Linux 5.17.8
Greg Kroah-Hartman
maintainerI'm announcing the release of the 5.17.8 kernel.
All users of the 5.17 kernel series must upgrade.
The updated 5.17.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.17.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +- fs/udf/namei.c | 8 ++++---- include/net/bluetooth/hci_core.h | 3 +++ include/uapi/linux/rfkill.h | 2 +- mm/gup.c | 2 +- mm/hugetlb.c | 3 ++- mm/memory-failure.c | 4 +++- mm/memory.c | 2 ++ mm/migrate.c | 14 ++++++++++---- mm/mlock.c | 1 + mm/shmem.c | 4 +++- mm/userfaultfd.c | 3 +++ net/bluetooth/hci_core.c | 6 +++--- 13 files changed, 37 insertions(+), 17 deletions(-)
Gleb Fotengauer-Malinovskiy (1):
rfkill: uapi: fix RFKILL_IOCTL_MAX_SIZE ioctl request definition
Greg Kroah-Hartman (1):
Linux 5.17.8
Huang Ying (1):
mm,migrate: fix establishing demotion target
Itay Iellin (1):
Bluetooth: Fix the creation of hdev->name
Jan Kara (1):
udf: Avoid using stale lengthOfImpUse
Miaohe Lin (1):
mm/mlock: fix potential imbalanced rlimit ucounts adjustment
Muchun Song (5):
mm: fix missing cache flush for all tail pages of compound page
mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
mm: hugetlb: fix missing cache flush in hugetlb_mcopy_atomic_pte()
mm: shmem: fix missing cache flush in shmem_mfill_atomic_pte()
mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic()
Naoya Horiguchi (1):
mm/hwpoison: fix error page recovered but reported "not recovered"
Peter Xu (1):
mm: fix invalid page pointer returned with FOLL_PIN gups
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 17 -SUBLEVEL = 7 +SUBLEVEL = 8 EXTRAVERSION = NAME = Superb Owl
fs/udf/namei.c +4 -4
@@ -75,11 +75,11 @@ int udf_write_fi(struct inode *inode, struct fileIdentDesc *cfi,if (fileident) {if (adinicb || (offset + lfi <0 )) { -memcpy (udf_get_fi_ident (sfi), fileident, lfi); +memcpy (sfi->impUse + liu, fileident, lfi); }else if (offset >=0 ) {memcpy (fibh->ebh->b_data + offset, fileident, lfi); }else { -memcpy (udf_get_fi_ident (sfi), fileident, -offset); +memcpy (sfi->impUse + liu, fileident, -offset);memcpy (fibh->ebh->b_data, fileident - offset, lfi + offset); }
@@ -88,11 +88,11 @@ int udf_write_fi(struct inode *inode, struct fileIdentDesc *cfi, offset += lfi;if (adinicb || (offset + padlen <0 )) { -memset (udf_get_fi_ident (sfi) + lfi,0x00 , padlen); +memset (sfi->impUse + liu + lfi,0x00 , padlen); }else if (offset >=0 ) {memset (fibh->ebh->b_data + offset,0x00 , padlen); }else { -memset (udf_get_fi_ident (sfi) + lfi,0x00 , -offset); +memset (sfi->impUse + liu + lfi,0x00 , -offset);memset (fibh->ebh->b_data,0x00 , padlen + offset); }
include/net/bluetooth/hci_core.h +3 -0
@@ -36,6 +36,9 @@/* HCI priority */ #define HCI_PRIO_MAX 7 +/* HCI maximum id value */ +#define HCI_MAX_ID 10000 +/* HCI Core structures */ struct inquiry_data {bdaddr_t bdaddr;
include/uapi/linux/rfkill.h +1 -1
@@ -184,7 +184,7 @@ struct rfkill_event_ext {#define RFKILL_IOC_NOINPUT 1#define RFKILL_IOCTL_NOINPUT _IO(RFKILL_IOC_MAGIC, RFKILL_IOC_NOINPUT)#define RFKILL_IOC_MAX_SIZE 2 -#define RFKILL_IOCTL_MAX_SIZE _IOW(RFKILL_IOC_MAGIC, RFKILL_IOC_EXT_SIZE, __u32) +#define RFKILL_IOCTL_MAX_SIZE _IOW(RFKILL_IOC_MAGIC, RFKILL_IOC_MAX_SIZE, __u32)/* and that's all userspace gets */
mm/gup.c +1 -1
@@ -465,7 +465,7 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, unsigned int flags) {/* No page to get reference */ -if (flags &FOLL_GET ) +if (flags & (FOLL_GET |FOLL_PIN ))return -EFAULT ;if (flags &FOLL_TOUCH ) {
