Angus Wang", "email": "angus.wang@amd.com", "time": "Thu Dec 09 17:27:01 2021 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Dec 28 17:02:31 2021 -0500" }, "message": "drm/amd/display: Changed pipe split policy to allow for multi-display pipe split\n\n[WHY]\nCurrent implementation of pipe split policy prevents pipe split with\nmultiple displays connected, which caused the MCLK speed to be stuck at\nmax\n\n[HOW]\nChanged the pipe split policies so that pipe split is allowed for\nmulti-display configurations\n\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/1522\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/1709\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/1655\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/1403\n\nNote this is a backport of this commit from amdgpu drm-next for 5.16.\n\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nReviewed-by: Aric Cyr \u003cAric.Cyr@amd.com\u003e\nAcked-by: Rodrigo Siqueira \u003cRodrigo.Siqueira@amd.com\u003e\nSigned-off-by: Angus Wang \u003cangus.wang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "33bb63915fee190102cae7d6576bc51a0bc342b2", "tree": "5c0587784248e7e67ec098f9a3f0f33d67f2cb30", "parents": [ "33735c1c8d0223170d79dbe166976d9cd7339c7a" ], "author": { "name": "Nicholas Kazlauskas", "email": "nicholas.kazlauskas@amd.com", "time": "Fri Dec 17 14:18:59 2021 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Dec 28 16:51:24 2021 -0500" }, "message": "drm/amd/display: Fix USB4 null pointer dereference in update_psp_stream_config\n\n[Why]\nA porting error on a previous patch left the block of code that\ncauses the crash from a NULL pointer dereference.\n\nMore specifically, we try to access link_enc before it\u0027s assigned in\nthe USB4 case in the following assignment:\n\nconfig.dio_output_idx \u003d link_enc-\u003etransmitter - TRANSMITTER_UNIPHY_A;\n\n[How]\nThat assignment occurs later depending on the ASIC version. It\u0027s only\nneeded on DCN31 and only after link_enc is already assigned.\n\nFixes: 986430446c917b (\"drm/amd/display: fix a crash on USB4 over C20 PHY\")\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e\nSigned-off-by: Nicholas Kazlauskas \u003cnicholas.kazlauskas@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "33735c1c8d0223170d79dbe166976d9cd7339c7a", "tree": "bc528b5fa3196d291b6f761d416ef4b08226973a", "parents": [ "a07f8b9983543d465b50870ab4f845d4d710ed3f" ], "author": { "name": "Nicholas Kazlauskas", "email": "nicholas.kazlauskas@amd.com", "time": "Thu Dec 09 16:05:36 2021 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Dec 28 16:51:24 2021 -0500" }, "message": "drm/amd/display: Set optimize_pwr_state for DCN31\n\n[Why]\nWe\u0027ll exit optimized power state to do link detection but we won\u0027t enter\nback into the optimized power state.\n\nThis could potentially block s2idle entry depending on the sequencing,\nbut it also means we\u0027re losing some power during the transition period.\n\n[How]\nHook up the handler like DCN21. It was also missed like the\nexit_optimized_pwr_state callback.\n\nFixes: 64b1d0e8d500 (\"drm/amd/display: Add DCN3.1 HWSEQ\")\n\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nReviewed-by: Eric Yang \u003cEric.Yang2@amd.com\u003e\nAcked-by: Rodrigo Siqueira \u003cRodrigo.Siqueira@amd.com\u003e\nSigned-off-by: Nicholas Kazlauskas \u003cnicholas.kazlauskas@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "a07f8b9983543d465b50870ab4f845d4d710ed3f", "tree": "dc939d682f0e7eb4f429d2268a58d00b81be6ca0", "parents": [ "d97e631af2db84c8c9d63abf68d487d0bb559e4c" ], "author": { "name": "Nicholas Kazlauskas", "email": "nicholas.kazlauskas@amd.com", "time": "Thu Dec 09 13:53:36 2021 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Dec 28 16:51:24 2021 -0500" }, "message": "drm/amd/display: Send s0i2_rdy in stream_count \u003d\u003d 0 optimization\n\n[Why]\nOtherwise SMU won\u0027t mark Display as idle when trying to perform s2idle.\n\n[How]\nMark the bit in the dcn31 codepath, doesn\u0027t apply to older ASIC.\n\nIt needed to be split from phy refclk off to prevent entering s2idle\nwhen PSR was engaged but driver was not ready.\n\nFixes: 118a33151658 (\"drm/amd/display: Add DCN3.1 clock manager support\")\n\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nReviewed-by: Eric Yang \u003cEric.Yang2@amd.com\u003e\nAcked-by: Rodrigo Siqueira \u003cRodrigo.Siqueira@amd.com\u003e\nSigned-off-by: Nicholas Kazlauskas \u003cnicholas.kazlauskas@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "d97e631af2db84c8c9d63abf68d487d0bb559e4c", "tree": "1b719ce9b35561215e7078b6f16e8cd8eb951981", "parents": [ "2eb82577a16d4c8eb31e4ed520649850bb95b223" ], "author": { "name": "Lai, Derek", "email": "Derek.Lai@amd.com", "time": "Mon Dec 06 17:10:59 2021 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Dec 28 16:51:24 2021 -0500" }, "message": "drm/amd/display: Added power down for DCN10\n\n[Why]\nThe change of setting a timer callback on boot for 10 seconds is still\nworking, just lacked power down for DCN10.\n\n[How]\nAdded power down for DCN10.\n\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nReviewed-by: Anthony Koo \u003cAnthony.Koo@amd.com\u003e\nAcked-by: Rodrigo Siqueira \u003cRodrigo.Siqueira@amd.com\u003e\nSigned-off-by: Derek Lai \u003cDerek.Lai@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "2eb82577a16d4c8eb31e4ed520649850bb95b223", "tree": "903b23782d35293e9a34547424e5988d1572f85d", "parents": [ "ebae8973884ee9ac703b3bfe34cabbb118b18538" ], "author": { "name": "Charlene Liu", "email": "Charlene.Liu@amd.com", "time": "Sun Dec 05 21:19:30 2021 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Dec 28 16:51:24 2021 -0500" }, "message": "drm/amd/display: fix B0 TMDS deepcolor no dislay issue\n\n[why]\nB0 PHY C map to F, D map to G driver use logic instance, dmub does the\nremap. Driver still need use the right PHY instance to access right HW.\n\n[how]\nuse phyical instance when program PHY register.\n\n[note]\ncould move resync_control programming to dmub next.\n\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nReviewed-by: Dmytro Laktyushkin \u003cDmytro.Laktyushkin@amd.com\u003e\nReviewed-by: Jun Lei \u003cJun.Lei@amd.com\u003e\nAcked-by: Rodrigo Siqueira \u003cRodrigo.Siqueira@amd.com\u003e\nSigned-off-by: Charlene Liu \u003cCharlene.Liu@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "e7c124bd04631973a3cc0df19ab881b56d8a2d50", "tree": "8c6fa4af01c20d8c80d1c0220b791397a625faa0", "parents": [ "ecf71de775a049cbfa6298deceb8ba2083331171", "732bc2ff080c447f8524f40c970c481f5da6eed3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 28 13:33:06 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 28 13:33:06 2021 -0800" }, "message": "Merge tag \u0027selinux-pr-20211228\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPull selinux fix from Paul Moore:\n \"One more small SELinux patch to address an uninitialized stack\n variable\"\n\n* tag \u0027selinux-pr-20211228\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n selinux: initialize proto variable in selinux_ip_postroute_compat()\n" }, { "commit": "0f80bfbf4919e32f52fe1312c3900ff4fbb7eeb9", "tree": "3821b3382d4ac9fc2cd820ec557553db41b47a70", "parents": [ "5e0c325cdb714409a5b242c9e73a1b61157abb36" ], "author": { "name": "Adrian Hunter", "email": "adrian.hunter@intel.com", "time": "Wed Dec 15 10:06:36 2021 +0200" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Dec 28 17:26:25 2021 -0300" }, "message": "perf scripts python: intel-pt-events.py: Fix printing of switch events\n\nThe intel-pt-events.py script displays only the last of consecutive switch\nstatements but that may not be the last switch event for the CPU. Fix by\nkeeping a dictionary of last context switch keyed by CPU, and make it\npossible to see all switch events by adding option --all-switch-events.\n\nFixes: a92bf335fd82eeee (\"perf scripts python: intel-pt-events.py: Add branches to script\")\nSigned-off-by: Adrian Hunter \u003cadrian.hunter@intel.com\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Riccardo Mancini \u003crickyman7@gmail.com\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/r/20211215080636.149562-4-adrian.hunter@intel.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "5e0c325cdb714409a5b242c9e73a1b61157abb36", "tree": "d9aae5a58c274761cabc8591447ee207039ae6c9", "parents": [ "a78abde220243d6f44a265fe36c49957f6fa9851" ], "author": { "name": "Adrian Hunter", "email": "adrian.hunter@intel.com", "time": "Wed Dec 15 10:06:35 2021 +0200" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Dec 28 17:26:25 2021 -0300" }, "message": "perf script: Fix CPU filtering of a script\u0027s switch events\n\nCPU filtering was not being applied to a script\u0027s switch events.