Linux 5.10.141
Greg Kroah-Hartman
maintainerI'm announcing the release of the 5.10.141 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 arch/s390/hypfs/hypfs_diag.c | 2 arch/s390/hypfs/inode.c | 2 arch/s390/mm/fault.c | 4 arch/x86/include/asm/nospec-branch.h | 92 ++++++++-------- drivers/android/binder.c | 1 drivers/dma-buf/udmabuf.c | 18 ++- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 3 drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 3 drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c | 2 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c | 6 + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c | 5 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c | 6 + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c | 2 drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 1 drivers/hid/hid-steam.c | 10 + drivers/hid/hidraw.c | 3 drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 1 drivers/mmc/host/mtk-sd.c | 6 + drivers/pci/pcie/portdrv_core.c | 9 + drivers/video/fbdev/pm2fb.c | 5 fs/io_uring.c | 5 fs/signalfd.c | 1 fs/xfs/xfs_filestream.c | 7 - fs/xfs/xfs_fsops.c | 52 +++------ fs/xfs/xfs_mount.h | 8 + fs/xfs/xfs_trans_dquot.c | 1 include/linux/fs.h | 1 include/linux/rmap.h | 7 - include/linux/skbuff.h | 8 + include/linux/skmsg.h | 3 include/net/sock.h | 68 ++++++++--- kernel/kprobes.c | 9 - kernel/trace/ftrace.c | 10 + lib/crypto/Kconfig | 1 lib/vdso/gettimeofday.c | 16 +- mm/mmap.c | 12 ++ mm/rmap.c | 29 ++--- net/bluetooth/l2cap_core.c | 10 - net/bpf/test_run.c | 3 net/core/dev.c | 1 net/core/neighbour.c | 27 +++- net/core/skmsg.c | 4 net/netfilter/Kconfig | 1 net/packet/af_packet.c | 4 scripts/Makefile.modpost | 3 47 files changed, 324 insertions(+), 152 deletions(-)
Alvin Lee (1):
drm/amd/display: For stereo keep "FLIP_ANY_FRAME"
Brian Foster (1):
xfs: fix soft lockup via spinning in filestream ag selection loop
Christophe Leroy (1):
lib/vdso: Mark do_hres_timens() and do_coarse_timens() __always_inline()
Darrick J. Wong (3):
xfs: remove infinite loop when reserving free block pool
xfs: always succeed at setting the reserve pool size
xfs: fix overfilling of reserve pool
Denis V. Lunev (1):
neigh: fix possible DoS due to net iface start/stop loop
Dongliang Mu (1):
media: pvrusb2: fix memory leak in pvr_probe
Dusica Milinkovic (1):
drm/amdgpu: Increase tlb flush timeout for sriov
Eric Biggers (1):
crypto: lib - remove unneeded selection of XOR_BLOCKS
Eric Sandeen (1):
xfs: revert "xfs: actually bump warning counts when we send warnings"
Evan Quan (1):
drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
Fudong Wang (1):
drm/amd/display: clear optc underflow before turn off odm clock
Geert Uytterhoeven (1):
netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
Gerald Schaefer (1):
s390/mm: do not trigger write fault when vma does not allow VM_WRITE
Greg Kroah-Hartman (2):
Revert "PCI/portdrv: Don't disable AER reporting in get_port_device_capability()" Linux 5.10.141
Hawkins Jiawei (1):
net: fix refcount bug in sk_psock_get (2)
Ilya Bakoulin (1):
drm/amd/display: Fix pixel clock programming
Jann Horn (2):
mm: Force TLB flush for PFNMAP mappings before unlink_file_vma() mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
Jing Leng (1):
kbuild: Fix include path in scripts/Makefile.modpost
Josip Pavic (1):
drm/amd/display: Avoid MPC infinite loop
Juergen Gross (1):
s390/hypfs: avoid error message under KVM
Karthik Alapati (1):
HID: hidraw: fix memory leak in hidraw_release()
Kuniyuki Iwashima (1):
