Skip to content

Commit 7a6695f

Browse files
committed
Merge tag 'v6.1.143' into orange-pi-6.1-rk35xx
This is the 6.1.143 stable release * tag 'v6.1.143' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux: Linux 6.1.143 ARM: 9354/1: ptrace: Use bitfield helpers arm64: Restrict pagetable teardown to avoid false warning firmware: arm_scmi: Ensure that the message-id supports fastchannel firmware: arm_scmi: Add a common helper to check if a message is supported io_uring/kbuf: account ring io_buffer_list memory nvme: always punt polled uring_cmd end_io work to task_work Revert "ipv6: save dontfrag in cork" x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c Kunit to check the longest symbol length s390/entry: Fix last breaking event handling in case of stack corruption media: uvcvideo: Rollback non processed entities on error bnxt_en: Fix W=stringop-overflow warning in bnxt_dcb.c bnxt_en: Fix W=1 warning in bnxt_dcb.c from fortify memcpy() eth: bnxt: fix one of the W=1 warnings about fortified memcpy() fbdev: hyperv_fb: Convert comma to semicolon fs: omfs: Use flexible-array member in struct omfs_extent ksmbd: remove unsafe_memcpy use in session setup ksmbd: Use unsafe_memcpy() for ntlm_negotiate drm/amdgpu: Add kicker device detection drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram drm/amd/display: Add null pointer check for get_first_active_display() drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready drm/bridge: cdns-dsi: Check return value when getting default PHY config drm/bridge: cdns-dsi: Fix connecting to next bridge drm/bridge: cdns-dsi: Fix phy de-init and flag it so drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() drm/amdkfd: Fix race in GWS queue scheduling drm/msm/gpu: Fix crash when throttling GPU immediately during boot drm/udl: Unregister device before cleaning up on disconnect drm/tegra: Fix a possible null pointer dereference drm/tegra: Assign plane type before registration drm/etnaviv: Protect the scheduler's pending list with its lock scsi: megaraid_sas: Fix invalid node index HID: wacom: fix kobject reference count leak HID: wacom: fix memory leak on sysfs attribute creation failure HID: wacom: fix memory leak on kobject creation failure HID: lenovo: Restrict F7/9/11 mode to compact keyboards only btrfs: update superblock's device bytes_used when dropping chunk btrfs: fix a race between renames and directory logging dm-raid: fix variable in journal device check Bluetooth: L2CAP: Fix L2CAP MTU negotiation serial: imx: Restore original RXTL for console to fix data loss dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type drm/bridge: ti-sn65dsi86: make use of debugfs_init callback net: selftests: fix TCP packet checksum ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). net: enetc: Correct endianness handling in _enetc_rd_reg64 um: ubd: Add missing error check in start_io_thread() vsock/uapi: fix linux/vm_sockets.h userspace compilation errors af_unix: Don't set -ECONNRESET for consumed OOB skb. wifi: mac80211: fix beacon interval calculation overflow libbpf: Fix null pointer dereference in btf_dump__free on allocation failure attach_recursive_mnt(): do not lock the covering tree when sliding something under it ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() atm: clip: prevent NULL deref in clip_push() s390/pkey: Prevent overflow in size calculation for memdup_user() ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 i2c: robotfuzz-osif: disable zero-length read messages i2c: tiny-usb: disable zero-length read messages af_unix: Don't leave consecutive consumed OOB skbs. af_unix: Don't call skb_get() for OOB skb. dummycon: Trigger redraw when switching consoles with deferred