1. 29 May, 2021 9 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 22447828
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "ARM fixes:
      
         - Another state update on exit to userspace fix
      
         - Prevent the creation of mixed 32/64 VMs
      
         - Fix regression with irqbypass not restarting the guest on failed
           connect
      
         - Fix regression with debug register decoding resulting in
           overlapping access
      
         - Commit exception state on exit to usrspace
      
         - Fix the MMU notifier return values
      
         - Add missing 'static' qualifiers in the new host stage-2 code
      
        x86 fixes:
      
         - fix guest missed wakeup with assigned devices
      
         - fix WARN reported by syzkaller
      
         - do not use BIT() in UAPI headers
      
         - make the kvm_amd.avic parameter bool
      
        PPC fixes:
      
         - make halt polling heuristics consistent with other architectures
      
        selftests:
      
         - various fixes
      
         - new performance selftest memslot_perf_test
      
         - test UFFD minor faults in demand_paging_test"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (44 commits)
        selftests: kvm: fix overlapping addresses in memslot_perf_test
        KVM: X86: Kill off ctxt->ud
        KVM: X86: Fix warning caused by stale emulation context
        KVM: X86: Use kvm_get_linear_rip() in single-step and #DB/#BP interception
        KVM: x86/mmu: Fix comment mentioning skip_4k
        KVM: VMX: update vcpu posted-interrupt descriptor when assigning device
        KVM: rename KVM_REQ_PENDING_TIMER to KVM_REQ_UNBLOCK
        KVM: x86: add start_assignment hook to kvm_x86_ops
        KVM: LAPIC: Narrow the timer latency between wait_lapic_expire and world switch
        selftests: kvm: do only 1 memslot_perf_test run by default
        KVM: X86: Use _BITUL() macro in UAPI headers
        KVM: selftests: add shared hugetlbfs backing source type
        KVM: selftests: allow using UFFD minor faults for demand paging
        KVM: selftests: create alias mappings when using shared memory
        KVM: selftests: add shmem backing source type
        KVM: selftests: refactor vm_mem_backing_src_type flags
        KVM: selftests: allow different backing source types
        KVM: selftests: compute correct demand paging size
        KVM: selftests: simplify setup_demand_paging error handling
        KVM: selftests: Print a message if /dev/kvm is missing
        ...
      22447828
    • Linus Torvalds's avatar
      Merge tag 's390-5.13-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 866c4b8a
      Linus Torvalds authored
      Pull s390 fixes from Vasily Gorbik:
       "Fix races in vfio-ccw request handling"
      
      * tag 's390-5.13-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        vfio-ccw: Serialize FSM IDLE state with I/O completion
        vfio-ccw: Reset FSM state to IDLE inside FSM
        vfio-ccw: Check initialized flag in cp_init()
      866c4b8a
    • Paolo Bonzini's avatar
      selftests: kvm: fix overlapping addresses in memslot_perf_test · 000ac429
      Paolo Bonzini authored
      
      
      vm_create allocates memory and maps it close to GPA.  This memory
      is separate from what is allocated in subsequent calls to
      vm_userspace_mem_region_add, so it is incorrect to pass the
      test memory size to vm_create_default.  Just pass a small
      fixed amount of memory which can be used later for page table,
      otherwise GPAs are already allocated at MEM_GPA and the
      test aborts.
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      000ac429
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 6799d4f2
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Ten small fixes, all in drivers"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
        scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq
        scsi: vmw_pvscsi: Set correct residual data length
        scsi: bnx2fc: Return failure if io_req is already in ABTS processing
        scsi: aic7xxx: Remove multiple definition of globals
        scsi: aic7xxx: Restore several defines for aic7xxx firmware build
        scsi: target: iblock: Fix smp_processor_id() BUG messages
        scsi: libsas: Use _safe() loop in sas_resume_port()
        scsi: target: tcmu: Fix xarray RCU warning
        scsi: target: core: Avoid smp_processor_id() in preemptible code
      6799d4f2
    • Linus Torvalds's avatar
      Merge tag 'block-5.13-2021-05-28' of git://git.kernel.dk/linux-block · 0217a27e
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - NVMe pull request (Christoph):
            - fix a memory leak in nvme_cdev_add (Guoqing Jiang)
            - fix inline data size comparison in nvmet_tcp_queue_response (Hou
              Pu)
            - fix false keep-alive timeout when a controller is torn down
              (Sagi Grimberg)
            - fix a nvme-tcp Kconfig dependency (Sagi Grimberg)
            - short-circuit reconnect retries for FC (Hannes Reinecke)
            - decode host pathing error for connect (Hannes Reinecke)
      