kprobes: don't call disarm_kprobe() for disabled kprobes
Lee Jones (1):
HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
Letu Ren (1):
fbdev: fb_pm2fb: Avoid potential divide by zero error
Luiz Augusto von Dentz (1):
Bluetooth: L2CAP: Fix build errors in some archs
Pavel Begunkov (1):
io_uring: disable polling pollfree files
Peter Zijlstra (2):
x86/nospec: Unwreck the RSB stuffing
x86/nospec: Fix i386 RSB stuffing
Vivek Kasireddy (1):
udmabuf: Set the DMA mask for the udmabuf device (v2)
Wenbin Mei (1):
mmc: mtk-sd: Clear interrupts when cqe off/disable
Yang Jihong (1):
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
Yang Yingliang (1):
net: neigh: don't call kfree_skb() under spin_lock_irqsave()
Zhengchao Shao (2):
bpf: Don't redirect packets with invalid pkt_len net/af_packet: check len when min_header_len equals to 0
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 10 -SUBLEVEL = 140 +SUBLEVEL = 141 EXTRAVERSION = NAME = Dare mighty things
arch/s390/hypfs/hypfs_diag.c +1 -1
@@ -437,7 +437,7 @@ __init int hypfs_diag_init(void)int rc;if (diag204_probe ()) { -pr_err ("The hardware system does not support hypfs\n" ); +pr_info ("The hardware system does not support hypfs\n" );return -ENODATA ; }
arch/s390/hypfs/inode.c +1 -1
@@ -496,9 +496,9 @@ static int __init hypfs_init(void)hypfs_vm_exit (); fail_hypfs_diag_exit:hypfs_diag_exit (); +pr_err ("Initialization of hypfs failed with rc=%i\n" , rc); fail_dbfs_exit:hypfs_dbfs_exit (); -pr_err ("Initialization of hypfs failed with rc=%i\n" , rc);return rc; }device_initcall (hypfs_init)
arch/s390/mm/fault.c +3 -1
@@ -429,7 +429,9 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access) flags =FAULT_FLAG_DEFAULT ;if (user_mode (regs)) flags |=FAULT_FLAG_USER ; -if (access ==VM_WRITE || (trans_exc_code & store_indication) ==0x400 ) +if ((trans_exc_code & store_indication) ==0x400 ) + access =VM_WRITE ; +if (access ==VM_WRITE ) flags |=FAULT_FLAG_WRITE ;mmap_read_lock (mm);
arch/x86/include/asm/nospec-branch.h +51 -41
112 lines not on this page · raw message
drivers/android/binder.c +1 -0
@@ -6069,6 +6069,7 @@ const struct file_operations binder_fops = { .open = binder_open, .flush = binder_flush, .release = binder_release, + .may_pollfree = true, };static int __init init_binder_device (const char *name)
drivers/dma-buf/udmabuf.c +17 -1
@@ -327,7 +327,23 @@ static struct miscdevice udmabuf_misc = {static int __init udmabuf_dev_init (void ) { -return misc_register (&udmabuf_misc); +int ret; + + ret =misc_register (&udmabuf_misc); +if (ret <0 ) { +pr_err ("Could not initialize udmabuf device\n" ); +return ret; + } + + ret =dma_coerce_mask_and_coherent (udmabuf_misc.this_device, +DMA_BIT_MASK (64 )); +if (ret <0 ) { +pr_err ("Could not setup DMA mask for udmabuf device\n" ); +misc_deregister (&udmabuf_misc); +return ret; + } + +return 0 ; } static void __exit udmabuf_dev_exit(void)
drivers/gpu/drm/amd/amdgpu/amdgpu.h +1 -1
@@ -283,7 +283,7 @@ enum amdgpu_kiq_irq {AMDGPU_CP_KIQ_IRQ_DRIVER0 =0 , AMDGPU_CP_KIQ_IRQ_LAST }; - +#define SRIOV_USEC_TIMEOUT 1200000/* wait 12 * 100ms for SRIOV */ #define MAX_KIQ_REG_WAIT 5000/* in usecs, 5ms */ #define MAX_KIQ_REG_BAILOUT_INTERVAL 5/* in msecs, 5ms */ #define MAX_KIQ_REG_TRY 80/* 20 -> 80 */
drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c +2 -1
@@ -371,6 +371,7 @@ static int gmc_v10_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev,uint32_t seq;uint16_t queried_pasid;bool ret; +u32 usec_timeout =amdgpu_sriov_vf (adev) ?SRIOV_USEC_TIMEOUT : adev->usec_timeout;struct amdgpu_ring *ring = &adev->gfx.kiq.ring;struct amdgpu_kiq *kiq = &adev->gfx.kiq;
