247 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	6d62ca19a7	Merge 5.10.181 into android12-5.10-lts ... Changes in 5.10.181 driver core: add a helper to setup both the of_node and fwnode of a device drm/mipi-dsi: Set the fwnode for mipi_dsi_device ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() linux/dim: Do nothing if no time delta between samples net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). netfilter: conntrack: fix possible bug_on with enable_hooks=1 netlink: annotate accesses to nlk->cb_running net: annotate sk->sk_err write from do_recvmmsg() net: deal with most data-races in sk_wait_event() net: tap: check vlan with eth_type_vlan() method net: add vlan_get_protocol_and_depth() helper tcp: factor out __tcp_close() helper tcp: add annotations around sk->sk_shutdown accesses ipvlan:Fix out-of-bounds caused by unclear skb->cb net: datagram: fix data-races in datagram_poll() af_unix: Fix a data race of sk->sk_receive_queue->qlen. af_unix: Fix data races around sk->sk_shutdown. drm/i915/dp: prevent potential div-by-zero fbdev: arcfb: Fix error handling in arcfb_probe() ext4: remove an unused variable warning with CONFIG_QUOTA=n ext4: reflect error codes from ext4_multi_mount_protect() to its callers ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled ext4: fix lockdep warning when enabling MMP ext4: remove redundant mb_regenerate_buddy() ext4: drop s_mb_bal_lock and convert protected fields to atomic ext4: add mballoc stats proc file ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set ext4: allow ext4_get_group_info() to fail refscale: Move shutdown from wait_event() to wait_event_idle() rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() drm/amd/display: Use DC_LOG_DC in the trasform pixel function regmap: cache: Return error in cache sync operations for REGCACHE_NONE arm64: dts: qcom: msm8996: Add missing DWC3 quirks memstick: r592: Fix UAF bug in r592_remove due to race condition firmware: arm_sdei: Fix sleep from invalid context BUG ACPI: EC: Fix oops when removing custom query handlers remoteproc: stm32_rproc: Add mutex protection for workqueue drm/tegra: Avoid potential 32-bit integer overflow ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects drm/amd: Fix an out of bounds error in BIOS parser wifi: ath: Silence memcpy run-time false positive warning bpf: Annotate data races in bpf_local_storage wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex ext2: Check block size validity during mount scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow net: pasemi: Fix return type of pasemi_mac_start_tx() net: Catch invalid index in XPS mapping scsi: target: iscsit: Free cmds before session free lib: cpu_rmap: Avoid use after free on rmap->obj array entries scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition gfs2: Fix inode height consistency check ext4: set goal start correctly in ext4_mb_normalize_request ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() f2fs: fix to drop all dirty pages during umount() if cp_error is set samples/bpf: Fix fout leak in hbm's run_bpf_prog wifi: iwlwifi: pcie: fix possible NULL pointer dereference wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf null_blk: Always check queue mode setting from configfs wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace wifi: ath11k: Fix SKB corruption in REO destination ring ipvs: Update width of source for ip_vs_sync_conn_options Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE HID: logitech-hidpp: Don't use the USB serial for USB devices HID: logitech-hidpp: Reconcile USB and Unifying serials spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 HID: wacom: generic: Set battery quirk only when we see battery data usb: typec: tcpm: fix multiple times discover svids error serial: 8250: Reinit port->pm on port specific driver unbind mcb-pci: Reallocate memory region to avoid memory overlapping sched: Fix KCSAN noinstr violation recordmcount: Fix memory leaks in the uwrite function RDMA/core: Fix multiple -Warray-bounds warnings iommu/arm-smmu-qcom: Limit the SMR groups to 128 clk: tegra20: fix gcc-7 constant overflow warning iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any Input: xpad - add constants for GIP interface numbers phy: st: miphy28lp: use _poll_timeout functions for waits mfd: dln2: Fix memory leak in dln2_probe() btrfs: move btrfs_find_highest_objectid/btrfs_find_free_objectid to disk-io.c btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid btrfs: fix space cache inconsistency after error loading it from disk xfrm: don't check the default policy if the policy allows the packet Revert "Fix XFRM-I support for nested ESP tunnels" drm/msm/dp: unregister audio driver during unbind drm/msm/dpu: Remove duplicate register defines from INTF cpupower: Make TSC read per CPU for Mperf monitor af_key: Reject optional tunnel/BEET mode templates in outbound policies net: fec: Better handle pm_runtime_get() failing in .remove() net: phy: dp83867: add w/a for packet errors seen with short cables ALSA: firewire-digi00x: prevent potential use after free ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 vsock: avoid to close connected socket after the timeout ipv4/tcp: do not use per netns ctl sockets net: Find dst with sk's xfrm policy not ctl_sk tcp: fix possible sk_priority leak in tcp_v4_send_reset() serial: arc_uart: fix of_iomap leak in `arc_serial_probe` erspan: get the proto with the md version for collect_md net: hns3: fix sending pfc frames after reset issue net: hns3: fix reset delay time to avoid configuration timeout media: netup_unidvb: fix use-after-free at del_timer() SUNRPC: Fix trace_svc_register() call site drm/exynos: fix g2d_open/close helper function definitions net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() net/tipc: fix tipc header files for kernel-doc tipc: add tipc_bearer_min_mtu to calculate min mtu tipc: do not update mtu if msg_max is too small in mtu negotiation tipc: check the bearer min mtu properly when setting it by netlink net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close wifi: mac80211: fix min center freq offset tracing wifi: iwlwifi: mvm: don't trust firmware n_channels scsi: storvsc: Don't pass unused PFNs to Hyper-V host cassini: Fix a memory leak in the error handling path of cas_init_one() igb: fix bit_shift to be in [1..8] range vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() netfilter: nft_set_rbtree: fix null deref on element insertion bridge: always declare tunnel functions ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go USB: usbtmc: Fix direction for 0-length ioctl control messages usb-storage: fix deadlock when a scsi command timeouts more than once USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value usb: dwc3: debugfs: Resume dwc3 before accessing registers usb: gadget: u_ether: Fix host MAC address case usb: typec: altmodes/displayport: fix pin_assignment_show ALSA: hda: Fix Oops by 9.1 surround channel names ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table ALSA: hda/realtek: Add quirk for Clevo L140AU ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() can: kvaser_pciefd: Call request_irq() before enabling interrupts can: kvaser_pciefd: Empty SRB buffer in probe can: kvaser_pciefd: Clear listen-only bit if not explicitly requested can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt can: kvaser_pciefd: Disable interrupts in probe error path statfs: enforce statfs[64] structure initialization serial: Add support for Advantech PCI-1611U card vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF ceph: force updating the msg pointer in non-split case tpm/tpm_tis: Disable interrupts for more Lenovo devices powerpc/64s/radix: Fix soft dirty tracking nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() HID: wacom: Force pen out of prox if no events have been received in a while HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs HID: wacom: add three styli to wacom_intuos_get_tool_type KVM: arm64: Link position-independent string routines into .hyp.text serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards serial: exar: Add support for Sealevel 7xxxC serial cards serial: 8250_exar: Add support for USR298x PCI Modems s390/qdio: get rid of register asm s390/qdio: fix do_sqbs() inline assembly constraint watchdog: sp5100_tco: Immediately trigger upon starting. ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 writeback, cgroup: remove extra percpu_ref_exit() net/sched: act_mirred: refactor the handle of xmit net/sched: act_mirred: better wording on protection against excessive stack growth act_mirred: use the backlog for nested calls to mirred ingress spi: fsl-spi: Re-organise transfer bits_per_word adaptation spi: fsl-cpm: Use 16 bit mode for large transfers with even size ocfs2: Switch to security_inode_init_security() ALSA: hda/ca0132: add quirk for EVGA X299 DARK ALSA: hda: Fix unhandled register update during auto-suspend period ALSA: hda/realtek: Enable headset onLenovo M70/M90 net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize m68k: Move signal frame following exception on 68020/030 parisc: Handle kgdb breakpoints only in kernel context parisc: Allow to reboot machine after system halt gpio: mockup: Fix mode of debugfs files btrfs: use nofs when cleaning up aborted transactions dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type x86/mm: Avoid incomplete Global INVLPG flushes selftests/memfd: Fix unknown type name build failure parisc: Fix flush_dcache_page() for usage from irq context x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms debugobjects: Don't wake up kswapd from fill_pool() fbdev: udlfb: Fix endpoint check net: fix stack overflow when LRO is disabled for virtual interfaces udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). USB: core: Add routines for endpoint checks in old drivers USB: sisusbvga: Add endpoint checks media: radio-shark: Add endpoint checks net: fix skb leak in __skb_tstamp_tx() selftests: fib_tests: mute cleanup error message octeontx2-pf: Fix TSOv6 offload bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields ipv6: Fix out-of-bounds access in ipv6_find_tlv() power: supply: leds: Fix blink to LED on transition power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition power: supply: bq27xxx: Fix I2C IRQ race on remove power: supply: bq27xxx: Fix poll_interval handling and races on remove power: supply: sbs-charger: Fix INHIBITED bit for Status reg fs: fix undefined behavior in bit shift for SB_NOUSER coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() x86/show_trace_log_lvl: Ensure stack pointer is aligned, again ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg forcedeth: Fix an error handling path in nv_probe() net/mlx5e: do as little as possible in napi poll when budget is 0 net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs net/mlx5: Fix error message when failing to allocate device memory net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay 3c589_cs: Fix an error handling path in tc589_probe() net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE Linux 5.10.181 Change-Id: Iaad0b0bb7c1ad061b28ad4ee16e03db935241177 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-27 08:23:11 +00:00
Theodore Ts'o	100c0ad6c0	ext4: allow ext4_get_group_info() to fail ... [ Upstream commit 5354b2af34 ] Previously, ext4_get_group_info() would treat an invalid group number as BUG(), since in theory it should never happen. However, if a malicious attaker (or fuzzer) modifies the superblock via the block device while it is the file system is mounted, it is possible for s_first_data_block to get set to a very large number. In that case, when calculating the block group of some block number (such as the starting block of a preallocation region), could result in an underflow and very large block group number. Then the BUG_ON check in ext4_get_group_info() would fire, resutling in a denial of service attack that can be triggered by root or someone with write access to the block device. For a quality of implementation perspective, it's best that even if the system administrator does something that they shouldn't, that it will not trigger a BUG. So instead of BUG'ing, ext4_get_group_info() will call ext4_error and return NULL. We also add fallback code in all of the callers of ext4_get_group_info() that it might NULL. Also, since ext4_get_group_info() was already borderline to be an inline function, un-inline it. The results in a next reduction of the compiled text size of ext4 by roughly 2k. Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230430154311.579720-2-tytso@mit.edu Reported-by: syzbot+e2efa3efc15a1c9e95c3@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=69b28112e098b070f639efb356393af3ffec4220 Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-30 12:57:47 +01:00
Greg Kroah-Hartman	1d17080edb	Merge 5.10.146 into android12-5.10-lts ... Changes in 5.10.146 drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega drm/amdgpu: indirect register access for nv12 sriov drm/amdgpu: Separate vf2pf work item init from virt data exchange drm/amdgpu: make sure to init common IP before gmc usb: typec: intel_pmc_mux: Update IOM port status offset for AlderLake usb: typec: intel_pmc_mux: Add new ACPI ID for Meteor Lake IOM device usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind usb: dwc3: Issue core soft reset before enabling run/stop usb: dwc3: gadget: Prevent repeat pullup() usb: dwc3: gadget: Refactor pullup() usb: dwc3: gadget: Don't modify GEVNTCOUNT in pullup() usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop usb: xhci-mtk: get the microframe boundary for ESIT usb: xhci-mtk: add only one extra CS for FS/LS INTR usb: xhci-mtk: use @sch_tt to check whether need do TT schedule usb: xhci-mtk: add a function to (un)load bandwidth info usb: xhci-mtk: add some schedule error number usb: xhci-mtk: allow multiple Start-Split in a microframe usb: xhci-mtk: relax TT periodic bandwidth allocation mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure serial: atmel: remove redundant assignment in rs485_config tty: serial: atmel: Preserve previous USART mode if RS485 disabled usb: add quirks for Lenovo OneLink+ Dock usb: gadget: udc-xilinx: replace memcpy with memcpy_toio usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer usb: cdns3: fix issue with rearming ISO OUT endpoint Revert "usb: add quirks for Lenovo OneLink+ Dock" vfio/type1: Change success value of vaddr_get_pfn() vfio/type1: Prepare for batched pinning with struct vfio_batch vfio/type1: Unpin zero pages Revert "usb: gadget: udc-xilinx: replace memcpy with memcpy_toio" arm64: Restrict ARM64_BTI_KERNEL to clang 12.0.0 and newer arm64/bti: Disable in kernel BTI when cross section thunks are broken USB: core: Fix RST error in hub.c USB: serial: option: add Quectel BG95 0x0203 composition USB: serial: option: add Quectel RM520N ALSA: hda/tegra: set depop delay for tegra ALSA: hda: add Intel 5 Series / 3400 PCI DID ALSA: hda/realtek: Add quirk for Huawei WRT-WX9 ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5570 laptop ALSA: hda/realtek: Re-arrange quirk table entries ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack ALSA: hda/realtek: Add quirk for ASUS GA503R laptop ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop iommu/vt-d: Check correct capability for sagaw determination media: flexcop-usb: fix endpoint type check efi: x86: Wipe setup_data on pure EFI boot efi: libstub: check Shim mode using MokSBStateRT wifi: mt76: fix reading current per-tid starting sequence number for aggregation gpio: mockup: fix NULL pointer dereference when removing debugfs gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully riscv: fix a nasty sigreturn bug... can: flexcan: flexcan_mailbox_read() fix return value for drop = true mm/slub: fix to return errno if kmalloc() fails KVM: SEV: add cache flush to solve SEV cache incoherency issues interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate xfs: fix up non-directory creation in SGID directories xfs: reorder iunlink remove operation in xfs_ifree xfs: validate inode fork size against fork format arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob drm/mediatek: dsi: Add atomic {destroy,duplicate}_state, reset callbacks arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get() arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma netfilter: nf_conntrack_sip: fix ct_sip_walk_headers netfilter: nf_conntrack_irc: Tighten matching on DCC message netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() iavf: Fix cached head and tail value for iavf_get_tx_pending ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header net: let flow have same hash in two directions net: core: fix flow symmetric hash net: phy: aquantia: wait for the suspend/resume operations to finish scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region scsi: mpt3sas: Fix return value check of dma_get_required_mask() net: bonding: Share lacpdu_mcast_addr definition net: bonding: Unsync device addresses on ndo_stop net: team: Unsync device addresses on ndo_stop drm/panel: simple: Fix innolux_g121i1_l01 bus_format MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko MIPS: Loongson32: Fix PHY-mode being left unspecified iavf: Fix bad page state iavf: Fix set max MTU size with port VLAN and jumbo frames i40e: Fix VF set max MTU size i40e: Fix set max_tx_rate when it is lower than 1 Mbps sfc: fix TX channel offset when using legacy interrupts sfc: fix null pointer dereference in efx_hard_start_xmit drm/hisilicon/hibmc: Allow to be built if COMPILE_TEST is enabled drm/hisilicon: Add depends on MMU of: mdio: Add of_node_put() when breaking out of for_each_xx net: ipa: fix assumptions about DMA address size net: ipa: fix table alignment requirement net: ipa: avoid 64-bit modulus net: ipa: DMA addresses are nicely aligned net: ipa: kill IPA_TABLE_ENTRY_SIZE net: ipa: properly limit modem routing table use wireguard: ratelimiter: disable timings test by default wireguard: netlink: avoid variable-sized memcpy on sockaddr net: enetc: move enetc_set_psfp() out of the common enetc_set_features() net: socket: remove register_gifconf net/sched: taprio: avoid disabling offload when it was never enabled net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain() netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() netfilter: ebtables: fix memory leak when blob is malformed can: gs_usb: gs_can_open(): fix race dev->can.state condition perf jit: Include program header in ELF files perf kcore_copy: Do not check /proc/modules is unchanged drm/mediatek: dsi: Move mtk_dsi_stop() call back to mtk_dsi_poweroff() net/smc: Stop the CLC flow if no link to map buffers on net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD net: sched: fix possible refcount leak in tc_new_tfilter() selftests: forwarding: add shebang for sch_red.sh drm/amd/amdgpu: fixing read wrong pf2vf data in SRIOV serial: Create uart_xmit_advance() serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup usb: xhci-mtk: fix issue of out-of-bounds array access vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external() drm/amdgpu: Fix check for RAS support cifs: use discard iterator to discard unneeded network data more efficiently cifs: always initialize struct msghdr smb_msg completely Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region drm/gma500: Fix BUG: sleeping function called from invalid context errors drm/amdgpu: use dirty framebuffer helper drm/amd/display: Limit user regamma to a valid value drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for stack usage drm/rockchip: Fix return type of cdn_dp_connector_mode_valid workqueue: don't skip lockdep work dependency in cancel_work_sync() i2c: imx: If pm_runtime_get_sync() returned 1 device access is possible i2c: mlxbf: incorrect base address passed during io write i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() i2c: mlxbf: Fix frequency calculation devdax: Fix soft-reservation memory description ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 ext4: limit the number of retries after discarding preallocations blocks ext4: make directory inode spreading reflect flexbg size Linux 5.10.146 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I45edad7e4191aad7a85278b43fa9909a6253643f	2022-09-29 17:06:30 +02:00
Jan Kara	c18383218c	ext4: make directory inode spreading reflect flexbg size ... commit 613c5a8589 upstream. Currently the Orlov inode allocator searches for free inodes for a directory only in flex block groups with at most inodes_per_group/16 more directory inodes than average per flex block group. However with growing size of flex block group this becomes unnecessarily strict. Scale allowed difference from average directory count per flex block group with flex block group size as we do with other metrics. Tested-by: Stefan Wahren <stefan.wahren@i2se.com> Tested-by: Ojaswin Mujoo <ojaswin@linux.ibm.com> Cc: stable@kernel.org Link: https://lore.kernel.org/all/0d81a7c2-46b7-6010-62a4-3e6cfc1628d6@i2se.com/ Signed-off-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20220908092136.11770-3-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-09-28 11:10:41 +02:00
Greg Kroah-Hartman	2df0fb4a4b	Merge 5.10.50 into android12-5.10-lts ... Changes in 5.10.50 Bluetooth: hci_qca: fix potential GPF Bluetooth: btqca: Don't modify firmware contents in-place Bluetooth: Remove spurious error message ALSA: usb-audio: fix rate on Ozone Z90 USB headset ALSA: usb-audio: Fix OOB access at proc output ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire ALSA: usb-audio: scarlett2: Fix wrong resume call ALSA: intel8x0: Fix breakage at ac97 clock measurement ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 ALSA: hda/realtek: Add another ALC236 variant support ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC media: dvb-usb: fix wrong definition Input: usbtouchscreen - fix control-request directions net: can: ems_usb: fix use-after-free in ems_usb_disconnect() usb: gadget: eem: fix echo command packet response issue usb: renesas-xhci: Fix handling of unknown ROM state USB: cdc-acm: blacklist Heimann USB Appset device usb: dwc3: Fix debugfs creation flow usb: typec: Add the missed altmode_id_remove() in typec_register_altmode() xhci: solve a double free problem while doing s4 gfs2: Fix underflow in gfs2_page_mkwrite gfs2: Fix error handling in init_statfs ntfs: fix validity check for file name attribute selftests/lkdtm: Avoid needing explicit sub-shell copy_page_to_iter(): fix ITER_DISCARD case iov_iter_fault_in_readable() should do nothing in xarray case Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl crypto: nx - Fix memcpy() over-reading in nonce crypto: ccp - Annotate SEV Firmware file names arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode ARM: dts: ux500: Fix LED probing ARM: dts: at91: sama5d4: fix pinctrl muxing btrfs: send: fix invalid path for unlink operations after parent orphanization btrfs: compression: don't try to compress if we don't have enough pages btrfs: clear defrag status of a root if starting transaction fails ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle ext4: fix kernel infoleak via ext4_extent_header ext4: fix overflow in ext4_iomap_alloc() ext4: return error code when ext4_fill_flex_info() fails ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit ext4: remove check for zero nr_to_scan in ext4_es_scan() ext4: fix avefreec in find_group_orlov ext4: use ext4_grp_locked_error in mb_find_extent can: bcm: delay release of struct bcm_op after synchronize_rcu() can: gw: synchronize rcu operations before removing gw job entry can: isotp: isotp_release(): omit unintended hrtimer restart on socket release can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path mac80211: remove iwlwifi specific workaround that broke sta NDP tx SUNRPC: Fix the batch tasks count wraparound. SUNRPC: Should wake up the privileged task firstly. bus: mhi: Wait for M2 state during system resume mm/gup: fix try_grab_compound_head() race with split_huge_page() perf/smmuv3: Don't trample existing events with global filter KVM: nVMX: Handle split-lock #AC exceptions that happen in L2 KVM: PPC: Book3S HV: Workaround high stack usage with clang KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs KVM: x86/mmu: Use MMU's role to detect CR4.SMEP value in nested NPT walk s390/cio: dont call css_wait_for_slow_path() inside a lock s390: mm: Fix secure storage access exception handling f2fs: Prevent swap file in LFS mode clk: agilex/stratix10/n5x: fix how the bypass_reg is handled clk: agilex/stratix10: remove noc_clk clk: agilex/stratix10: fix bypass representation rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path iio: frequency: adf4350: disable reg and clk on error in adf4350_probe() iio: light: tcs3472: do not free unallocated IRQ iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA as volatile, too iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR iio: ltr501: ltr501_read_ps(): add missing endianness conversion iio: accel: bma180: Fix BMA25x bandwidth register values serial: mvebu-uart: fix calculation of clock divisor serial: sh-sci: Stop dmaengine transfer in sci_stop_tx() serial_cs: Add Option International GSM-Ready 56K/ISDN modem serial_cs: remove wrong GLOBETROTTER.cis entry ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() ssb: sdio: Don't overwrite const buffer if block_write fails rsi: Assign beacon rate settings to the correct rate_info descriptor field rsi: fix AP mode with WPA failure due to encrypted EAPOL tracing/histograms: Fix parsing of "sym-offset" modifier tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing seq_buf: Make trace_seq_putmem_hex() support data longer than 8 powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi() loop: Fix missing discard support when using LOOP_CONFIGURE evm: Execute evm_inode_init_security() only when an HMAC key is loaded evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded fuse: Fix crash in fuse_dentry_automount() error path fuse: Fix crash if superblock of submount gets killed early fuse: Fix infinite loop in sget_fc() fuse: ignore PG_workingset after stealing fuse: check connected before queueing on fpq->io fuse: reject internal errno thermal/cpufreq_cooling: Update offline CPUs per-cpu thermal_pressure spi: Make of_register_spi_device also set the fwnode Add a reference to ucounts for each cred staging: media: rkvdec: fix pm_runtime_get_sync() usage count media: marvel-ccic: fix some issues when getting pm_runtime media: mdk-mdp: fix pm_runtime_get_sync() usage count media: s5p: fix pm_runtime_get_sync() usage count media: am437x: fix pm_runtime_get_sync() usage count media: sh_vou: fix pm_runtime_get_sync() usage count media: mtk-vcodec: fix PM runtime get logic media: s5p-jpeg: fix pm_runtime_get_sync() usage count media: sunxi: fix pm_runtime_get_sync() usage count media: sti/bdisp: fix pm_runtime_get_sync() usage count media: exynos4-is: fix pm_runtime_get_sync() usage count media: exynos-gsc: fix pm_runtime_get_sync() usage count spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf' spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() spi: omap-100k: Fix the length judgment problem regulator: uniphier: Add missing MODULE_DEVICE_TABLE sched/core: Initialize the idle task with preemption disabled hwrng: exynos - Fix runtime PM imbalance on error crypto: nx - add missing MODULE_DEVICE_TABLE media: sti: fix obj-$(config) targets media: cpia2: fix memory leak in cpia2_usb_probe media: cobalt: fix race condition in setting HPD media: hevc: Fix dependent slice segment flags media: pvrusb2: fix warning in pvr2_i2c_core_done media: imx: imx7_mipi_csis: Fix logging of only error event counters crypto: qat - check return code of qat_hal_rd_rel_reg() crypto: qat - remove unused macro in FW loader crypto: qce: skcipher: Fix incorrect sg count for dma transfers arm64: perf: Convert snprintf to sysfs_emit sched/fair: Fix ascii art by relpacing tabs media: i2c: ov2659: Use clk_{prepare_enable,disable_unprepare}() to set xvclk on/off media: bt878: do not schedule tasklet when it is not setup media: em28xx: Fix possible memory leak of em28xx struct media: hantro: Fix .buf_prepare media: cedrus: Fix .buf_prepare media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release media: bt8xx: Fix a missing check bug in bt878_probe media: st-hva: Fix potential NULL pointer dereferences crypto: hisilicon/sec - fixup 3des minimum key size declaration Makefile: fix GDB warning with CONFIG_RELR media: dvd_usb: memory leak in cinergyt2_fe_attach memstick: rtsx_usb_ms: fix UAF mmc: sdhci-sprd: use sdhci_sprd_writew mmc: via-sdmmc: add a check against NULL pointer dereference spi: meson-spicc: fix a wrong goto jump for avoiding memory leak. spi: meson-spicc: fix memory leak in meson_spicc_probe crypto: shash - avoid comparing pointers to exported functions under CFI media: dvb_net: avoid speculation from net slot media: siano: fix device register error path media: imx-csi: Skip first few frames from a BT.656 source hwmon: (max31790) Report correct current pwm duty cycles hwmon: (max31790) Fix pwmX_enable attributes drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe() KVM: PPC: Book3S HV: Fix TLB management on SMT8 POWER9 and POWER10 processors btrfs: fix error handling in __btrfs_update_delayed_inode btrfs: abort transaction if we fail to update the delayed inode btrfs: sysfs: fix format string for some discard stats btrfs: don't clear page extent mapped if we're not invalidating the full page btrfs: disable build on platforms having page size 256K locking/lockdep: Fix the dep path printing for backwards BFS lockding/lockdep: Avoid to find wrong lock dep path in check_irq_usage() KVM: s390: get rid of register asm usage regulator: mt6358: Fix vdram2 .vsel_mask regulator: da9052: Ensure enough delay time for .set_voltage_time_sel media: Fix Media Controller API config checks ACPI: video: use native backlight for GA401/GA502/GA503 HID: do not use down_interruptible() when unbinding devices EDAC/ti: Add missing MODULE_DEVICE_TABLE ACPI: processor idle: Fix up C-state latency if not ordered hv_utils: Fix passing zero to 'PTR_ERR' warning lib: vsprintf: Fix handling of number field widths in vsscanf Input: goodix - platform/x86: touchscreen_dmi - Move upside down quirks to touchscreen_dmi.c platform/x86: touchscreen_dmi: Add an extra entry for the upside down Goodix touchscreen on Teclast X89 tablets platform/x86: touchscreen_dmi: Add info for the Goodix GT912 panel of TM800A550L tablets ACPI: EC: Make more Asus laptops use ECDT _GPE block_dump: remove block_dump feature in mark_inode_dirty() blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter blk-mq: clear stale request in tags->rq[] before freeing one request pool fs: dlm: cancel work sync othercon random32: Fix implicit truncation warning in prandom_seed_state() open: don't silently ignore unknown O-flags in openat2() drivers: hv: Fix missing error code in vmbus_connect() fs: dlm: fix memory leak when fenced ACPICA: Fix memory leak caused by _CID repair function ACPI: bus: Call kobject_put() in acpi_init() error path ACPI: resources: Add checks for ACPI IRQ override block: fix race between adding/removing rq qos and normal IO platform/x86: asus-nb-wmi: Revert "Drop