1. 29 May, 2021 6 commits
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 6799d4f2
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Ten small fixes, all in drivers"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
        scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq
        scsi: vmw_pvscsi: Set correct residual data length
        scsi: bnx2fc: Return failure if io_req is already in ABTS processing
        scsi: aic7xxx: Remove multiple definition of globals
        scsi: aic7xxx: Restore several defines for aic7xxx firmware build
        scsi: target: iblock: Fix smp_processor_id() BUG messages
        scsi: libsas: Use _safe() loop in sas_resume_port()
        scsi: target: tcmu: Fix xarray RCU warning
        scsi: target: core: Avoid smp_processor_id() in preemptible code
      6799d4f2
    • Linus Torvalds's avatar
      Merge tag 'block-5.13-2021-05-28' of git://git.kernel.dk/linux-block · 0217a27e
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - NVMe pull request (Christoph):
            - fix a memory leak in nvme_cdev_add (Guoqing Jiang)
            - fix inline data size comparison in nvmet_tcp_queue_response (Hou
              Pu)
            - fix false keep-alive timeout when a controller is torn down
              (Sagi Grimberg)
            - fix a nvme-tcp Kconfig dependency (Sagi Grimberg)
            - short-circuit reconnect retries for FC (Hannes Reinecke)
            - decode host pathing error for connect (Hannes Reinecke)
      
       - MD pull request (Song):
            - Fix incorrect chunk boundary assert (Christoph)
      
       - Fix s390/dasd verification panic (Stefan)
      
      * tag 'block-5.13-2021-05-28' of git://git.kernel.dk/linux-block:
        nvmet: fix false keep-alive timeout when a controller is torn down
        nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
        nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME
        md/raid5: remove an incorrect assert in in_chunk_boundary
        s390/dasd: add missing discipline function
        nvme-fabrics: decode host pathing error for connect
        nvme-fc: short-circuit reconnect retries
        nvme: fix potential memory leaks in nvme_cdev_add
      0217a27e
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.13-2021-05-28' of git://git.kernel.dk/linux-block · b3dbbae6
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "A few minor fixes:
      
         - Fix an issue with hashed wait removal on exit (Zqiang, Pavel)
      
         - Fix a recent data race introduced in this series (Marco)"
      
      * tag 'io_uring-5.13-2021-05-28' of git://git.kernel.dk/linux-block:
        io_uring: fix data race to avoid potential NULL-deref
        io-wq: Fix UAF when wakeup wqe in hash waitqueue
        io_uring/io-wq: close io-wq full-stop gap
      b3dbbae6
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2021-05-29' of git://anongit.freedesktop.org/drm/drm · 567d1fd8
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Pretty quiet this week, couple of amdgpu, one i915, and a few misc otherwise.
      
        ttm:
         - prevent irrelevant swapout
      
        amdgpu:
         - MultiGPU fan fix
         - VCN powergating fixes
      
        amdkfd:
         - Fix SDMA register offset error
      
        meson:
         - fix shutdown crash
      
        i915:
         - Re-enable LTTPR non-transparent LT mode for DPCD_REV < 1.4"
      
      * tag 'drm-fixes-2021-05-29' of git://anongit.freedesktop.org/drm/drm:
        drm/ttm: Skip swapout if ttm object is not populated
        drm/i915: Reenable LTTPR non-transparent LT mode for DPCD_REV<1.4
        drm/meson: fix shutdown crash when component not probed
        drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate
        drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate
        drm/amdgpu/jpeg2.0: add cancel_delayed_work_sync before power gate
        drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate
        drm/amdgpu/vcn2.5: add cancel_delayed_work_sync before power gate
        drm/amdgpu/vcn2.0: add cancel_delayed_work_sync before power gate
        drm/amdgpu/vcn1: add cancel_delayed_work_sync before power gate
        drm/amdkfd: correct sienna_cichlid SDMA RLC register offset error
        drm/amd/pm: correct MGpuFanBoost setting
      567d1fd8
    • Linus Torvalds's avatar
      Merge tag 'perf-tools-fixes-for-v5.13-2021-05-28' of... · f289d990
      Linus Torvalds authored
      Merge tag 'perf-tools-fixes-for-v5.13-2021-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux
      
      Pull perf tools fixes from Arnaldo Carvalho de Melo:
      
       - Fix error checking of BPF prog attachment in 'perf stat'.
      