@@ -389,7 +390,7 @@ static int gmc_v10_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev,amdgpu_ring_commit (ring);spin_unlock (&adev->gfx.kiq.ring_lock); - r =amdgpu_fence_wait_polling (ring, seq, adev->usec_timeout); + r =amdgpu_fence_wait_polling (ring, seq, usec_timeout);if (r <1 ) {dev_err (adev->dev,"wait for kiq fence error: %ld.\n" , r);return -ETIME ;
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +2 -1
@@ -839,6 +839,7 @@ static int gmc_v9_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev,uint32_t seq;uint16_t queried_pasid;bool ret; +u32 usec_timeout =amdgpu_sriov_vf (adev) ?SRIOV_USEC_TIMEOUT : adev->usec_timeout;struct amdgpu_ring *ring = &adev->gfx.kiq.ring;struct amdgpu_kiq *kiq = &adev->gfx.kiq;
@@ -878,7 +879,7 @@ static int gmc_v9_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev,amdgpu_ring_commit (ring);spin_unlock (&adev->gfx.kiq.ring_lock); - r =amdgpu_fence_wait_polling (ring, seq, adev->usec_timeout); + r =amdgpu_fence_wait_polling (ring, seq, usec_timeout);if (r <1 ) {dev_err (adev->dev,"wait for kiq fence error: %ld.\n" , r);up_read (&adev->reset_sem);
drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c +2 -0
@@ -546,9 +546,11 @@ static void dce112_get_pix_clk_dividers_helper (switch (pix_clk_params->color_depth) {case COLOR_DEPTH_101010 : actual_pixel_clock_100hz = (actual_pixel_clock_100hz *5 ) >>2 ; + actual_pixel_clock_100hz -= actual_pixel_clock_100hz %10 ;break ;case COLOR_DEPTH_121212 : actual_pixel_clock_100hz = (actual_pixel_clock_100hz *6 ) >>2 ; + actual_pixel_clock_100hz -= actual_pixel_clock_100hz %10 ;break ;case COLOR_DEPTH_161616 : actual_pixel_clock_100hz = actual_pixel_clock_100hz *2 ;
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c +6 -0
@@ -125,6 +125,12 @@ struct mpcc *mpc1_get_mpcc_for_dpp(struct mpc_tree *tree, int dpp_id)while (tmp_mpcc !=NULL ) {if (tmp_mpcc->dpp_id == dpp_id)return tmp_mpcc; + +/* avoid circular linked list */ +ASSERT (tmp_mpcc != tmp_mpcc->mpcc_bot); +if (tmp_mpcc == tmp_mpcc->mpcc_bot) +break ; + tmp_mpcc = tmp_mpcc->mpcc_bot; }return NULL ;
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c +5 -0
@@ -464,6 +464,11 @@ void optc1_enable_optc_clock(struct timing_generator *optc, bool enable)OTG_CLOCK_ON ,1 , 1, 1000); }else { + +//last chance to clear underflow, otherwise, it will always there due to clock is off. +if (optc->funcs->is_optc_underflow_occurred (optc) == true) + optc->funcs->clear_optc_underflow (optc); +REG_UPDATE_2 (OTG_CLOCK_CONTROL ,OTG_CLOCK_GATE_DIS ,0 ,OTG_CLOCK_EN ,0 );
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c +6 -0
@@ -533,6 +533,12 @@ struct mpcc *mpc2_get_mpcc_for_dpp(struct mpc_tree *tree, int dpp_id)while (tmp_mpcc !=NULL ) {if (tmp_mpcc->dpp_id ==0xf || tmp_mpcc->dpp_id == dpp_id)return tmp_mpcc; + +/* avoid circular linked list */ +ASSERT (tmp_mpcc != tmp_mpcc->mpcc_bot); +if (tmp_mpcc == tmp_mpcc->mpcc_bot) +break ; + tmp_mpcc = tmp_mpcc->mpcc_bot; }return NULL ;
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c +1 -1
@@ -86,7 +86,7 @@ bool hubp3_program_surface_flip_and_addr( VMID, address->vmid);if (address->type ==PLN_ADDR_TYPE_GRPH_STEREO ) { -REG_UPDATE (DCSURF_FLIP_CONTROL ,SURFACE_FLIP_MODE_FOR_STEREOSYNC ,0x1 ); +REG_UPDATE (DCSURF_FLIP_CONTROL ,SURFACE_FLIP_MODE_FOR_STEREOSYNC ,0 );REG_UPDATE (DCSURF_FLIP_CONTROL ,SURFACE_FLIP_IN_STEREOSYNC ,0x1 ); }else {
drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +1 -0