duplicate DMI quirk structures" platform/x86: asus-nb-wmi: Revert "add support for ASUS ROG Zephyrus G14 and G15" platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard() nvme-pci: fix var. type for increasing cq_head nvmet-fc: do not check for invalid target port in nvmet_fc_handle_fcp_rqst() EDAC/Intel: Do not load EDAC driver when running as a guest PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv() cifs: improve fallocate emulation ACPI: EC: trust DSDT GPE for certain HP laptop clocksource: Retry clock read if long delays detected clocksource: Check per-CPU clock synchronization when marked unstable tpm_tis_spi: add missing SPI device ID entries ACPI: tables: Add custom DSDT file as makefile prerequisite HID: wacom: Correct base usage for capacitive ExpressKey status bits cifs: fix missing spinlock around update to ses->status mailbox: qcom: Use PLATFORM_DEVID_AUTO to register platform device block: fix discard request merge kthread_worker: fix return value when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() ia64: mca_drv: fix incorrect array size calculation writeback, cgroup: increment isw_nr_in_flight before grabbing an inode spi: Allow to have all native CSs in use along with GPIOs spi: Avoid undefined behaviour when counting unused native CSs media: venus: Rework error fail recover logic media: s5p_cec: decrement usage count if disabled media: hantro: do a PM resume earlier crypto: ixp4xx - dma_unmap the correct address crypto: ixp4xx - update IV after requests crypto: ux500 - Fix error return code in hash_hw_final() sata_highbank: fix deferred probing pata_rb532_cf: fix deferred probing media: I2C: change 'RST' to "RSET" to fix multiple build errors sched/uclamp: Fix wrong implementation of cpu.uclamp.min sched/uclamp: Fix locking around cpu_util_update_eff() kbuild: Fix objtool dependency for 'OBJECT_FILES_NON_STANDARD_<obj> := n' pata_octeon_cf: avoid WARN_ON() in ata_host_activate() evm: fix writing <securityfs>/evm overflow x86/elf: Use _BITUL() macro in UAPI headers crypto: sa2ul - Fix leaks on failure paths with sa_dma_init() crypto: sa2ul - Fix pm_runtime enable in sa_ul_probe() crypto: ccp - Fix a resource leak in an error handling path media: rc: i2c: Fix an error message pata_ep93xx: fix deferred probing locking/lockdep: Reduce LOCKDEP dependency list media: rkvdec: Fix .buf_prepare media: exynos4-is: Fix a use after free in isp_video_release media: au0828: fix a NULL vs IS_ERR() check media: tc358743: Fix error return code in tc358743_probe_of() media: gspca/gl860: fix zero-length control requests m68k: atari: Fix ATARI_KBD_CORE kconfig unmet dependency warning media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2() regulator: fan53880: Fix vsel_mask setting for FAN53880_BUCK crypto: nitrox - fix unchecked variable in nitrox_register_interrupts crypto: omap-sham - Fix PM reference leak in omap sham ops crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit crypto: sm2 - remove unnecessary reset operations crypto: sm2 - fix a memory leak in sm2 mmc: usdhi6rol0: fix error return code in usdhi6_probe() arm64: consistently use reserved_pg_dir arm64/mm: Fix ttbr0 values stored in struct thread_info for software-pan media: subdev: remove VIDIOC_DQEVENT_TIME32 handling media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx hwmon: (lm70) Use device_get_match_data() hwmon: (lm70) Revert "hwmon: (lm70) Add support for ACPI" hwmon: (max31722) Remove non-standard ACPI device IDs hwmon: (max31790) Fix fan speed reporting for fan7..12 KVM: nVMX: Sync all PGDs on nested transition with shadow paging KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap KVM: nVMX: Don't clobber nested MMU's A/D status on EPTP switch KVM: x86/mmu: Fix return value in tdp_mmu_map_handle_target_level() perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number KVM: arm64: Don't zero the cycle count register when PMCR_EL0.P is set regulator: hi655x: Fix pass wrong pointer to config.driver_data btrfs: clear log tree recovering status if starting transaction fails x86/sev: Make sure IRQs are disabled while GHCB is active x86/sev: Split up runtime #VC handler for correct state tracking sched/rt: Fix RT utilization tracking during policy change sched/rt: Fix Deadline utilization tracking during policy change sched/uclamp: Fix uclamp_tg_restrict() lockdep: Fix wait-type for empty stack lockdep/selftests: Fix selftests vs PROVE_RAW_LOCK_NESTING spi: spi-sun6i: Fix chipselect/clock bug crypto: nx - Fix RCU warning in nx842_OF_upd_status psi: Fix race between psi_trigger_create/destroy media: v4l2-async: Clean v4l2_async_notifier_add_fwnode_remote_subdev media: video-mux: Skip dangling endpoints PM / devfreq: Add missing error code in devfreq_add_device() ACPI: PM / fan: Put fan device IDs into separate header file block: avoid double io accounting for flush request nvme-pci: look for StorageD3Enable on companion ACPI device instead ACPI: sysfs: Fix a buffer overrun problem with description_show() mark pstore-blk as broken clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG extcon: extcon-max8997: Fix IRQ freeing at error path ACPI: APEI: fix synchronous external aborts in user-mode blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled() blk-wbt: make sure throttle is enabled properly ACPI: Use DEVICE_ATTR_<RW|RO|WO> macros ACPI: bgrt: Fix CFI violation cpufreq: Make cpufreq_online() call driver->offline() on errors blk-mq: update hctx->dispatch_busy in case of real scheduler ocfs2: fix snprintf() checking dax: fix ENOMEM handling in grab_mapping_entry() mm/debug_vm_pgtable/basic: add validation for dirtiness after write protect mm/debug_vm_pgtable/basic: iterate over entire protection_map[] mm/debug_vm_pgtable: ensure THP availability via has_transparent_hugepage() swap: fix do_swap_page() race with swapoff mm/shmem: fix shmem_swapin() race with swapoff mm: memcg/slab: properly set up gfp flags for objcg pointer array mm: page_alloc: refactor setup_per_zone_lowmem_reserve() mm/page_alloc: fix counting of managed_pages xfrm: xfrm_state_mtu should return at least 1280 for ipv6 drm/bridge/sii8620: fix dependency on extcon drm/bridge: Fix the stop condition of drm_bridge_chain_pre_enable() drm/amd/dc: Fix a missing check bug in dm_dp_mst_detect() drm/ast: Fix missing conversions to managed API video: fbdev: imxfb: Fix an error message net: mvpp2: Put fwnode in error case during ->probe() net: pch_gbe: Propagate error from devm_gpio_request_one() pinctrl: renesas: r8a7796: Add missing bias for PRESET# pin pinctrl: renesas: r8a77990: JTAG pins do not have pull-down capabilities drm/vmwgfx: Mark a surface gpu-dirty after the SVGA3dCmdDXGenMips command drm/vmwgfx: Fix cpu updates of coherent multisample surfaces net: qrtr: ns: Fix error return code in qrtr_ns_init() clk: meson: g12a: fix gp0 and hifi ranges net: ftgmac100: add missing error return code in ftgmac100_probe() drm: rockchip: set alpha_en to 0 if it is not used drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write() drm/rockchip: dsi: move all lane config except LCDC mux to bind() drm/rockchip: lvds: Fix an error handling path drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 result mptcp: fix pr_debug in mptcp_token_new_connect mptcp: generate subflow hmac after mptcp_finish_join() RDMA/srp: Fix a recently introduced memory leak RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its stats RDMA/rtrs: Do not reset hb_missed_max after re-connection RDMA/rtrs-srv: Fix memory leak of unfreed rtrs_srv_stats object RDMA/rtrs-srv: Fix memory leak when having multiple sessions RDMA/rtrs-clt: Check if the queue_depth has changed during a reconnection RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats ehea: fix error return code in ehea_restart_qps() clk: tegra30: Use 300MHz for video decoder by default xfrm: remove the fragment check for ipv6 beet mode net/sched: act_vlan: Fix modify to allow 0 RDMA/core: Sanitize WQ state received from the userspace drm/pl111: depend on CONFIG_VEXPRESS_CONFIG RDMA/rxe: Fix failure during driver load drm/pl111: Actually fix CONFIG_VEXPRESS_CONFIG depends drm/vc4: hdmi: Fix error path of hpd-gpios clk: vc5: fix output disabling when enabling a FOD drm: qxl: ensure surf.data is ininitialized tools/bpftool: Fix error return code in do_batch() ath10k: go to path err_unsupported when chip id is not supported ath10k: add missing error return code in ath10k_pci_probe() wireless: carl9170: fix LEDS build errors & warnings ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others clk: imx8mq: remove SYS PLL 1/2 clock gates wcn36xx: Move hal_buf allocation to devm_kmalloc in probe ssb: Fix error return code in ssb_bus_scan() brcmfmac: fix setting of station info chains bitmask brcmfmac: correctly report average RSSI in station info brcmfmac: Fix a double-free in brcmf_sdio_bus_reset brcmsmac: mac80211_if: Fix a resource leak in an error handling path cw1200: Revert unnecessary patches that fix unreal use-after-free bugs ath11k: Fix an error handling path in ath11k_core_fetch_board_data_api_n() ath10k: Fix an error code in ath10k_add_interface() ath11k: send beacon template after vdev_start/restart during csa netlabel: Fix memory leak in netlbl_mgmt_add_common RDMA/mlx5: Don't add slave port to unaffiliated list netfilter: nft_exthdr: check for IPv6 packet before further processing netfilter: nft_osf: check for TCP packet before further processing netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols RDMA/rxe: Fix qp reference counting for atomic ops selftests/bpf: Whitelist test_progs.h from .gitignore xsk: Fix missing validation for skb and unaligned mode xsk: Fix broken Tx ring validation bpf: Fix libelf endian handling in resolv_btfids RDMA/rtrs-srv: Set minimal max_send_wr and max_recv_wr samples/bpf: Fix Segmentation fault for xdp_redirect command samples/bpf: Fix the error return code of xdp_redirect's main() mt76: fix possible NULL pointer dereference in mt76_tx mt76: mt7615: fix NULL pointer dereference in tx_prepare_skb() net: ethernet: aeroflex: fix UAF in greth_of_remove net: ethernet: ezchip: fix UAF in nps_enet_remove net: ethernet: ezchip: fix error handling vrf: do not push non-ND strict packets with a source LLA through packet taps again net: sched: add barrier to ensure correct ordering for lockless qdisc tls: prevent oversized sendfile() hangs by ignoring MSG_MORE netfilter: nf_tables_offload: check FLOW_DISSECTOR_KEY_BASIC in VLAN transfer logic pkt_sched: sch_qfq: fix qfq_change_class() error path xfrm: Fix xfrm offload fallback fail case iwlwifi: increase PNVM load timeout rtw88: 8822c: fix lc calibration timing vxlan: add missing rcu_read_lock() in neigh_reduce() ip6_tunnel: fix GRE6 segmentation net/ipv4: swap flow ports when validating source net: ti: am65-cpsw-nuss: Fix crash when changing number of TX queues tc-testing: fix list handling ieee802154: hwsim: Fix memory leak in hwsim_add_one ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() bpf: Fix null ptr deref with mixed tail calls and subprogs drm/msm: Fix error return code in msm_drm_init() drm/msm/dpu: Fix error return code in dpu_mdss_init() mac80211: remove iwlwifi specific workaround NDPs of null_response net: bcmgenet: Fix attaching to PYH failed on RPi 4B ipv6: exthdrs: do not blindly use init_net can: j1939: j1939_sk_setsockopt(): prevent allocation of j1939 filter for optlen == 0 bpf: Do not change gso_size during bpf_skb_change_proto() i40e: Fix error handling in i40e_vsi_open i40e: Fix autoneg disabling for non-10GBaseT links i40e: Fix missing rtnl locking when setting up pf switch Revert "ibmvnic: remove duplicate napi_schedule call in open function" ibmvnic: set ltb->buff to NULL after freeing ibmvnic: free tx_pool if tso_pool alloc fails RDMA/cma: Protect RMW with qp_mutex net: macsec: fix the length used to copy the key for offloading net: phy: mscc: fix macsec key length net: atlantic: fix the macsec key length ipv6: fix out-of-bound access in ip6_parse_tlv() e1000e: Check the PCIm state net: dsa: sja1105: fix NULL pointer dereference in sja1105_reload_cbs() bpfilter: Specify the log level for the kmsg message RDMA/cma: Fix incorrect Packet Lifetime calculation gve: Fix swapped vars when fetching max queues Revert "be2net: disable bh with spin_lock in be_process_mcc" Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid Bluetooth: Fix not sending Set Extended Scan Response Bluetooth: Fix Set Extended (Scan Response) Data Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event clk: actions: Fix UART clock dividers on Owl S500 SoC clk: actions: Fix SD clocks factor table on Owl S500 SoC clk: actions: Fix bisp_factor_table based clocks on Owl S500 SoC clk: actions: Fix AHPPREDIV-H-AHB clock chain on Owl S500 SoC clk: qcom: clk-alpha-pll: fix CAL_L write in alpha_pll_fabia_prepare clk: si5341: Wait for DEVICE_READY on startup clk: si5341: Avoid divide errors due to bogus register contents clk: si5341: Check for input clock presence and PLL lock on startup clk: si5341: Update initialization magic writeback: fix obtain a reference to a freeing memcg css net: lwtunnel: handle MTU calculation in forwading net: sched: fix warning in tcindex_alloc_perfect_hash net: tipc: fix FB_MTU eat two pages RDMA/mlx5: Don't access NULL-cleared mpi pointer RDMA/core: Always release restrack object MIPS: Fix PKMAP with 32-bit MIPS huge page support staging: fbtft: Rectify GPIO handling staging: fbtft: Don't spam logs when probe is deferred ASoC: rt5682: Disable irq on shutdown rcu: Invoke rcu_spawn_core_kthreads() from rcu_spawn_gp_kthread() serial: fsl_lpuart: don't modify arbitrary data on lpuart32 serial: fsl_lpuart: remove RTSCTS handling from get_mctrl() serial: 8250_omap: fix a timeout loop condition tty: nozomi: Fix a resource leak in an error handling function mwifiex: re-fix for unaligned accesses iio: adis_buffer: do not return ints in irq handlers iio: adis16400: do not return ints in irq handlers iio: adis16475: do not return ints in irq handlers iio: accel: bma180: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: bma220: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: hid: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: kxcjk-1013: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: mxc4005: Fix overread of data and alignment issue. iio: accel: stk8312: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: stk8ba50: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: ti-ads1015: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: vf610: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: gyro: bmg160: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: humidity: am2315: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: srf08: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: pulsed-light: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: as3935: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: magn: hmc5843: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: magn: bmc150: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: isl29125: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: tcs3414: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: tcs3472: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: chemical: atlas: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: cros_ec_sensors: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: potentiostat: lmp91000: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() ASoC: rk3328: fix missing clk_disable_unprepare() on error in rk3328_platform_probe() ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() backlight: lm3630a_bl: Put fwnode in error case during ->probe() ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() Input: hil_kbd - fix error return code in hil_dev_connect() perf scripting python: Fix tuple_set_u64() mtd: partitions: redboot: seek fis-index-block in the right node mtd: rawnand: arasan: Ensure proper configuration for the asserted target staging: mmal-vchiq: Fix incorrect static vchiq_instance. char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol() firmware: stratix10-svc: Fix a resource leak in an error handling path tty: nozomi: Fix the error handling path of 'nozomi_card_init()' leds: class: The -ENOTSUPP should never be seen by user space leds: lm3532: select regmap I2C API leds: lm36274: Put fwnode in error case during ->probe() leds: lm3692x: Put fwnode in any case during ->probe() leds: lm3697: Don't spam logs when probe is deferred leds: lp50xx: Put fwnode in error case during ->probe() scsi: FlashPoint: Rename si_flags field scsi: iscsi: Flush block work before unblock mfd: mp2629: Select MFD_CORE to fix build error mfd: rn5t618: Fix IRQ trigger by changing it to level mode fsi: core: Fix return of error values on failures fsi: scom: Reset the FSI2PIB engine for any error fsi: occ: Don't accept response from un-initialized OCC fsi/sbefifo: Clean up correct FIFO when receiving reset request from SBE fsi/sbefifo: Fix reset timeout visorbus: fix error return code in visorchipset_init() iommu/amd: Fix extended features logging s390/irq: select HAVE_IRQ_EXIT_ON_IRQ_STACK s390: enable HAVE_IOREMAP_PROT s390: appldata depends on PROC_SYSCTL selftests: splice: Adjust for handler fallback removal iommu/dma: Fix IOVA reserve dma ranges ASoC: max98373-sdw: use first_hw_init flag on resume ASoC: rt1308-sdw: use first_hw_init flag on resume ASoC: rt5682-sdw: use first_hw_init flag on resume ASoC: rt700-sdw: use first_hw_init flag on resume ASoC: rt711-sdw: use first_hw_init flag on resume ASoC: rt715-sdw: use first_hw_init flag on resume ASoC: rt5682: fix getting the wrong device id when the suspend_stress_test ASoC: rt5682-sdw: set regcache_cache_only false before reading RT5682_DEVICE_ID ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()' usb: gadget: f_fs: Fix setting of device and driver data cross-references usb: dwc2: Don't reset the core after setting turnaround time eeprom: idt_89hpesx: Put fwnode in matching case during ->probe() eeprom: idt_89hpesx: Restore printing the unsupported fwnode name thunderbolt: Bond lanes only when dual_link_port != NULL in alloc_dev_default() iio: adc: at91-sama5d2: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: hx711: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: mxs-lradc: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: ti-ads8688: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: magn: rm3100: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: light: vcnl4000: Fix buffer alignment in iio_push_to_buffers_with_timestamp() ASoC: fsl_spdif: Fix error handler with pm_runtime_enable staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt() staging: gdm724x: check for overflow in gdm_lte_netif_rx() staging: rtl8712: fix error handling in r871xu_drv_init staging: rtl8712: fix memory leak in rtl871x_load_fw_cb coresight: core: Fix use of uninitialized pointer staging: mt7621-dts: fix pci address for PCI memory range serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: isl29501: Fix buffer alignment in iio_push_to_buffers_with_timestamp() ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK of: Fix truncation of memory sizes on 32-bit platforms mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume() habanalabs: Fix an error handling path in 'hl_pci_probe()' scsi: mpt3sas: Fix error return value in _scsih_expander_add() soundwire: stream: Fix test for DP prepare complete phy: uniphier-pcie: Fix updating phy parameters phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe() extcon: sm5502: Drop invalid register write in sm5502_reg_data extcon: max8997: Add missing modalias string powerpc/powernv: Fix machine check reporting of async store errors ASoC: atmel-i2s: Fix usage of capture and playback at the same time configfs: fix memleak in configfs_release_bin_file ASoC: Intel: sof_sdw: add SOF_RT715_DAI_ID_FIX for AlderLake ASoC: fsl_spdif: Fix unexpected interrupt after suspend leds: as3645a: Fix error return code in as3645a_parse_node() leds: ktd2692: Fix an error handling path selftests/ftrace: fix event-no-pid on 1-core machine serial: 8250: 8250_omap: Disable RX interrupt after DMA enable serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs powerpc: Offline CPU in stop_this_cpu() powerpc/papr_scm: Properly handle UUID types and API powerpc/64s: Fix copy-paste data exposure into newly created tasks powerpc/papr_scm: Make 'perf_stats' invisible if perf-stats unavailable ALSA: firewire-lib: Fix 'amdtp_domain_start()' when no AMDTP_OUT_STREAM stream is found serial: mvebu-uart: do not allow changing baudrate when uartclk is not available serial: mvebu-uart: correctly calculate minimal possible baudrate arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART vfio/pci: Handle concurrent vma faults mm/pmem: avoid inserting hugepage PTE entry with fsdax if hugepage support is disabled mm/huge_memory.c: remove dedicated macro HPAGE_CACHE_INDEX_MASK mm/huge_memory.c: add missing read-only THP checking in transparent_hugepage_enabled() mm/huge_memory.c: don't discard hugepage if other processes are mapping it mm/hugetlb: use helper huge_page_order and pages_per_huge_page mm/hugetlb: remove redundant check in preparing and destroying gigantic page hugetlb: remove prep_compound_huge_page cleanup include/linux/huge_mm.h: remove extern keyword mm/z3fold: fix potential memory leak in z3fold_destroy_pool() mm/z3fold: use release_z3fold_page_locked() to release locked z3fold page lib/math/rational.c: fix divide by zero selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really random selftests/vm/pkeys: handle negative sys_pkey_alloc() return code selftests/vm/pkeys: refill shadow register after implicit kernel write perf llvm: Return -ENOMEM when asprintf() fails csky: fix syscache.c fallthrough warning csky: syscache: Fixup duplicate cache flush exfat: handle wrong stream entry size in exfat_readdir() scsi: fc: Correct RHBA attributes length scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd() mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion fscrypt: don't ignore minor_hash when hash is 0 fscrypt: fix derivation of SipHash keys on big endian CPUs tpm: Replace WARN_ONCE() with dev_err_once() in tpm_tis_status() erofs: fix error return code in erofs_read_superblock() block: return the correct bvec when checking for gaps io_uring: fix blocking inline submission mmc: block: Disable CMDQ on the ioctl path mmc: vub3000: fix control-request direction media: exynos4-is: remove a now unused integer scsi: core: Retry I/O for Notify (Enable Spinup) Required error crypto: qce - fix error return code in qce_skcipher_async_req_handle() s390: preempt: Fix preempt_count initialization cred: add missing return error code when set_cred_ucounts() failed iommu/dma: Fix compile warning in 32-bit builds powerpc/preempt: Don't touch the idle task's preempt_count during hotplug Linux 5.10.50 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iec4eab24ea8eb5a6d79739a1aec8432d93a8f82c	2021-07-14 17:35:23 +02:00
Pan Dong	6903f99f19	ext4: fix avefreec in find_group_orlov ... commit c89849cc02 upstream. The avefreec should be average free clusters instead of average free blocks, otherwize Orlov's allocator will not work properly when bigalloc enabled. Cc: stable@kernel.org Signed-off-by: Pan Dong <pandong.peter@bytedance.com> Link: https://lore.kernel.org/r/20210525073656.31594-1-pandong.peter@bytedance.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-14 16:55:41 +02:00
Greg Kroah-Hartman	9e08e97ec6	Merge 5.10.43 into android12-5.10 ... Changes in 5.10.43 btrfs: tree-checker: do not error out if extent ref hash doesn't match net: usb: cdc_ncm: don't spew notifications hwmon: (dell-smm-hwmon) Fix index values hwmon: (pmbus/isl68137) remove READ_TEMPERATURE_3 for RAA228228 netfilter: conntrack: unregister ipv4 sockopts on error unwind efi/fdt: fix panic when no valid fdt found efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared efi/libstub: prevent read overflow in find_file_option() efi: cper: fix snprintf() use in cper_dimm_err_location() vfio/pci: Fix error return code in vfio_ecap_init() vfio/pci: zap_vma_ptes() needs MMU samples: vfio-mdev: fix error handing in mdpy_fb_probe() vfio/platform: fix module_put call in error flow ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service HID: logitech-hidpp: initialize level variable HID: pidff: fix error return code in hid_pidff_init() HID: i2c-hid: fix format string mismatch devlink: Correct VIRTUAL port to not have phys_port attributes net/sched: act_ct: Offload connections with commit action net/sched: act_ct: Fix ct template allocation for zone 0 mptcp: always parse mptcp options for MPC reqsk nvme-rdma: fix in-casule data send for chained sgls ACPICA: Clean up context mutex during object deletion perf probe: Fix NULL pointer dereference in convert_variable_location() net: dsa: tag_8021q: fix the VLAN IDs used for encoding sub-VLANs net: sock: fix in-kernel mark setting net/tls: Replace TLS_RX_SYNC_RUNNING with RCU net/tls: Fix use-after-free after the TLS device goes down and up net/mlx5e: Fix incompatible casting net/mlx5: Check firmware sync reset requested is set before trying to abort it net/mlx5e: Check for needed capability for cvlan matching net/mlx5: DR, Create multi-destination flow table with level less than 64 nvmet: fix freeing unallocated p2pmem netfilter: nft_ct: skip expectations for confirmed conntrack netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches drm/i915/selftests: Fix return value check in live_breadcrumbs_smoketest() bpf: Simplify cases in bpf_base_func_proto bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks ieee802154: fix error return code in ieee802154_add_iface() ieee802154: fix error return code in ieee802154_llsec_getparams() igb: add correct exception tracing for XDP ixgbevf: add correct exception tracing for XDP cxgb4: fix regression with HASH tc prio value update ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions ice: Fix allowing VF to request more/less queues via virtchnl ice: Fix VFR issues for AVF drivers that expect ATQLEN cleared ice: handle the VF VSI rebuild failure ice: report supported and advertised autoneg using PHY capabilities ice: Allow all LLDP packets from PF to Tx i2c: qcom-geni: Add shutdown callback for i2c cxgb4: avoid link re-train during TC-MQPRIO configuration i40e: optimize for XDP_REDIRECT in xsk path i40e: add correct exception tracing for XDP ice: simplify ice_run_xdp ice: optimize for XDP_REDIRECT in xsk path ice: add correct exception tracing for XDP ixgbe: optimize for XDP_REDIRECT in xsk path ixgbe: add correct exception tracing for XDP arm64: dts: ti: j7200-main: Mark Main NAVSS as dma-coherent optee: use export_uuid() to copy client UUID bus: ti-sysc: Fix am335x resume hang for usb otg module arm64: dts: ls1028a: fix memory node arm64: dts: zii-ultra: fix 12V_MAIN voltage arm64: dts: freescale: sl28: var4: fix RGMII clock and voltage ARM: dts: imx7d-meerkat96: Fix the 'tuning-step' property ARM: dts: imx7d-pico: Fix the 'tuning-step' property ARM: dts: imx: emcon-avari: Fix nxp,pca8574 #gpio-cells bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act tipc: add extack messages for bearer/media failure tipc: fix unique bearer names sanity check serial: stm32: fix threaded interrupt handling riscv: vdso: fix and clean-up Makefile io_uring: fix link timeout refs io_uring: use better types for cflags drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate Bluetooth: fix the erroneous flush_work() order Bluetooth: use correct lock to prevent UAF of hdev object wireguard: do not use -O3 wireguard: peer: allocate in kmem_cache wireguard: use synchronize_net rather than synchronize_rcu wireguard: selftests: remove old conntrack kconfig value wireguard: selftests: make sure rp_filter is disabled on vethc wireguard: allowedips: initialize list head in selftest wireguard: allowedips: remove nodes in O(1) wireguard: allowedips: allocate nodes in kmem_cache wireguard: allowedips: free empty intermediate nodes when removing single node net: caif: added cfserl_release function net: caif: add proper error handling net: caif: fix memory leak in caif_device_notify net: caif: fix memory leak in cfusbl_device_notify HID: i2c-hid: Skip ELAN power-on command after reset HID: magicmouse: fix NULL-deref on disconnect HID: multitouch: require Finger field to mark Win8 reports as MT gfs2: fix scheduling while atomic bug in glocks ALSA: timer: Fix master timer notification ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx ALSA: hda: update the power_state during the direct-complete ARM: dts: imx6dl-yapp4: Fix RGMII connection to QCA8334 switch ARM: dts: imx6q-dhcom: Add PU,VDD1P1,VDD2P5 regulators ext4: fix memory leak in ext4_fill_super ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed ext4: fix fast commit alignment issues ext4: fix memory leak in ext4_mb_init_backend on error path. ext4: fix accessing uninit percpu counter variable with fast_commit usb: dwc2: Fix build in periphal-only mode pid: take a reference when initializing `cad_pid` ocfs2: fix data corruption by fallocate mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() mm/page_alloc: fix counting of free pages after take off from buddy x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove update_pasid() x86/sev: Check SME/SEV support in CPUID first nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect drm/amdgpu: Don't query CE and UE errors drm/amdgpu: make sure we unpin the UVD BO x86/apic: Mark _all_ legacy interrupts when IO/APIC is missing powerpc/kprobes: Fix validation of prefixed instructions across page boundary btrfs: mark ordered extent and inode with error if we fail to finish btrfs: fix error handling in btrfs_del_csums btrfs: return errors from btrfs_del_csums in cleanup_ref_head btrfs: fixup error handling in fixup_inode_link_counts btrfs: abort in rename_exchange if we fail to insert the second ref btrfs: fix deadlock when cloning inline extents and low on available space mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY drm/msm/dpu: always use mdp device to scale bandwidth btrfs: fix unmountable seed device after fstrim KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode KVM: arm64: Fix debug register indexing x86/kvm: Teardown PV features on boot CPU as well x86/kvm: Disable kvmclock on all CPUs on shutdown x86/kvm: Disable all PV features on crash lib/lz4: explicitly support in-place decompression i2c: qcom-geni: Suspend and resume the bus during SYSTEM_SLEEP_PM ops netfilter: nf_tables: missing error reporting for not selected expressions xen-netback: take a reference to the RX task thread neighbour: allow NUD_NOARP entries to be forced GCed Linux 5.10.43 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8d7ec0878193e4e454076809b7fb71fcc4e3d810	2021-06-12 14:48:14 +02:00
