Skip to content
  1. Oct 29, 2021
    • Linus Torvalds's avatar
      Merge tag 'linux-watchdog-5.15-rc7' of git://www.linux-watchdog.org/linux-watchdog · eecd231a
      Linus Torvalds authored
      Pull watchdog fixes from Wim Van Sebroeck:
       "I overlooked Guenters request to sent this upstream earlier, so it's a
        bit late in the release cycle.
      
        This contains:
      
         - Revert "watchdog: iTCO_wdt: Account for rebooting on second
           timeout"
      
         - sbsa: only use 32-bit accessors
      
         - sbsa: drop unneeded MODULE_ALIAS
      
         - ixp4xx_wdt: Fix address space warning
      
         - Fix OMAP watchdog early handling"
      
      * tag 'linux-watchdog-5.15-rc7' of git://www.linux-watchdog.org/linux-watchdog:
        watchdog: Fix OMAP watchdog early handling
        watchdog: ixp4xx_wdt: Fix address space warning
        watchdog: sbsa: drop unneeded MODULE_ALIAS
        watchdog: sbsa: only use 32-bit accessors
        Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout"
      eecd231a
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.15-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · fc18cc89
      Linus Torvalds authored
      Pull tracing fix from Steven Rostedt:
       "Do not WARN when attaching event probe to non-existent event
      
        If the user tries to attach an event probe (eprobe) to an event that
        does not exist, it will trigger a warning. There's an error check that
        only expects memory issues otherwise it is considered a bug. But
        changes in the code to move around the locking made it that it can
        error out if the user attempts to attach to an event that does not
        exist, returning an -ENODEV. As this path can be caused by user space
        putting in a bad value, do not trigger a WARN"
      
      * tag 'trace-v5.15-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Do not warn when connecting eprobe to non existing event
      fc18cc89
  2. Oct 28, 2021
  3. Oct 27, 2021
  4. Oct 26, 2021
  5. Oct 25, 2021
    • Mark Zhang's avatar
      RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string · 64733956
      Mark Zhang authored
      When copying the device name, the length of the data memcpy copied exceeds
      the length of the source buffer, which cause the KASAN issue below.  Use
      strscpy_pad() instead.
      
       BUG: KASAN: slab-out-of-bounds in ib_nl_set_path_rec_attrs+0x136/0x320 [ib_core]
       Read of size 64 at addr ffff88811a10f5e0 by task rping/140263
       CPU: 3 PID: 140263 Comm: rping Not tainted 5.15.0-rc1+ #1
       Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
       Call Trace:
        dump_stack_lvl+0x57/0x7d
        print_address_description.constprop.0+0x1d/0xa0
        kasan_report+0xcb/0x110
        kasan_check_range+0x13d/0x180
        memcpy+0x20/0x60
        ib_nl_set_path_rec_attrs+0x136/0x320 [ib_core]
        ib_nl_make_request+0x1c6/0x380 [ib_core]
        send_mad+0x20a/0x220 [ib_core]
        ib_sa_path_rec_get+0x3e3/0x800 [ib_core]
        cma_query_ib_route+0x29b/0x390 [rdma_cm]
        rdma_resolve_route+0x308/0x3e0 [rdma_cm]
        ucma_resolve_route+0xe1/0x150 [rdma_ucm]
        ucma_write+0x17b/0x1f0 [rdma_ucm]
        vfs_write+0x142/0x4d0
        ksys_write+0x133/0x160
        do_syscall_64+0x43/0x90
        entry_SYSCALL_64_after_hwframe+0x44/0xae
       RIP: 0033:0x7f26499aa90f
       Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c fd ff ff 48
       RSP: 002b:00007f26495f2dc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
       RAX: ffffffffffffffda RBX: 00000000000007d0 RCX: 00007f26499aa90f
       RDX: 0000000000000010 RSI: 00007f26495f2e00 RDI: 0000000000000003
       RBP: 00005632a8315440 R08: 0000000000000000 R09: 0000000000000001
       R10: 0000000000000000 R11: 0000000000000293 R12: 00007f26495f2e00
       R13: 00005632a83154e0 R14: 00005632a8315440 R15: 00005632a830a810
      
       Allocated by task 131419:
        kasan_save_stack+0x1b/0x40
        __kasan_kmalloc+0x7c/0x90
        proc_self_get_link+0x8b/0x100
        pick_link+0x4f1/0x5c0
        step_into+0x2eb/0x3d0
        walk_component+0xc8/0x2c0
        link_path_walk+0x3b8/0x580
        path_openat+0x101/0x230
        do_filp_open+0x12e/0x240
        do_sys_openat2+0x115/0x280
        __x64_sys_openat+0xce/0x140
        do_syscall_64+0x43/0x90
        entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Fixes: 2ca546b9 ("IB/sa: Route SA pathrecord query through netlink")
      Link: https://lore.kernel.org/r/72ede0f6dab61f7f23df9ac7a70666e07ef314b0.1635055496.git.leonro@nvidia.com
      
      
      Signed-off-by: default avatarMark Zhang <markzhang@nvidia.com>
      Reviewed-by: default avatarMark Bloch <mbloch@nvidia.com>
      Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
      64733956
    • LABBE Corentin's avatar
      ARM: 9148/1: handle CONFIG_CPU_ENDIAN_BE32 in arch/arm/kernel/head.S · 00568b8a
      LABBE Corentin authored
      
      
      My intel-ixp42x-welltech-epbx100 no longer boot since 4.14.
      This is due to commit 463dbba4 ("ARM: 9104/2: Fix Keystone 2 kernel
      mapping regression")
      which forgot to handle CONFIG_CPU_ENDIAN_BE32 as possible BE config.
      