@@ -2759,6 +2759,7 @@ static const struct pptable_funcs sienna_cichlid_ppt_funcs = { .dump_pptable = sienna_cichlid_dump_pptable, .init_microcode = smu_v11_0_init_microcode, .load_microcode = smu_v11_0_load_microcode, + .fini_microcode = smu_v11_0_fini_microcode, .init_smc_tables = sienna_cichlid_init_smc_tables, .fini_smc_tables = smu_v11_0_fini_smc_tables, .init_power = smu_v11_0_init_power,
drivers/hid/hid-steam.c +10 -0
@@ -134,6 +134,11 @@ static int steam_recv_report(struct steam_device *steam,int ret; r = steam->hdev->report_enum[HID_FEATURE_REPORT ].report_id_hash[0 ]; +if (!r) { +hid_err (steam->hdev,"No HID_FEATURE_REPORT submitted - nothing to read\n" ); +return -EINVAL ; + } +if (hid_report_len (r) <64 )return -EINVAL ;
@@ -165,6 +170,11 @@ static int steam_send_report(struct steam_device *steam,int ret; r = steam->hdev->report_enum[HID_FEATURE_REPORT ].report_id_hash[0 ]; +if (!r) { +hid_err (steam->hdev,"No HID_FEATURE_REPORT submitted - nothing to read\n" ); +return -EINVAL ; + } +if (hid_report_len (r) <64 )return -EINVAL ;
drivers/hid/hidraw.c +3 -0
@@ -346,10 +346,13 @@ static int hidraw_release(struct inode * inode, struct file * file)unsigned int minor =iminor (inode);struct hidraw_list *list = file->private_data;unsigned long flags; +int i;mutex_lock (&minors_lock);spin_lock_irqsave (&hidraw_table[minor]->list_lock, flags); +for (i = list->tail; i < list->head; i++) +kfree (list->buffer[i].value);list_del (&list->node);spin_unlock_irqrestore (&hidraw_table[minor]->list_lock, flags);kfree (list);
drivers/media/usb/pvrusb2/pvrusb2-hdw.c +1 -0
@@ -2610,6 +2610,7 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,del_timer_sync (&hdw->encoder_run_timer);del_timer_sync (&hdw->encoder_wait_timer);flush_work (&hdw->workpoll); +v4l2_device_unregister (&hdw->v4l2_dev);usb_free_urb (hdw->ctl_read_urb);usb_free_urb (hdw->ctl_write_urb);kfree (hdw->ctl_read_buffer);
drivers/mmc/host/mtk-sd.c +6 -0
@@ -2293,6 +2293,9 @@ static void msdc_cqe_disable(struct mmc_host *mmc, bool recovery)/* disable busy check */ sdr_clr_bits (host->base +MSDC_PATCH_BIT1 ,MSDC_PB1_BUSY_CHECK_SEL ); + val =readl (host->base +MSDC_INT ); +writel (val, host->base +MSDC_INT ); +if (recovery) {sdr_set_field (host->base +MSDC_DMA_CTRL ,MSDC_DMA_CTRL_STOP ,1 );
@@ -2693,11 +2696,14 @@ static int __maybe_unused msdc_suspend(struct device *dev) {struct mmc_host *mmc =dev_get_drvdata (dev);int ret; +u32 val;if (mmc->caps2 &MMC_CAP2_CQE ) { ret =cqhci_suspend (mmc);if (ret)return ret; + val =readl (((struct msdc_host *)mmc_priv (mmc))->base +MSDC_INT ); +writel (val, ((struct msdc_host *)mmc_priv (mmc))->base +MSDC_INT ); }return pm_runtime_force_suspend (dev);
drivers/pci/pcie/portdrv_core.c +8 -1
@@ -222,8 +222,15 @@ static int get_port_device_capability(struct pci_dev *dev)#ifdef CONFIG_PCIEAER if (dev->aer_cap &&pci_aer_available () && - (pcie_ports_native || host->native_aer)) + (pcie_ports_native || host->native_aer)) { services |=PCIE_PORT_SERVICE_AER ; + +/* +* Disable AER on this port in case it's been enabled by the +* BIOS (the AER service driver will enable it when necessary). +*/ +pci_disable_pcie_error_reporting (dev); + }#endif /*
drivers/video/fbdev/pm2fb.c +5 -0
@@ -616,6 +616,11 @@ static int pm2fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)return -EINVAL ; } +if (!var->pixclock) { +DPRINTK ("pixclock is zero\n" ); +return -EINVAL ; + } +if (PICOS2KHZ (var->pixclock) >PM2_MAX_PIXCLOCK ) {DPRINTK ("pixclock too high (%ldKHz)\n" ,PICOS2KHZ (var->pixclock));
fs/io_uring.c +5 -0