       - MD pull request (Song):
            - Fix incorrect chunk boundary assert (Christoph)
      
       - Fix s390/dasd verification panic (Stefan)
      
      * tag 'block-5.13-2021-05-28' of git://git.kernel.dk/linux-block:
        nvmet: fix false keep-alive timeout when a controller is torn down
        nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
        nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME
        md/raid5: remove an incorrect assert in in_chunk_boundary
        s390/dasd: add missing discipline function
        nvme-fabrics: decode host pathing error for connect
        nvme-fc: short-circuit reconnect retries
        nvme: fix potential memory leaks in nvme_cdev_add
      0217a27e
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.13-2021-05-28' of git://git.kernel.dk/linux-block · b3dbbae6
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "A few minor fixes:
      
         - Fix an issue with hashed wait removal on exit (Zqiang, Pavel)
      
         - Fix a recent data race introduced in this series (Marco)"
      
      * tag 'io_uring-5.13-2021-05-28' of git://git.kernel.dk/linux-block:
        io_uring: fix data race to avoid potential NULL-deref
        io-wq: Fix UAF when wakeup wqe in hash waitqueue
        io_uring/io-wq: close io-wq full-stop gap
      b3dbbae6
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2021-05-29' of git://anongit.freedesktop.org/drm/drm · 567d1fd8
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Pretty quiet this week, couple of amdgpu, one i915, and a few misc otherwise.
      
        ttm:
         - prevent irrelevant swapout
      
        amdgpu:
         - MultiGPU fan fix
         - VCN powergating fixes
      
        amdkfd:
         - Fix SDMA register offset error
      
        meson:
         - fix shutdown crash
      
        i915:
         - Re-enable LTTPR non-transparent LT mode for DPCD_REV < 1.4"
      
      * tag 'drm-fixes-2021-05-29' of git://anongit.freedesktop.org/drm/drm:
        drm/ttm: Skip swapout if ttm object is not populated
        drm/i915: Reenable LTTPR non-transparent LT mode for DPCD_REV<1.4
        drm/meson: fix shutdown crash when component not probed
        drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate
        drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate
        drm/amdgpu/jpeg2.0: add cancel_delayed_work_sync before power gate
        drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate
        drm/amdgpu/vcn2.5: add cancel_delayed_work_sync before power gate
        drm/amdgpu/vcn2.0: add cancel_delayed_work_sync before power gate
        drm/amdgpu/vcn1: add cancel_delayed_work_sync before power gate
        drm/amdkfd: correct sienna_cichlid SDMA RLC register offset error
        drm/amd/pm: correct MGpuFanBoost setting
      567d1fd8
    • Linus Torvalds's avatar
      Merge tag 'perf-tools-fixes-for-v5.13-2021-05-28' of... · f289d990
      Linus Torvalds authored
      Merge tag 'perf-tools-fixes-for-v5.13-2021-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux
      
      Pull perf tools fixes from Arnaldo Carvalho de Melo:
      
       - Fix error checking of BPF prog attachment in 'perf stat'.
      
       - Fix getting maximum number of fds in the vendor events JSON parser.
      
       - Move debug initialization earlier, fixing a segfault in some cases.
      
       - Fix eventcode of power10 JSON events.
      
      * tag 'perf-tools-fixes-for-v5.13-2021-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
        perf vendor events powerpc: Fix eventcode of power10 JSON events
        perf stat: Fix error check for bpf_program__attach
        perf debug: Move debug initialization earlier
        perf jevents: Fix getting maximum number of fds
      f289d990
    • Linus Torvalds's avatar
      Merge tag '5.13-rc4-smb3' of git://git.samba.org/sfrench/cifs-2.6 · 7c0ec89d
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "Three SMB3 fixes.
      
