提交 · 2f3891b0340194ce3f9305aed3372ffb7414273b · openeuler / Kernel

21 11月, 2022 40 次提交

pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map · 2f3891b0

由 Miaoqian Lin 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 78d05103891d3e96144b846fbc39f2cfb3384eae
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=78d05103891d3e96144b846fbc39f2cfb3384eae

--------------------------------

commit 4b32e054 upstream.

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak."

Fixes: c2f6d059 ("pinctrl: nomadik: refactor DT parser to take two paths")
Signed-off-by: NMiaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20220607111602.57355-1-linmq006@gmail.comSigned-off-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

2f3891b0

net: bgmac: Fix a BUG triggered by wrong bytes_compl · 02e12155

由 Sandor Bodo-Merle 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit ab2b55bb25db289ba0b68e3d58494476bdb1041d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ab2b55bb25db289ba0b68e3d58494476bdb1041d

--------------------------------

commit 1b7680c6 upstream.

On one of our machines we got:

kernel BUG at lib/dynamic_queue_limits.c:27!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
CPU: 0 PID: 1166 Comm: irq/41-bgmac Tainted: G        W  O    4.14.275-rt132 #1
Hardware name: BRCM XGS iProc
task: ee3415c0 task.stack: ee32a000
PC is at dql_completed+0x168/0x178
LR is at bgmac_poll+0x18c/0x6d8
pc : [<c03b9430>]    lr : [<c04b5a18>]    psr: 800a0313
sp : ee32be14  ip : 000005ea  fp : 00000bd4
r10: ee558500  r9 : c0116298  r8 : 00000002
r7 : 00000000  r6 : ef128810  r5 : 01993267  r4 : 01993851
r3 : ee558000  r2 : 000070e1  r1 : 00000bd4  r0 : ee52c180
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 12c5387d  Table: 8e88c04a  DAC: 00000051
Process irq/41-bgmac (pid: 1166, stack limit = 0xee32a210)
Stack: (0xee32be14 to 0xee32c000)
be00:                                              ee558520 ee52c100 ef128810
be20: 00000000 00000002 c0116298 c04b5a18 00000000 c0a0c8c4 c0951780 00000040
be40: c0701780 ee558500 ee55d520 ef05b340 ef6f9780 ee558520 00000001 00000040
be60: ffffe000 c0a56878 ef6fa040 c0952040 0000012c c0528744 ef6f97b0 fffcfb6a
be80: c0a04104 2eda8000 c0a0c4ec c0a0d368 ee32bf44 c0153534 ee32be98 ee32be98
bea0: ee32bea0 ee32bea0 ee32bea8 ee32bea8 00000000 c01462e4 ffffe000 ef6f22a8
bec0: ffffe000 00000008 ee32bee4 c0147430 ffffe000 c094a2a8 00000003 ffffe000
bee0: c0a54528 00208040 0000000c c0a0c8c4 c0a65980 c0124d3c 00000008 ee558520
bf00: c094a23c c0a02080 00000000 c07a9910 ef136970 ef136970 ee30a440 ef136900
bf20: ee30a440 00000001 ef136900 ee30a440 c016d990 00000000 c0108db0 c012500c
bf40: ef136900 c016da14 ee30a464 ffffe000 00000001 c016dd14 00000000 c016db28
bf60: ffffe000 ee21a080 ee30a400 00000000 ee32a000 ee30a440 c016dbfc ee25fd70
bf80: ee21a09c c013edcc ee32a000 ee30a400 c013ec7c 00000000 00000000 00000000
bfa0: 00000000 00000000 00000000 c0108470 00000000 00000000 00000000 00000000
bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
[<c03b9430>] (dql_completed) from [<c04b5a18>] (bgmac_poll+0x18c/0x6d8)
[<c04b5a18>] (bgmac_poll) from [<c0528744>] (net_rx_action+0x1c4/0x494)
[<c0528744>] (net_rx_action) from [<c0124d3c>] (do_current_softirqs+0x1ec/0x43c)
[<c0124d3c>] (do_current_softirqs) from [<c012500c>] (__local_bh_enable+0x80/0x98)
[<c012500c>] (__local_bh_enable) from [<c016da14>] (irq_forced_thread_fn+0x84/0x98)
[<c016da14>] (irq_forced_thread_fn) from [<c016dd14>] (irq_thread+0x118/0x1c0)
[<c016dd14>] (irq_thread) from [<c013edcc>] (kthread+0x150/0x158)
[<c013edcc>] (kthread) from [<c0108470>] (ret_from_fork+0x14/0x24)
Code: a83f15e0 0200001a 0630a0e1 c3ffffea (f201f0e7)

The issue seems similar to commit 90b3b339 ("net: hisilicon: Fix a BUG
trigered by wrong bytes_compl") and potentially introduced by commit
b38c83dd ("bgmac: simplify tx ring index handling").

If there is an RX interrupt between setting ring->end
and netdev_sent_queue() we can hit the BUG_ON as bgmac_dma_tx_free()
can miscalculate the queue size while called from bgmac_poll().