@@ -5198,6 +5198,11 @@ static __poll_t __io_arm_poll_handler(struct io_kiocb *req,struct io_ring_ctx *ctx = req->ctx;bool cancel = false; +if (req->file->f_op->may_pollfree) { +spin_lock_irq (&ctx->completion_lock); +return -EOPNOTSUPP ; + } +INIT_HLIST_NODE (&req->hash_node);io_init_poll_iocb (poll, mask, wake_func); poll->file = req->file;
fs/signalfd.c +1 -0
@@ -248,6 +248,7 @@ static const struct file_operations signalfd_fops = { .poll = signalfd_poll, .read = signalfd_read, .llseek = noop_llseek, + .may_pollfree = true, };static int do_signalfd4 (int ufd,sigset_t *mask,int flags)
fs/xfs/xfs_filestream.c +4 -3
@@ -128,11 +128,12 @@ xfs_filestream_pick_ag(if (!pag->pagf_init) { err =xfs_alloc_pagf_init (mp,NULL , ag, trylock);if (err) { -xfs_perag_put (pag); -if (err != -EAGAIN ) +if (err != -EAGAIN ) { +xfs_perag_put (pag);return err; + }/* Couldn't lock the AGF, skip this AG. */ -continue ; + goto next_ag; } }
fs/xfs/xfs_fsops.c +21 -31
67 lines not on this page · raw message
fs/xfs/xfs_mount.h +8 -0
@@ -406,6 +406,14 @@ extern int xfs_initialize_perag(xfs_mount_t *mp, xfs_agnumber_t agcount, xfs_agnumber_t *maxagi);extern void xfs_unmountfs (xfs_mount_t *); +/* Accessor added for 5.10.y backport */ +static inline uint64_t +xfs_fdblocks_unavailable ( +struct xfs_mount *mp) +{ +return mp->m_alloc_set_aside; +} +extern int xfs_mod_fdblocks (struct xfs_mount *mp,int64_t delta,bool reserved);extern int xfs_mod_frextents (struct xfs_mount *mp,int64_t delta);
fs/xfs/xfs_trans_dquot.c +0 -1
@@ -615,7 +615,6 @@ xfs_dqresv_check(return QUOTA_NL_ISOFTLONGWARN ; } - res->warnings++;return QUOTA_NL_ISOFTWARN ; }
include/linux/fs.h +1 -0
@@ -1859,6 +1859,7 @@ struct file_operations { struct file *file_out, loff_t pos_out, loff_t len, unsigned int remap_flags);int (*fadvise)(struct file *,loff_t ,loff_t ,int ); +bool may_pollfree; } __randomize_layout;struct inode_operations {
include/linux/rmap.h +5 -2
@@ -39,12 +39,15 @@ struct anon_vma {atomic_t refcount;/* -* Count of child anon_vmas and VMAs which points to this anon_vma. +* Count of child anon_vmas. Equals to the count of all anon_vmas that +* have ->parent pointing to this one, including itself. * * This counter is used for making decision about reusing anon_vma * instead of forking new one. See comments in function anon_vma_clone. */ -unsigned degree; +unsigned long num_children; +/* Count of VMAs whose ->anon_vma pointer points to this object. */ +unsigned long num_active_vmas;struct anon_vma *parent;/* Parent of this anon_vma */
include/linux/skbuff.h +8 -0
@@ -2222,6 +2222,14 @@ static inline void skb_set_tail_pointer(struct sk_buff *skb, const int offset)#endif /* NET_SKBUFF_DATA_USES_OFFSET */ +static inline void skb_assert_len (struct sk_buff *skb) +{ +#ifdef CONFIG_DEBUG_NET +if (WARN_ONCE (!skb->len,"%s\n" , __func__)) +DO_ONCE_LITE (skb_dump,KERN_ERR , skb, false); +#endif /* CONFIG_DEBUG_NET */ +} +/* * Add data to an sk_buff */
include/linux/skmsg.h +2 -1
@@ -281,7 +281,8 @@ static inline void sk_msg_sg_copy_clear(struct sk_msg *msg, u32 start)static inline struct sk_psock *sk_psock (const struct sock *sk) { -return rcu_dereference_sk_user_data (sk); +return __rcu_dereference_sk_user_data_with_flags (sk, +SK_USER_DATA_PSOCK ); } static inline void sk_psock_queue_msg(struct sk_psock *psock,
include/net/sock.h +48 -20
86 lines not on this page · raw message
kernel/kprobes.c +5 -4