\n\nFixes: 5bf83c29a0ad2e78 (\"perf script: Add scripting operation process_switch()\")\nSigned-off-by: Adrian Hunter \u003cadrian.hunter@intel.com\u003e\nAcked-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Riccardo Mancini \u003crickyman7@gmail.com\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/r/20211215080636.149562-3-adrian.hunter@intel.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "a78abde220243d6f44a265fe36c49957f6fa9851", "tree": "90af02feebd6b9300643ae8e1d84736bb34c8beb", "parents": [ "9f3c16a430e8ac6b8211da106f4e4841d896ec99" ], "author": { "name": "Adrian Hunter", "email": "adrian.hunter@intel.com", "time": "Wed Dec 15 10:06:34 2021 +0200" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Dec 28 17:26:25 2021 -0300" }, "message": "perf intel-pt: Fix parsing of VM time correlation arguments\n\nParser did not take \u0027:\u0027 into account.\n\nExample:\n\n Before:\n\n $ perf record -e intel_pt//u uname\n Linux\n [ perf record: Woken up 1 times to write data ]\n [ perf record: Captured and wrote 0.026 MB perf.data ]\n $ perf inject -i perf.data --vm-time-correlation\u003d\"dry-run 123\"\n $ perf inject -i perf.data --vm-time-correlation\u003d\"dry-run 123:456\"\n Failed to parse VM Time Correlation options\n 0x620 [0x98]: failed to process type: 70 [Invalid argument]\n $\n\n After:\n\n $ perf inject -i perf.data --vm-time-correlation\u003d\"dry-run 123:456\"\n $\n\nFixes: e3ff42bdebcfeb5f (\"perf intel-pt: Parse VM Time Correlation options and set up decoding\")\nSigned-off-by: Adrian Hunter \u003cadrian.hunter@intel.com\u003e\nAcked-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Riccardo Mancini \u003crickyman7@gmail.com\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/r/20211215080636.149562-2-adrian.hunter@intel.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "9f3c16a430e8ac6b8211da106f4e4841d896ec99", "tree": "96e3de225e23465169ae5befe385d7a9d7ad270a", "parents": [ "ecf71de775a049cbfa6298deceb8ba2083331171" ], "author": { "name": "Miaoqian Lin", "email": "linmq006@gmail.com", "time": "Tue Dec 14 01:10:27 2021 +0000" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Tue Dec 28 17:26:25 2021 -0300" }, "message": "perf expr: Fix return value of ids__new()\n\ncallers of ids__new() function only do NULL checking for the return\nvalue. ids__new() calles hashmap__new(), which may return\nERR_PTR(-ENOMEM).\n\nInstead of changing the checking one-by-one return NULL instead of\nERR_PTR(-ENOMEM) to keep it consistent.\n\nSigned-off-by: Miaoqian Lin \u003clinmq006@gmail.com\u003e\nReviewed-by: German Gomez \u003cgerman.gomez@arm.com\u003e\nTested-by: German Gomez \u003cgerman.gomez@arm.com\u003e\nAcked-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Andi Kleen \u003cak@linux.intel.com\u003e\nCc: Ian Rogers \u003cirogers@google.com\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lore.kernel.org/lkml/20211214011030.20200-1-linmq006@gmail.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "ecf71de775a049cbfa6298deceb8ba2083331171", "tree": "001a722a1677a1773bf809682eaa1c2ed5825b95", "parents": [ "f651faaaba5f41ffac195e64f58483721e60eafc", "4daa9ff89ef27be43c15995412d6aee393a78200" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 28 11:46:15 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 28 11:46:15 2021 -0800" }, "message": "Merge tag \u0027auxdisplay-for-linus-v5.16\u0027 of git://github.com/ojeda/linux\n\nPull auxdisplay fixes from Miguel Ojeda:\n \"A couple of improvements for charlcd:\n\n - check pointer before dereferencing\n\n - fix coding style issue\"\n\n* tag \u0027auxdisplay-for-linus-v5.16\u0027 of git://github.com/ojeda/linux:\n auxdisplay: charlcd: checking for pointer reference before dereferencing\n auxdisplay: charlcd: fixing coding style issue\n" }, { "commit": "f651faaaba5f41ffac195e64f58483721e60eafc", "tree": "77d3ab88b81aa3a309a2ff5fe8a233a25f604250", "parents": [ "a8ad9a2434dc7967ab285437f443cae633b6fc1c", "8d84fca4375e3c35dadc16b8c7eee6821b2a575c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 28 11:42:01 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 28 11:42:01 2021 -0800" }, "message": "Merge tag \u0027powerpc-5.16-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fix from Michael Ellerman:\n \"Fix DEBUG_WX never reporting any WX mappings, due to use of an\n incorrect config symbol since we converted to using generic ptdump\"\n\n* tag \u0027powerpc-5.16-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/ptdump: Fix DEBUG_WX since generic ptdump conversion\n" }, { "commit": "f85846bbf43de38fb2c89fe7d2a085608c4eb25a", "tree": "a126b2282f900d3bf88121a1d9b1d8b9733788e8", "parents": [ "1e81dcc1ab7de7a789e60042ce82d5a612632599" ], "author": { "name": "James McLaughlin", "email": "james.mclaughlin@qsc.com", "time": "Fri Dec 17 16:49:33 2021 -0700" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Dec 28 09:54:11 2021 -0800" }, "message": "igc: Fix TX timestamp support for non-MSI-X platforms\n\nTime synchronization was not properly enabled on non-MSI-X platforms.\n\nFixes: 2c344ae24501 (\"igc: Add support for TX timestamping\")\nSigned-off-by: James McLaughlin \u003cjames.mclaughlin@qsc.com\u003e\nReviewed-by: Vinicius Costa Gomes \u003cvinicius.gomes@intel.com\u003e\nTested-by: Nechama Kraus \u003cnechamax.kraus@linux.intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "1e81dcc1ab7de7a789e60042ce82d5a612632599", "tree": "0eb735ecf2f17c8d15a78f3dc771d6fdb4e0d4f1", "parents": [ "16fa29aef7963293f8792789210002ec9f9607ac" ], "author": { "name": "Vinicius Costa Gomes", "email": "vinicius.gomes@intel.com", "time": "Mon Dec 13 16:39:49 2021 -0800" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Dec 28 09:54:10 2021 -0800" }, "message": "igc: Do not enable crosstimestamping for i225-V models\n\nIt was reported that when PCIe PTM is enabled, some lockups could\nbe observed with some integrated i225-V models.\n\nWhile the issue is investigated, we can disable crosstimestamp for\nthose models and see no loss of functionality, because those models\ndon\u0027t have any support for time synchronization.\n\nFixes: a90ec8483732 (\"igc: Add support for PTP getcrosststamp()\")\nLink: https://lore.kernel.org/all/924175a188159f4e03bd69908a91e606b574139b.camel@gmx.de/\nReported-by: Stefan Dietrich \u003croots@gmx.de\u003e\nSigned-off-by: Vinicius Costa Gomes \u003cvinicius.gomes@intel.com\u003e\nTested-by: Nechama Kraus \u003cnechamax.kraus@linux.intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "ebae8973884ee9ac703b3bfe34cabbb118b18538", "tree": "06b7389fda4ca1eea1a17e4217e7cea091d3bb61", "parents": [ "7be3be2b027c12e84833b3dc9597d3bb7e4c5464" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Dec 23 14:13:02 2021 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Dec 28 09:07:30 2021 -0500" }, "message": "drm/amdgpu: no DC support for headless chips\n\nChips with no display hardware should return false for\nDC support.\n\nv2: drop Arcturus and Aldebaran\n\nFixes: f7f12b25823c0d (\"drm/amdgpu: default to true in amdgpu_device_asic_has_dc_support\")\nReviewed-by: Evan Quan \u003cevan.quan@amd.com\u003e\nReviewed-by: Guchun Chen \u003cguchun.chen@amd.com\u003e\nReported-by: Tareque Md.Hanif \u003ctarequemd.hanif@yahoo.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "16fa29aef7963293f8792789210002ec9f9607ac", "tree": "7dc9d1354ef88f560485ae6e2ecf701b55ec9645", "parents": [ "1b9dadba502234eea7244879b8d5d126bfaf9f0c", "349d43127dac00c15231e8ffbcaabd70f7b0e544" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Dec 28 12:42:46 2021 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Dec 28 12:42:46 2021 +0000" }, "message": "Merge branch \u0027smc-fixes\u0027\n\nDust Li says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/smc: fix kernel panic caused by race of smc_sock\n\nThis patchset fixes the race between smc_release triggered by\nclose(2) and cdc_handle triggered by underlaying RDMA device.\n\nThe race is caused because the smc_connection may been released\nbefore the pending tx CDC messages got its CQEs. In order to fix\nthis, I add a counter to track how many pending WRs we have posted\nthrough the smc_connection, and only release the smc_connection\nafter there is no pending WRs on the connection.\n\nThe first patch prevents posting WR on a QP that is not in RTS\nstate. This patch is needed because if we post WR on a QP that\nis not in RTS state, ib_post_send() may success but no CQE will\nreturn, and that will confuse the counter tracking the pending\nWRs.\n\nThe second patch add a counter to track how many WRs were posted\nthrough the smc_connection, and don\u0027t reset the QP on link destroying\nto prevent leak of the counter.