       - Fix getting maximum number of fds in the vendor events JSON parser.
      
       - Move debug initialization earlier, fixing a segfault in some cases.
      
       - Fix eventcode of power10 JSON events.
      
      * tag 'perf-tools-fixes-for-v5.13-2021-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
        perf vendor events powerpc: Fix eventcode of power10 JSON events
        perf stat: Fix error check for bpf_program__attach
        perf debug: Move debug initialization earlier
        perf jevents: Fix getting maximum number of fds
      f289d990
    • Linus Torvalds's avatar
      Merge tag '5.13-rc4-smb3' of git://git.samba.org/sfrench/cifs-2.6 · 7c0ec89d
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "Three SMB3 fixes.
      
        Two for stable, and the other fixes a problem pointed out with a
        recently added ioctl"
      
      * tag '5.13-rc4-smb3' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: change format of CIFS_FULL_KEY_DUMP ioctl
        cifs: fix string declarations and assignments in tracepoints
        cifs: set server->cipher_type to AES-128-CCM for SMB3.0
      7c0ec89d
  2. 28 May, 2021 8 commits
  3. 27 May, 2021 22 commits
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.13-2021-05-26' of... · ac6e9e3d
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.13-2021-05-26' of https://gitlab.freedesktop.org/agd5f/linux
      
       into drm-fixes
      
      amd-drm-fixes-5.13-2021-05-26:
      
      amdgpu:
      - MultiGPU fan fix
      - VCN powergating fixes
      
      amdkfd:
      - Fix SDMA register offset error
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20210527031831.4057-1-alexander.deucher@amd.com
      ac6e9e3d
    • Linus Torvalds's avatar
      Merge branch 'for-5.13-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu · 97e5bf60
      Linus Torvalds authored
      Pull percpu fixes from Dennis Zhou:
       "This contains a cleanup to lib/percpu-refcount.c and an update to the
        MAINTAINERS file to more formally take over support for lib/percpu*"
      
      * 'for-5.13-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu:
        MAINTAINERS: Add lib/percpu* as part of percpu entry
        percpu_ref: Don't opencode percpu_ref_is_dying
      97e5bf60
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 3c856a31
      Linus Torvalds authored
      Pull arm64 fixes from Catalin Marinas:
      
       - Don't use contiguous or block mappings for the linear map when KFENCE
         is enabled.
      
       - Fix link in the arch_counter_enforce_ordering() comment.
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: mm: don't use CON and BLK mapping if KFENCE is enabled
        arm64: Fix stale link in the arch_counter_enforce_ordering() comment
      3c856a31
    • Linus Torvalds's avatar
      Merge tag 'for-5.13/dm-fixes-2' of... · 38747c9a
      Linus Torvalds authored
      Merge tag 'for-5.13/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - Fix DM verity target's 'require_signatures' module_param permissions.
      
       - Revert DM snapshot fix from v5.13-rc3 and then properly fix crash
         when an origin has no snapshots. This allows only the proper fix to
         go to stable@ (since the original fix was successfully dropped).
      
      * tag 'for-5.13/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm snapshot: properly fix a crash when an origin has no snapshots
        dm snapshot: revert "fix a crash when an origin has no snapshots"
        dm verity: fix require_signatures module_param permissions
      38747c9a
    • Aurelien Aptel's avatar
      cifs: change format of CIFS_FULL_KEY_DUMP ioctl · 1bb56810
      Aurelien Aptel authored
      
      
      Make CIFS_FULL_KEY_DUMP ioctl able to return variable-length keys.
      