        Two for stable, and the other fixes a problem pointed out with a
        recently added ioctl"
      
      * tag '5.13-rc4-smb3' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: change format of CIFS_FULL_KEY_DUMP ioctl
        cifs: fix string declarations and assignments in tracepoints
        cifs: set server->cipher_type to AES-128-CCM for SMB3.0
      7c0ec89d
  2. 28 May, 2021 12 commits
  3. 27 May, 2021 19 commits
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.13-2021-05-26' of... · ac6e9e3d
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.13-2021-05-26' of https://gitlab.freedesktop.org/agd5f/linux
      
       into drm-fixes
      
      amd-drm-fixes-5.13-2021-05-26:
      
      amdgpu:
      - MultiGPU fan fix
      - VCN powergating fixes
      
      amdkfd:
      - Fix SDMA register offset error
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20210527031831.4057-1-alexander.deucher@amd.com
      ac6e9e3d
    • Linus Torvalds's avatar
      Merge branch 'for-5.13-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu · 97e5bf60
      Linus Torvalds authored
      Pull percpu fixes from Dennis Zhou:
       "This contains a cleanup to lib/percpu-refcount.c and an update to the
        MAINTAINERS file to more formally take over support for lib/percpu*"
      
      * 'for-5.13-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu:
        MAINTAINERS: Add lib/percpu* as part of percpu entry
        percpu_ref: Don't opencode percpu_ref_is_dying
      97e5bf60
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 3c856a31
      Linus Torvalds authored
      Pull arm64 fixes from Catalin Marinas:
      
       - Don't use contiguous or block mappings for the linear map when KFENCE
         is enabled.
      
       - Fix link in the arch_counter_enforce_ordering() comment.
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: mm: don't use CON and BLK mapping if KFENCE is enabled
        arm64: Fix stale link in the arch_counter_enforce_ordering() comment
      3c856a31
    • Linus Torvalds's avatar
      Merge tag 'for-5.13/dm-fixes-2' of... · 38747c9a
      Linus Torvalds authored
      Merge tag 'for-5.13/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - Fix DM verity target's 'require_signatures' module_param permissions.
      
       - Revert DM snapshot fix from v5.13-rc3 and then properly fix crash
         when an origin has no snapshots. This allows only the proper fix to
         go to stable@ (since the original fix was successfully dropped).
      
      * tag 'for-5.13/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm snapshot: properly fix a crash when an origin has no snapshots
        dm snapshot: revert "fix a crash when an origin has no snapshots"
        dm verity: fix require_signatures module_param permissions
      38747c9a
    • Aurelien Aptel's avatar
      cifs: change format of CIFS_FULL_KEY_DUMP ioctl · 1bb56810
      Aurelien Aptel authored
      
      
      Make CIFS_FULL_KEY_DUMP ioctl able to return variable-length keys.
      
      * userspace needs to pass the struct size along with optional
        session_id and some space at the end to store keys
      * if there is enough space kernel returns keys in the extra space and
        sets the length of each key via xyz_key_length fields
      
      This also fixes the build error for get_user() on ARM.
      
      Sample program:
      
      	#include <stdlib.h>
      	#include <stdio.h>
      	#include <stdint.h>
      	#include <sys/fcntl.h>
      	#include <sys/ioctl.h>
      
      	struct smb3_full_key_debug_info {
      	        uint32_t   in_size;
      	        uint64_t   session_id;
      	        uint16_t   cipher_type;
      	        uint8_t    session_key_length;
      	        uint8_t    server_in_key_length;
      	        uint8_t    server_out_key_length;
      	        uint8_t    data[];
      	        /*
      	         * return this struct with the keys appended at the end:
      	         * uint8_t session_key[session_key_length];
      	         * uint8_t server_in_key[server_in_key_length];
      	         * uint8_t server_out_key[server_out_key_length];
      	         */
      	} __attribute__((packed));
      