@@ -1786,11 +1786,12 @@ static struct kprobe *__disable_kprobe(struct kprobe *p)/* Try to disarm and disable this/parent probe */ if (p == orig_p ||aggr_kprobe_disabled (orig_p)) {/* -* If kprobes_all_disarmed is set, orig_p -* should have already been disarmed, so -* skip unneed disarming process. +* Don't be lazy here. Even if 'kprobes_all_disarmed' +* is false, 'orig_p' might not have been armed yet. +* Note arm_all_kprobes() __tries__ to arm all kprobes +* on the best effort basis. */ -if (!kprobes_all_disarmed) { +if (!kprobes_all_disarmed && !kprobe_disabled (orig_p)) { ret =disarm_kprobe (orig_p, true);if (ret) { p->flags &= ~KPROBE_FLAG_DISABLED ;
kernel/trace/ftrace.c +10 -0
@@ -2899,6 +2899,16 @@ int ftrace_startup(struct ftrace_ops *ops, int command)ftrace_startup_enable (command); +/* +* If ftrace is in an undefined state, we just remove ops from list +* to prevent the NULL pointer, instead of totally rolling it back and +* free trampoline, because those actions could cause further damage. +*/ +if (unlikely (ftrace_disabled)) { +__unregister_ftrace_function (ops); +return -ENODEV ; + } + ops->flags &= ~FTRACE_OPS_FL_ADDING ;return 0 ;
lib/crypto/Kconfig +0 -1
@@ -33,7 +33,6 @@ config CRYPTO_ARCH_HAVE_LIB_CHACHA config CRYPTO_LIB_CHACHA_GENERIC tristate - select XOR_BLOCKS help This symbol can be depended upon by arch implementations of the ChaCha library interface that require the generic code as a
lib/vdso/gettimeofday.c +8 -8
@@ -46,8 +46,8 @@ static inline bool vdso_cycles_ok(u64 cycles)#endif #ifdef CONFIG_TIME_NS -static int do_hres_timens (const struct vdso_data *vdns,clockid_t clk, -struct __kernel_timespec *ts) +static __always_inline int do_hres_timens(const struct vdso_data *vdns, clockid_t clk, +struct __kernel_timespec *ts) {const struct vdso_data *vd =__arch_get_timens_vdso_data ();const struct timens_offset *offs = &vdns->offset[clk];
@@ -97,8 +97,8 @@ static __always_inline const struct vdso_data *__arch_get_timens_vdso_data(void)return NULL ; } -static int do_hres_timens (const struct vdso_data *vdns,clockid_t clk, -struct __kernel_timespec *ts) +static __always_inline int do_hres_timens(const struct vdso_data *vdns, clockid_t clk, +struct __kernel_timespec *ts) {return -EINVAL ; }
@@ -159,8 +159,8 @@ static __always_inline int do_hres(const struct vdso_data *vd, clockid_t clk, }#ifdef CONFIG_TIME_NS -static int do_coarse_timens (const struct vdso_data *vdns,clockid_t clk, -struct __kernel_timespec *ts) +static __always_inline int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, +struct __kernel_timespec *ts) {const struct vdso_data *vd =__arch_get_timens_vdso_data ();const struct vdso_timestamp *vdso_ts = &vd->basetime[clk];
@@ -188,8 +188,8 @@ static int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk,return 0 ; }#else -static int do_coarse_timens (const struct vdso_data *vdns,clockid_t clk, -struct __kernel_timespec *ts) +static __always_inline int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, +struct __kernel_timespec *ts) {return -1 ; }
mm/mmap.c +12 -0
@@ -2669,6 +2669,18 @@ static void unmap_region(struct mm_struct *mm,tlb_gather_mmu (&tlb, mm, start, end);update_hiwater_rss (mm);unmap_vmas (&tlb, vma, start, end); + +/* +* Ensure we have no stale TLB entries by the time this mapping is +* removed from the rmap. +* Note that we don't have to worry about nested flushes here because +* we're holding the mm semaphore for removing the mapping - so any +* concurrent flush in this region has to be coming through the rmap, +* and we synchronize against that using the rmap lock. +*/ +if ((vma->vm_flags & (VM_PFNMAP |VM_MIXEDMAP )) !=0 ) +tlb_flush_mmu (&tlb); +free_pgtables (&tlb, vma, prev ? prev->vm_end :FIRST_USER_ADDRESS , next ? next->vm_start :USER_PGTABLES_CEILING );tlb_finish_mmu (&tlb, start, end);