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "349d43127dac00c15231e8ffbcaabd70f7b0e544", "tree": "7dc9d1354ef88f560485ae6e2ecf701b55ec9645", "parents": [ "90cee52f2e780345d3629e278291aea5ac74f40f" ], "author": { "name": "Dust Li", "email": "dust.li@linux.alibaba.com", "time": "Tue Dec 28 17:03:25 2021 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Dec 28 12:42:45 2021 +0000" }, "message": "net/smc: fix kernel panic caused by race of smc_sock\n\nA crash occurs when smc_cdc_tx_handler() tries to access smc_sock\nbut smc_release() has already freed it.\n\n[ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88\n[ 4570.696048] #PF: supervisor write access in kernel mode\n[ 4570.696728] #PF: error_code(0x0002) - not-present page\n[ 4570.697401] PGD 0 P4D 0\n[ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI\n[ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111\n[ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0\n[ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30\n\u003c...\u003e\n[ 4570.711446] Call Trace:\n[ 4570.711746] \u003cIRQ\u003e\n[ 4570.711992] smc_cdc_tx_handler+0x41/0xc0\n[ 4570.712470] smc_wr_tx_tasklet_fn+0x213/0x560\n[ 4570.712981] ? smc_cdc_tx_dismisser+0x10/0x10\n[ 4570.713489] tasklet_action_common.isra.17+0x66/0x140\n[ 4570.714083] __do_softirq+0x123/0x2f4\n[ 4570.714521] irq_exit_rcu+0xc4/0xf0\n[ 4570.714934] common_interrupt+0xba/0xe0\n\nThough smc_cdc_tx_handler() checked the existence of smc connection,\nsmc_release() may have already dismissed and released the smc socket\nbefore smc_cdc_tx_handler() further visits it.\n\nsmc_cdc_tx_handler() |smc_release()\nif (!conn) |\n |\n |smc_cdc_tx_dismiss_slots()\n | smc_cdc_tx_dismisser()\n |\n |sock_put(\u0026smc-\u003esk) \u003c- last sock_put,\n | smc_sock freed\nbh_lock_sock(\u0026smc-\u003esk) (panic) |\n\nTo make sure we won\u0027t receive any CDC messages after we free the\nsmc_sock, add a refcount on the smc_connection for inflight CDC\nmessage(posted to the QP but haven\u0027t received related CQE), and\ndon\u0027t release the smc_connection until all the inflight CDC messages\nhaven been done, for both success or failed ones.\n\nUsing refcount on CDC messages brings another problem: when the link\nis going to be destroyed, smcr_link_clear() will reset the QP, which\nthen remove all the pending CQEs related to the QP in the CQ. To make\nsure all the CQEs will always come back so the refcount on the\nsmc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced\nby smc_ib_modify_qp_error().\nAnd remove the timeout in smc_wr_tx_wait_no_pending_sends() since we\nneed to wait for all pending WQEs done, or we may encounter use-after-\nfree when handling CQEs.\n\nFor IB device removal routine, we need to wait for all the QPs on that\ndevice been destroyed before we can destroy CQs on the device, or\nthe refcount on smc_connection won\u0027t reach 0 and smc_sock cannot be\nreleased.\n\nFixes: 5f08318f617b (\"smc: connection data control (CDC)\")\nReported-by: Wen Gu \u003cguwen@linux.alibaba.com\u003e\nSigned-off-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "90cee52f2e780345d3629e278291aea5ac74f40f", "tree": "bd949f7dcff078d5f1a839a41db8204e13e7205e", "parents": [ "1b9dadba502234eea7244879b8d5d126bfaf9f0c" ], "author": { "name": "Dust Li", "email": "dust.li@linux.alibaba.com", "time": "Tue Dec 28 17:03:24 2021 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Dec 28 12:42:45 2021 +0000" }, "message": "net/smc: don\u0027t send CDC/LLC message if link not ready\n\nWe found smc_llc_send_link_delete_all() sometimes wait\nfor 2s timeout when testing with RDMA link up/down.\nIt is possible when a smc_link is in ACTIVATING state,\nthe underlaying QP is still in RESET or RTR state, which\ncannot send any messages out.\n\nsmc_llc_send_link_delete_all() use smc_link_usable() to\nchecks whether the link is usable, if the QP is still in\nRESET or RTR state, but the smc_link is in ACTIVATING, this\nLLC message will always fail without any CQE entering the\nCQ, and we will always wait 2s before timeout.\n\nSince we cannot send any messages through the QP before\nthe QP enter RTS. I add a wrapper smc_link_sendable()\nwhich checks the state of QP along with the link state.\nAnd replace smc_link_usable() with smc_link_sendable()\nin all LLC \u0026 CDC message sending routine.\n\nFixes: 5f08318f617b (\"smc: connection data control (CDC)\")\nSigned-off-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1b9dadba502234eea7244879b8d5d126bfaf9f0c", "tree": "7f59a71a6ee030dc45a148908af7e477b228ef37", "parents": [ "5be60a945329d82f06fc755a43eeefbfc5f77d72" ], "author": { "name": "Wei Yongjun", "email": "weiyongjun1@huawei.com", "time": "Tue Dec 28 12:48:11 2021 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Dec 28 12:40:20 2021 +0000" }, "message": "NFC: st21nfca: Fix memory leak in device probe and remove\n\n\u0027phy-\u003epending_skb\u0027 is alloced when device probe, but forgot to free\nin the error handling path and remove path, this cause memory leak\nas follows:\n\nunreferenced object 0xffff88800bc06800 (size 512):\n comm \"8\", pid 11775, jiffies 4295159829 (age 9.032s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [\u003c00000000d66c09ce\u003e] __kmalloc_node_track_caller+0x1ed/0x450\n [\u003c00000000c93382b3\u003e] kmalloc_reserve+0x37/0xd0\n [\u003c000000005fea522c\u003e] __alloc_skb+0x124/0x380\n [\u003c0000000019f29f9a\u003e] st21nfca_hci_i2c_probe+0x170/0x8f2\n\nFix it by freeing \u0027pending_skb\u0027 in error and remove.\n\nFixes: 68957303f44a (\"NFC: ST21NFCA: Add driver for STMicroelectronics ST21NFCA NFC Chip\")\nReported-by: Hulk Robot \u003chulkci@huawei.com\u003e\nSigned-off-by: Wei Yongjun \u003cweiyongjun1@huawei.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5be60a945329d82f06fc755a43eeefbfc5f77d72", "tree": "852c09e5edb5ef9d632c02704215c9835d3dcc29", "parents": [ "1cd5384c88af5b59bf9f3b6c1a151bc14b88c2cd" ], "author": { "name": "Aleksander Jan Bajkowski", "email": "olek2@wp.pl", "time": "Mon Dec 27 17:22:03 2021 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Dec 28 12:18:18 2021 +0000" }, "message": "net: lantiq_xrx200: fix statistics of received bytes\n\nReceived frames have FCS truncated. There is no need\nto subtract FCS length from the statistics.\n\nFixes: fe1a56420cf2 (\"net: lantiq: Add Lantiq / Intel VRX200 Ethernet driver\")\nSigned-off-by: Aleksander Jan Bajkowski \u003colek2@wp.pl\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1cd5384c88af5b59bf9f3b6c1a151bc14b88c2cd", "tree": "bd55bb91ba242ae10b754ccc4ce110e46660ea17", "parents": [ "8b5fdfc57cc2471179d1c51081424ded833c16c8" ], "author": { "name": "Christophe JAILLET", "email": "christophe.jaillet@wanadoo.fr", "time": "Sun Dec 26 18:51:44 2021 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Dec 28 12:16:34 2021 +0000" }, "message": "net: ag71xx: Fix a potential double free in error handling paths\n\n\u0027ndev\u0027 is a managed resource allocated with devm_alloc_etherdev(), so there\nis no need to call free_netdev() explicitly or there will be a double\nfree().\n\nSimplify all error handling paths accordingly.\n\nFixes: d51b6ce441d3 (\"net: ethernet: add ag71xx driver\")\nSigned-off-by: Christophe JAILLET \u003cchristophe.jaillet@wanadoo.fr\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8b5fdfc57cc2471179d1c51081424ded833c16c8", "tree": "07fcbb421f1b990a1e5a4cb8cfd0c6c96e3348bc", "parents": [ "79b69a83705e621b258ac6d8ae6d3bfdb4b930aa" ], "author": { "name": "wolfgang huang", "email": "huangjinhui@kylinos.cn", "time": "Tue Dec 28 16:01:20 2021 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Dec 28 12:12:04 2021 +0000" }, "message": "mISDN: change function names to avoid conflicts\n\nAs we build for mips, we meet following error. l1_init error with\nmultiple definition. Some architecture devices usually marked with\nl1, l2, lxx as the start-up phase. so we change the mISDN function\nnames, align with Isdnl2_xxx.\n\nmips-linux-gnu-ld: drivers/isdn/mISDN/layer1.o: in function `l1_init\u0027:\n(.text+0x890): multiple definition of `l1_init\u0027; \\\narch/mips/kernel/bmips_5xxx_init.o:(.text+0xf0): first defined here\nmake[1]: *** [home/mips/kernel-build/linux/Makefile:1161: vmlinux] Error 1\n\nSigned-off-by: wolfgang huang \u003chuangjinhui@kylinos.cn\u003e\nReported-by: k2ci \u003ckernel-bot@kylinos.cn\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7be3be2b027c12e84833b3dc9597d3bb7e4c5464", "tree": "3562d5ee76b32d318df8d5332836fdd7a5246f46", "parents": [ "daf8de0874ab5b74b38a38726fdd3d07ef98a7ee" ], "author": { "name": "Evan Quan", "email": "evan.quan@amd.com", "time": "Fri Dec 17 19:05:06 2021 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Dec 27 13:08:28 2021 -0500" }, "message": "drm/amdgpu: put SMU into proper state on runpm suspending for BOCO capable platform\n\nBy setting mp1_state as PP_MP1_STATE_UNLOAD, MP1 will do some proper cleanups and\nput itself into a state ready for PNP. That can workaround some random resuming\nfailure observed on BOCO capable platforms.