Ritesh Harjani	3b713aafa7	ext4: fix accessing uninit percpu counter variable with fast_commit ... commit b45f189a19 upstream. When running generic/527 with fast_commit configuration, the following issue is seen on Power. With fast_commit, during ext4_fc_replay() (which can be called from ext4_fill_super()), if inode eviction happens then it can access an uninitialized percpu counter variable. This patch adds the check before accessing the counters in ext4_free_inode() path. [ 321.165371] run fstests generic/527 at 2021-04-29 08:38:43 [ 323.027786] EXT4-fs (dm-0): mounted filesystem with ordered data mode. Opts: block_validity. Quota mode: none. [ 323.618772] BUG: Unable to handle kernel data access on read at 0x1fbd80000 [ 323.619767] Faulting instruction address: 0xc000000000bae78c cpu 0x1: Vector: 300 (Data Access) at [c000000010706ef0] pc: c000000000bae78c: percpu_counter_add_batch+0x3c/0x100 lr: c0000000006d0bb0: ext4_free_inode+0x780/0xb90 pid = 5593, comm = mount ext4_free_inode+0x780/0xb90 ext4_evict_inode+0xa8c/0xc60 evict+0xfc/0x1e0 ext4_fc_replay+0xc50/0x20f0 do_one_pass+0xfe0/0x1350 jbd2_journal_recover+0x184/0x2e0 jbd2_journal_load+0x1c0/0x4a0 ext4_fill_super+0x2458/0x4200 mount_bdev+0x1dc/0x290 ext4_mount+0x28/0x40 legacy_get_tree+0x4c/0xa0 vfs_get_tree+0x4c/0x120 path_mount+0xcf8/0xd70 do_mount+0x80/0xd0 sys_mount+0x3fc/0x490 system_call_exception+0x384/0x3d0 system_call_common+0xec/0x278 Cc: stable@kernel.org Fixes: 8016e29f43 ("ext4: fast commit recovery path") Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com> Reviewed-by: Harshad Shirwadkar <harshadshirwadkar@gmail.com> Link: https://lore.kernel.org/r/6cceb9a75c54bef8fa9696c1b08c8df5ff6169e2.1619692410.git.riteshh@linux.ibm.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-06-10 13:39:26 +02:00
Greg Kroah-Hartman	a1ac3f3093	Merge 5.10.36 into android12-5.10 ... Changes in 5.10.36 bus: mhi: core: Fix check for syserr at power_up bus: mhi: core: Clear configuration from channel context during reset bus: mhi: core: Sanity check values from remote device before use nitro_enclaves: Fix stale file descriptors on failed usercopy dyndbg: fix parsing file query without a line-range suffix s390/disassembler: increase ebpf disasm buffer size s390/zcrypt: fix zcard and zqueue hot-unplug memleak vhost-vdpa: fix vm_flags for virtqueue doorbell mapping tpm: acpi: Check eventlog signature before using it ACPI: custom_method: fix potential use-after-free issue ACPI: custom_method: fix a possible memory leak ftrace: Handle commands when closing set_ftrace_filter file ARM: 9056/1: decompressor: fix BSS size calculation for LLVM ld.lld arm64: dts: marvell: armada-37xx: add syscon compatible to NB clk node arm64: dts: mt8173: fix property typo of 'phys' in dsi node ecryptfs: fix kernel panic with null dev_name fs/epoll: restore waking from ep_done_scan() mtd: spi-nor: core: Fix an issue of releasing resources during read/write Revert "mtd: spi-nor: macronix: Add support for mx25l51245g" mtd: spinand: core: add missing MODULE_DEVICE_TABLE() mtd: rawnand: atmel: Update ecc_stats.corrected counter mtd: physmap: physmap-bt1-rom: Fix unintentional stack access erofs: add unsupported inode i_format check spi: stm32-qspi: fix pm_runtime usage_count counter spi: spi-ti-qspi: Free DMA resources scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() scsi: mpt3sas: Block PCI config access from userspace during reset mmc: uniphier-sd: Fix an error handling path in uniphier_sd_probe() mmc: uniphier-sd: Fix a resource leak in the remove function mmc: sdhci: Check for reset prior to DMA address unmap mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based controllers mmc: sdhci-tegra: Add required callbacks to set/clear CQE_EN bit mmc: block: Update ext_csd.cache_ctrl if it was written mmc: block: Issue a cache flush only when it's enabled mmc: core: Do a power cycle when the CMD11 fails mmc: core: Set read only for SD cards with permanent write protect bit mmc: core: Fix hanging on I/O during system suspend for removable cards irqchip/gic-v3: Do not enable irqs when handling spurious interrups cifs: Return correct error code from smb2_get_enc_key cifs: fix out-of-bound memory access when calling smb3_notify() at mount point cifs: detect dead connections only when echoes are enabled. smb2: fix use-after-free in smb2_ioctl_query_info() btrfs: handle remount to no compress during compression x86/build: Disable HIGHMEM64G selection for M486SX btrfs: fix metadata extent leak after failure to create subvolume intel_th: pci: Add Rocket Lake CPU support btrfs: fix race between transaction aborts and fsyncs leading to use-after-free posix-timers: Preserve return value in clock_adjtime32() fbdev: zero-fill colormap in fbcmap.c cpuidle: tegra: Fix C7 idling state on Tegra114 bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first staging: wimax/i2400m: fix byte-order issue spi: ath79: always call chipselect function spi: ath79: remove spi-master setup and cleanup assignment bus: mhi: core: Destroy SBL devices when moving to mission mode crypto: api - check for ERR pointers in crypto_destroy_tfm() crypto: qat - fix unmap invalid dma address usb: gadget: uvc: add bInterval checking for HS mode usb: webcam: Invalid size of Processing Unit Descriptor x86/sev: Do not require Hypervisor CPUID bit for SEV guests crypto: hisilicon/sec - fixes a printing error genirq/matrix: Prevent allocation counter corruption usb: gadget: f_uac2: validate input parameters usb: gadget: f_uac1: validate input parameters usb: dwc3: gadget: Ignore EP queue requests during bus reset usb: xhci: Fix port minor revision kselftest/arm64: mte: Fix compilation with native compiler ARM: tegra: acer-a500: Rename avdd to vdda of touchscreen node PCI: PM: Do not read power state in pci_enable_device_flags() kselftest/arm64: mte: Fix MTE feature detection ARM: dts: BCM5301X: fix "reg" formatting in /memory node ARM: dts: ux500: Fix up TVK R3 sensors x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) x86/boot: Add $(CLANG_FLAGS) to compressed KBUILD_CFLAGS efi/libstub: Add $(CLANG_FLAGS) to x86 flags soc/tegra: pmc: Fix completion of power-gate toggling arm64: dts: imx8mq-librem5-r3: Mark buck3 as always on tee: optee: do not check memref size on return from Secure World soundwire: cadence: only prepare attached devices on clock stop perf/arm_pmu_platform: Use dev_err_probe() for IRQ errors perf/arm_pmu_platform: Fix error handling random: initialize ChaCha20 constants with correct endianness usb: xhci-mtk: support quirk to disable usb2 lpm fpga: dfl: pci: add DID for D5005 PAC cards xhci: check port array allocation was successful before dereferencing it xhci: check control context is valid before dereferencing it. xhci: fix potential array out of bounds with several interrupters bus: mhi: core: Clear context for stopped channels from remove() ARM: dts: at91: change the key code of the gpio key tools/power/x86/intel-speed-select: Increase string size platform/x86: ISST: Account for increased timeout in some cases spi: dln2: Fix reference leak to master spi: omap-100k: Fix reference leak to master spi: qup: fix PM reference leak in spi_qup_remove() usb: gadget: tegra-xudc: Fix possible use-after-free in tegra_xudc_remove() usb: musb: fix PM reference leak in musb_irq_work() usb: core: hub: Fix PM reference leak in usb_port_resume() usb: dwc3: gadget: Check for disabled LPM quirk tty: n_gsm: check error while registering tty devices intel_th: Consistency and off-by-one fix phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() crypto: sun8i-ss - Fix PM reference leak when pm_runtime_get_sync() fails crypto: sun8i-ce - Fix PM reference leak in sun8i_ce_probe() crypto: stm32/hash - Fix PM reference leak on stm32-hash.c crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c crypto: sa2ul - Fix PM reference leak in sa_ul_probe() crypto: omap-aes - Fix PM reference leak on omap-aes.c platform/x86: intel_pmc_core: Don't use global pmcdev in quirks spi: sync up initial chipselect state btrfs: do proper error handling in create_reloc_root btrfs: do proper error handling in btrfs_update_reloc_root btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s drm: Added orientation quirk for OneGX1 Pro drm/qxl: do not run release if qxl failed to init drm/qxl: release shadow on shutdown drm/ast: Fix invalid usage of AST_MAX_HWC_WIDTH in cursor atomic_check drm/amd/display: changing sr exit latency drm/ast: fix memory leak when unload the driver drm/amd/display: Check for DSC support instead of ASIC revision drm/amd/display: Don't optimize bandwidth before disabling planes drm/amdgpu/display: buffer INTERRUPT_LOW_IRQ_CONTEXT interrupt work drm/amd/display/dc/dce/dce_aux: Remove duplicate line causing 'field overwritten' issue scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe scsi: lpfc: Fix pt2pt connection does not recover after LOGO drm/amdgpu: Fix some unload driver issues sched/pelt: Fix task util_est update filtering kvfree_rcu: Use same set of GFP flags as does single-argument scsi: target: pscsi: Fix warning in pscsi_complete_cmd() media: ite-cir: check for receive overflow media: drivers: media: pci: sta2x11: fix Kconfig dependency on GPIOLIB media: imx: capture: Return -EPIPE from __capture_legacy_try_fmt() atomisp: don't let it go past pipes array power: supply: bq27xxx: fix power_avg for newer ICs extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged extcon: arizona: Fix various races on driver unbind media: media/saa7164: fix saa7164_encoder_register() memory leak bugs media: gspca/sq905.c: fix uninitialized variable power: supply: Use IRQF_ONESHOT backlight: qcom-wled: Use sink_addr for sync toggle backlight: qcom-wled: Fix FSC update issue for WLED5 drm/amdgpu: mask the xgmi number of hops reported from psp to kfd drm/amdkfd: Fix UBSAN shift-out-of-bounds warning drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac drm/amd/pm: fix workload mismatch on vega10 drm/amd/display: Fix UBSAN warning for not a valid value for type '_Bool' drm/amd/display: DCHUB underflow counter increasing in some scenarios drm/amd/display: fix dml prefetch validation scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() drm/vkms: fix misuse of WARN_ON scsi: qla2xxx: Fix use after free in bsg mmc: sdhci-esdhc-imx: validate pinctrl before use it mmc: sdhci-pci: Add PCI IDs for Intel LKF mmc: sdhci-brcmstb: Remove CQE quirk ata: ahci: Disable SXS for Hisilicon Kunpeng920 drm/komeda: Fix bit check to import to value of proper type nvmet: return proper error code from discovery ctrl selftests/resctrl: Enable gcc checks to detect buffer overflows selftests/resctrl: Fix compilation issues for global variables selftests/resctrl: Fix compilation issues for other global variables selftests/resctrl: Clean up resctrl features check selftests/resctrl: Fix missing options "-n" and "-p" selftests/resctrl: Use resctrl/info for feature detection selftests/resctrl: Fix incorrect parsing of iMC counters selftests/resctrl: Fix checking for < 0 for unsigned values power: supply: cpcap-charger: Add usleep to cpcap charger to avoid usb plug bounce scsi: smartpqi: Use host-wide tag space scsi: smartpqi: Correct request leakage during reset operations scsi: smartpqi: Add new PCI IDs scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() media: em28xx: fix memory leak media: vivid: update EDID drm/msm/dp: Fix incorrect NULL check kbot warnings in DP driver clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() media: tc358743: fix possible use-after-free in tc358743_remove() media: adv7604: fix possible use-after-free in adv76xx_remove() media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() media: i2c: tda1997: Fix possible use-after-free in tda1997x_remove() media: i2c: adv7842: fix possible use-after-free in adv7842_remove() media: platform: sti: Fix runtime PM imbalance in regs_show media: sun8i-di: Fix runtime PM imbalance in deinterlace_start_streaming media: dvb-usb: fix memory leak in dvb_usb_adapter_init media: gscpa/stv06xx: fix memory leak sched/fair: Ignore percpu threads for imbalance pulls drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal drm/msm/mdp5: Do not multiply vclk line count by 100 drm/amdgpu/ttm: Fix memory leak userptr pages drm/radeon/ttm: Fix memory leak userptr pages drm/amd/display: Fix debugfs link_settings entry drm/amd/display: Fix UBSAN: shift-out-of-bounds warning drm/amdkfd: Fix cat debugfs hang_hws file causes system crash bug amdgpu: avoid incorrect %hu format string drm/amd/display: Try YCbCr420 color when YCbCr444 fails drm/amdgpu: fix NULL pointer dereference scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response scsi: lpfc: Fix error handling for mailboxes completed in MBX_POLL mode scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic mfd: intel-m10-bmc: Fix the register access range mfd: da9063: Support SMBus and I2C mode mfd: arizona: Fix rumtime PM imbalance on error scsi: libfc: Fix a format specifier perf: Rework perf_event_exit_event() sched,fair: Alternative sched_slice() block/rnbd-clt: Fix missing a memory free when unloading the module s390/archrandom: add parameter check for s390_arch_random_generate sched,psi: Handle potential task count underflow bugs more gracefully power: supply: cpcap-battery: fix invalid usage of list cursor ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer ALSA: hda/conexant: Re-order CX5066 quirk table entries ALSA: sb: Fix two use after free in snd_sb_qsound_build ALSA: usb-audio: Explicitly set up the clock selector ALSA: usb-audio: Add dB range mapping for Sennheiser Communications Headset PC 8 ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G7 ALSA: hda/realtek: GA503 use same quirks as GA401 ALSA: hda/realtek: fix mic boost on Intel NUC 8 ALSA: hda/realtek - Headset Mic issue on HP platform ALSA: hda/realtek: fix static noise on ALC285 Lenovo laptops ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx tools/power/turbostat: Fix turbostat for AMD Zen CPUs btrfs: fix race when picking most recent mod log operation for an old root arm64/vdso: Discard .note.gnu.property sections in vDSO Makefile: Move -Wno-unused-but-set-variable out of GCC only block fs: fix reporting supported extra file attributes for statx() virtiofs: fix memory leak in virtio_fs_probe() kcsan, debugfs: Move debugfs file creation out of early init ubifs: Only check replay with inode type to judge if inode linked f2fs: fix error handling in f2fs_end_enable_verity() f2fs: fix to avoid out-of-bounds memory access mlxsw: spectrum_mr: Update egress RIF list before route's action openvswitch: fix stack OOB read while fragmenting IPv4 packets ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds NFS: Don't discard pNFS layout segments that are marked for return NFSv4: Don't discard segments marked for return in _pnfs_return_layout() Input: ili210x - add missing negation for touch indication on ili210x jffs2: Fix kasan slab-out-of-bounds problem jffs2: Hook up splice_write callback powerpc/powernv: Enable HAIL (HV AIL) for ISA v3.1 processors powerpc/eeh: Fix EEH handling for hugepages in ioremap space. powerpc/kexec_file: Use current CPU info while setting up FDT powerpc/32: Fix boot failure with CONFIG_STACKPROTECTOR powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h intel_th: pci: Add Alder Lake-M support tpm: efi: Use local variable for calculating final log size tpm: vtpm_proxy: Avoid reading host log when using a virtual device crypto: arm/curve25519 - Move '.fpu' after '.arch' crypto: rng - fix crypto_rng_reset() refcounting when !CRYPTO_STATS md/raid1: properly indicate failure when ending a failed write request dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload sequences fuse: fix write deadlock exfat: fix erroneous discard when clear cluster bit sfc: farch: fix TX queue lookup in TX flush done handling sfc: farch: fix TX queue lookup in TX event handling security: commoncap: fix -Wstringop-overread warning Fix misc new gcc warnings jffs2: check the validity of dstlen in jffs2_zlib_compress() smb3: when mounting with multichannel include it in requested capabilities smb3: do not attempt multichannel to server which does not support it Revert 337f13046f ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported kbuild: update config_data.gz only when the content of .config is changed ext4: annotate data race in start_this_handle() ext4: annotate data race in jbd2_journal_dirty_metadata() ext4: fix check to prevent false positive report of incorrect used inodes ext4: do not set SB_ACTIVE in ext4_orphan_cleanup() ext4: fix error code in ext4_commit_super ext4: fix ext4_error_err save negative errno into superblock ext4: fix error return code in ext4_fc_perform_commit() ext4: allow the dax flag to be set and cleared on inline directories ext4: Fix occasional generic/418 failure media: dvbdev: Fix memory leak in dvb_media_device_free() media: dvb-usb: Fix use-after-free access media: dvb-usb: Fix memory leak at error in dvb_usb_device_init() media: staging/intel-ipu3: Fix memory leak in imu_fmt media: staging/intel-ipu3: Fix set_fmt error handling media: staging/intel-ipu3: Fix race condition during set_fmt media: v4l2-ctrls: fix reference to freed memory media: venus: hfi_parser: Don't initialize parser on v1 usb: gadget: dummy_hcd: fix gpf in gadget_setup usb: gadget: Fix double free of device descriptor pointers usb: gadget/function/f_fs string table fix for multiple languages usb: dwc3: gadget: Remove FS bInterval_m1 limitation usb: dwc3: gadget: Fix START_TRANSFER link state check usb: dwc3: core: Do core softreset when switch mode usb: dwc2: Fix session request interrupt handler tty: fix memory leak in vc_deallocate rsi: Use resume_noirq for SDIO tools/power turbostat: Fix offset overflow issue in index converting tracing: Map all PIDs to command lines tracing: Restructure trace_clock_global() to never block dm persistent data: packed struct should have an aligned() attribute too dm space map common: fix division bug in sm_ll_find_free_block() dm integrity: fix missing goto in bitmap_flush_interval error handling dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails lib/vsprintf.c: remove leftover 'f' and 'F' cases from bstr_printf() thermal/drivers/cpufreq_cooling: Fix slab OOB issue thermal/core/fair share: Lock the thermal zone while looping over instances Linux 5.10.36 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I7b8075de5edd8de69205205cddb9a3273d7d0810	2021-05-13 14:22:11 +02:00