takeover tty: vt: make consw::con_switch() return a bool tty: vt: sanitize arguments of consw::con_clear() tty: vt: make init parameter of consw::con_init() a bool vgacon: remove unneeded forward declarations vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() PCI: apple: Set only available ports up PCI: apple: Use helper function for_each_child_of_node_scoped() uio_hv_generic: Align ring size to system page uio_hv_generic: Query the ringbuffer size for device Drivers: hv: vmbus: Add utility function for querying ring size Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails Drivers: hv: Change hv_free_hyperv_page() to take void * argument Drivers: hv: move panic report code from vmbus to hv early init code Drivers: hv: vmbus: Remove second mapping of VMBus monitor pages drivers: hv, hyperv_fb: Untangle and refactor Hyper-V panic notifiers fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var f2fs: don't over-report free space or inodes in statvfs ASoC: codecs: wcd9335: Fix missing free of regulator supplies ASoC: codec: wcd9335: Convert to GPIO descriptors ASoC: codecs: wcd9335: Handle nicer probe deferral and simplify with dev_err_probe() media: imx-jpeg: Cleanup after an allocation error media: imx-jpeg: Reset slot data pointers when freed media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead media: imx-jpeg: Support to assign slot for encoder/decoder media: imx-jpeg: Add a timeout mechanism for each frame media: imx-jpeg: Remove unnecessary memset() after dma_alloc_coherent() jfs: validate AG parameters in dbMount() to prevent crashes fs/jfs: consolidate sanity checking in dbMount Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 btrfs: handle csum tree error with rescue=ibadroots correctly ovl: Check for NULL d_inode() in ovl_dentry_upper() ceph: fix possible integer overflow in ceph_zero_objects() ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock ALSA: hda: Add new pci id for AMD GPU display HD audio controller ALSA: hda: Ignore unsol events for cards being shut down usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode usb: cdc-wdm: avoid setting WDM_READ for ZLP-s usb: Add checks for snprintf() calls in usb_alloc_dev() usb: common: usb-conn-gpio: use a unique name for usb connector device tty: serial: uartlite: register uart driver in init usb: potential integer overflow in usbg_make_tpg() iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos usb: dwc2: also exit clock_gating when stopping udc while suspended coresight: Only check bottom two claim bits um: use proper care when taking mmap lock during segfault um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h iio: pressure: zpa2326: Use aligned_s64 for the timestamp bcache: fix NULL pointer in cache_set_flush() amd/amdkfd: fix a kfd_process ref leak md/md-bitmap: fix dm-raid max_write_behind setting PCI: apple: Fix missing OF node reference in apple_pcie_setup_port dmaengine: xilinx_dma: Set dma_device directions rust: module: place cleanup_module() in .exit.text section ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension hwmon: (pmbus/max34440) Fix support for max34451 NFSv4: xattr handlers should check for absent nfs filehandles leds: multicolor: Fix intensity setting while SW blinking mfd: max14577: Fix wakeup source leaks on device unbind mailbox: Not protect module_put with spin_lock_irqsave NFSv4.2: fix listxattr to return selinux security label NFSv4: Always set NLINK even if the server doesn't support it cifs: Fix cifs_query_path_info() for Windows NT servers cifs: Correctly set SMB1 SessionKey field in Session Setup Request Signed-off-by: Khusika Dhamar Gusti <[email protected]>
2 parents 9d24229 + 04d1cca commit 7a6695f