\n\nSigned-off-by: Evan Quan \u003cevan.quan@amd.com\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nReviewed-by: Guchun Chen \u003cguchun.chen@amd.com\u003e\nReviewed-by: Lijo Lazar \u003clijo.lazar@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "daf8de0874ab5b74b38a38726fdd3d07ef98a7ee", "tree": "26d6a9cec0b96af8b1d466649aa7fa17a5af248d", "parents": [ "8c45096c60d6ce6341c374636100ed1b2c1c33a1" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Nov 12 11:25:30 2021 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Dec 27 12:16:34 2021 -0500" }, "message": "drm/amdgpu: always reset the asic in suspend (v2)\n\nIf the platform suspend happens to fail and the power rail\nis not turned off, the GPU will be in an unknown state on\nresume, so reset the asic so that it will be in a known\ngood state on resume even if the platform suspend failed.\n\nv2: handle s0ix\n\nAcked-by: Luben Tuikov \u003cluben.tuikov@amd.com\u003e\nAcked-by: Evan Quan \u003cevan.quan@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "a8ad9a2434dc7967ab285437f443cae633b6fc1c", "tree": "366e95790e66fcc2d916052b1b5150e70239c3c5", "parents": [ "fc74e0a40e4f9fd0468e34045b0c45bba11dcbb2", "4bc5e64e6cf37007e436970024e5998ee0935651" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 27 08:58:35 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 27 08:58:35 2021 -0800" }, "message": "Merge tag \u0027efi-urgent-for-v5.16-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI fix from Ard Biesheuvel:\n \"Another EFI fix for v5.16:\n\n - Prevent missing prototype warning from breaking the build under\n CONFIG_WERROR\u003dy\"\n\n* tag \u0027efi-urgent-for-v5.16-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:\n efi: Move efifb_setup_from_dmi() prototype from arch headers\n" }, { "commit": "8c45096c60d6ce6341c374636100ed1b2c1c33a1", "tree": "d02e1c8c8b87fe9a2571c95908718fbd09e30c4f", "parents": [ "4d625a97a7e96be016382e3bb0a3cead05fec153" ], "author": { "name": "Prike Liang", "email": "Prike.Liang@amd.com", "time": "Mon Dec 13 16:17:02 2021 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Dec 27 11:57:25 2021 -0500" }, "message": "drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume\n\nIn the s0ix entry need retain gfx in the gfxoff state,so here need\u0027t\nset gfx cgpg in the S0ix suspend-resume process. Moreover move the S0ix\ncheck into SMU12 can simplify the code condition check.\n\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/1712\nSigned-off-by: Prike Liang \u003cPrike.Liang@amd.com\u003e\nReviewed-by: Evan Quan \u003cevan.quan@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "732bc2ff080c447f8524f40c970c481f5da6eed3", "tree": "67fb464fe0aa6eeff99dd09d704089b9158627d2", "parents": [ "cc274ae7763d9700a56659f3228641d7069e7a3f" ], "author": { "name": "Tom Rix", "email": "trix@redhat.com", "time": "Fri Dec 24 07:07:39 2021 -0800" }, "committer": { "name": "Paul Moore", "email": "paul@paul-moore.com", "time": "Mon Dec 27 10:41:20 2021 -0500" }, "message": "selinux: initialize proto variable in selinux_ip_postroute_compat()\n\nClang static analysis reports this warning\n\nhooks.c:5765:6: warning: 4th function call argument is an uninitialized\n value\n if (selinux_xfrm_postroute_last(sksec-\u003esid, skb, \u0026ad, proto))\n ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nselinux_parse_skb() can return ok without setting proto. The later call\nto selinux_xfrm_postroute_last() does an early check of proto and can\nreturn ok if the garbage proto value matches. So initialize proto.\n\nCc: stable@vger.kernel.org\nFixes: eef9b41622f2 (\"selinux: cleanup selinux_xfrm_sock_rcv_skb() and selinux_xfrm_postroute_last()\")\nSigned-off-by: Tom Rix \u003ctrix@redhat.com\u003e\n[PM: typo/spelling and checkpatch.pl description fixes]\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\n" }, { "commit": "79b69a83705e621b258ac6d8ae6d3bfdb4b930aa", "tree": "6e74633fa3b792deb3b9407b9ed3920dab8eeb4b", "parents": [ "7175f02c4e5f5a9430113ab9ca0fd0ce98b28a51" ], "author": { "name": "Krzysztof Kozlowski", "email": "krzysztof.kozlowski@canonical.com", "time": "Sun Dec 26 13:03:47 2021 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Dec 27 14:58:37 2021 +0000" }, "message": "nfc: uapi: use kernel size_t to fix user-space builds\n\nFix user-space builds if it includes /usr/include/linux/nfc.h before\nsome of other headers:\n\n /usr/include/linux/nfc.h:281:9: error: unknown type name ‘size_t’\n 281 | size_t service_name_len;\n | ^~~~~~\n\nFixes: d646960f7986 (\"NFC: Initial LLCP support\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7175f02c4e5f5a9430113ab9ca0fd0ce98b28a51", "tree": "85680742389aa4e8f8180557cd4121657d40ab6e", "parents": [ "ca506fca461b260ab32952b610c3d4aadc6c11fd" ], "author": { "name": "Dmitry V. Levin", "email": "ldv@altlinux.org", "time": "Sun Dec 26 16:01:27 2021 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Dec 27 14:58:03 2021 +0000" }, "message": "uapi: fix linux/nfc.h userspace compilation errors\n\nReplace sa_family_t with __kernel_sa_family_t to fix the following\nlinux/nfc.h userspace compilation errors:\n\n/usr/include/linux/nfc.h:266:2: error: unknown type name \u0027sa_family_t\u0027\n sa_family_t sa_family;\n/usr/include/linux/nfc.h:274:2: error: unknown type name \u0027sa_family_t\u0027\n sa_family_t sa_family;\n\nFixes: 23b7869c0fd0 (\"NFC: add the NFC socket raw protocol\")\nFixes: d646960f7986 (\"NFC: Initial LLCP support\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Dmitry V. Levin \u003cldv@altlinux.org\u003e\nReviewed-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ca506fca461b260ab32952b610c3d4aadc6c11fd", "tree": "fedfc3be53b74fb30c70463913e53663e5ba6af6", "parents": [ "5f50153288452e10b6edd69ec9112c49442b054a" ], "author": { "name": "Matthias-Christian Ott", "email": "ott@mirix.org", "time": "Sun Dec 26 23:12:08 2021 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Dec 27 14:52:06 2021 +0000" }, "message": "net: usb: pegasus: Do not drop long Ethernet frames\n\nThe D-Link DSB-650TX (2001:4002) is unable to receive Ethernet frames\nthat are longer than 1518 octets, for example, Ethernet frames that\ncontain 802.1Q VLAN tags.\n\nThe frames are sent to the pegasus driver via USB but the driver\ndiscards them because they have the Long_pkt field set to 1 in the\nreceived status report. The function read_bulk_callback of the pegasus\ndriver treats such received \"packets\" (in the terminology of the\nhardware) as errors but the field simply does just indicate that the\nEthernet frame (MAC destination to FCS) is longer than 1518 octets.\n\nIt seems that in the 1990s there was a distinction between\n\"giant\" (\u003e 1518) and \"runt\" (\u003c 64) frames and the hardware includes\nflags to indicate this distinction. It seems that the purpose of the\ndistinction \"giant\" frames was to not allow infinitely long frames due\nto transmission errors and to allow hardware to have an upper limit of\nthe frame size. However, the hardware already has such limit with its\n2048 octet receive buffer and, therefore, Long_pkt is merely a\nconvention and should not be treated as a receive error.\n\nActually, the hardware is even able to receive Ethernet frames with 2048\noctets which exceeds the claimed limit frame size limit of the driver of\n1536 octets (PEGASUS_MTU).\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Matthias-Christian Ott \u003cott@mirix.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5f50153288452e10b6edd69ec9112c49442b054a", "tree": "6046d36102a90f60cacce248cf9e4c4a663ce4c9", "parents": [ "6c25449e1a32c594d743df8e8258e8ef870b6a77" ], "author": { "name": "Zekun Shen", "email": "bruceshenzk@gmail.com", "time": "Sun Dec 26 21:32:45 2021 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Dec 27 14:49:53 2021 +0000" }, "message": "atlantic: Fix buff_ring OOB in aq_ring_rx_clean\n\nThe function obtain the next buffer without boundary check.\nWe should return with I/O error code.\n\nThe bug is found by fuzzing and the crash report is attached.\nIt is an OOB bug although reported as use-after-free.