      	#define CIFS_IOCTL_MAGIC 0xCF
      	#define CIFS_DUMP_FULL_KEY _IOWR(CIFS_IOCTL_MAGIC, 10, struct smb3_full_key_debug_info)
      
      	void dump(const void *p, size_t len) {
      	        const char *hex = "0123456789ABCDEF";
      	        const uint8_t *b = p;
      	        for (int i = 0; i < len; i++)
      	                printf("%c%c ", hex[(b[i]>>4)&0xf], hex[b[i]&0xf]);
      	        putchar('\n');
      	}
      
      	int main(int argc, char **argv)
      	{
      	        struct smb3_full_key_debug_info *keys;
      	        uint8_t buf[sizeof(*keys)+1024] = {0};
      	        size_t off = 0;
      	        int fd, rc;
      
      	        keys = (struct smb3_full_key_debug_info *)&buf;
      	        keys->in_size = sizeof(buf);
      
      	        fd = open(argv[1], O_RDONLY);
      	        if (fd < 0)
      	                perror("open"), exit(1);
      
      	        rc = ioctl(fd, CIFS_DUMP_FULL_KEY, keys);
      	        if (rc < 0)
      	                perror("ioctl"), exit(1);
      
      	        printf("SessionId      ");
      	        dump(&keys->session_id, 8);
      	        printf("Cipher         %04x\n", keys->cipher_type);
      
      	        printf("SessionKey     ");
      	        dump(keys->data+off, keys->session_key_length);
      	        off += keys->session_key_length;
      
      	        printf("ServerIn Key   ");
      	        dump(keys->data+off, keys->server_in_key_length);
      	        off += keys->server_in_key_length;
      
      	        printf("ServerOut Key  ");
      	        dump(keys->data+off, keys->server_out_key_length);
      
      	        return 0;
      	}
      
      Usage:
      
      	$ gcc -o dumpkeys dumpkeys.c
      
      Against Windows Server 2020 preview (with AES-256-GCM support):
      
      	# mount.cifs //$ip/test /mnt -o "username=administrator,password=foo,vers=3.0,seal"
      	# ./dumpkeys /mnt/somefile
      	SessionId      0D 00 00 00 00 0C 00 00
      	Cipher         0002
      	SessionKey     AB CD CC 0D E4 15 05 0C 6F 3C 92 90 19 F3 0D 25
      	ServerIn Key   73 C6 6A C8 6B 08 CF A2 CB 8E A5 7D 10 D1 5B DC
      	ServerOut Key  6D 7E 2B A1 71 9D D7 2B 94 7B BA C4 F0 A5 A4 F8
      	# umount /mnt
      
      	With 256 bit keys:
      
      	# echo 1 > /sys/module/cifs/parameters/require_gcm_256
      	# mount.cifs //$ip/test /mnt -o "username=administrator,password=foo,vers=3.11,seal"
      	# ./dumpkeys /mnt/somefile
      	SessionId      09 00 00 00 00 0C 00 00
      	Cipher         0004
      	SessionKey     93 F5 82 3B 2F B7 2A 50 0B B9 BA 26 FB 8C 8B 03
      	ServerIn Key   6C 6A 89 B2 CB 7B 78 E8 04 93 37 DA 22 53 47 DF B3 2C 5F 02 26 70 43 DB 8D 33 7B DC 66 D3 75 A9
      	ServerOut Key  04 11 AA D7 52 C7 A8 0F ED E3 93 3A 65 FE 03 AD 3F 63 03 01 2B C0 1B D7 D7 E5 52 19 7F CC 46 B4
      Signed-off-by: default avatarAurelien Aptel <aaptel@suse.com>
      Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      1bb56810
    • Shyam Prasad N's avatar
      cifs: fix string declarations and assignments in tracepoints · eb068818
      Shyam Prasad N authored
      
      
      We missed using the variable length string macros in several
      tracepoints. Fixed them in this change.
      
      There's probably more useful macros that we can use to print
      others like flags etc. But I'll submit sepawrate patches for
      those at a future date.
      Signed-off-by: default avatarShyam Prasad N <sprasad@microsoft.com>
      Cc: <stable@vger.kernel.org> # v5.12
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      eb068818
    • Aurelien Aptel's avatar
      cifs: set server->cipher_type to AES-128-CCM for SMB3.0 · 6d2fcfe6
      Aurelien Aptel authored
      
      
      SMB3.0 doesn't have encryption negotiate context but simply uses
      the SMB2_GLOBAL_CAP_ENCRYPTION flag.
      