The machine which triggered the BUG runs a v4.14 RT kernel - but the issue
seems present in mainline too.

Fixes: b38c83dd ("bgmac: simplify tx ring index handling")
Signed-off-by: NSandor Bodo-Merle <sbodomerle@gmail.com>
Reviewed-by: NFlorian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20220808173939.193804-1-sbodomerle@gmail.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

02e12155

virtio_net: fix memory leak inside XPD_TX with mergeable · cdbfed89

由 Xuan Zhuo 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit faafa2a87f697ee537c29446097e1cc3143506fa
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=faafa2a87f697ee537c29446097e1cc3143506fa

--------------------------------

commit 7a542bee upstream.

When we call xdp_convert_buff_to_frame() to get xdpf, if it returns
NULL, we should check if xdp_page was allocated by xdp_linearize_page().
If it is newly allocated, it should be freed here alone. Just like any
other "goto err_xdp".

Fixes: 44fa2dbd ("xdp: transition into using xdp_frame for ndo_xdp_xmit")
Signed-off-by: NXuan Zhuo <xuanzhuo@linux.alibaba.com>
Acked-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

cdbfed89

SUNRPC: Reinitialise the backchannel request buffers before reuse · 5408d877

由 Trond Myklebust 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit fd70ebf2999be258f15c790f53f3247f9f2f905e
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd70ebf2999be258f15c790f53f3247f9f2f905e

--------------------------------

commit 6622e3a7 upstream.

When we're reusing the backchannel requests instead of freeing them,
then we should reinitialise any values of the send/receive xdr_bufs so
that they reflect the available space.

Fixes: 0d2a970d ("SUNRPC: Fix a backchannel race")
Signed-off-by: NTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

5408d877

sunrpc: fix expiry of auth creds · a0bd62b4

由 Dan Aloni 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 59d2e8fa4127c1417a5b3e0f33e59ae8216df720
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=59d2e8fa4127c1417a5b3e0f33e59ae8216df720

--------------------------------

commit f1bafa73 upstream.

Before this commit, with a large enough LRU of expired items (100), the
loop skipped all the expired items and was entirely ineffectual in
trimming the LRU list.

Fixes: 95cd6232 ('SUNRPC: Clean up the AUTH cache code')
Signed-off-by: NDan Aloni <dan.aloni@vastdata.com>
Signed-off-by: NTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

a0bd62b4

net: atlantic: fix aq_vec index out of range error · a54c8c83

由 Chia-Lin Kao (AceLan) 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit df60c534d4c5a681172952dd4b475a5d818b3a86
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=df60c534d4c5a681172952dd4b475a5d818b3a86

--------------------------------

commit 2ba5e47f upstream.

The final update statement of the for loop exceeds the array range, the
dereference of self->aq_vec[i] is not checked and then leads to the
index out of range error.
Also fixed this kind of coding style in other for loop.

[   97.937604] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1404:48
[   97.937607] index 8 is out of range for type 'aq_vec_s *[8]'
[   97.937608] CPU: 38 PID: 3767 Comm: kworker/u256:18 Not tainted 5.19.0+ #2
[   97.937610] Hardware name: Dell Inc. Precision 7865 Tower/, BIOS 1.0.0 06/12/2022
[   97.937611] Workqueue: events_unbound async_run_entry_fn
[   97.937616] Call Trace:
[   97.937617]  <TASK>
[   97.937619]  dump_stack_lvl+0x49/0x63
[   97.937624]  dump_stack+0x10/0x16
[   97.937626]  ubsan_epilogue+0x9/0x3f
[   97.937627]  __ubsan_handle_out_of_bounds.cold+0x44/0x49
[   97.937629]  ? __scm_send+0x348/0x440
[   97.937632]  ? aq_vec_stop+0x72/0x80 [atlantic]
[   97.937639]  aq_nic_stop+0x1b6/0x1c0 [atlantic]
[   97.937644]  aq_suspend_common+0x88/0x90 [atlantic]
[   97.937648]  aq_pm_suspend_poweroff+0xe/0x20 [atlantic]
[   97.937653]  pci_pm_suspend+0x7e/0x1a0
[   97.937655]  ? pci_pm_suspend_noirq+0x2b0/0x2b0
[   97.937657]  dpm_run_callback+0x54/0x190
[   97.937660]  __device_suspend+0x14c/0x4d0
[   97.937661]  async_suspend+0x23/0x70
[   97.937663]  async_run_entry_fn+0x33/0x120
[   97.937664]  process_one_work+0x21f/0x3f0
[   97.937666]  worker_thread+0x4a/0x3c0
[   97.937668]  ? process_one_work+0x3f0/0x3f0
[   97.937669]  kthread+0xf0/0x120
[   97.937671]  ? kthread_complete_and_exit+0x20/0x20
[   97.937672]  ret_from_fork+0x22/0x30
[   97.937676]  </TASK>

v2. fixed "warning: variable 'aq_vec' set but not used"

v3. simplified a for loop

Fixes: 97bde5c4 ("net: ethernet: aquantia: Support for NIC-specific code")
Signed-off-by: NChia-Lin Kao (AceLan) <acelan.kao@canonical.com>
Acked-by: NSudarsana Reddy Kalluru <skalluru@marvell.com>
Link: https://lore.kernel.org/r/20220808081845.42005-1-acelan.kao@canonical.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

a54c8c83

can: mcp251x: Fix race condition on receive interrupt · 639ab170

由 Sebastian Würl 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit cc25abcec82c943b4dac2acb8a37c56f6e8b7078
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=cc25abcec82c943b4dac2acb8a37c56f6e8b7078

--------------------------------

commit d80d60b0 upstream.