\n\n[ 4.804724] BUG: KASAN: use-after-free in aq_ring_rx_clean+0x1e88/0x2730 [atlantic]\n[ 4.805661] Read of size 4 at addr ffff888034fe93a8 by task ksoftirqd/0/9\n[ 4.806505]\n[ 4.806703] CPU: 0 PID: 9 Comm: ksoftirqd/0 Tainted: G W 5.6.0 #34\n[ 4.809030] Call Trace:\n[ 4.809343] dump_stack+0x76/0xa0\n[ 4.809755] print_address_description.constprop.0+0x16/0x200\n[ 4.810455] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic]\n[ 4.811234] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic]\n[ 4.813183] __kasan_report.cold+0x37/0x7c\n[ 4.813715] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic]\n[ 4.814393] kasan_report+0xe/0x20\n[ 4.814837] aq_ring_rx_clean+0x1e88/0x2730 [atlantic]\n[ 4.815499] ? hw_atl_b0_hw_ring_rx_receive+0x9a5/0xb90 [atlantic]\n[ 4.816290] aq_vec_poll+0x179/0x5d0 [atlantic]\n[ 4.816870] ? _GLOBAL__sub_I_65535_1_aq_pci_func_init+0x20/0x20 [atlantic]\n[ 4.817746] ? __next_timer_interrupt+0xba/0xf0\n[ 4.818322] net_rx_action+0x363/0xbd0\n[ 4.818803] ? call_timer_fn+0x240/0x240\n[ 4.819302] ? __switch_to_asm+0x40/0x70\n[ 4.819809] ? napi_busy_loop+0x520/0x520\n[ 4.820324] __do_softirq+0x18c/0x634\n[ 4.820797] ? takeover_tasklets+0x5f0/0x5f0\n[ 4.821343] run_ksoftirqd+0x15/0x20\n[ 4.821804] smpboot_thread_fn+0x2f1/0x6b0\n[ 4.822331] ? smpboot_unregister_percpu_thread+0x160/0x160\n[ 4.823041] ? __kthread_parkme+0x80/0x100\n[ 4.823571] ? smpboot_unregister_percpu_thread+0x160/0x160\n[ 4.824301] kthread+0x2b5/0x3b0\n[ 4.824723] ? kthread_create_on_node+0xd0/0xd0\n[ 4.825304] ret_from_fork+0x35/0x40\n\nSigned-off-by: Zekun Shen \u003cbruceshenzk@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6c25449e1a32c594d743df8e8258e8ef870b6a77", "tree": "5ab8d44b9ae18dfc7ac04c9334bca20369a2bec4", "parents": [ "6d7373dabfd3933ee30c40fc8c09d2a788f6ece1" ], "author": { "name": "yangxingwu", "email": "xingwu.yang@gmail.com", "time": "Mon Dec 27 16:29:51 2021 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Dec 27 14:47:14 2021 +0000" }, "message": "net: udp: fix alignment problem in udp4_seq_show()\n\n$ cat /pro/net/udp\n\nbefore:\n\n sl local_address rem_address st tx_queue rx_queue tr tm-\u003ewhen\n26050: 0100007F:0035 00000000:0000 07 00000000:00000000 00:00000000\n26320: 0100007F:0143 00000000:0000 07 00000000:00000000 00:00000000\n27135: 00000000:8472 00000000:0000 07 00000000:00000000 00:00000000\n\nafter:\n\n sl local_address rem_address st tx_queue rx_queue tr tm-\u003ewhen\n26050: 0100007F:0035 00000000:0000 07 00000000:00000000 00:00000000\n26320: 0100007F:0143 00000000:0000 07 00000000:00000000 00:00000000\n27135: 00000000:8472 00000000:0000 07 00000000:00000000 00:00000000\n\nSigned-off-by: yangxingwu \u003cxingwu.yang@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6d7373dabfd3933ee30c40fc8c09d2a788f6ece1", "tree": "5d0710bc18de96399506cd99e77f045c10defd99", "parents": [ "c1833c3964d5bd8c163bd4e01736a38bc473cb8a" ], "author": { "name": "Karsten Graul", "email": "kgraul@linux.ibm.com", "time": "Mon Dec 27 14:35:30 2021 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Dec 27 14:46:17 2021 +0000" }, "message": "net/smc: fix using of uninitialized completions\n\nIn smc_wr_tx_send_wait() the completion on index specified by\npend-\u003eidx is initialized and after smc_wr_tx_send() was called the wait\nfor completion starts. pend-\u003eidx is used to get the correct index for\nthe wait, but the pend structure could already be cleared in\nsmc_wr_tx_process_cqe().\nIntroduce pnd_idx to hold and use a local copy of the correct index.\n\nFixes: 09c61d24f96d (\"net/smc: wait for departure of an IB message\")\nSigned-off-by: Karsten Graul \u003ckgraul@linux.ibm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c1833c3964d5bd8c163bd4e01736a38bc473cb8a", "tree": "b6027a7e9ea168a993d100b153cd63fe591b19ba", "parents": [ "e6007b85dfa284c4726c249e3c2fc4181ca8e179" ], "author": { "name": "William Zhao", "email": "wizhao@redhat.com", "time": "Thu Dec 23 12:33:16 2021 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Dec 27 12:17:33 2021 +0000" }, "message": "ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate\n\nThe \"__ip6_tnl_parm\" struct was left uninitialized causing an invalid\nload of random data when the \"__ip6_tnl_parm\" struct was used elsewhere.\nAs an example, in the function \"ip6_tnl_xmit_ctl()\", it tries to access\nthe \"collect_md\" member. With \"__ip6_tnl_parm\" being uninitialized and\ncontaining random data, the UBSAN detected that \"collect_md\" held a\nnon-boolean value.\n\nThe UBSAN issue is as follows:\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nUBSAN: invalid-load in net/ipv6/ip6_tunnel.c:1025:14\nload of value 30 is not a valid value for type \u0027_Bool\u0027\nCPU: 1 PID: 228 Comm: kworker/1:3 Not tainted 5.16.0-rc4+ #8\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nWorkqueue: ipv6_addrconf addrconf_dad_work\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x44/0x57\nubsan_epilogue+0x5/0x40\n__ubsan_handle_load_invalid_value+0x66/0x70\n? __cpuhp_setup_state+0x1d3/0x210\nip6_tnl_xmit_ctl.cold.52+0x2c/0x6f [ip6_tunnel]\nvti6_tnl_xmit+0x79c/0x1e96 [ip6_vti]\n? lock_is_held_type+0xd9/0x130\n? vti6_rcv+0x100/0x100 [ip6_vti]\n? lock_is_held_type+0xd9/0x130\n? rcu_read_lock_bh_held+0xc0/0xc0\n? lock_acquired+0x262/0xb10\ndev_hard_start_xmit+0x1e6/0x820\n__dev_queue_xmit+0x2079/0x3340\n? mark_lock.part.52+0xf7/0x1050\n? netdev_core_pick_tx+0x290/0x290\n? kvm_clock_read+0x14/0x30\n? kvm_sched_clock_read+0x5/0x10\n? sched_clock_cpu+0x15/0x200\n? find_held_lock+0x3a/0x1c0\n? lock_release+0x42f/0xc90\n? lock_downgrade+0x6b0/0x6b0\n? mark_held_locks+0xb7/0x120\n? neigh_connected_output+0x31f/0x470\n? lockdep_hardirqs_on+0x79/0x100\n? neigh_connected_output+0x31f/0x470\n? ip6_finish_output2+0x9b0/0x1d90\n? rcu_read_lock_bh_held+0x62/0xc0\n? ip6_finish_output2+0x9b0/0x1d90\nip6_finish_output2+0x9b0/0x1d90\n? ip6_append_data+0x330/0x330\n? ip6_mtu+0x166/0x370\n? __ip6_finish_output+0x1ad/0xfb0\n? nf_hook_slow+0xa6/0x170\nip6_output+0x1fb/0x710\n? nf_hook.constprop.32+0x317/0x430\n? ip6_finish_output+0x180/0x180\n? __ip6_finish_output+0xfb0/0xfb0\n? lock_is_held_type+0xd9/0x130\nndisc_send_skb+0xb33/0x1590\n? __sk_mem_raise_allocated+0x11cf/0x1560\n? dst_output+0x4a0/0x4a0\n? ndisc_send_rs+0x432/0x610\naddrconf_dad_completed+0x30c/0xbb0\n? addrconf_rs_timer+0x650/0x650\n? addrconf_dad_work+0x73c/0x10e0\naddrconf_dad_work+0x73c/0x10e0\n? addrconf_dad_completed+0xbb0/0xbb0\n? rcu_read_lock_sched_held+0xaf/0xe0\n? rcu_read_lock_bh_held+0xc0/0xc0\nprocess_one_work+0x97b/0x1740\n? pwq_dec_nr_in_flight+0x270/0x270\nworker_thread+0x87/0xbf0\n? process_one_work+0x1740/0x1740\nkthread+0x3ac/0x490\n? set_kthread_struct+0x100/0x100\nret_from_fork+0x22/0x30\n\u003c/TASK\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nThe solution is to initialize \"__ip6_tnl_parm\" struct to zeros in the\n\"vti6_siocdevprivate()\" function.\n\nSigned-off-by: William Zhao \u003cwizhao@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d46f329a3f6048e04736e86cb13c880645048792", "tree": "f2b8cdbfde81aaa5a06756e21b59524287506c41", "parents": [ "0f9d36af8f211d296ffd23bdce61a72cdfbb1a3c" ], "author": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Tue Dec 14 11:59:13 2021 -0800" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Mon Dec 27 11:33:40 2021 +0200" }, "message": "drm/i915: Increment composite fence seqno\n\nIncrement composite fence seqno on each fence creation.\n\nFixes: 544460c33821 (\"drm/i915: Multi-BB execbuf\")\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nReviewed-by: John Harrison \u003cJohn.C.Harrison@Intel.com\u003e\nSigned-off-by: John Harrison \u003cJohn.C.Harrison@Intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20211214195913.35735-1-matthew.brost@intel.com\n(cherry picked from commit 62eeb9ae1364cd96991ccc6e3c5c69d66b8c64df)\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n" }, { "commit": "0f9d36af8f211d296ffd23bdce61a72cdfbb1a3c", "tree": "32066af8b574aa41fc04c1ad3b857f4ee06eaa79", "parents": [ "fc74e0a40e4f9fd0468e34045b0c45bba11dcbb2" ], "author": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Sat Dec 18 16:19:09 2021 -0800" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Mon Dec 27 11:33:34 2021 +0200" }, "message": "drm/i915: Fix possible uninitialized variable in parallel extension\n\n\u0027prev_engine\u0027 was declared inside the output loop and checked in the\ninner after at least 1 pass of either loop. The variable should be\ndeclared outside both loops as it needs to be persistent across the\nentire loop structure.