      When that flag is present in the neg response cifs.ko uses AES-128-CCM
      which is the only cipher available in this context.
      
      cipher_type was set to the server cipher only when parsing encryption
      negotiate context (SMB3.1.1).
      
      For SMB3.0 it was set to 0. This means cipher_type value can be 0 or 1
      for AES-128-CCM.
      
      Fix this by checking for SMB3.0 and encryption capability and setting
      cipher_type appropriately.
      Signed-off-by: default avatarAurelien Aptel <aaptel@suse.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      6d2fcfe6
    • Linus Torvalds's avatar
      Merge tag 'acpi-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 3224374f
      Linus Torvalds authored
      Pull ACPI fix from Rafael Wysocki:
       "Fix a recent ACPI power management regression causing boot issues to
        occur on some systems due to attempts to turn off ACPI power resources
        that are already off (which should work according to the ACPI
        specification)"
      
      * tag 'acpi-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: power: Refine turning off unused power resources
      3224374f
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v5.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 96c132f8
      Linus Torvalds authored
      Pull iommu fixes from Joerg Roedel:
      
       - Important fix for the AMD IOMMU driver in the recently added
         page-specific invalidation code to fix a calculation.
      
       - Fix a NULL-ptr dereference in the AMD IOMMU driver when a device
         switches domain types.
      
       - Fixes for the Intel VT-d driver to check for allocation failure and
         do correct cleanup.
      
       - Another fix for Intel VT-d to not allow supervisor page requests from
         devices when using second level page translation.
      
       - Add a MODULE_DEVICE_TABLE to the VIRTIO IOMMU driver
      
      * tag 'iommu-fixes-v5.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu/vt-d: Fix sysfs leak in alloc_iommu()
        iommu/vt-d: Use user privilege for RID2PASID translation
        iommu/vt-d: Check for allocation failure in aux_detach_device()
        iommu/virtio: Add missing MODULE_DEVICE_TABLE
        iommu/amd: Fix wrong parentheses on page-specific invalidations
        iommu/amd: Clear DMA ops when switching domain
      96c132f8
    • Ian Rogers's avatar
      perf debug: Move debug initialization earlier · c59870e2
      Ian Rogers authored
      This avoids segfaults during option handlers that use pr_err. For
      example, "perf --debug nopager list" segfaults before this change.
      
      Fixes: 8abceacf
      
       (perf debug: Add debug_set_file function)
      Signed-off-by: default avatarIan Rogers <irogers@google.com>
      Tested-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Link: http://lore.kernel.org/lkml/20210519164447.2672030-1-irogers@google.com
      
      Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      c59870e2
    • David Howells's avatar
      afs: Fix the nlink handling of dir-over-dir rename · f610a5a2
      David Howells authored
      Fix rename of one directory over another such that the nlink on the deleted
      directory is cleared to 0 rather than being decremented to 1.
      
      This was causing the generic/035 xfstest to fail.
      
      Fixes: e49c7b2f
      
       ("afs: Build an abstraction around an "operation" concept")
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: default avatarMarc Dionne <marc.dionne@auristor.com>
      cc: linux-afs@lists.infradead.org
      Link: https://lore.kernel.org/r/162194384460.3999479.7605572278074191079.stgit@warthog.procyon.org.uk/
      
       # v1
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f610a5a2
    • Rolf Eike Beer's avatar
      iommu/vt-d: Fix sysfs leak in alloc_iommu() · 0ee74d5a
      Rolf Eike Beer authored
      iommu_device_sysfs_add() is called before, so is has to be cleaned on subsequent
      errors.
      