File tree

123 files changed

+1594
-1482
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

123 files changed

+1594
-1482
lines changed

Documentation/devicetree/bindings/serial/8250.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ allOf:
4444
- ns16550
4545
- ns16550a
4646
then:
47-
anyOf:
47+
oneOf:
4848
- required: [ clock-frequency ]
4949
- required: [ clocks ]
5050

Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-License-Identifier: GPL-2.0
22
VERSION = 6
33
PATCHLEVEL = 1
4-
SUBLEVEL = 142
4+
SUBLEVEL = 143
55
EXTRAVERSION =
66
NAME = Curry Ramen
77

arch/arm/include/asm/ptrace.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
#include <uapi/asm/ptrace.h>
1111

1212
#ifndef __ASSEMBLY__
13+
#include <linux/bitfield.h>
1314
#include <linux/types.h>
1415

1516
struct pt_regs {
@@ -35,8 +36,8 @@ struct svc_pt_regs {
3536

3637
#ifndef CONFIG_CPU_V7M
3738
#define isa_mode(regs) \
38-
((((regs)->ARM_cpsr & PSR_J_BIT) >> (__ffs(PSR_J_BIT) - 1)) | \
39-
(((regs)->ARM_cpsr & PSR_T_BIT) >> (__ffs(PSR_T_BIT))))
39+
(FIELD_GET(PSR_J_BIT, (regs)->ARM_cpsr) << 1 | \
40+
FIELD_GET(PSR_T_BIT, (regs)->ARM_cpsr))
4041
#else
4142
#define isa_mode(regs) 1 /* Thumb */
4243
#endif

arch/arm64/mm/mmu.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1503,7 +1503,8 @@ int pud_free_pmd_page(pud_t *pudp, unsigned long addr)
15031503
next = addr;
15041504
end = addr + PUD_SIZE;
15051505
do {
1506-
pmd_free_pte_page(pmdp, next);
1506+
if (pmd_present(READ_ONCE(*pmdp)))
1507+
pmd_free_pte_page(pmdp, next);
15071508
} while (pmdp++, next += PMD_SIZE, next != end);
15081509

15091510
pud_clear(pudp);

arch/s390/kernel/entry.S

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -690,7 +690,7 @@ ENTRY(stack_overflow)
690690
stmg %r0,%r7,__PT_R0(%r11)
691691
stmg %r8,%r9,__PT_PSW(%r11)
692692
mvc __PT_R8(64,%r11),0(%r14)
693-
stg %r10,__PT_ORIG_GPR2(%r11) # store last break to orig_gpr2
693+
mvc __PT_ORIG_GPR2(8,%r11),__LC_PGM_LAST_BREAK
694694
xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
695695
lgr %r2,%r11 # pass pointer to pt_regs
696696
jg kernel_stack_overflow

arch/um/drivers/ubd_user.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ int start_io_thread(unsigned long sp, int *fd_out)
4141
*fd_out = fds[1];
4242

4343
err = os_set_fd_block(*fd_out, 0);
44-
err = os_set_fd_block(kernel_fd, 0);
44+
err |= os_set_fd_block(kernel_fd, 0);
4545
if (err) {
4646
printk("start_io_thread - failed to set nonblocking I/O.\n");
4747
goto out_close;

arch/um/include/asm/asm-prototypes.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,6 @@
11
#include <asm-generic/asm-prototypes.h>
2+
#include <asm/checksum.h>
3+
4+
#ifdef CONFIG_UML_X86
5+
extern void cmpxchg8b_emu(void);
6+
#endif

arch/um/kernel/trap.c

Lines changed: 117 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,122 @@
1717
#include <os.h>
1818
#include <skas.h>
1919