The mcp251x driver uses both receiving mailboxes of the CAN controller
chips. For retrieving the CAN frames from the controller via SPI, it checks
once per interrupt which mailboxes have been filled and will retrieve the
messages accordingly.

This introduces a race condition, as another CAN frame can enter mailbox 1
while mailbox 0 is emptied. If now another CAN frame enters mailbox 0 until
the interrupt handler is called next, mailbox 0 is emptied before
mailbox 1, leading to out-of-order CAN frames in the network device.

This is fixed by checking the interrupt flags once again after freeing
mailbox 0, to correctly also empty mailbox 1 before leaving the handler.

For reproducing the bug I created the following setup:
 - Two CAN devices, one Raspberry Pi with MCP2515, the other can be any.
 - Setup CAN to 1 MHz
 - Spam bursts of 5 CAN-messages with increasing CAN-ids
 - Continue sending the bursts while sleeping a second between the bursts
 - Check on the RPi whether the received messages have increasing CAN-ids
 - Without this patch, every burst of messages will contain a flipped pair

v3: https://lore.kernel.org/all/20220804075914.67569-1-sebastian.wuerl@ororatech.com
v2: https://lore.kernel.org/all/20220804064803.63157-1-sebastian.wuerl@ororatech.com
v1: https://lore.kernel.org/all/20220803153300.58732-1-sebastian.wuerl@ororatech.com

Fixes: bf66f373 ("can: mcp251x: Move to threaded interrupts instead of workqueues.")
Signed-off-by: NSebastian Würl <sebastian.wuerl@ororatech.com>
Link: https://lore.kernel.org/all/20220804081411.68567-1-sebastian.wuerl@ororatech.com
[mkl: reduce scope of intf1, eflag1]
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

639ab170

bpf: Check the validity of max_rdwr_access for sock local storage map iterator · 65e97d55

由 Hou Tao 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit b9d9cf88c828d5c6071c8e8c025210d5269cb499
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b9d9cf88c828d5c6071c8e8c025210d5269cb499

--------------------------------

commit 52bd05eb upstream.

The value of sock local storage map is writable in map iterator, so check
max_rdwr_access instead of max_rdonly_access.

Fixes: 5ce6e77c ("bpf: Implement bpf iterator for sock local storage map")
Signed-off-by: NHou Tao <houtao1@huawei.com>
Acked-by: NYonghong Song <yhs@fb.com>
Acked-by: NMartin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/r/20220810080538.1845898-6-houtao@huaweicloud.comSigned-off-by: NAlexei Starovoitov <ast@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

65e97d55

bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator · e72f736e

由 Hou Tao 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit f7d844df5e20dd1ca32a697f188e98ad90f29d8e
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f7d844df5e20dd1ca32a697f188e98ad90f29d8e

--------------------------------

commit f0d2b271 upstream.

sock_map_iter_attach_target() acquires a map uref, and the uref may be
released before or in the middle of iterating map elements. For example,
the uref could be released in sock_map_iter_detach_target() as part of
bpf_link_release(), or could be released in bpf_map_put_with_uref() as
part of bpf_map_release().

Fixing it by acquiring an extra map uref in .init_seq_private and
releasing it in .fini_seq_private.

Fixes: 03653515 ("net: Allow iterating sockmap and sockhash")
Signed-off-by: NHou Tao <houtao1@huawei.com>
Acked-by: NYonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/r/20220810080538.1845898-5-houtao@huaweicloud.comSigned-off-by: NAlexei Starovoitov <ast@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

e72f736e

bpf: Acquire map uref in .init_seq_private for sock local storage map iterator · cecb2aa4

由 Hou Tao 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit d7ad7e65aa2fb5608b3b499aeaf1697f2e2e0cfd
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d7ad7e65aa2fb5608b3b499aeaf1697f2e2e0cfd

--------------------------------

commit 3c5f6e69 upstream.

bpf_iter_attach_map() acquires a map uref, and the uref may be released
before or in the middle of iterating map elements. For example, the uref
could be released in bpf_iter_detach_map() as part of
bpf_link_release(), or could be released in bpf_map_put_with_uref() as
part of bpf_map_release().

So acquiring an extra map uref in bpf_iter_init_sk_storage_map() and
releasing it in bpf_iter_fini_sk_storage_map().