\n\nFixes: e5e32171a2cf (\"drm/i915/guc: Connect UAPI to GuC multi-lrc interface\")\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nReviewed-by: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\nSigned-off-by: John Harrison \u003cJohn.C.Harrison@Intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20211219001909.24348-1-matthew.brost@intel.com\n(cherry picked from commit cbffbac9c14220b8716b0a9c29d72243f6b14ef3)\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n" }, { "commit": "fc74e0a40e4f9fd0468e34045b0c45bba11dcbb2", "tree": "2f3ee6675870be058ddb79a0f2fa5514f49799e8", "parents": [ "e8ffcd3ab0e5d7332cc75c214fe74e52240b117b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 26 13:17:17 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 26 13:17:17 2021 -0800" }, "message": "Linux 5.16-rc7\n" }, { "commit": "e8ffcd3ab0e5d7332cc75c214fe74e52240b117b", "tree": "ccf354734caebaa425909462d842368b363e610d", "parents": [ "2afa90bd1c7526766b5eadb1856988b61a31501f", "57690554abe135fee81d6ac33cc94d75a7e224bb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 26 10:28:55 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 26 10:28:55 2021 -0800" }, "message": "Merge tag \u0027x86_urgent_for_v5.16_rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Borislav Petkov:\n\n - Prevent potential undefined behavior due to shifting pkey constants\n into the sign bit\n\n - Move the EFI memory reservation code *after* the efi\u003d cmdline parsing\n has happened\n\n - Revert two commits which turned out to be the wrong direction to\n chase when accommodating early memblock reservations consolidation\n and command line parameters parsing\n\n* tag \u0027x86_urgent_for_v5.16_rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/pkey: Fix undefined behaviour with PKRU_WD_BIT\n x86/boot: Move EFI range reservation after cmdline parsing\n Revert \"x86/boot: Pull up cmdline preparation and early param parsing\"\n Revert \"x86/boot: Mark prepare_command_line() __init\"\n" }, { "commit": "2afa90bd1c7526766b5eadb1856988b61a31501f", "tree": "d0efa841b33cafa9fd0b03b14b230e4697753c7e", "parents": [ "438645193e59e91761ccb3fa55f6ce70b615ff93", "dcce50e6cc4d86a63dc0a9a6ee7d4f948ccd53a1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 26 10:19:40 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 26 10:19:40 2021 -0800" }, "message": "Merge tag \u0027objtool_urgent_for_v5.16_rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull objtool fixes from Borislav Petkov:\n\n - Prevent clang from reordering the reachable annotation in\n an inline asm statement without inputs\n\n - Fix objtool builds on non-glibc systems due to undefined\n __always_inline\n\n* tag \u0027objtool_urgent_for_v5.16_rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n compiler.h: Fix annotation macro misplacement with Clang\n uapi: Fix undefined __always_inline on non-glibc systems\n" }, { "commit": "438645193e59e91761ccb3fa55f6ce70b615ff93", "tree": "efe5a60788c0062952e1f83711efab58da1072f4", "parents": [ "e2ae0d4a6b0ba461542f0fd0ba0b828658013e9f", "b67210cc217f9ca1c576909454d846970c13dfd4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 20:00:09 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 20:00:09 2021 -0800" }, "message": "Merge tag \u0027pinctrl-v5.16-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n \"Some hopefully final pin control fixes for the v5.16 kernel:\n\n - Fix an out-of-bounds bug in the Mediatek driver\n\n - Fix an init order bug in the Broadcom BCM2835 driver\n\n - Fix a GPIO offset bug in the STM32 driver\"\n\n* tag \u0027pinctrl-v5.16-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines\n pinctrl: bcm2835: Change init order for gpio hogs\n pinctrl: mediatek: fix global-out-of-bounds issue\n" }, { "commit": "e2ae0d4a6b0ba461542f0fd0ba0b828658013e9f", "tree": "99e3b3590ab861c584e65d88a6df0bbb4aef433f", "parents": [ "5b5e3d03470205b98363f50b8d6a7f5f40440458", "cdc5287acad9ede121924a9c9313544b80d15842" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 13:08:22 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 13:08:22 2021 -0800" }, "message": "Merge tag \u0027hwmon-for-v5.16-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n \"A couple of lm90 driver fixes. None of them are critical, but they\n should nevertheless be fixed\"\n\n* tag \u0027hwmon-for-v5.16-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (lm90) Do not report \u0027busy\u0027 status bit as alarm\n hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681\n hwmon: (lm90) Drop critical attribute support for MAX6654\n hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations\n hwmon: (lm90) Fix usage of CONFIG2 register in detect function\n" }, { "commit": "5b5e3d03470205b98363f50b8d6a7f5f40440458", "tree": "3787e7bd3fda3f898c7f88b862bfeb3293583e14", "parents": [ "d0cc67b2781654ac71c73d303e0347e5e9b10ad3", "4ebfee2bbc1a9c343dd50565ba5ae249fac32267" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 13:00:14 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 13:00:14 2021 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n \"A few small updates to drivers.\n\n Of note we are now deferring probes of i8042 on some Asus devices as\n the controller is not ready to respond to queries first time around\n when the driver is compiled into the kernel\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312\n Input: atmel_mxt_ts - fix double free in mxt_read_info_block\n Input: goodix - fix memory leak in goodix_firmware_upload\n Input: goodix - add id-\u003emodel mapping for the \"9111\" model\n Input: goodix - try not to touch the reset-pin on x86/ACPI devices\n Input: i8042 - enable deferred probe quirk for ASUS UM325UA\n Input: elantech - fix stack out of bound access in elantech_change_report_id()\n Input: iqs626a - prohibit inlining of channel parsing functions\n Input: i8042 - add deferred probe support\n" }, { "commit": "d0cc67b2781654ac71c73d303e0347e5e9b10ad3", "tree": "8e7b6f8d8eb7ddbef57a1ab91780b4e5b13201ad", "parents": [ "b927dfc67d05a72167ab980c375ed98b2ee9c2c6", "2a57d83c78f889bf3f54eede908d0643c40d5418" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:30:03 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:30:03 2021 -0800" }, "message": "Merge branch \u0027akpm\u0027 (patches from Andrew)\n\nMerge misc fixes from Andrew Morton:\n \"9 patches.\n\n Subsystems affected by this patch series: mm (kfence, mempolicy,\n memory-failure, pagemap, pagealloc, damon, and memory-failure),\n core-kernel, and MAINTAINERS\"\n\n* emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e:\n mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()\n mm/damon/dbgfs: protect targets destructions with kdamond_lock\n mm/page_alloc: fix __alloc_size attribute for alloc_pages_exact_nid\n mm: delete unsafe BUG from page_cache_add_speculative()\n mm, hwpoison: fix condition in free hugetlb page path\n MAINTAINERS: mark more list instances as moderated\n kernel/crash_core: suppress unknown crashkernel parameter warning\n mm: mempolicy: fix THP allocations escaping mempolicy restrictions\n kfence: fix memory leak when cat kfence objects\n" }, { "commit": "2a57d83c78f889bf3f54eede908d0643c40d5418", "tree": "8aa64773bd3af0d98adb485d0f03b2469f40d6ba", "parents": [ "34796417964b8d0aef45a99cf6c2d20cebe33733" ], "author": { "name": "Liu Shixin", "email": "liushixin2@huawei.com", "time": "Fri Dec 24 21:12:58 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:20:56 2021 -0800" }, "message": "mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()\n\nHulk Robot reported a panic in put_page_testzero() when testing\nmadvise() with MADV_SOFT_OFFLINE. The BUG() is triggered when retrying\nget_any_page(). This is because we keep MF_COUNT_INCREASED flag in\nsecond try but the refcnt is not increased.\n\n page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) \u003d\u003d 0)\n ------------[ cut here ]------------\n kernel BUG at include/linux/mm.h:737!\n invalid opcode: 0000 [#1] PREEMPT SMP\n CPU: 5 PID: 2135 Comm: sshd Tainted: G B 5.16.0-rc6-dirty #373\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n RIP: release_pages+0x53f/0x840\n Call Trace:\n free_pages_and_swap_cache+0x64/0x80\n tlb_flush_mmu+0x6f/0x220\n unmap_page_range+0xe6c/0x12c0\n unmap_single_vma+0x90/0x170\n unmap_vmas+0xc4/0x180\n exit_mmap+0xde/0x3a0\n mmput+0xa3/0x250\n do_exit+0x564/0x1470\n do_group_exit+0x3b/0x100\n __do_sys_exit_group+0x13/0x20\n __x64_sys_exit_group+0x16/0x20\n do_syscall_64+0x34/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n Modules linked in:\n ---[ end trace e99579b570fe0649 ]---\n RIP: 0010:release_pages+0x53f/0x840\n\nLink: https://lkml.kernel.org/r/20211221074908.3910286-1-liushixin2@huawei.com\nFixes: b94e02822deb (\"mm,hwpoison: try to narrow window race for free pages\")\nSigned-off-by: Liu Shixin \u003cliushixin2@huawei.com\u003e\nReported-by: Hulk Robot \u003chulkci@huawei.com\u003e\nReviewed-by: Oscar Salvador \u003cosalvador@suse.de\u003e\nAcked-by: Naoya Horiguchi \u003cnaoya.horiguchi@nec.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "34796417964b8d0aef45a99cf6c2d20cebe33733", "tree": "580b499bc32555b25e5f8f011409d7a8fe925667", "parents": [ "595ec1973c276f6c0c1de8aca5eef8dfd81f9b49" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Fri Dec 24 21:12:54 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:20:56 2021 -0800" }, "message": "mm/damon/dbgfs: protect targets destructions with kdamond_lock\n\nDAMON debugfs interface iterates current monitoring targets in\n\u0027dbgfs_target_ids_read()\u0027 while holding the corresponding\n\u0027kdamond_lock\u0027. However, it also destructs the monitoring targets in\n\u0027dbgfs_before_terminate()\u0027 without holding the lock. This can result in\na use_after_free bug. This commit avoids the race by protecting the\ndestruction with the corresponding \u0027kdamond_lock\u0027.