20+
/*
21+
* NOTE: UML does not have exception tables. As such, this is almost a copy
22+
* of the code in mm/memory.c, only adjusting the logic to simply check whether
23+
* we are coming from the kernel instead of doing an additional lookup in the
24+
* exception table.
25+
* We can do this simplification because we never get here if the exception was
26+
* fixable.
27+
*/
28+
static inline bool get_mmap_lock_carefully(struct mm_struct *mm, bool is_user)
29+
{
30+
if (likely(mmap_read_trylock(mm)))
31+
return true;
32+
33+
if (!is_user)
34+
return false;
35+
36+
return !mmap_read_lock_killable(mm);
37+
}
38+
39+
static inline bool mmap_upgrade_trylock(struct mm_struct *mm)
40+
{
41+
/*
42+
* We don't have this operation yet.
43+
*
44+
* It should be easy enough to do: it's basically a
45+
* atomic_long_try_cmpxchg_acquire()
46+
* from RWSEM_READER_BIAS -> RWSEM_WRITER_LOCKED, but
47+
* it also needs the proper lockdep magic etc.
48+
*/
49+
return false;
50+
}
51+
52+
static inline bool upgrade_mmap_lock_carefully(struct mm_struct *mm, bool is_user)
53+
{
54+
mmap_read_unlock(mm);
55+
if (!is_user)
56+
return false;
57+
58+
return !mmap_write_lock_killable(mm);
59+
}
60+
61+
/*
62+
* Helper for page fault handling.
63+
*
64+
* This is kind of equivalend to "mmap_read_lock()" followed
65+
* by "find_extend_vma()", except it's a lot more careful about
66+
* the locking (and will drop the lock on failure).
67+
*
68+
* For example, if we have a kernel bug that causes a page
69+
* fault, we don't want to just use mmap_read_lock() to get
70+
* the mm lock, because that would deadlock if the bug were
71+
* to happen while we're holding the mm lock for writing.
72+
*
73+
* So this checks the exception tables on kernel faults in
74+
* order to only do this all for instructions that are actually
75+
* expected to fault.
76+
*
77+
* We can also actually take the mm lock for writing if we
78+
* need to extend the vma, which helps the VM layer a lot.
79+
*/
80+
static struct vm_area_struct *
81+
um_lock_mm_and_find_vma(struct mm_struct *mm,
82+
unsigned long addr, bool is_user)
83+
{
84+
struct vm_area_struct *vma;
85+
86+
if (!get_mmap_lock_carefully(mm, is_user))
87+
return NULL;
88+
89+
vma = find_vma(mm, addr);
90+
if (likely(vma && (vma->vm_start <= addr)))
91+
return vma;
92+
93+
/*
94+
* Well, dang. We might still be successful, but only
95+
* if we can extend a vma to do so.
96+
*/
97+
if (!vma || !(vma->vm_flags & VM_GROWSDOWN)) {
98+
mmap_read_unlock(mm);
99+
return NULL;
100+
}
101+
102+
/*
103+
* We can try to upgrade the mmap lock atomically,
104+
* in which case we can continue to use the vma
105+
* we already looked up.
106+
*
107+
* Otherwise we'll have to drop the mmap lock and
108+
* re-take it, and also look up the vma again,
109+
* re-checking it.
110+
*/
111+
if (!mmap_upgrade_trylock(mm)) {
112+
if (!upgrade_mmap_lock_carefully(mm, is_user))
113+
return NULL;
114+
115+
vma = find_vma(mm, addr);
116+
if (!vma)
117+
goto fail;
118+
if (vma->vm_start <= addr)
119+
goto success;
120+
if (!(vma->vm_flags & VM_GROWSDOWN))
121+
goto fail;
122+
}
123+
124+
if (expand_stack_locked(vma, addr))
125+
goto fail;
126+
127+
success:
128+
mmap_write_downgrade(mm);
129+
return vma;
130+
131+
fail:
132+
mmap_write_unlock(mm);
133+
return NULL;
134+
}
135+
20136
/*
21137
* Note this is constrained to return 0, -EFAULT, -EACCES, -ENOMEM by
22138
* segv().
@@ -43,21 +159,10 @@ int handle_page_fault(unsigned long address, unsigned long ip,
43159
if (is_user)
44160
flags |= FAULT_FLAG_USER;
45161
retry:
46-
mmap_read_lock(mm);
47-
vma = find_vma(mm, address);
48-
if (!vma)
49-
goto out;
50-
if (vma->vm_start <= address)
51-
goto good_area;
52-
if (!(vma->vm_flags & VM_GROWSDOWN))
53-
goto out;
54-
if (is_user && !ARCH_IS_STACKGROW(address))
55-
goto out;
56-
vma = expand_stack(mm, address);
162+
vma = um_lock_mm_and_find_vma(mm, address, is_user);
57163
if (!vma)
58164
goto out_nosemaphore;
59165

60-
good_area:
61166
*code_out = SEGV_ACCERR;
62167
if (is_write) {
63168
if (!(vma->vm_flags & VM_WRITE))

arch/x86/tools/insn_decoder_test.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@
1010
#include <assert.h>
1111
#include <unistd.h>
1212
#include <stdarg.h>
13-
14-
#define unlikely(cond) (cond)
13+
#include <linux/kallsyms.h>
1514

1615
#include <asm/insn.h>
1716
#include <inat.c>
@@ -106,7 +105,7 @@ static void parse_args(int argc, char **argv)
106105
}
107106
}
108107

109-
#define BUFSIZE 256
108+
#define BUFSIZE (256 + KSYM_NAME_LEN)
110109

111110
int main(int argc, char **argv)
112111
{

arch/x86/um/asm/checksum.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@
2020
*/
2121
extern __wsum csum_partial(const void *buff, int len, __wsum sum);
2222

23+
/* Do not call this directly. Declared for export type visibility. */
24+
extern __visible __wsum csum_partial_copy_generic(const void *src, void *dst, int len);
25+
2326
/**
2427
* csum_fold - Fold and invert a 32bit checksum.
2528
* sum: 32bit unfolded sum

0 commit comments

Comments
 (0)