Fixes: 5ce6e77c ("bpf: Implement bpf iterator for sock local storage map")
Signed-off-by: NHou Tao <houtao1@huawei.com>
Acked-by: NYonghong Song <yhs@fb.com>
Acked-by: NMartin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/r/20220810080538.1845898-4-houtao@huaweicloud.comSigned-off-by: NAlexei Starovoitov <ast@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

cecb2aa4

bpf: Acquire map uref in .init_seq_private for hash map iterator · 42386554

由 Hou Tao 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit bda6fe3ea8932129881684ab52034673e36e6ae6
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bda6fe3ea8932129881684ab52034673e36e6ae6

--------------------------------

commit ef1e93d2 upstream.

bpf_iter_attach_map() acquires a map uref, and the uref may be released
before or in the middle of iterating map elements. For example, the uref
could be released in bpf_iter_detach_map() as part of
bpf_link_release(), or could be released in bpf_map_put_with_uref() as
part of bpf_map_release().

So acquiring an extra map uref in bpf_iter_init_hash_map() and
releasing it in bpf_iter_fini_hash_map().

Fixes: d6c4503c ("bpf: Implement bpf iterator for hash maps")
Signed-off-by: NHou Tao <houtao1@huawei.com>
Acked-by: NYonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/r/20220810080538.1845898-3-houtao@huaweicloud.comSigned-off-by: NAlexei Starovoitov <ast@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

42386554

bpf: Acquire map uref in .init_seq_private for array map iterator · a8311913

由 Hou Tao 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 30d7198da84f8767c38bebf21c3b7eb2a87ff46a
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=30d7198da84f8767c38bebf21c3b7eb2a87ff46a

--------------------------------

commit f76fa6b3 upstream.

bpf_iter_attach_map() acquires a map uref, and the uref may be released
before or in the middle of iterating map elements. For example, the uref
could be released in bpf_iter_detach_map() as part of
bpf_link_release(), or could be released in bpf_map_put_with_uref() as
part of bpf_map_release().

Alternative fix is acquiring an extra bpf_link reference just like
a pinned map iterator does, but it introduces unnecessary dependency
on bpf_link instead of bpf_map.

So choose another fix: acquiring an extra map uref in .init_seq_private
for array map iterator.

Fixes: d3cc2ab5 ("bpf: Implement bpf iterator for array maps")
Signed-off-by: NHou Tao <houtao1@huawei.com>
Acked-by: NYonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/r/20220810080538.1845898-2-houtao@huaweicloud.comSigned-off-by: NAlexei Starovoitov <ast@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

a8311913

NFSv4/pnfs: Fix a use-after-free bug in open · 3b15b7ef

由 Trond Myklebust 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 76ffd2042438769298f34b76102b40dea89de616
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=76ffd2042438769298f34b76102b40dea89de616

--------------------------------

commit 2135e5d5 upstream.

If someone cancels the open RPC call, then we must not try to free
either the open slot or the layoutget operation arguments, since they
are likely still in use by the hung RPC call.

Fixes: 69494938 ("NFSv4: Don't hold the layoutget locks across multiple RPC calls")
Signed-off-by: NTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

3b15b7ef

NFSv4.1: RECLAIM_COMPLETE must handle EACCES · 116dfbe6

由 Zhang Xianwei 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit f2bd1cc1fe7a58af9f701e82a84d035104ceb87f
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f2bd1cc1fe7a58af9f701e82a84d035104ceb87f

--------------------------------

commit e35a5e78 upstream.

A client should be able to handle getting an EACCES error while doing
a mount operation to reclaim state due to NFS4CLNT_RECLAIM_REBOOT
being set. If the server returns RPC_AUTH_BADCRED because authentication
failed when we execute "exportfs -au", then RECLAIM_COMPLETE will go a
wrong way. After mount succeeds, all OPEN call will fail due to an
NFS4ERR_GRACE error being returned. This patch is to fix it by resending
a RPC request.
Signed-off-by: NZhang Xianwei <zhang.xianwei8@zte.com.cn>
Signed-off-by: NYi Wang <wang.yi59@zte.com.cn>
Fixes: aa5190d0 ("NFSv4: Kill nfs4_async_handle_error() abuses by NFSv4.1")
Signed-off-by: NTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

116dfbe6

NFSv4: Fix races in the legacy idmapper upcall · ddc243a1

由 Trond Myklebust 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit cfde64bd315d6845416f34e7754e475d4179337c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=cfde64bd315d6845416f34e7754e475d4179337c

--------------------------------

commit 51fd2eb5 upstream.

nfs_idmap_instantiate() will cause the process that is waiting in
request_key_with_auxdata() to wake up and exit. If there is a second
process waiting for the idmap->idmap_mutex, then it may wake up and
start a new call to request_key_with_auxdata(). If the call to
idmap_pipe_downcall() from the first process has not yet finished
calling nfs_idmap_complete_pipe_upcall_locked(), then we may end up
triggering the WARN_ON_ONCE() in nfs_idmap_prepare_pipe_upcall().