mm/rmap.c +16 -13
@@ -89,7 +89,8 @@ static inline struct anon_vma *anon_vma_alloc(void) anon_vma =kmem_cache_alloc (anon_vma_cachep,GFP_KERNEL );if (anon_vma) {atomic_set (&anon_vma->refcount,1 ); - anon_vma->degree =1 ;/* Reference for first vma */ + anon_vma->num_children =0 ; + anon_vma->num_active_vmas =0 ; anon_vma->parent = anon_vma;/* * Initialise the anon_vma root to point to itself. If called
@@ -197,6 +198,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma) anon_vma =anon_vma_alloc ();if (unlikely (!anon_vma)) goto out_enomem_free_avc; + anon_vma->num_children++;/* self-parent link for new root */ allocated = anon_vma; }
@@ -206,8 +208,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma)if (likely (!vma->anon_vma)) { vma->anon_vma = anon_vma;anon_vma_chain_link (vma, avc, anon_vma); -/* vma reference or self-parent link for new root */ - anon_vma->degree++; + anon_vma->num_active_vmas++; allocated =NULL ; avc =NULL ; }
@@ -292,19 +293,19 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)anon_vma_chain_link (dst, avc, anon_vma);/* -* Reuse existing anon_vma if its degree lower than two, -* that means it has no vma and only one anon_vma child. +* Reuse existing anon_vma if it has no vma and only one +* anon_vma child. * -* Do not chose parent anon_vma, otherwise first child -* will always reuse it. Root anon_vma is never reused: +* Root anon_vma is never reused: * it has self-parent reference and at least one child. */ if (!dst->anon_vma && src->anon_vma && - anon_vma != src->anon_vma && anon_vma->degree <2 ) + anon_vma->num_children <2 && + anon_vma->num_active_vmas ==0 ) dst->anon_vma = anon_vma; }if (dst->anon_vma) - dst->anon_vma->degree++; + dst->anon_vma->num_active_vmas++;unlock_anon_vma_root (root);return 0 ;
@@ -354,6 +355,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) anon_vma =anon_vma_alloc ();if (!anon_vma) goto out_error; + anon_vma->num_active_vmas++; avc =anon_vma_chain_alloc (GFP_KERNEL );if (!avc) goto out_error_free_anon_vma;
@@ -374,7 +376,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) vma->anon_vma = anon_vma;anon_vma_lock_write (anon_vma);anon_vma_chain_link (vma, avc, anon_vma); - anon_vma->parent->degree++; + anon_vma->parent->num_children++;anon_vma_unlock_write (anon_vma);return 0 ;
@@ -406,7 +408,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)* to free them outside the lock. */ if (RB_EMPTY_ROOT (&anon_vma->rb_root.rb_root)) { - anon_vma->parent->degree--; + anon_vma->parent->num_children--;continue ; }
@@ -414,7 +416,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)anon_vma_chain_free (avc); }if (vma->anon_vma) - vma->anon_vma->degree--; + vma->anon_vma->num_active_vmas--;unlock_anon_vma_root (root);/*
@@ -425,7 +427,8 @@ void unlink_anon_vmas(struct vm_area_struct *vma)list_for_each_entry_safe (avc, next, &vma->anon_vma_chain, same_vma) {struct anon_vma *anon_vma = avc->anon_vma; -VM_WARN_ON (anon_vma->degree); +VM_WARN_ON (anon_vma->num_children); +VM_WARN_ON (anon_vma->num_active_vmas);put_anon_vma (anon_vma);list_del (&avc->same_vma);
net/bluetooth/l2cap_core.c +5 -5
@@ -1988,11 +1988,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, src_match = !bacmp (&c->src, src); dst_match = !bacmp (&c->dst, dst);if (src_match && dst_match) { - c =l2cap_chan_hold_unless_zero (c); -if (c) { -read_unlock (&chan_list_lock); -return c; - } +if (!l2cap_chan_hold_unless_zero (c)) +continue ; + +read_unlock (&chan_list_lock); +return c; }/* Closest match */