Theodore Ts'o	133e83b5b3	ext4: allow the dax flag to be set and cleared on inline directories ... commit 4811d9929c upstream. This is needed to allow generic/607 to pass for file systems with the inline data_feature enabled, and it allows the use of file systems where the directories use inline_data, while the files are accessed via DAX. Cc: stable@kernel.org Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-05-11 14:47:38 +02:00
Zhang Yi	098b257563	ext4: fix check to prevent false positive report of incorrect used inodes ... commit a149d2a5ca upstream. Commit <50122847007> ("ext4: fix check to prevent initializing reserved inodes") check the block group zero and prevent initializing reserved inodes. But in some special cases, the reserved inode may not all belong to the group zero, it may exist into the second group if we format filesystem below. mkfs.ext4 -b 4096 -g 8192 -N 1024 -I 4096 /dev/sda So, it will end up triggering a false positive report of a corrupted file system. This patch fix it by avoid check reserved inodes if no free inode blocks will be zeroed. Cc: stable@kernel.org Fixes: 5012284700 ("ext4: fix check to prevent initializing reserved inodes") Signed-off-by: Zhang Yi <yi.zhang@huawei.com> Suggested-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20210331121516.2243099-1-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-05-11 14:47:37 +02:00
Greg Kroah-Hartman	862e667eb7	Merge 96485e4462 ("Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4") into android-mainline ... Steps on the way to 5.10-rc1 Resolves conflicts in: fs/ext4/dir.c fs/ext4/ext4.h fs/ext4/namei.c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I397787046920175eb183fa5342d2923f819bb2f4	2020-10-27 11:29:45 +01:00
Greg Kroah-Hartman	9d77f49849	Merge 6f5032a852 ("Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt") into android-mainline ... Steps on the way to 5.10-rc1 Change-Id: Ifceecc1b9f94ea893484002c69aeb7b82d246f64 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-10-23 11:56:31 +02:00
Linus Torvalds	96485e4462	Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 ... Pull ext4 updates from Ted Ts'o: "The siginificant new ext4 feature this time around is Harshad's new fast_commit mode. In addition, thanks to Mauricio for fixing a race where mmap'ed pages that are being changed in parallel with a data=journal transaction commit could result in bad checksums in the failure that could cause journal replays to fail. Also notable is Ritesh's buffered write optimization which can result in significant improvements on parallel write workloads. (The kernel test robot reported a 330.6% improvement on fio.write_iops on a 96 core system using DAX) Besides that, we have the usual miscellaneous cleanups and bug fixes" Link: https://lore.kernel.org/r/20200925071217.GO28663@shao2-debian * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (46 commits) ext4: fix invalid inode checksum ext4: add fast commit stats in procfs ext4: add a mount opt to forcefully turn fast commits on ext4: fast commit recovery path jbd2: fast commit recovery path ext4: main fast-commit commit path jbd2: add fast commit machinery ext4 / jbd2: add fast commit initialization ext4: add fast_commit feature and handling for extended mount options doc: update ext4 and journalling docs to include fast commit feature ext4: Detect already used quota file early jbd2: avoid transaction reuse after reformatting ext4: use the normal helper to get the actual inode ext4: fix bs < ps issue reported with dioread_nolock mount opt ext4: data=journal: write-protect pages on j_submit_inode_data_buffers() ext4: data=journal: fixes for ext4_page_mkwrite() jbd2, ext4, ocfs2: introduce/use journal callbacks j_submit|finish_inode_data_buffers() jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers() ext4: introduce ext4_sb_bread_unmovable() to replace sb_bread_unmovable() ext4: use ext4_sb_bread() instead of sb_bread() ...	2020-10-22 10:31:08 -07:00
Harshad Shirwadkar	8016e29f43	ext4: fast commit recovery path ... This patch adds fast commit recovery path support for Ext4 file system. We add several helper functions that are similar in spirit to e2fsprogs journal recovery path handlers. Example of such functions include - a simple block allocator, idempotent block bitmap update function etc. Using these routines and the fast commit log in the fast commit area, the recovery path (ext4_fc_replay()) performs fast commit log recovery. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Harshad Shirwadkar <harshadshirwadkar@gmail.com> Link: https://lore.kernel.org/r/20201015203802.3597742-8-harshadshirwadkar@gmail.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2020-10-21 23:22:38 -04:00
zhangyi (F)	2d069c0889	ext4: use common helpers in all places reading metadata buffers ... Revome all open codes that read metadata buffers, switch to use ext4_read_bh_*() common helpers. Signed-off-by: zhangyi (F) <yi.zhang@huawei.com> Suggested-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20200924073337.861472-4-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2020-10-18 10:37:14 -04:00
zhangyi (F)	d9befedaaf	ext4: clear buffer verified flag if read meta block from disk ... The metadata buffer is no longer trusted after we read it from disk again because it is not uptodate for some reasons (e.g. failed to write back). Otherwise we may get below memory corruption problem in ext4_ext_split()->memset() if we read stale data from the newly allocated extent block on disk which has been failed to async write out but miss verify again since the verified bit has already been set on the buffer. [ 29.774674] BUG: unable to handle kernel paging request at ffff88841949d000 ... [ 29.783317] Oops: 0002 [#2] SMP [ 29.784219] R10: 00000000000f4240 R11: 0000000000002e28 R12: ffff88842fa1c800 [ 29.784627] CPU: 1 PID: 126 Comm: kworker/u4:3 Tainted: G D W [ 29.785546] R13: ffffffff9cddcc20 R14: ffffffff9cddd420 R15: ffff88842fa1c2f8 [ 29.786679] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),BIOS ?-20190727_0738364 [ 29.787588] FS: 0000000000000000(0000) GS:ffff88842fa00000(0000) knlGS:0000000000000000 [ 29.789288] Workqueue: writeback wb_workfn [ 29.790319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.790321] (flush-8:0) [ 29.790844] CR2: 0000000000000008 CR3: 00000004234f2000 CR4: 00000000000006f0 [ 29.791924] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.792839] RIP: 0010:__memset+0x24/0x30 [ 29.793739] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.794256] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 033 [ 29.795161] Kernel panic - not syncing: Fatal exception in interrupt ... [ 29.808149] Call Trace: [ 29.808475] ext4_ext_insert_extent+0x102e/0x1be0 [ 29.809085] ext4_ext_map_blocks+0xa89/0x1bb0 [ 29.809652] ext4_map_blocks+0x290/0x8a0 [ 29.809085] ext4_ext_map_blocks+0xa89/0x1bb0 [ 29.809652] ext4_map_blocks+0x290/0x8a0 [ 29.810161] ext4_writepages+0xc85/0x17c0 ... Fix this by clearing buffer's verified bit if we read meta block from disk again. Signed-off-by: zhangyi (F) <yi.zhang@huawei.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200924073337.861472-2-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2020-10-18 10:37:13 -04:00
Eric Biggers	02ce5316af	ext4: use fscrypt_prepare_new_inode() and fscrypt_set_context() ... Convert ext4 to use the new functions fscrypt_prepare_new_inode() and fscrypt_set_context(). This avoids calling fscrypt_get_encryption_info() from within a transaction, which can deadlock because fscrypt_get_encryption_info() isn't GFP_NOFS-safe. For more details about this problem, see the earlier patch "fscrypt: add fscrypt_prepare_new_inode() and fscrypt_set_context()". Link: https://lore.kernel.org/r/20200917041136.178600-4-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com>	2020-09-22 06:48:33 -07:00
Eric Biggers	177cc0e710	ext4: factor out ext4_xattr_credits_for_new_inode() ... To compute a new inode's xattr credits, we need to know whether the inode will be encrypted or not. When we switch to use the new helper function fscrypt_prepare_new_inode(), we won't find out whether the inode will be encrypted until slightly later than is currently the case. That will require moving the code block that computes the xattr credits. To make this easier and reduce the length of __ext4_new_inode(), move this code block into a new function ext4_xattr_credits_for_new_inode(). Link: https://lore.kernel.org/r/20200917041136.178600-3-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com>	2020-09-22 06:48:32 -07:00
Greg Kroah-Hartman	1d722fa8e9	Merge 5.8-rc2 into android-mainline ... Linux 5.8-rc2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0e2f0302387539982d5577ad72079621c35c5f61	2020-06-27 09:48:57 +02:00
Daniel Rosenberg	705a3e5b18	ANDROID: ext4: Handle casefolding with encryption ... This adds support for encryption with casefolding. Since the name on disk is case preserving, and also encrypted, we can no longer just recompute the hash on the fly. Additionally, to avoid leaking extra information from the hash of the unencrypted name, we use siphash via an fscrypt v2 policy. The hash is stored at the end of the directory entry for all entries inside of an encrypted and casefolded directory apart from those that deal with '.' and '..'. This way, the change is backwards compatible with existing ext4 filesystems. Signed-off-by: Daniel Rosenberg <drosen@google.com> Signed-off-by: Paul Lawrence <paullawrence@google.com> Test: Boots, /data/media is case insensitive Bug: 138322712 Change-Id: I07354e3129aa07d309fbe36c002fee1af718f348	2020-06-25 18:38:07 +00:00
Linus Torvalds	3be20b6fc1	Merge tag 'ext4-for-linus-5.8-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 ... Pull more ext4 updates from Ted Ts'o: "This is the second round of ext4 commits for 5.8 merge window [1]. It includes the per-inode DAX support, which was dependant on the DAX infrastructure which came in via the XFS tree, and a number of regression and bug fixes; most notably the "BUG: using smp_processor_id() in preemptible code in ext4_mb_new_blocks" reported by syzkaller" [1] The pull request actually came in 15 minutes after I had tagged the rc1 release. Tssk, tssk, late.. - Linus * tag 'ext4-for-linus-5.8-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4, jbd2: ensure panic by fix a race between jbd2 abort and ext4 error handlers ext4: support xattr gnu.* namespace for the Hurd ext4: mballoc: Use this_cpu_read instead of this_cpu_ptr ext4: avoid utf8_strncasecmp() with unstable name ext4: stop overwrite the errcode in ext4_setup_super ext4: fix partial cluster initialization when splitting extent ext4: avoid race conditions when remounting with options that change dax Documentation/dax: Update DAX enablement for ext4 fs/ext4: Introduce DAX inode flag fs/ext4: Remove jflag variable fs/ext4: Make DAX mount option a tri-state fs/ext4: Only change S_DAX on inode load fs/ext4: Update ext4_should_use_dax() fs/ext4: Change EXT4_MOUNT_DAX to EXT4_MOUNT_DAX_ALWAYS fs/ext4: Disallow verity if inode is DAX fs/ext4: Narrow scope of DAX check in setflags	2020-06-15 09:32:10 -07:00
Theodore Ts'o	68cd44920d	Enable ext4 support for per-file/directory dax operations ... This adds the same per-file/per-directory DAX support for ext4 as was done for xfs, now that we finally have consensus over what the interface should be.	2020-06-11 10:51:44 -04:00
Linus Torvalds	0b166a57e6	Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 ... Pull ext4 updates from Ted Ts'o: "A lot of bug fixes and cleanups for ext4, including: - Fix performance problems found in dioread_nolock now that it is the default, caused by transaction leaks. - Clean up fiemap handling in ext4 - Clean up and refactor multiple block allocator (mballoc) code - Fix a problem with mballoc with a smaller file systems running out of blocks because they couldn't properly use blocks that had been reserved by inode preallocation. - Fixed a race in ext4_sync_parent() versus rename() - Simplify the error handling in the extent manipulation code - Make sure all metadata I/O errors are felected to ext4_ext_dirty()'s and ext4_make_inode_dirty()'s callers. - Avoid passing an error pointer to brelse in ext4_xattr_set() - Fix race which could result to freeing an inode on the dirty last in data=journal mode. - Fix refcount handling if ext4_iget() fails - Fix a crash in generic/019 caused by a corrupted extent node" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (58 commits) ext4: avoid unnecessary transaction starts during writeback ext4: don't block for O_DIRECT if IOCB_NOWAIT is set ext4: remove the access_ok() check in ext4_ioctl_get_es_cache fs: remove the access_ok() check in ioctl_fiemap fs: handle FIEMAP_FLAG_SYNC in fiemap_prep fs: move fiemap range validation into the file systems instances iomap: fix the iomap_fiemap prototype fs: move the fiemap definitions out of fs.h fs: mark __generic_block_fiemap static ext4: remove the call to fiemap_check_flags in ext4_fiemap ext4: split _ext4_fiemap ext4: fix fiemap size checks for bitmap files ext4: fix EXT4_MAX_LOGICAL_BLOCK macro add comment for ext4_dir_entry_2 file_type member jbd2: avoid leaking transaction credits when unreserving handle ext4: drop ext4_journal_free_reserved() ext4: mballoc: use lock for checking free blocks while retrying ext4: mballoc: refactor ext4_mb_good_group() ext4: mballoc: introduce pcpu seqcnt for freeing PA to improve ENOSPC handling ext4: mballoc: refactor ext4_mb_discard_preallocations() ...	2020-06-05 16:19:28 -07:00