      Fixes: 39ab9555
      
       ("iommu: Add sysfs bindings for struct iommu_device")
      Cc: stable@vger.kernel.org # 4.11.x
      Signed-off-by: default avatarRolf Eike Beer <eb@emlix.com>
      Acked-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
      Link: https://lore.kernel.org/r/17411490.HIIP88n32C@mobilepool36.emlix.com
      Link: https://lore.kernel.org/r/20210525070802.361755-2-baolu.lu@linux.intel.com
      
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      0ee74d5a
    • Marco Elver's avatar
      io_uring: fix data race to avoid potential NULL-deref · b16ef427
      Marco Elver authored
      Commit ba5ef6dc ("io_uring: fortify tctx/io_wq cleanup") introduced
      setting tctx->io_wq to NULL a bit earlier. This has caused KCSAN to
      detect a data race between accesses to tctx->io_wq:
      
        write to 0xffff88811d8df330 of 8 bytes by task 3709 on cpu 1:
         io_uring_clean_tctx                  fs/io_uring.c:9042 [inline]
         __io_uring_cancel                    fs/io_uring.c:9136
         io_uring_files_cancel                include/linux/io_uring.h:16 [inline]
         do_exit                              kernel/exit.c:781
         do_group_exit                        kernel/exit.c:923
         get_signal                           kernel/signal.c:2835
         arch_do_signal_or_restart            arch/x86/kernel/signal.c:789
         handle_signal_work                   kernel/entry/common.c:147 [inline]
         exit_to_user_mode_loop               kernel/entry/common.c:171 [inline]
         ...
        read to 0xffff88811d8df330 of 8 bytes by task 6412 on cpu 0:
         io_uring_try_cancel_iowq             fs/io_uring.c:8911 [inline]
         io_uring_try_cancel_requests         fs/io_uring.c:8933
         io_ring_exit_work                    fs/io_uring.c:8736
         process_one_work                     kernel/workqueue.c:2276
         ...
      
      With the config used, KCSAN only reports data races with value changes:
      this implies that in the case here we also know that tctx->io_wq was
      non-NULL. Therefore, depending on interleaving, we may end up with:
      
                    [CPU 0]                 |        [CPU 1]
        io_uring_try_cancel_iowq()          | io_uring_clean_tctx()
          if (!tctx->io_wq) // false        |   ...
          ...                               |   tctx->io_wq = NULL
          io_wq_cancel_cb(tctx->io_wq, ...) |   ...
            -> NULL-deref                   |
      
      Note: It is likely that thus far we've gotten lucky and the compiler
      optimizes the double-read into a single read into a register -- but this
      is never guaranteed, and can easily change with a different config!
      
      Fix the data race by restoring the previous behaviour, where both
      setting io_wq to NULL and put of the wq are _serialized_ after
      concurrent io_uring_try_cancel_iowq() via acquisition of the uring_lock
      and removal of the node in io_uring_del_task_file().
      
      Fixes: ba5ef6dc
      
       ("io_uring: fortify tctx/io_wq cleanup")
      Suggested-by: default avatarPavel Begunkov <asml.silence@gmail.com>
      Reported-by: syzbot+bf2b3d0435b9b728946c@syzkaller.appspotmail.com
      Signed-off-by: default avatarMarco Elver <elver@google.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Link: https://lore.kernel.org/r/20210527092547.2656514-1-elver@google.com
      
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      b16ef427
    • Jens Axboe's avatar
      Merge tag 'nvme-5.13-2021-05-27' of git://git.infradead.org/nvme into block-5.13 · a4b58f17
      Jens Axboe authored
      Pull NVMe fixes from Christoph:
      
      "nvme fixes for Linux 5.13
      
       - fix a memory leak in nvme_cdev_add (Guoqing Jiang)
       - fix inline data size comparison in nvmet_tcp_queue_response (Hou Pu)
       - fix false keep-alive timeout when a controller is torn down
         (Sagi Grimberg)
       - fix a nvme-tcp Kconfig dependency (Sagi Grimberg)
       - short-circuit reconnect retries for FC (Hannes Reinecke)
       - decode host pathing error for connect (Hannes Reinecke)"
      
      * tag 'nvme-5.13-2021-05-27' of git://git.infradead.org/nvme:
        nvmet: fix false keep-alive timeout when a controller is torn down
        nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
        nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME
        nvme-fabrics: decode host pathing error for connect
        nvme-fc: short-circuit reconnect retries
        nvme: fix potential memory leaks in nvme_cdev_add
      a4b58f17
    • Huilong Deng's avatar
      nfs: Remove trailing semicolon in macros · a799b68a
      Huilong Deng authored
      