net/bpf/test_run.c +3 -0
@@ -441,6 +441,9 @@ static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb) {struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb; +if (!skb->len) +return -EINVAL ; +if (!__skb)return 0 ;
net/core/dev.c +1 -0
@@ -4097,6 +4097,7 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev)bool again = false;skb_reset_mac_header (skb); +skb_assert_len (skb);if (unlikely (skb_shinfo (skb)->tx_flags &SKBTX_SCHED_TSTAMP ))__skb_tstamp_tx (skb,NULL , skb->sk,SCM_TSTAMP_SCHED );
net/core/neighbour.c +21 -6
@@ -280,11 +280,26 @@ static int neigh_del_timer(struct neighbour *n)return 0 ; } -static void pneigh_queue_purge (struct sk_buff_head *list) +static void pneigh_queue_purge (struct sk_buff_head *list,struct net *net) { +struct sk_buff_head tmp; +unsigned long flags;struct sk_buff *skb; -while ((skb =skb_dequeue (list)) !=NULL ) { +skb_queue_head_init (&tmp); +spin_lock_irqsave (&list->lock, flags); + skb =skb_peek (list); +while (skb !=NULL ) { +struct sk_buff *skb_next =skb_peek_next (skb, list); +if (net ==NULL ||net_eq (dev_net (skb->dev), net)) { +__skb_unlink (skb, list); +__skb_queue_tail (&tmp, skb); + } + skb = skb_next; + } +spin_unlock_irqrestore (&list->lock, flags); + +while ((skb =__skb_dequeue (&tmp))) {dev_put (skb->dev);kfree_skb (skb); }
@@ -358,9 +373,9 @@ static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,write_lock_bh (&tbl->lock);neigh_flush_dev (tbl, dev, skip_perm);pneigh_ifdown_and_unlock (tbl, dev); - -del_timer_sync (&tbl->proxy_timer); -pneigh_queue_purge (&tbl->proxy_queue); +pneigh_queue_purge (&tbl->proxy_queue,dev_net (dev)); +if (skb_queue_empty_lockless (&tbl->proxy_queue)) +del_timer_sync (&tbl->proxy_timer);return 0 ; }
@@ -1743,7 +1758,7 @@ int neigh_table_clear(int index, struct neigh_table *tbl)/* It is not clean... Fix it to unload IPv6 module safely */ cancel_delayed_work_sync (&tbl->gc_work);del_timer_sync (&tbl->proxy_timer); -pneigh_queue_purge (&tbl->proxy_queue); +pneigh_queue_purge (&tbl->proxy_queue,NULL );neigh_ifdown (tbl,NULL );if (atomic_read (&tbl->entries))pr_crit ("neighbour leakage\n" );
net/core/skmsg.c +3 -1
@@ -612,7 +612,9 @@ struct sk_psock *sk_psock_init(struct sock *sk, int node)sk_psock_set_state (psock,SK_PSOCK_TX_ENABLED );refcount_set (&psock->refcnt,1 ); -rcu_assign_sk_user_data_nocopy (sk, psock); +__rcu_assign_sk_user_data_with_flags (sk, psock, +SK_USER_DATA_NOCOPY | +SK_USER_DATA_PSOCK );sock_hold (sk); out:
net/netfilter/Kconfig +0 -1
@@ -118,7 +118,6 @@ config NF_CONNTRACK_ZONES config NF_CONNTRACK_PROCFS bool "Supply CT list in procfs (OBSOLETE)" - default y depends on PROC_FS help This option enables for the list of known conntrack entries
net/packet/af_packet.c +2 -2
@@ -2986,8 +2986,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)if (err) goto out_free; -if (sock->type ==SOCK_RAW && - !dev_validate_header (dev, skb->data, len)) { +if ((sock->type ==SOCK_RAW && + !dev_validate_header (dev, skb->data, len)) || !skb->len) { err = -EINVAL ; goto out_free; }
scripts/Makefile.modpost +1 -2
@@ -87,8 +87,7 @@ obj := $(KBUILD_EXTMOD) src := $(obj) # Include the module's Makefile to find KBUILD_EXTRA_SYMBOLS -include $(if $(wildcard $(KBUILD_EXTMOD)/Kbuild), \ - $(KBUILD_EXTMOD)/Kbuild, $(KBUILD_EXTMOD)/Makefile) +include $(if $(wildcard $(src)/Kbuild), $(src)/Kbuild, $(src)/Makefile) # modpost option for external modules MODPOST += -e