\n\nLink: https://lkml.kernel.org/r/20211221094447.2241-1-sj@kernel.org\nReported-by: Sangwoo Bae \u003csangwoob@amazon.com\u003e\nFixes: 4bc05954d007 (\"mm/damon: implement a debugfs-based user space interface\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[5.15.x]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "595ec1973c276f6c0c1de8aca5eef8dfd81f9b49", "tree": "488e6ef636209d2491847bc98eec9020c6193aeb", "parents": [ "94ab10dd42a70acc5208a41325617e3d9cf81a70" ], "author": { "name": "Thibaut Sautereau", "email": "thibaut.sautereau@ssi.gouv.fr", "time": "Fri Dec 24 21:12:51 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:20:56 2021 -0800" }, "message": "mm/page_alloc: fix __alloc_size attribute for alloc_pages_exact_nid\n\nThe second parameter of alloc_pages_exact_nid is the one indicating the\nsize of memory pointed by the returned pointer.\n\nLink: https://lkml.kernel.org/r/YbjEgwhn4bGblp//@coeus\nFixes: abd58f38dfb4 (\"mm/page_alloc: add __alloc_size attributes for better bounds checking\")\nSigned-off-by: Thibaut Sautereau \u003cthibaut.sautereau@ssi.gouv.fr\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Daniel Micay \u003cdanielmicay@gmail.com\u003e\nCc: Levente Polyak \u003clevente@leventepolyak.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "94ab10dd42a70acc5208a41325617e3d9cf81a70", "tree": "2e311202b36a9e0f1f37647e169cbd0052da6155", "parents": [ "e37e7b0b3bd52ec4f8ab71b027bcec08f57f1b3b" ], "author": { "name": "Hugh Dickins", "email": "hughd@google.com", "time": "Fri Dec 24 21:12:48 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:20:55 2021 -0800" }, "message": "mm: delete unsafe BUG from page_cache_add_speculative()\n\nIt is not easily reproducible, but on 5.16-rc I have several times hit\nthe VM_BUG_ON_PAGE(PageTail(page), page) in\npage_cache_add_speculative(): usually from filemap_get_read_batch() for\nan ext4 read, yesterday from next_uptodate_page() from\nfilemap_map_pages() for a shmem fault.\n\nThat BUG used to be placed where page_ref_add_unless() had succeeded,\nbut now it is placed before folio_ref_add_unless() is attempted: that is\nnot safe, since it is only the acquired reference which makes the page\nsafe from racing THP collapse or split.\n\nWe could keep the BUG, checking PageTail only when\nfolio_ref_try_add_rcu() has succeeded; but I don\u0027t think it adds much\nvalue - just delete it.\n\nLink: https://lkml.kernel.org/r/8b98fc6f-3439-8614-c3f3-945c659a1aba@google.com\nFixes: 020853b6f5ea (\"mm: Add folio_try_get_rcu()\")\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nReviewed-by: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: William Kucharski \u003cwilliam.kucharski@oracle.com\u003e\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: Mike Rapoport \u003crppt@linux.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e37e7b0b3bd52ec4f8ab71b027bcec08f57f1b3b", "tree": "01b196046df27a6f93f99b6e9df0d7d1d1e77f5f", "parents": [ "7e5b901e4609441fc6bb94701c4743b39b6c277e" ], "author": { "name": "Naoya Horiguchi", "email": "naoya.horiguchi@nec.com", "time": "Fri Dec 24 21:12:45 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:20:55 2021 -0800" }, "message": "mm, hwpoison: fix condition in free hugetlb page path\n\nWhen a memory error hits a tail page of a free hugepage,\n__page_handle_poison() is expected to be called to isolate the error in\n4kB unit, but it\u0027s not called due to the outdated if-condition in\nmemory_failure_hugetlb(). This loses the chance to isolate the error in\nthe finer unit, so it\u0027s not optimal. Drop the condition.\n\nThis \"(p !\u003d head \u0026\u0026 TestSetPageHWPoison(head)\" condition is based on the\nold semantics of PageHWPoison on hugepage (where PG_hwpoison flag was\nset on the subpage), so it\u0027s not necessray any more. By getting to set\nPG_hwpoison on head page for hugepages, concurrent error events on\ndifferent subpages in a single hugepage can be prevented by\nTestSetPageHWPoison(head) at the beginning of memory_failure_hugetlb().\nSo dropping the condition should not reopen the race window originally\nmentioned in commit b985194c8c0a (\"hwpoison, hugetlb:\nlock_page/unlock_page does not match for handling a free hugepage\")\n\n[naoya.horiguchi@linux.dev: fix \"HardwareCorrupted\" counter]\n Link: https://lkml.kernel.org/r/20211220084851.GA1460264@u2004\n\nLink: https://lkml.kernel.org/r/20211210110208.879740-1-naoya.horiguchi@linux.dev\nSigned-off-by: Naoya Horiguchi \u003cnaoya.horiguchi@nec.com\u003e\nReported-by: Fei Luo \u003cluofei@unicloud.com\u003e\nReviewed-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[5.14+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "7e5b901e4609441fc6bb94701c4743b39b6c277e", "tree": "110c4d54f9da2ed30c894cfe76a79cfbf4dcff22", "parents": [ "71d2bcec2d4d69ff109c497e6611d6c53c8926d4" ], "author": { "name": "Randy Dunlap", "email": "rdunlap@infradead.org", "time": "Fri Dec 24 21:12:42 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:20:55 2021 -0800" }, "message": "MAINTAINERS: mark more list instances as moderated\n\nSome lists that are moderated are not marked as moderated consistently,\nso mark them all as moderated.\n\nLink: https://lkml.kernel.org/r/20211209001330.18558-1-rdunlap@infradead.org\nSigned-off-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\nCc: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\nCc: Conor Culhane \u003cconor.culhane@silvaco.com\u003e\nCc: Ryder Lee \u003cryder.lee@mediatek.com\u003e\nCc: Jianjun Wang \u003cjianjun.wang@mediatek.com\u003e\nCc: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "71d2bcec2d4d69ff109c497e6611d6c53c8926d4", "tree": "974ec36efc4dc51d56f448190c7853b5c8af0f03", "parents": [ "338635340669d5b317c7e8dcf4fff4a0f3651d87" ], "author": { "name": "Philipp Rudo", "email": "prudo@redhat.com", "time": "Fri Dec 24 21:12:39 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:20:55 2021 -0800" }, "message": "kernel/crash_core: suppress unknown crashkernel parameter warning\n\nWhen booting with crashkernel\u003d on the kernel command line a warning\nsimilar to\n\n Kernel command line: ro console\u003dttyS0 crashkernel\u003d256M\n Unknown kernel command line parameters \"crashkernel\u003d256M\", will be passed to user space.\n\nis printed.\n\nThis comes from crashkernel\u003d being parsed independent from the kernel\nparameter handling mechanism. So the code in init/main.c doesn\u0027t know\nthat crashkernel\u003d is a valid kernel parameter and prints this incorrect\nwarning.\n\nSuppress the warning by adding a dummy early_param handler for\ncrashkernel\u003d.\n\nLink: https://lkml.kernel.org/r/20211208133443.6867-1-prudo@redhat.com\nFixes: 86d1919a4fb0 (\"init: print out unknown kernel parameters\")\nSigned-off-by: Philipp Rudo \u003cprudo@redhat.com\u003e\nAcked-by: Baoquan He \u003cbhe@redhat.com\u003e\nCc: Andrew Halaney \u003cahalaney@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "338635340669d5b317c7e8dcf4fff4a0f3651d87", "tree": "d5f9d15f079098d035ec89814ec22b0256818f07", "parents": [ "0129ab1f268b6cf88825eae819b9b84aa0a85634" ], "author": { "name": "Andrey Ryabinin", "email": "arbn@yandex-team.com", "time": "Fri Dec 24 21:12:35 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:20:55 2021 -0800" }, "message": "mm: mempolicy: fix THP allocations escaping mempolicy restrictions\n\nalloc_pages_vma() may try to allocate THP page on the local NUMA node\nfirst:\n\n\tpage \u003d __alloc_pages_node(hpage_node,\n\t\tgfp | __GFP_THISNODE | __GFP_NORETRY, order);\n\nAnd if the allocation fails it retries allowing remote memory:\n\n\tif (!page \u0026\u0026 (gfp \u0026 __GFP_DIRECT_RECLAIM))\n \t\tpage \u003d __alloc_pages_node(hpage_node,\n\t\t\t\t\tgfp, order);\n\nHowever, this retry allocation completely ignores memory policy nodemask\nallowing allocation to escape restrictions.\n\nThe first appearance of this bug seems to be the commit ac5b2c18911f\n(\"mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings\").\n\nThe bug disappeared later in the commit 89c83fb539f9 (\"mm, thp:\nconsolidate THP gfp handling into alloc_hugepage_direct_gfpmask\") and\nreappeared again in slightly different form in the commit 76e654cc91bb\n(\"mm, page_alloc: allow hugepage fallback to remote nodes when\nmadvised\")\n\nFix this by passing correct nodemask to the __alloc_pages() call.