      
      Macros should not use a trailing semicolon.
      Signed-off-by: default avatarHuilong Deng <denghuilong@cdjrlc.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
      a799b68a
    • David Matlack's avatar
      KVM: x86/mmu: Fix comment mentioning skip_4k · bedd9195
      David Matlack authored
      
      
      This comment was left over from a previous version of the patch that
      introduced wrprot_gfn_range, when skip_4k was passed in instead of
      min_level.
      Signed-off-by: default avatarDavid Matlack <dmatlack@google.com>
      Message-Id: <20210526163227.3113557-1-dmatlack@google.com>
      Reviewed-by: default avatarSean Christopherson <seanjc@google.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      bedd9195
    • Chuck Lever's avatar
      xprtrdma: Revert 586a0787 · ae605ee9
      Chuck Lever authored
      Commit 9ed5af26 ("SUNRPC: Clean up the handling of page padding
      in rpc_prepare_reply_pages()") [Dec 2020] affects RPC Replies that
      have a data payload (i.e., Write chunks).
      
      rpcrdma_prepare_readch(), as its name suggests, sets up Read chunks
      which are data payloads within RPC Calls. Those payloads are
      constructed by xdr_write_pages(), which continues to stuff the call
      buffer's tail kvec with the payload's XDR roundup. Thus removing
      the tail buffer logic in rpcrdma_prepare_readch() was the wrong
      thing to do.
      
      Fixes: 586a0787
      
       ("xprtrdma: Clean up rpcrdma_prepare_readch()")
      Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
      ae605ee9
    • Zhang Xiaoxu's avatar
      NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config · e67afa7e
      Zhang Xiaoxu authored
      Since commit bdcc2cd1 ("NFSv4.2: handle NFS-specific llseek errors"),
      nfs42_proc_llseek would return -EOPNOTSUPP rather than -ENOTSUPP when
      SEEK_DATA on NFSv4.0/v4.1.
      
      This will lead xfstests generic/285 not run on NFSv4.0/v4.1 when set the
      CONFIG_NFS_V4_2, rather than run failed.
      
      Fixes: bdcc2cd1
      
       ("NFSv4.2: handle NFS-specific llseek errors")
      Cc: <stable.vger.kernel.org> # 4.2
      Signed-off-by: default avatarZhang Xiaoxu <zhangxiaoxu5@huawei.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
      e67afa7e
    • Marcelo Tosatti's avatar
      KVM: VMX: update vcpu posted-interrupt descriptor when assigning device · a2486020
      Marcelo Tosatti authored
      
      
      For VMX, when a vcpu enters HLT emulation, pi_post_block will:
      
      1) Add vcpu to per-cpu list of blocked vcpus.
      
      2) Program the posted-interrupt descriptor "notification vector"
      to POSTED_INTR_WAKEUP_VECTOR
      
      With interrupt remapping, an interrupt will set the PIR bit for the
      vector programmed for the device on the CPU, test-and-set the
      ON bit on the posted interrupt descriptor, and if the ON bit is clear
      generate an interrupt for the notification vector.
      
      This way, the target CPU wakes upon a device interrupt and wakes up
      the target vcpu.
      
      Problem is that pi_post_block only programs the notification vector
      if kvm_arch_has_assigned_device() is true. Its possible for the
      following to happen:
      
      1) vcpu V HLTs on pcpu P, kvm_arch_has_assigned_device is false,
      notification vector is not programmed
      2) device is assigned to VM
      3) device interrupts vcpu V, sets ON bit
      (notification vector not programmed, so pcpu P remains in idle)
      4) vcpu 0 IPIs vcpu V (in guest), but since pi descriptor ON bit is set,
      kvm_vcpu_kick is skipped
      5) vcpu 0 busy spins on vcpu V's response for several seconds, until
      RCU watchdog NMIs all vCPUs.
      
      To fix this, use the start_assignment kvm_x86_ops callback to kick
      vcpus out of the halt loop, so the notification vector is
      properly reprogrammed to the wakeup vector.
      Reported-by: default avatarPei Zhang <pezhang@redhat.com>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      Message-Id: <20210526172014.GA29007@fuller.cnet>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      a2486020