The fix is to ensure that we clear idmap->idmap_upcall_data before
calling nfs_idmap_instantiate().

Fixes: e9ab41b6 ("NFSv4: Clean up the legacy idmapper upcall")
Signed-off-by: NTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

ddc243a1

NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly · ec6743a6

由 Trond Myklebust 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 060c111373ee809f4b44a1d648cf704a39532c34
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=060c111373ee809f4b44a1d648cf704a39532c34

--------------------------------

commit 7ccafd4b upstream.

Don't assume that the NFS4ERR_DELAY means that the server is processing
this slot id.

Fixes: 3453d570 ("NFSv4.1: Avoid false retries when RPC calls are interrupted")
Signed-off-by: NTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

ec6743a6

NFSv4.1: Don't decrease the value of seq_nr_highest_sent · 65059d93

由 Trond Myklebust 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit a351a73d90641240d2de6b41682475edd9671bf3
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a351a73d90641240d2de6b41682475edd9671bf3

--------------------------------

commit f07a5d24 upstream.

When we're trying to figure out what the server may or may not have seen
in terms of request numbers, do not assume that requests with a larger
number were missed, just because we saw a reply to a request with a
smaller number.

Fixes: 3453d570 ("NFSv4.1: Avoid false retries when RPC calls are interrupted")
Signed-off-by: NTrond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

65059d93

Documentation: ACPI: EINJ: Fix obsolete example · a9ecc22a

由 Qifu Zhang 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit a408f135c4c2ba3948e1bbdbe5eff115f3d5d058
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a408f135c4c2ba3948e1bbdbe5eff115f3d5d058

--------------------------------

commit 9066e151 upstream.

Since commit 488dac0c ("libfs: fix error cast of negative value in
simple_attr_write()"), the EINJ debugfs interface no longer accepts
negative values as input. Attempt to do so will result in EINVAL.

Fixes: 488dac0c ("libfs: fix error cast of negative value in simple_attr_write()")
Signed-off-by: NQifu Zhang <zhangqifu@bytedance.com>
Reviewed-by: NTony Luck <tony.luck@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

a9ecc22a

apparmor: Fix memleak in aa_simple_write_to_buffer() · dcffff15

由 Xiu Jianfeng 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 8aab4295582eb397a125d2788b829fa62b88dbf7
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8aab4295582eb397a125d2788b829fa62b88dbf7

--------------------------------

commit 417ea9fe upstream.

When copy_from_user failed, the memory is freed by kvfree. however the
management struct and data blob are allocated independently, so only
kvfree(data) cause a memleak issue here. Use aa_put_loaddata(data) to
fix this issue.

Fixes: a6a52579 ("apparmor: split load data into management struct and data blob")
Signed-off-by: NXiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: NJohn Johansen <john.johansen@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

dcffff15

apparmor: fix reference count leak in aa_pivotroot() · 43763817

由 Xin Xiong 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 2ceeb3296e9dde1d5772348046affcefdea605e2
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2ceeb3296e9dde1d5772348046affcefdea605e2

--------------------------------

commit 11c3627e upstream.

The aa_pivotroot() function has a reference counting bug in a specific
path. When aa_replace_current_label() returns on success, the function
forgets to decrement the reference count of “target”, which is
increased earlier by build_pivotroot(), causing a reference leak.

Fix it by decreasing the refcount of “target” in that path.

Fixes: 2ea3ffb7 ("apparmor: add mount mediation")
Co-developed-by: NXiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: NXiyu Yang <xiyuyang19@fudan.edu.cn>
Co-developed-by: NXin Tan <tanxin.ctf@gmail.com>
Signed-off-by: NXin Tan <tanxin.ctf@gmail.com>
Signed-off-by: NXin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: NJohn Johansen <john.johansen@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

43763817

apparmor: fix overlapping attachment computation · 45cec310

由 John Johansen 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 2672f3eb7a7f8bc076a146c6f062233f56b1d3c1
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2672f3eb7a7f8bc076a146c6f062233f56b1d3c1

--------------------------------

commit 2504db20 upstream.

When finding the profile via patterned attachments, the longest left
match is being set to the static compile time value and not using the
runtime computed value.

Fix this by setting the candidate value to the greater of the
precomputed value or runtime computed value.

Fixes: 21f60661 ("apparmor: improve overlapping domain attachment resolution")
Signed-off-by: NJohn Johansen <john.johansen@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

45cec310

apparmor: fix setting unconfined mode on a loaded profile · 0a41ebb1

由 John Johansen 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 1ac89741a2e7ce6d446df33ad610a1e41f6c3241
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1ac89741a2e7ce6d446df33ad610a1e41f6c3241

--------------------------------

commit 3bbb7b2e upstream.

When loading a profile that is set to unconfined mode, that label
flag is not set when it should be. Ensure it is set so that when
used in a label the unconfined check will be applied correctly.