\n\nThe demonstration/reproducer of the problem:\n\n $ mount -oremount,size\u003d4G,huge\u003dalways /dev/shm/\n $ echo always \u003e /sys/kernel/mm/transparent_hugepage/defrag\n $ cat mbind_thp.c\n #include \u003cunistd.h\u003e\n #include \u003csys/mman.h\u003e\n #include \u003csys/stat.h\u003e\n #include \u003cfcntl.h\u003e\n #include \u003cassert.h\u003e\n #include \u003cstdlib.h\u003e\n #include \u003cstdio.h\u003e\n #include \u003cnumaif.h\u003e\n\n #define SIZE 2ULL \u003c\u003c 30\n int main(int argc, char **argv)\n {\n int fd;\n unsigned long long i;\n char *addr;\n pid_t pid;\n char buf[100];\n unsigned long nodemask \u003d 1;\n\n fd \u003d open(\"/dev/shm/test\", O_RDWR|O_CREAT);\n assert(fd \u003e 0);\n assert(ftruncate(fd, SIZE) \u003d\u003d 0);\n\n addr \u003d mmap(NULL, SIZE, PROT_READ|PROT_WRITE,\n MAP_SHARED, fd, 0);\n\n assert(mbind(addr, SIZE, MPOL_BIND, \u0026nodemask, 2, MPOL_MF_STRICT|MPOL_MF_MOVE)\u003d\u003d0);\n for (i \u003d 0; i \u003c SIZE; i+\u003d4096) {\n addr[i] \u003d 1;\n }\n pid \u003d getpid();\n snprintf(buf, sizeof(buf), \"grep shm /proc/%d/numa_maps\", pid);\n system(buf);\n sleep(10000);\n\n return 0;\n }\n $ gcc mbind_thp.c -o mbind_thp -lnuma\n $ numactl -H\n available: 2 nodes (0-1)\n node 0 cpus: 0 2\n node 0 size: 1918 MB\n node 0 free: 1595 MB\n node 1 cpus: 1 3\n node 1 size: 2014 MB\n node 1 free: 1731 MB\n node distances:\n node 0 1\n 0: 10 20\n 1: 20 10\n $ rm -f /dev/shm/test; taskset -c 0 ./mbind_thp\n 7fd970a00000 bind:0 file\u003d/dev/shm/test dirty\u003d524288 active\u003d0 N0\u003d396800 N1\u003d127488 kernelpagesize_kB\u003d4\n\nLink: https://lkml.kernel.org/r/20211208165343.22349-1-arbn@yandex-team.com\nFixes: ac5b2c18911f (\"mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings\")\nSigned-off-by: Andrey Ryabinin \u003carbn@yandex-team.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "0129ab1f268b6cf88825eae819b9b84aa0a85634", "tree": "4921fedcb3c7fa5eb73e9e16774e820e5c64eaf6", "parents": [ "bc491fb12513e79702c6f936c838f792b5389129" ], "author": { "name": "Baokun Li", "email": "libaokun1@huawei.com", "time": "Fri Dec 24 21:12:32 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 25 12:20:55 2021 -0800" }, "message": "kfence: fix memory leak when cat kfence objects\n\nHulk robot reported a kmemleak problem:\n\n unreferenced object 0xffff93d1d8cc02e8 (size 248):\n comm \"cat\", pid 23327, jiffies 4624670141 (age 495992.217s)\n hex dump (first 32 bytes):\n 00 40 85 19 d4 93 ff ff 00 10 00 00 00 00 00 00 .@..............\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n seq_open+0x2a/0x80\n full_proxy_open+0x167/0x1e0\n do_dentry_open+0x1e1/0x3a0\n path_openat+0x961/0xa20\n do_filp_open+0xae/0x120\n do_sys_openat2+0x216/0x2f0\n do_sys_open+0x57/0x80\n do_syscall_64+0x33/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n unreferenced object 0xffff93d419854000 (size 4096):\n comm \"cat\", pid 23327, jiffies 4624670141 (age 495992.217s)\n hex dump (first 32 bytes):\n 6b 66 65 6e 63 65 2d 23 32 35 30 3a 20 30 78 30 kfence-#250: 0x0\n 30 30 30 30 30 30 30 37 35 34 62 64 61 31 32 2d 0000000754bda12-\n backtrace:\n seq_read_iter+0x313/0x440\n seq_read+0x14b/0x1a0\n full_proxy_read+0x56/0x80\n vfs_read+0xa5/0x1b0\n ksys_read+0xa0/0xf0\n do_syscall_64+0x33/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nI find that we can easily reproduce this problem with the following\ncommands:\n\n\tcat /sys/kernel/debug/kfence/objects\n\techo scan \u003e /sys/kernel/debug/kmemleak\n\tcat /sys/kernel/debug/kmemleak\n\nThe leaked memory is allocated in the stack below:\n\n do_syscall_64\n do_sys_open\n do_dentry_open\n full_proxy_open\n seq_open ---\u003e alloc seq_file\n vfs_read\n full_proxy_read\n seq_read\n seq_read_iter\n traverse ---\u003e alloc seq_buf\n\nAnd it should have been released in the following process:\n\n do_syscall_64\n syscall_exit_to_user_mode\n exit_to_user_mode_prepare\n task_work_run\n ____fput\n __fput\n full_proxy_release ---\u003e free here\n\nHowever, the release function corresponding to file_operations is not\nimplemented in kfence. As a result, a memory leak occurs. Therefore,\nthe solution to this problem is to implement the corresponding release\nfunction.\n\nLink: https://lkml.kernel.org/r/20211206133628.2822545-1-libaokun1@huawei.com\nFixes: 0ce20dd84089 (\"mm: add Kernel Electric-Fence infrastructure\")\nSigned-off-by: Baokun Li \u003clibaokun1@huawei.com\u003e\nReported-by: Hulk Robot \u003chulkci@huawei.com\u003e\nAcked-by: Marco Elver \u003celver@google.com\u003e\nReviewed-by: Kefeng Wang \u003cwangkefeng.wang@huawei.com\u003e\nCc: Alexander Potapenko \u003cglider@google.com\u003e\nCc: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: Yu Kuai \u003cyukuai3@huawei.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e6007b85dfa284c4726c249e3c2fc4181ca8e179", "tree": "fb3f4f610750825f428b2359fec02bcd3ce142ad", "parents": [ "5ec7d18d1813a5bead0b495045606c93873aecbb" ], "author": { "name": "Ma Xinjian", "email": "xinjianx.ma@intel.com", "time": "Fri Dec 24 17:59:28 2021 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Dec 25 17:15:49 2021 +0000" }, "message": "selftests: mptcp: Remove the deprecated config NFT_COUNTER\n\nNFT_COUNTER was removed since\n390ad4295aa (\"netfilter: nf_tables: make counter support built-in\")\nLKP/0Day will check if all configs listing under selftests are able to\nbe enabled properly.\n\nFor the missing configs, it will report something like:\nLKP WARN miss config CONFIG_NFT_COUNTER\u003d of net/mptcp/config\n\n- it\u0027s not reasonable to keep the deprecated configs.\n- configs under kselftests are recommended by corresponding tests.\nSo if some configs are missing, it will impact the testing results\n\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nSigned-off-by: Ma Xinjian \u003cxinjianx.ma@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5ec7d18d1813a5bead0b495045606c93873aecbb", "tree": "d6929bddd265b41fc2e785ae553cd0edf60beb41", "parents": [ "b45396afa4177f2b1ddfeff7185da733fade1dc3" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Thu Dec 23 13:04:30 2021 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Dec 25 17:13:37 2021 +0000" }, "message": "sctp: use call_rcu to free endpoint\n\nThis patch is to delay the endpoint free by calling call_rcu() to fix\nanother use-after-free issue in sctp_sock_dump():\n\n BUG: KASAN: use-after-free in __lock_acquire+0x36d9/0x4c20\n Call Trace:\n __lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218\n lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844\n __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]\n _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168\n spin_lock_bh include/linux/spinlock.h:334 [inline]\n __lock_sock+0x203/0x350 net/core/sock.c:2253\n lock_sock_nested+0xfe/0x120 net/core/sock.c:2774\n lock_sock include/net/sock.h:1492 [inline]\n sctp_sock_dump+0x122/0xb20 net/sctp/diag.c:324\n sctp_for_each_transport+0x2b5/0x370 net/sctp/socket.c:5091\n sctp_diag_dump+0x3ac/0x660 net/sctp/diag.c:527\n __inet_diag_dump+0xa8/0x140 net/ipv4/inet_diag.c:1049\n inet_diag_dump+0x9b/0x110 net/ipv4/inet_diag.c:1065\n netlink_dump+0x606/0x1080 net/netlink/af_netlink.c:2244\n __netlink_dump_start+0x59a/0x7c0 net/netlink/af_netlink.c:2352\n netlink_dump_start include/linux/netlink.h:216 [inline]\n inet_diag_handler_cmd+0x2ce/0x3f0 net/ipv4/inet_diag.c:1170\n __sock_diag_cmd net/core/sock_diag.c:232 [inline]\n sock_diag_rcv_msg+0x31d/0x410 net/core/sock_diag.c:263\n netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477\n sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:274\n\nThis issue occurs when asoc is peeled off and the old sk is freed after\ngetting it by asoc-\u003ebase.sk and before calling lock_sock(sk).\n\nTo prevent the sk free, as a holder of the sk, ep should be alive when\ncalling lock_sock(). This patch uses call_rcu() and moves sock_put and\nep free into sctp_endpoint_destroy_rcu(), so that it\u0027s safe to try to\nhold the ep under rcu_read_lock in sctp_transport_traverse_process().\n\nIf sctp_endpoint_hold() returns true, it means this ep is still alive\nand we have held it and can continue to dump it; If it returns false,\nit means this ep is dead and can be freed after rcu_read_unlock, and\nwe should skip it.\n\nIn sctp_sock_dump(), after locking the sk, if this ep is different from\ntsp-\u003easoc-\u003eep, it means during this dumping, this asoc was peeled off\nbefore calling lock_sock(), and the sk should be skipped; If this ep is\nthe same with tsp-\u003easoc-\u003eep, it means no peeloff happens on this asoc,\nand due to lock_sock, no peeloff will happen either until release_sock.\n\nNote that delaying endpoint free won\u0027t delay the port release, as the\nport release happens in sctp_endpoint_destroy() before calling call_rcu().\nAlso, freeing endpoint by call_rcu() makes it safe to access the sk by\nasoc-\u003ebase.sk in sctp_assocs_seq_show() and sctp_rcv().\n\nThanks Jones to bring this issue up.\n\nv1-\u003ev2:\n - improve the changelog.\n - add kfree(ep) into sctp_endpoint_destroy_rcu(), as Jakub noticed.\n\nReported-by: syzbot+9276d76e83e3bcde6c99@syzkaller.appspotmail.com\nReported-by: Lee Jones \u003clee.jones@linaro.org\u003e\nFixes: d25adbeb0cdb (\"sctp: fix an use-after-free issue in sctp_sock_dump\")\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" } ], "next": "b45396afa4177f2b1ddfeff7185da733fade1dc3" }