mm/hugetlb.c +2 -1
@@ -5820,7 +5820,8 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm, *pagep =NULL ; goto out; } -folio_copy (page_folio (page),page_folio (*pagep)); +copy_user_huge_page (page, *pagep, dst_addr, dst_vma, +pages_per_huge_page (h));put_page (*pagep); *pagep =NULL ; }
mm/memory-failure.c +3 -1
@@ -707,8 +707,10 @@ static int kill_accessing_process(struct task_struct *p, unsigned long pfn, (void *)&priv);if (ret ==1 && priv.tk.addr)kill_proc (&priv.tk, pfn, flags); +else + ret =0 ;mmap_read_unlock (p->mm); -return ret ? -EFAULT : -EHWPOISON ; +return ret >0 ? -EHWPOISON : -EFAULT ; }static const char *action_name[] = {
mm/memory.c +2 -0
@@ -5475,6 +5475,8 @@ long copy_huge_page_from_user(struct page *dst_page,if (rc)break ; +flush_dcache_page (subpage); +cond_resched (); }return ret_val;
mm/migrate.c +10 -4
@@ -916,9 +916,12 @@ static int move_to_new_page(struct page *newpage, struct page *page,if (!PageMappingFlags (page)) page->mapping =NULL ; -if (likely (!is_zone_device_page (newpage))) -flush_dcache_page (newpage); +if (likely (!is_zone_device_page (newpage))) { +int i, nr =compound_nr (newpage); +for (i =0 ; i < nr; i++) +flush_dcache_page (newpage + i); + } } out:return rc;
@@ -3082,18 +3085,21 @@ static int establish_migrate_target(int node, nodemask_t *used,if (best_distance !=-1 ) { val =node_distance (node, migration_target);if (val > best_distance) -return NUMA_NO_NODE ; + goto out_clear; } index = nd->nr;if (WARN_ONCE (index >=DEMOTION_TARGET_NODES ,"Exceeds maximum demotion target nodes\n" )) -return NUMA_NO_NODE ; + goto out_clear; nd->nodes[index] = migration_target; nd->nr++;return migration_target; +out_clear: +node_clear (migration_target, *used); +return NUMA_NO_NODE ; }/*
mm/mlock.c +1 -0
@@ -838,6 +838,7 @@ int user_shm_lock(size_t size, struct ucounts *ucounts) }if (!get_ucounts (ucounts)) {dec_rlimit_ucounts (ucounts,UCOUNT_RLIMIT_MEMLOCK , locked); + allowed =0 ; goto out; } allowed =1 ;
mm/shmem.c +3 -1
@@ -2357,8 +2357,10 @@ int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,/* don't free the page */ goto out_unacct_blocks; } + +flush_dcache_page (page); }else {/* ZEROPAGE */ -clear_highpage (page); +clear_user_highpage (page, dst_addr); } }else { page = *pagep;
mm/userfaultfd.c +3 -0
@@ -153,6 +153,8 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,/* don't free the page */ goto out; } + +flush_dcache_page (page); }else { page = *pagep; *pagep =NULL ;
@@ -628,6 +630,7 @@ static __always_inline ssize_t __mcopy_atomic(struct mm_struct *dst_mm, err = -EFAULT ; goto out; } +flush_dcache_page (page); goto retry; }else BUG_ON (page);
net/bluetooth/hci_core.c +3 -3
@@ -2554,10 +2554,10 @@ int hci_register_dev(struct hci_dev *hdev)*/ switch (hdev->dev_type) {case HCI_PRIMARY : - id =ida_simple_get (&hci_index_ida,0 ,0 ,GFP_KERNEL ); + id =ida_simple_get (&hci_index_ida,0 ,HCI_MAX_ID ,GFP_KERNEL );break ;case HCI_AMP : - id =ida_simple_get (&hci_index_ida,1 ,0 ,GFP_KERNEL ); + id =ida_simple_get (&hci_index_ida,1 ,HCI_MAX_ID ,GFP_KERNEL );break ;default :return -EINVAL ;
@@ -2566,7 +2566,7 @@ int hci_register_dev(struct hci_dev *hdev)if (id <0 )return id; -sprintf (hdev->name,"hci%d" , id); +snprintf (hdev->name,sizeof (hdev->name),"hci%d" , id); hdev->id = id;BT_DBG ("%p name %s bus %d" , hdev, hdev->name, hdev->bus);