Fixes: 03816507 ("apparmor: allow setting any profile into the unconfined state")
Signed-off-by: NJohn Johansen <john.johansen@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

0a41ebb1

apparmor: fix aa_label_asxprint return check · 67dc6616

由 Tom Rix 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 4188f91c82e3720afd6c65f698ce88c867e02588
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4188f91c82e3720afd6c65f698ce88c867e02588

--------------------------------

commit 3e2a3a08 upstream.

Clang static analysis reports this issue
label.c:1802:3: warning: 2nd function call argument
  is an uninitialized value
  pr_info("%s", str);
  ^~~~~~~~~~~~~~~~~~

str is set from a successful call to aa_label_asxprint(&str, ...)
On failure a negative value is returned, not a -1.  So change
the check.

Fixes: f1bd9041 ("apparmor: add the base fns() for domain labels")
Signed-off-by: NTom Rix <trix@redhat.com>
Signed-off-by: NJohn Johansen <john.johansen@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

67dc6616

apparmor: Fix failed mount permission check error message · 8bc7670e

由 John Johansen 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit e0ca0156a78666f630f469271b4a48ef6ddc0704
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e0ca0156a78666f630f469271b4a48ef6ddc0704

--------------------------------

commit ec240b59 upstream.

When the mount check fails due to a permission check failure instead
of explicitly at one of the subcomponent checks, AppArmor is reporting
a failure in the flags match. However this is not true and AppArmor
can not attribute the error at this point to any particular component,
and should only indicate the mount failed due to missing permissions.

Fixes: 2ea3ffb7 ("apparmor: add mount mediation")
Signed-off-by: NJohn Johansen <john.johansen@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

8bc7670e

apparmor: fix absroot causing audited secids to begin with = · a5a58bda

由 John Johansen 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 08f8128bc9f2b4489e8dd84b91cb69abc0b9c963
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=08f8128bc9f2b4489e8dd84b91cb69abc0b9c963

--------------------------------

commit 511f7b5b upstream.

AppArmor is prefixing secids that are converted to secctx with the =
to indicate the secctx should only be parsed from an absolute root
POV. This allows catching errors where secctx are reparsed back into
internal labels.

Unfortunately because audit is using secid to secctx conversion this
means that subject and object labels can result in a very unfortunate
== that can break audit parsing.

eg. the subj==unconfined term in the below audit message

type=USER_LOGIN msg=audit(1639443365.233:160): pid=1633 uid=0 auid=1000
ses=3 subj==unconfined msg='op=login id=1000 exe="/usr/sbin/sshd"
hostname=192.168.122.1 addr=192.168.122.1 terminal=/dev/pts/1 res=success'

Fix this by switch the prepending of = to a _. This still works as a
special character to flag this case without breaking audit. Also move
this check behind debug as it should not be needed during normal
operqation.

Fixes: 26b78995 ("apparmor: add support for absolute root view based labels")
Reported-by: NCasey Schaufler <casey@schaufler-ca.com>
Signed-off-by: NJohn Johansen <john.johansen@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

a5a58bda

apparmor: fix quiet_denied for file rules · 81aba287

由 John Johansen 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit bca03f0bbc3be412d875221418504b14185fc9b1
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bca03f0bbc3be412d875221418504b14185fc9b1

--------------------------------

commit 68ff8540 upstream.

Global quieting of denied AppArmor generated file events is not
handled correctly. Unfortunately the is checking if quieting of all
audit events is set instead of just denied events.

Fixes: 67012e82 ("AppArmor: basic auditing infrastructure.")
Signed-off-by: NJohn Johansen <john.johansen@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

81aba287

can: ems_usb: fix clang's -Wunaligned-access warning · 951c7f49

由 Marc Kleine-Budde 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 2b74344135fc68c7bd833206f584f45eabf65e92
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2b74344135fc68c7bd833206f584f45eabf65e92

--------------------------------

commit a4cb6e62 upstream.

clang emits a -Wunaligned-access warning on struct __packed
ems_cpc_msg.

The reason is that the anonymous union msg (not declared as packed) is
being packed right after some non naturally aligned variables (3*8
bits + 2*32) inside a packed struct:

| struct __packed ems_cpc_msg {
| 	u8 type;	/* type of message */
| 	u8 length;	/* length of data within union 'msg' */
| 	u8 msgid;	/* confirmation handle */
| 	__le32 ts_sec;	/* timestamp in seconds */
| 	__le32 ts_nsec;	/* timestamp in nano seconds */
|	/* ^ not naturally aligned */
|
| 	union {
| 	/* ^ not declared as packed */
| 		u8 generic[64];
| 		struct cpc_can_msg can_msg;
| 		struct cpc_can_params can_params;
| 		struct cpc_confirm confirmation;
| 		struct cpc_overrun overrun;
| 		struct cpc_can_error error;
| 		struct cpc_can_err_counter err_counter;
| 		u8 can_state;
| 	} msg;
| };

Starting from LLVM 14, having an unpacked struct nested in a packed
struct triggers a warning. c.f. [1].

Fix the warning by marking the anonymous union as packed.