      Suggested-by: default avatarKrzysztof Hałasa <khalasa@piap.pl>
      Fixes: 463dbba4 ("ARM: 9104/2: Fix Keystone 2 kernel mapping regression")
      Signed-off-by: default avatarCorentin Labbe <clabbe.montjoie@gmail.com>
      Signed-off-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
      00568b8a
    • Zheyu Ma's avatar
      ata: sata_mv: Fix the error handling of mv_chip_id() · a0023bb9
      Zheyu Ma authored
      
      
      mv_init_host() propagates the value returned by mv_chip_id() which in turn
      gets propagated by mv_pci_init_one() and hits local_pci_probe().
      
      During the process of driver probing, the probe function should return < 0
      for failure, otherwise, the kernel will treat value > 0 as success.
      
      Since this is a bug rather than a recoverable runtime error we should
      use dev_alert() instead of dev_err().
      
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@opensource.wdc.com>
      a0023bb9
    • Linus Torvalds's avatar
      Revert "mm/secretmem: use refcount_t instead of atomic_t" · 87066fdd
      Linus Torvalds authored
      
      
      This reverts commit 11086054.
      
      Converting the "secretmem_users" counter to a refcount is incorrect,
      because a refcount is special in zero and can't just be incremented (but
      a count of users is not, and "no users" is actually perfectly valid and
      not a sign of a free'd resource).
      
      Reported-by: default avatar <syzbot+75639e6a0331cd61d3e2@syzkaller.appspotmail.com>
      Cc: Jordy Zomer <jordy@pwning.systems>
      Cc: Kees Cook <keescook@chromium.org>,
      Cc: Jordy Zomer <jordy@jordyzomer.github.io>
      Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
      Cc: Mike Rapoport <rppt@kernel.org>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      87066fdd
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · b20078fd
      Linus Torvalds authored
      Pull autofs fix from Al Viro:
       "Fix for a braino of mine (in getting rid of open-coded
        dentry_path_raw() in autofs a couple of cycles ago).
      
        Mea culpa...  Obvious -stable fodder"
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        autofs: fix wait name hash calculation in autofs_wait()
      b20078fd
    • Linus Torvalds's avatar
      Merge tag 'sched_urgent_for_v5.15_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 6c62666d
      Linus Torvalds authored
      Pull scheduler fix from Borislav Petkov:
       "Reset clang's Shadow Call Stack on hotplug to prevent it from
        overflowing"
      
      * tag 'sched_urgent_for_v5.15_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/scs: Reset the shadow stack when idle_task_exit
      6c62666d
    • Linus Torvalds's avatar
      Merge tag 'x86_urgent_for_v5.15_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 16bc1776
      Linus Torvalds authored
      Pull x86 fix from Borislav Petkov:
       "A single change adding Dave Hansen to our maintainers team"
      
      * tag 'x86_urgent_for_v5.15_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        MAINTAINERS: Add Dave Hansen to the x86 maintainer team
      16bc1776
    • Linus Torvalds's avatar
      Merge tag '5.15-rc6-ksmbd-fixes' of git://git.samba.org/ksmbd · c460e789
      Linus Torvalds authored
      Pull ksmbd fixes from Steve French:
       "Ten fixes for the ksmbd kernel server, for improved security and
        additional buffer overflow checks:
      
         - a security improvement to session establishment to reduce the
           possibility of dictionary attacks
      
         - fix to ensure that maximum i/o size negotiated in the protocol is
           not less than 64K and not more than 8MB to better match expected
           behavior
      
         - fix for crediting (flow control) important to properly verify that
           sufficient credits are available for the requested operation
      
         - seven additional buffer overflow, buffer validation checks"
      
      * tag '5.15-rc6-ksmbd-fixes' of git://git.samba.org/ksmbd:
        ksmbd: add buffer validation in session setup
        ksmbd: throttle session setup failures to avoid dictionary attacks
        ksmbd: validate OutputBufferLength of QUERY_DIR, QUERY_INFO, IOCTL requests
        ksmbd: validate credit charge after validating SMB2 PDU body size
        ksmbd: add buffer validation for smb direct
        ksmbd: limit read/write/trans buffer size not to exceed 8MB
        ksmbd: validate compound response buffer
        ksmbd: fix potencial 32bit overflow from data area check in smb2_write
        ksmbd: improve credits management
        ksmbd: add validation in smb2_ioctl
      c460e789
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 0f386a60
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Ten fixes, seven of which are in drivers.
      
        The core fixes are one to fix a potential crash on resume, one to sort
        out our reference count releases to avoid releasing in-use modules and
        one to adjust the cmd per lun calculation to avoid an overflow in
        hyper-v"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: ufs: ufs-pci: Force a full restore after suspend-to-disk
        scsi: qla2xxx: Fix unmap of already freed sgl
        scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()
        scsi: qla2xxx: Return -ENOMEM if kzalloc() fails
        scsi: sd: Fix crashes in sd_resume_runtime()
        scsi: mpi3mr: Fix duplicate device entries when scanning through sysfs
        scsi: core: Put LLD module refcnt after SCSI device is released
        scsi: storvsc: Fix validation for unsolicited incoming packets
        scsi: iscsi: Fix set_param() handling
        scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
      0f386a60
  6. Oct 23, 2021