Xiyu Yang	3bbd0ef260	ext4: fix buffer_head refcnt leak when ext4_iget() fails ... ext4_orphan_get() invokes ext4_read_inode_bitmap(), which returns a reference of the specified buffer_head object to "bitmap_bh" with increased refcnt. When ext4_orphan_get() returns, local variable "bitmap_bh" becomes invalid, so the refcount should be decreased to keep refcount balanced. The reference counting issue happens in one exception handling path of ext4_orphan_get(). When ext4_iget() fails, the function forgets to decrease the refcnt increased by ext4_read_inode_bitmap(), causing a refcnt leak. Fix this issue by calling brelse() when ext4_iget() fails. Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> Cc: stable@kernel.org Link: https://lore.kernel.org/r/1587618568-13418-1-git-send-email-xiyuyang19@fudan.edu.cn Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2020-06-03 23:16:49 -04:00
Ira Weiny	043546e46d	fs/ext4: Only change S_DAX on inode load ... To prevent complications with in memory inodes we only set S_DAX on inode load. FS_XFLAG_DAX can be changed at any time and S_DAX will change after inode eviction and reload. Add init bool to ext4_set_inode_flags() to indicate if the inode is being newly initialized. Assert that S_DAX is not set on an inode which is just being loaded. Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Ira Weiny <ira.weiny@intel.com> Link: https://lore.kernel.org/r/20200528150003.828793-6-ira.weiny@intel.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2020-05-28 22:09:47 -04:00
Christoph Hellwig	9398554fb3	block: remove the error_sector argument to blkdev_issue_flush ... The argument isn't used by any caller, and drivers don't fill out bi_sector for flush requests either. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>	2020-05-22 08:45:46 -06:00
Theodore Ts'o	a17a9d935d	ext4: increase wait time needed before reuse of deleted inode numbers ... Current wait times have proven to be too short to protect against inode reuses that lead to metadata inconsistencies. Now that we will retry the inode allocation if we can't find any recently deleted inodes, it's a lot safer to increase the recently deleted time from 5 seconds to a minute. Link: https://lore.kernel.org/r/20200414023925.273867-1-tytso@mit.edu Google-Bug-Id: 36602237 Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2020-04-15 23:58:49 -04:00
Josh Triplett	9033783c8c	ext4: fix return-value types in several function comments ... The documentation comments for ext4_read_block_bitmap_nowait and ext4_read_inode_bitmap describe them as returning NULL on error, but they return an ERR_PTR on error; update the documentation to match. The documentation comment for ext4_wait_block_bitmap describes it as returning 1 on error, but it returns -errno on error; update the documentation to match. Signed-off-by: Josh Triplett <josh@joshtriplett.org> Reviewed-by: Ritesh Harani <riteshh@linux.ibm.com> Link: https://lore.kernel.org/r/60a3f4996f4932c45515aaa6b75ca42f2a78ec9b.1585512514.git.josh@joshtriplett.org Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2020-04-15 23:58:48 -04:00
Theodore Ts'o	54d3adbc29	ext4: save all error info in save_error_info() and drop ext4_set_errno() ... Using a separate function, ext4_set_errno() to set the errno is problematic because it doesn't do the right thing once s_last_error_errorcode is non-zero. It's also less racy to set all of the error information all at once. (Also, as a bonus, it shrinks code size slightly.) Link: https://lore.kernel.org/r/20200329020404.686965-1-tytso@mit.edu Fixes: 878520ac45 ("ext4: save the error code which triggered...") Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2020-04-01 17:29:06 -04:00
Jan Kara	d05466b27b	ext4: avoid ENOSPC when avoiding to reuse recently deleted inodes ... When ext4 is running on a filesystem without a journal, it tries not to reuse recently deleted inodes to provide better chances for filesystem recovery in case of crash. However this logic forbids reuse of freed inodes for up to 5 minutes and especially for filesystems with smaller number of inodes can lead to ENOSPC errors returned when allocating new inodes. Fix the problem by allowing to reuse recently deleted inode if there's no other inode free in the scanned range. Signed-off-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20200318121317.31941-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2020-03-26 10:55:00 -04:00
Suraj Jitindar Singh	7c990728b9	ext4: fix potential race between s_flex_groups online resizing and access ... During an online resize an array of s_flex_groups structures gets replaced so it can get enlarged. If there is a concurrent access to the array and this memory has been reused then this can lead to an invalid memory access. The s_flex_group array has been converted into an array of pointers rather than an array of structures. This is to ensure that the information contained in the structures cannot get out of sync during a resize due to an accessor updating the value in the old structure after it has been copied but before the array pointer is updated. Since the structures them- selves are no longer copied but only the pointers to them this case is mitigated. Link: https://bugzilla.kernel.org/show_bug.cgi?id=206443 Link: https://lore.kernel.org/r/20200221053458.730016-4-tytso@mit.edu Signed-off-by: Suraj Jitindar Singh <surajjs@amazon.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org	2020-02-21 19:31:46 -05:00
Theodore Ts'o	46f870d690	ext4: simulate various I/O and checksum errors when reading metadata ... This allows us to test various error handling code paths Link: https://lore.kernel.org/r/20191209012317.59398-1-tytso@mit.edu Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2019-12-26 11:28:31 -05:00
Theodore Ts'o	878520ac45	ext4: save the error code which triggered an ext4_error() in the superblock ... This allows the cause of an ext4_error() report to be categorized based on whether it was triggered due to an I/O error, or an memory allocation error, or other possible causes. Most errors are caused by a detected file system inconsistency, so the default code stored in the superblock will be EXT4_ERR_EFSCORRUPTED. Link: https://lore.kernel.org/r/20191204032335.7683-1-tytso@mit.edu Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2019-12-26 11:28:23 -05:00
yangerkun	a70fd5ac2e	ext4: reserve revoke credits in __ext4_new_inode ... It's possible that __ext4_new_inode will release the xattr block, so it will trigger a warning since there is revoke credits will be 0 if the handle == NULL. The below scripts can reproduce it easily. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3861 at fs/jbd2/revoke.c:374 jbd2_journal_revoke+0x30e/0x540 fs/jbd2/revoke.c:374 ... __ext4_forget+0x1d7/0x800 fs/ext4/ext4_jbd2.c:248 ext4_free_blocks+0x213/0x1d60 fs/ext4/mballoc.c:4743 ext4_xattr_release_block+0x55b/0x780 fs/ext4/xattr.c:1254 ext4_xattr_block_set+0x1c2c/0x2c40 fs/ext4/xattr.c:2112 ext4_xattr_set_handle+0xa7e/0x1090 fs/ext4/xattr.c:2384 __ext4_set_acl+0x54d/0x6c0 fs/ext4/acl.c:214 ext4_init_acl+0x218/0x2e0 fs/ext4/acl.c:293 __ext4_new_inode+0x352a/0x42b0 fs/ext4/ialloc.c:1151 ext4_mkdir+0x2e9/0xbd0 fs/ext4/namei.c:2774 vfs_mkdir+0x386/0x5f0 fs/namei.c:3811 do_mkdirat+0x11c/0x210 fs/namei.c:3834 do_syscall_64+0xa1/0x530 arch/x86/entry/common.c:294 ... ------------------------------------- scripts: mkfs.ext4 /dev/vdb mount /dev/vdb /mnt cd /mnt && mkdir dir && for i in {1..8}; do setfacl -dm "u:user_"$i":rx" dir; done mkdir dir/dir1 && mv dir/dir1 ./ sh repro.sh && add some user [root@localhost ~]# cat repro.sh while [ 1 -eq 1 ]; do rm -rf dir rm -rf dir1/dir1 mkdir dir for i in {1..8}; do setfacl -dm "u:test"$i":rx" dir; done setfacl -m "u:user_9:rx" dir & mkdir dir1/dir1 & done Before exec repro.sh, dir1 has inherit the default acl from dir, and xattr block of dir1 dir is not the same, so the h_refcount of these two dir's xattr block will be 1. Then repro.sh can trigger the warning with the situation show as below. The last h_refcount can be clear with mkdir, and __ext4_new_inode has not reserved revoke credits, so the warning will happened, fix it by reserve revoke credits in __ext4_new_inode. Thread 1 Thread 2 mkdir dir set default acl(will create a xattr block blk1 and the refcount of ext4_xattr_header will be 1) ... mkdir dir1/dir1 ->....->ext4_init_acl ->__ext4_set_acl(set default acl, will reuse blk1, and h_refcount will be 2) setfacl->ext4_set_acl->... ->ext4_xattr_block_set(will create new block blk2 to store xattr) ->__ext4_set_acl(set access acl, since h_refcount of blk1 is 2, will create blk3 to store xattr) ->ext4_xattr_release_block(dec h_refcount of blk1 to 1) ->ext4_xattr_release_block(dec h_refcount and since it is 0, will release the block and trigger the warning) Link: https://lore.kernel.org/r/20191213014900.47228-1-yangerkun@huawei.com Reported-by: Hulk Robot <hulkci@huawei.com> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: yangerkun <yangerkun@huawei.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2019-12-14 17:47:13 -05:00
Jan Kara	f4c2d372b8	ext4: fix leak of quota reservations ... Commit 8fcc3a5806 ("ext4: rework reserved cluster accounting when invalidating pages") moved freeing of delayed allocation reservations from dirty page invalidation time to time when we evict corresponding status extent from extent status tree. For inodes which don't have any blocks allocated this may actually happen only in ext4_clear_blocks() which is after we've dropped references to quota structures from the inode. Thus reservation of quota leaked. Fix the problem by clearing quota information from the inode only after evicting extent status tree in ext4_clear_inode(). Link: https://lore.kernel.org/r/20191108115420.GI20863@quack2.suse.cz Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Fixes: 8fcc3a5806 ("ext4: rework reserved cluster accounting when invalidating pages") Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2019-11-14 19:25:47 -05:00
Jan Kara	83448bdfb5	ext4: Reserve revoke credits for freed blocks ... So far we have reserved only relatively high fixed amount of revoke credits for each transaction. We over-reserved by large amount for most cases but when freeing large directories or files with data journalling, the fixed amount is not enough. In fact the worst case estimate is inconveniently large (maximum extent size) for freeing of one extent. We fix this by doing proper estimate of the amount of blocks that need to be revoked when removing blocks from the inode due to truncate or hole punching and otherwise reserve just a small amount of revoke credits for each transaction to accommodate freeing of xattrs block or so. Signed-off-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20191105164437.32602-23-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2019-11-05 16:00:49 -05:00
Gabriel Krisman Bertazi	b886ee3e77	ext4: Support case-insensitive file name lookups ... This patch implements the actual support for case-insensitive file name lookups in ext4, based on the feature bit and the encoding stored in the superblock. A filesystem that has the casefold feature set is able to configure directories with the +F (EXT4_CASEFOLD_FL) attribute, enabling lookups to succeed in that directory in a case-insensitive fashion, i.e: match a directory entry even if the name used by userspace is not a byte per byte match with the disk name, but is an equivalent case-insensitive version of the Unicode string. This operation is called a case-insensitive file name lookup. The feature is configured as an inode attribute applied to directories and inherited by its children. This attribute can only be enabled on empty directories for filesystems that support the encoding feature, thus preventing collision of file names that only differ by case. * dcache handling: For a +F directory, Ext4 only stores the first equivalent name dentry used in the dcache. This is done to prevent unintentional duplication of dentries in the dcache, while also allowing the VFS code to quickly find the right entry in the cache despite which equivalent string was used in a previous lookup, without having to resort to ->lookup(). d_hash() of casefolded directories is implemented as the hash of the casefolded string, such that we always have a well-known bucket for all the equivalencies of the same string. d_compare() uses the utf8_strncasecmp() infrastructure, which handles the comparison of equivalent, same case, names as well. For now, negative lookups are not inserted in the dcache, since they would need to be invalidated anyway, because we can't trust missing file dentries. This is bad for performance but requires some leveraging of the vfs layer to fix. We can live without that for now, and so does everyone else. * on-disk data: Despite using a specific version of the name as the internal representation within the dcache, the name stored and fetched from the disk is a byte-per-byte match with what the user requested, making this implementation 'name-preserving'. i.e. no actual information is lost when writing to storage. DX is supported by modifying the hashes used in +F directories to make them case/encoding-aware. The new disk hashes are calculated as the hash of the full casefolded string, instead of the string directly. This allows us to efficiently search for file names in the htree without requiring the user to provide an exact name. * Dealing with invalid sequences: By default, when a invalid UTF-8 sequence is identified, ext4 will treat it as an opaque byte sequence, ignoring the encoding and reverting to the old behavior for that unique file. This means that case-insensitive file name lookup will not work only for that file. An optional bit can be set in the superblock telling the filesystem code and userspace tools to enforce the encoding. When that optional bit is set, any attempt to create a file name using an invalid UTF-8 sequence will fail and return an error to userspace. * Normalization algorithm: The UTF-8 algorithms used to compare strings in ext4 is implemented lives in fs/unicode, and is based on a previous version developed by SGI. It implements the Canonical decomposition (NFD) algorithm described by the Unicode specification 12.1, or higher, combined with the elimination of ignorable code points (NFDi) and full case-folding (CF) as documented in fs/unicode/utf8_norm.c. NFD seems to be the best normalization method for EXT4 because: - It has a lower cost than NFC/NFKC (which requires decomposing to NFD as an intermediary step) - It doesn't eliminate important semantic meaning like compatibility decompositions. Although: - This implementation is not completely linguistic accurate, because different languages have conflicting rules, which would require the specialization of the filesystem to a given locale, which brings all sorts of problems for removable media and for users who use more than one language. Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.co.uk> Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2019-04-25 14:12:08 -04:00
Chandan Rajendra	592ddec757	ext4: use IS_ENCRYPTED() to check encryption status ... This commit removes the ext4 specific ext4_encrypted_inode() and makes use of the generic IS_ENCRYPTED() macro to check for the encryption status of an inode. Reviewed-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Chandan Rajendra <chandan@linux.vnet.ibm.com> Signed-off-by: Eric Biggers <ebiggers@google.com>	2019-01-23 23:56:43 -05:00