[1] https://github.com/llvm/llvm-project/issues/55520

Fixes: 702171ad ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
Link: https://lore.kernel.org/all/20220802094021.959858-1-mkl@pengutronix.de
Cc: Gerhard Uttenthaler <uttenthaler@ems-wuensche.com>
Cc: Sebastian Haas <haas@ems-wuensche.com>
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

951c7f49

ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II · b283ef10

由 Takashi Iwai 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 7f06c7821187653529dba3879a3a8128a3cc3604
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7f06c7821187653529dba3879a3a8128a3cc3604

--------------------------------

commit 6bc29062 upstream.

ASUS ROG Zenith II has two USB interfaces, one for the front headphone
and another for the rest I/O.  Currently we provided the mixer mapping
for the latter but with an incomplete form.

This patch corrects and provides more comprehensive mixer mapping, as
well as providing the proper device names for both the front headphone
and main audio.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211005
Fixes: 2a48218f ("ALSA: usb-audio: Add mixer workaround for TRX40 and co")
Link: https://lore.kernel.org/r/20220809073259.18849-1-tiwai@suse.deSigned-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

b283ef10

tracing: Have filter accept "common_cpu" to be consistent · b7e7e578

由 Steven Rostedt (Google) 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 5d3b02b80d9307b6e70977ce716a4219dd995668
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5d3b02b80d9307b6e70977ce716a4219dd995668

--------------------------------

commit b2380577 upstream.

Make filtering consistent with histograms. As "cpu" can be a field of an
event, allow for "common_cpu" to keep it from being confused with the
"cpu" field of the event.

Link: https://lkml.kernel.org/r/20220820134401.513062765@goodmis.org
Link: https://lore.kernel.org/all/20220820220920.e42fa32b70505b1904f0a0ad@kernel.org/

Cc: stable@vger.kernel.org
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tzvetomir Stoyanov <tz.stoyanov@gmail.com>
Cc: Tom Zanussi <zanussi@kernel.org>
Fixes: 1e3bac71 ("tracing/histogram: Rename "cpu" to "common_cpu"")
Suggested-by: NMasami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: NMasami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: NSteven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

b7e7e578

btrfs: fix lost error handling when looking up extended ref on log replay · dbbb81df

由 Filipe Manana 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 6359850f9d8f704e15906c833b4e7a21045dea4b
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6359850f9d8f704e15906c833b4e7a21045dea4b

--------------------------------

commit 7a6b75b7 upstream.

During log replay, when processing inode references, if we get an error
when looking up for an extended reference at __add_inode_ref(), we ignore
it and proceed, returning success (0) if no other error happens after the
lookup. This is obviously wrong because in case an extended reference
exists and it encodes some name not in the log, we need to unlink it,
otherwise the filesystem state will not match the state it had after the
last fsync.

So just make __add_inode_ref() return an error it gets from the extended
reference lookup.

Fixes: f186373f ("btrfs: extended inode refs")
CC: stable@vger.kernel.org # 4.9+
Signed-off-by: NFilipe Manana <fdmanana@suse.com>
Reviewed-by: NDavid Sterba <dsterba@suse.com>
Signed-off-by: NDavid Sterba <dsterba@suse.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

dbbb81df

mmc: meson-gx: Fix an error handling path in meson_mmc_probe() · 11ae350b

由 Christophe JAILLET 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 79895cefa4c6573a8f6f55d09e9bab267dd25449
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=79895cefa4c6573a8f6f55d09e9bab267dd25449

--------------------------------

commit b3e1cf31 upstream.

The commit in Fixes has introduced a new error handling which should goto
the existing error handling path.
Otherwise some resources leak.

Fixes: 19c6beaa ("mmc: meson-gx: add device reset")
Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/be4b863bacf323521ba3a02efdc4fca9cdedd1a6.1659855351.git.christophe.jaillet@wanadoo.frSigned-off-by: NUlf Hansson <ulf.hansson@linaro.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

11ae350b

mmc: pxamci: Fix an error handling path in pxamci_probe() · 0cddf6b0

由 Christophe JAILLET 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 13a497c3c598b2b63cad64cdb0082f2e67145987
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=13a497c3c598b2b63cad64cdb0082f2e67145987

--------------------------------

commit 98d7c5e5 upstream.

The commit in Fixes: has moved some code around without updating gotos to
the error handling path.

Update it now and release some resources if pxamci_of_init() fails.

Fixes: fa3a5115 ("mmc: pxamci: call mmc_of_parse()")
Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/6d75855ad4e2470e9ed99e0df21bc30f0c925a29.1658862932.git.christophe.jaillet@wanadoo.frSigned-off-by: NUlf Hansson <ulf.hansson@linaro.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

0cddf6b0

mmc: pxamci: Fix another error handling path in pxamci_probe() · 861c51fe

由 Christophe JAILLET 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 4a211dd4856ee00fc76370db7889415e16a7ae2a
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4a211dd4856ee00fc76370db7889415e16a7ae2a

--------------------------------

commit b886f54c upstream.

The commit in Fixes: has introduced an new error handling without branching
to the existing error handling path.

Update it now and release some resources if pxamci_init_ocr() fails.

Fixes: 61951fd6 ("mmc: pxamci: let mmc core handle regulators")
Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/07a2dcebf8ede69b484103de8f9df043f158cffd.1658862932.git.christophe.jaillet@wanadoo.frSigned-off-by: NUlf Hansson <ulf.hansson@linaro.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

861c51fe

ata: libata-eh: Add missing command name · 8e215819

由 Damien Le Moal 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit a785d8417812979b31e6c8e3263701ecdeca0770
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a785d8417812979b31e6c8e3263701ecdeca0770

--------------------------------

commit d3122bf9 upstream.

Add the missing command name for ATA_CMD_NCQ_NON_DATA to
ata_get_cmd_name().

Fixes: 661ce1f0 ("libata/libsas: Define ATA_CMD_NCQ_NON_DATA")
Cc: stable@vger.kernel.org
Signed-off-by: NDamien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: NHannes Reinecke <hare@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

8e215819

rds: add missing barrier to release_refill · af247939

由 Mikulas Patocka 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit fb1857c2e41a4b4d215b5e799016169a1356fc10
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fb1857c2e41a4b4d215b5e799016169a1356fc10

--------------------------------

commit 9f414eb4 upstream.

The functions clear_bit and set_bit do not imply a memory barrier, thus it
may be possible that the waitqueue_active function (which does not take
any locks) is moved before clear_bit and it could miss a wakeup event.

Fix this bug by adding a memory barrier after clear_bit.
Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

af247939

x86/mm: Use proper mask when setting PUD mapping · 286f7ed5

由 Aaron Lu 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit 6876b4804b041856a8a390b949983ae00d1fd5b8
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6876b4804b041856a8a390b949983ae00d1fd5b8

--------------------------------

commit 88e0a749 upstream.

Commit c164fbb4("x86/mm: thread pgprot_t through
init_memory_mapping()") mistakenly used __pgprot() which doesn't respect
__default_kernel_pte_mask when setting PUD mapping.

Fix it by only setting the one bit we actually need (PSE) and leaving
the other bits (that have been properly masked) alone.

Fixes: c164fbb4 ("x86/mm: thread pgprot_t through init_memory_mapping()")
Signed-off-by: NAaron Lu <aaron.lu@intel.com>
Cc: stable@kernel.org
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

286f7ed5

ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU · cfb9b6c9

由 Christoffer Sandberg 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit b68e40b52f179f27912c4f35598f9c9b2e93a40c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b68e40b52f179f27912c4f35598f9c9b2e93a40c

--------------------------------

commit 90d74fdb upstream.

Fixes headset microphone detection on Clevo NS50PU and NS70PU.
Signed-off-by: NChristoffer Sandberg <cs@tuxedo.de>
Signed-off-by: NWerner Sembach <wse@tuxedocomputers.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220817135144.34103-1-wse@tuxedocomputers.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

cfb9b6c9

ALSA: info: Fix llseek return value when using callback · 22d44689

由 Amadeusz Sławiński 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.138
commit e14e2fec35d3a1a3e8f8e6ee81ba2be4b6530c30
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I60QFD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e14e2fec35d3a1a3e8f8e6ee81ba2be4b6530c30

--------------------------------

commit 9be080ed upstream.

When using callback there was a flow of

	ret = -EINVAL
	if (callback) {
		offset = callback();
		goto out;
	}
	...
	offset = some other value in case of no callback;
	ret = offset;
out:
	return ret;

which causes the snd_info_entry_llseek() to return -EINVAL when there is
callback handler. Fix this by setting "ret" directly to callback return
value before jumping to "out".

Fixes: 73029e0f ("ALSA: info - Implement common llseek for binary mode")
Signed-off-by: NAmadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220817124924.3974577-1-amadeuszx.slawinski@linux.intel.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>

22d44689

!260 svm: Delete unused ioctl command · 591381a5

由 openeuler-ci-bot 提交于 11月 21, 2022

Merge Pull Request from: @zhangjian210 
 
This patch delete unused function of SVM:

Now, the SVM_IOCTL_SET_RC,SVM_IOCTL_REMAP_PROC function has not been used by others, 
and SVM_IOCTL_REMAP_PROC interface has withdrawal of rights action, so we must delete
it's function.

Delete interface:
SVM_IOCTL_REMAP_PROC
SVM_IOCTL_SET_RC 
 
Link:https://gitee.com/openeuler/kernel/pulls/260 
Reviewed-by: Zheng Zengkai <zhengzengkai@huawei.com> 
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>

591381a5

svm: Delete unused ioctl command · 7cc20317

由 Wang Wensheng 提交于 11月 18, 2022

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I61RA3

-------------------------------

The following three ioctl command are not in used at all. Delete those
implementation.

SVM_IOCTL_SET_RC
SVM_IOCTL_REMAP_PROC
Signed-off-by: NWang Wensheng <wangwensheng4@huawei.com>

7cc20317

openeuler / Kernel 1 年多 前同步成功

openeuler / Kernel
1 年多前同步成功