Theodore Ts'o	8a363970d1	ext4: avoid declaring fs inconsistent due to invalid file handles ... If we receive a file handle, either from NFS or open_by_handle_at(2), and it points at an inode which has not been initialized, and the file system has metadata checksums enabled, we shouldn't try to get the inode, discover the checksum is invalid, and then declare the file system as being inconsistent. This can be reproduced by creating a test file system via "mke2fs -t ext4 -O metadata_csum /tmp/foo.img 8M", mounting it, cd'ing into that directory, and then running the following program. #define _GNU_SOURCE #include <fcntl.h> struct handle { struct file_handle fh; unsigned char fid[MAX_HANDLE_SZ]; }; int main(int argc, char **argv) { struct handle h = {{8, 1 }, { 12, }}; open_by_handle_at(AT_FDCWD, &h.fh, O_RDONLY); return 0; } Google-Bug-Id: 120690101 Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org	2018-12-19 12:29:13 -05:00
Al Viro	e884bce1d9	ext4: don't open-code ERR_CAST ... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>	2018-10-10 16:41:40 -04:00
Wang Shilong	5ef2a69993	ext4: use ext4_warning() for sb_getblk failure ... Out of memory should not be considered as critical errors; so replace ext4_error() with ext4_warnig(). Signed-off-by: Wang Shilong <wshilong@ddn.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@vger.kernel.org	2018-08-01 12:02:31 -04:00
Arnd Bergmann	7b62b29320	ext4: use timespec64 for all inode times ... This is the last missing piece for the inode times on 32-bit systems: now that VFS interfaces use timespec64, we just need to stop truncating the tv_sec values for y2038 compatibililty. Reviewed-by: Andreas Dilger <adilger@dilger.ca> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2018-07-29 15:51:00 -04:00
Theodore Ts'o	5012284700	ext4: fix check to prevent initializing reserved inodes ... Commit 8844618d8a: "ext4: only look at the bg_flags field if it is valid" will complain if block group zero does not have the EXT4_BG_INODE_ZEROED flag set. Unfortunately, this is not correct, since a freshly created file system has this flag cleared. It gets almost immediately after the file system is mounted read-write --- but the following somewhat unlikely sequence will end up triggering a false positive report of a corrupted file system: mkfs.ext4 /dev/vdc mount -o ro /dev/vdc /vdc mount -o remount,rw /dev/vdc Instead, when initializing the inode table for block group zero, test to make sure that itable_unused count is not too large, since that is the case that will result in some or all of the reserved inodes getting cleared. This fixes the failures reported by Eric Whiteney when running generic/230 and generic/231 in the the nojournal test case. Fixes: 8844618d8a ("ext4: only look at the bg_flags field if it is valid") Reported-by: Eric Whitney <enwlinux@gmail.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu>	2018-07-29 15:34:00 -04:00
Theodore Ts'o	8d5a803c6a	ext4: check for allocation block validity with block group locked ... With commit 044e6e3d74: "ext4: don't update checksum of new initialized bitmaps" the buffer valid bit will get set without actually setting up the checksum for the allocation bitmap, since the checksum will get calculated once we actually allocate an inode or block. If we are doing this, then we need to (re-)check the verified bit after we take the block group lock. Otherwise, we could race with another process reading and verifying the bitmap, which would then complain about the checksum being invalid. https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1780137 Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org	2018-07-12 19:08:05 -04:00
Linus Torvalds	70a2dc6abc	Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 ... Pull ext4 bugfixes from Ted Ts'o: "Bug fixes for ext4; most of which relate to vulnerabilities where a maliciously crafted file system image can result in a kernel OOPS or hang. At least one fix addresses an inline data bug could be triggered by userspace without the need of a crafted file system (although it does require that the inline data feature be enabled)" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: check superblock mapped prior to committing ext4: add more mount time checks of the superblock ext4: add more inode number paranoia checks ext4: avoid running out of journal credits when appending to an inline file jbd2: don't mark block as modified if the handle is out of credits ext4: never move the system.data xattr out of the inode body ext4: clear i_data in ext4_inode_info when removing inline data ext4: include the illegal physical block in the bad map ext4_error msg ext4: verify the depth of extent tree in ext4_find_extent() ext4: only look at the bg_flags field if it is valid ext4: make sure bitmaps and the inode table don't overlap with bg descriptors ext4: always check block group bounds in ext4_init_block_bitmap() ext4: always verify the magic number in xattr blocks ext4: add corruption check in ext4_xattr_set_entry() ext4: add warn_on_error mount option	2018-07-08 11:10:30 -07:00
Linus Torvalds	7a932516f5	Merge tag 'vfs-timespec64' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground ... Pull inode timestamps conversion to timespec64 from Arnd Bergmann: "This is a late set of changes from Deepa Dinamani doing an automated treewide conversion of the inode and iattr structures from 'timespec' to 'timespec64', to push the conversion from the VFS layer into the individual file systems. As Deepa writes: 'The series aims to switch vfs timestamps to use struct timespec64. Currently vfs uses struct timespec, which is not y2038 safe. The series involves the following: 1. Add vfs helper functions for supporting struct timepec64 timestamps. 2. Cast prints of vfs timestamps to avoid warnings after the switch. 3. Simplify code using vfs timestamps so that the actual replacement becomes easy. 4. Convert vfs timestamps to use struct timespec64 using a script. This is a flag day patch. Next steps: 1. Convert APIs that can handle timespec64, instead of converting timestamps at the boundaries. 2. Update internal data structures to avoid timestamp conversions' Thomas Gleixner adds: 'I think there is no point to drag that out for the next merge window. The whole thing needs to be done in one go for the core changes which means that you're going to play that catchup game forever. Let's get over with it towards the end of the merge window'" * tag 'vfs-timespec64' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground: pstore: Remove bogus format string definition vfs: change inode times to use struct timespec64 pstore: Convert internal records to timespec64 udf: Simplify calls to udf_disk_stamp_to_time fs: nfs: get rid of memcpys for inode times ceph: make inode time prints to be long long lustre: Use long long type to print inode time fs: add timespec64_truncate()	2018-06-15 07:31:07 +09:00
Theodore Ts'o	8844618d8a	ext4: only look at the bg_flags field if it is valid ... The bg_flags field in the block group descripts is only valid if the uninit_bg or metadata_csum feature is enabled. We were not consistently looking at this field; fix this. Also block group #0 must never have uninitialized allocation bitmaps, or need to be zeroed, since that's where the root inode, and other special inodes are set up. Check for these conditions and mark the file system as corrupted if they are detected. This addresses CVE-2018-10876. https://bugzilla.kernel.org/show_bug.cgi?id=199403 Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org	2018-06-14 00:58:00 -04:00
Deepa Dinamani	95582b0083	vfs: change inode times to use struct timespec64 ... struct timespec is not y2038 safe. Transition vfs to use y2038 safe struct timespec64 instead. The change was made with the help of the following cocinelle script. This catches about 80% of the changes. All the header file and logic changes are included in the first 5 rules. The rest are trivial substitutions. I avoid changing any of the function signatures or any other filesystem specific data structures to keep the patch simple for review. The script can be a little shorter by combining different cases. But, this version was sufficient for my usecase. virtual patch @ depends on patch @ identifier now; @@ - struct timespec + struct timespec64 current_time ( ... ) { - struct timespec now = current_kernel_time(); + struct timespec64 now = current_kernel_time64(); ... - return timespec_trunc( + return timespec64_trunc( ... ); } @ depends on patch @ identifier xtime; @@ struct \( iattr \| inode \| kstat \) { ... - struct timespec xtime; + struct timespec64 xtime; ... } @ depends on patch @ identifier t; @@ struct inode_operations { ... int (*update_time) (..., - struct timespec t, + struct timespec64 t, ...); ... } @ depends on patch @ identifier t; identifier fn_update_time =~ "update_time$"; @@ fn_update_time (..., - struct timespec *t, + struct timespec64 *t, ...) { ... } @ depends on patch @ identifier t; @@ lease_get_mtime( ... , - struct timespec *t + struct timespec64 *t ) { ... } @te depends on patch forall@ identifier ts; local idexpression struct inode *inode_node; identifier i_xtime =~ "^i_[acm]time$"; identifier ia_xtime =~ "^ia_[acm]time$"; identifier fn_update_time =~ "update_time$"; identifier fn; expression e, E3; local idexpression struct inode *node1; local idexpression struct inode *node2; local idexpression struct iattr *attr1; local idexpression struct iattr *attr2; local idexpression struct iattr attr; identifier i_xtime1 =~ "^i_[acm]time$"; identifier i_xtime2 =~ "^i_[acm]time$"; identifier ia_xtime1 =~ "^ia_[acm]time$"; identifier ia_xtime2 =~ "^ia_[acm]time$"; @@ ( ( - struct timespec ts; + struct timespec64 ts; | - struct timespec ts = current_time(inode_node); + struct timespec64 ts = current_time(inode_node); ) <+... when != ts ( - timespec_equal(&inode_node->i_xtime, &ts) + timespec64_equal(&inode_node->i_xtime, &ts) | - timespec_equal(&ts, &inode_node->i_xtime) + timespec64_equal(&ts, &inode_node->i_xtime) | - timespec_compare(&inode_node->i_xtime, &ts) + timespec64_compare(&inode_node->i_xtime, &ts) | - timespec_compare(&ts, &inode_node->i_xtime) + timespec64_compare(&ts, &inode_node->i_xtime) | ts = current_time(e) | fn_update_time(..., &ts,...) | inode_node->i_xtime = ts | node1->i_xtime = ts | ts = inode_node->i_xtime | <+... attr1->ia_xtime ...+> = ts | ts = attr1->ia_xtime | ts.tv_sec | ts.tv_nsec | btrfs_set_stack_timespec_sec(..., ts.tv_sec) | btrfs_set_stack_timespec_nsec(..., ts.tv_nsec) | - ts = timespec64_to_timespec( + ts = ... -) | - ts = ktime_to_timespec( + ts = ktime_to_timespec64( ...) | - ts = E3 + ts = timespec_to_timespec64(E3) | - ktime_get_real_ts(&ts) + ktime_get_real_ts64(&ts) | fn(..., - ts + timespec64_to_timespec(ts) ,...) ) ...+> ( <... when != ts - return ts; + return timespec64_to_timespec(ts); ...> ) | - timespec_equal(&node1->i_xtime1, &node2->i_xtime2) + timespec64_equal(&node1->i_xtime2, &node2->i_xtime2) | - timespec_equal(&node1->i_xtime1, &attr2->ia_xtime2) + timespec64_equal(&node1->i_xtime2, &attr2->ia_xtime2) | - timespec_compare(&node1->i_xtime1, &node2->i_xtime2) + timespec64_compare(&node1->i_xtime1, &node2->i_xtime2) | node1->i_xtime1 = - timespec_trunc(attr1->ia_xtime1, + timespec64_trunc(attr1->ia_xtime1, ...) | - attr1->ia_xtime1 = timespec_trunc(attr2->ia_xtime2, + attr1->ia_xtime1 = timespec64_trunc(attr2->ia_xtime2, ...) | - ktime_get_real_ts(&attr1->ia_xtime1) + ktime_get_real_ts64(&attr1->ia_xtime1) | - ktime_get_real_ts(&attr.ia_xtime1) + ktime_get_real_ts64(&attr.ia_xtime1) ) @ depends on patch @ struct inode *node; struct iattr *attr; identifier fn; identifier i_xtime =~ "^i_[acm]time$"; identifier ia_xtime =~ "^ia_[acm]time$"; expression e; @@ ( - fn(node->i_xtime); + fn(timespec64_to_timespec(node->i_xtime)); | fn(..., - node->i_xtime); + timespec64_to_timespec(node->i_xtime)); | - e = fn(attr->ia_xtime); + e = fn(timespec64_to_timespec(attr->ia_xtime)); ) @ depends on patch forall @ struct inode *node; struct iattr *attr; identifier i_xtime =~ "^i_[acm]time$"; identifier ia_xtime =~ "^ia_[acm]time$"; identifier fn; @@ { + struct timespec ts; <+... ( + ts = timespec64_to_timespec(node->i_xtime); fn (..., - &node->i_xtime, + &ts, ...); | + ts = timespec64_to_timespec(attr->ia_xtime); fn (..., - &attr->ia_xtime, + &ts, ...); ) ...+> } @ depends on patch forall @ struct inode *node; struct iattr *attr; struct kstat *stat; identifier ia_xtime =~ "^ia_[acm]time$"; identifier i_xtime =~ "^i_[acm]time$"; identifier xtime =~ "^[acm]time$"; identifier fn, ret; @@ { + struct timespec ts; <+... ( + ts = timespec64_to_timespec(node->i_xtime); ret = fn (..., - &node->i_xtime, + &ts, ...); | + ts = timespec64_to_timespec(node->i_xtime); ret = fn (..., - &node->i_xtime); + &ts); | + ts = timespec64_to_timespec(attr->ia_xtime); ret = fn (..., - &attr->ia_xtime, + &ts, ...); | + ts = timespec64_to_timespec(attr->ia_xtime); ret = fn (..., - &attr->ia_xtime); + &ts); | + ts = timespec64_to_timespec(stat->xtime); ret = fn (..., - &stat->xtime); + &ts); ) ...+> } @ depends on patch @ struct inode *node; struct inode *node2; identifier i_xtime1 =~ "^i_[acm]time$"; identifier i_xtime2 =~ "^i_[acm]time$"; identifier i_xtime3 =~ "^i_[acm]time$"; struct iattr *attrp; struct iattr *attrp2; struct iattr attr ; identifier ia_xtime1 =~ "^ia_[acm]time$"; identifier ia_xtime2 =~ "^ia_[acm]time$"; struct kstat *stat; struct kstat stat1; struct timespec64 ts; identifier xtime =~ "^[acmb]time$"; expression e; @@ ( ( node->i_xtime2 \| attrp->ia_xtime2 \| attr.ia_xtime2 \) = node->i_xtime1 ; | node->i_xtime2 = \( node2->i_xtime1 \| timespec64_trunc(...) \); | node->i_xtime2 = node->i_xtime1 = node->i_xtime3 = \(ts \| current_time(...) \); | node->i_xtime1 = node->i_xtime3 = \(ts \| current_time(...) \); | stat->xtime = node2->i_xtime1; | stat1.xtime = node2->i_xtime1; | ( node->i_xtime2 \| attrp->ia_xtime2 \) = attrp->ia_xtime1 ; | ( attrp->ia_xtime1 \| attr.ia_xtime1 \) = attrp2->ia_xtime2; | - e = node->i_xtime1; + e = timespec64_to_timespec( node->i_xtime1 ); | - e = attrp->ia_xtime1; + e = timespec64_to_timespec( attrp->ia_xtime1 ); | node->i_xtime1 = current_time(...); | node->i_xtime2 = node->i_xtime1 = node->i_xtime3 = - e; + timespec_to_timespec64(e); | node->i_xtime1 = node->i_xtime3 = - e; + timespec_to_timespec64(e); | - node->i_xtime1 = e; + node->i_xtime1 = timespec_to_timespec64(e); ) Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com> Cc: <anton@tuxera.com> Cc: <balbi@kernel.org> Cc: <bfields@fieldses.org> Cc: <darrick.wong@oracle.com> Cc: <dhowells@redhat.com> Cc: <dsterba@suse.com> Cc: <dwmw2@infradead.org> Cc: <hch@lst.de> Cc: <hirofumi@mail.parknet.co.jp> Cc: <hubcap@omnibond.com> Cc: <jack@suse.com> Cc: <jaegeuk@kernel.org> Cc: <jaharkes@cs.cmu.edu> Cc: <jslaby@suse.com> Cc: <keescook@chromium.org> Cc: <mark@fasheh.com> Cc: <miklos@szeredi.hu> Cc: <nico@linaro.org> Cc: <reiserfs-devel@vger.kernel.org> Cc: <richard@nod.at> Cc: <sage@redhat.com> Cc: <sfrench@samba.org> Cc: <swhiteho@redhat.com> Cc: <tj@kernel.org> Cc: <trond.myklebust@primarydata.com> Cc: <tytso@mit.edu> Cc: <viro@zeniv.linux.org.uk>	2018-06-05 16:57:31 -07:00
Wang Shilong	206f6d552d	ext4: mark inode bitmap corrupted when found ... There are still some cases that we missed to set block bitmaps corrupted bit properly: 1)inode bitmap number is wrong. 2)failed to read block bitmap due to disk errors. 3)double allocations from bitmap Also remove a duplicated call ext4_error() afer ext4_read_inode_bitmap(), as ext4_error() have been called inside ext4_read_inode_bitmap() properly. Signed-off-by: Wang Shilong <wshilong@ddn.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reviewed-by: Andreas Dilger <adilger@dilger.ca>	2018-05-12 12:15:21 -04:00