      * userspace needs to pass the struct size along with optional
        session_id and some space at the end to store keys
      * if there is enough space kernel returns keys in the extra space and
        sets the length of each key via xyz_key_length fields
      
      This also fixes the build error for get_user() on ARM.
      
      Sample program:
      
      	#include <stdlib.h>
      	#include <stdio.h>
      	#include <stdint.h>
      	#include <sys/fcntl.h>
      	#include <sys/ioctl.h>
      
      	struct smb3_full_key_debug_info {
      	        uint32_t   in_size;
      	        uint64_t   session_id;
      	        uint16_t   cipher_type;
      	        uint8_t    session_key_length;
      	        uint8_t    server_in_key_length;
      	        uint8_t    server_out_key_length;
      	        uint8_t    data[];
      	        /*
      	         * return this struct with the keys appended at the end:
      	         * uint8_t session_key[session_key_length];
      	         * uint8_t server_in_key[server_in_key_length];
      	         * uint8_t server_out_key[server_out_key_length];
      	         */
      	} __attribute__((packed));
      
      	#define CIFS_IOCTL_MAGIC 0xCF
      	#define CIFS_DUMP_FULL_KEY _IOWR(CIFS_IOCTL_MAGIC, 10, struct smb3_full_key_debug_info)
      
      	void dump(const void *p, size_t len) {
      	        const char *hex = "0123456789ABCDEF";
      	        const uint8_t *b = p;
      	        for (int i = 0; i < len; i++)
      	                printf("%c%c ", hex[(b[i]>>4)&0xf], hex[b[i]&0xf]);
      	        putchar('\n');
      	}
      
      	int main(int argc, char **argv)
      	{
      	        struct smb3_full_key_debug_info *keys;
      	        uint8_t buf[sizeof(*keys)+1024] = {0};
      	        size_t off = 0;
      	        int fd, rc;
      
      	        keys = (struct smb3_full_key_debug_info *)&buf;
      	        keys->in_size = sizeof(buf);
      
      	        fd = open(argv[1], O_RDONLY);
      	        if (fd < 0)
      	                perror("open"), exit(1);
      
      	        rc = ioctl(fd, CIFS_DUMP_FULL_KEY, keys);
      	        if (rc < 0)
      	                perror("ioctl"), exit(1);
      
      	        printf("SessionId      ");
      	        dump(&keys->session_id, 8);
      	        printf("Cipher         %04x\n", keys->cipher_type);
      
      	        printf("SessionKey     ");
      	        dump(keys->data+off, keys->session_key_length);
      	        off += keys->session_key_length;
      
      	        printf("ServerIn Key   ");
      	        dump(keys->data+off, keys->server_in_key_length);
      	        off += keys->server_in_key_length;
      
      	        printf("ServerOut Key  ");
      	        dump(keys->data+off, keys->server_out_key_length);
      
      	        return 0;
      	}
      
      Usage:
      
      	$ gcc -o dumpkeys dumpkeys.c
      
      Against Windows Server 2020 preview (with AES-256-GCM support):
      
      	# mount.cifs //$ip/test /mnt -o "username=administrator,password=foo,vers=3.0,seal"
      	# ./dumpkeys /mnt/somefile
      	SessionId      0D 00 00 00 00 0C 00 00
      	Cipher         0002
      	SessionKey     AB CD CC 0D E4 15 05 0C 6F 3C 92 90 19 F3 0D 25
      	ServerIn Key   73 C6 6A C8 6B 08 CF A2 CB 8E A5 7D 10 D1 5B DC
      	ServerOut Key  6D 7E 2B A1 71 9D D7 2B 94 7B BA C4 F0 A5 A4 F8
      	# umount /mnt
      
      	With 256 bit keys:
      
      	# echo 1 > /sys/module/cifs/parameters/require_gcm_256
      	# mount.cifs //$ip/test /mnt -o "username=administrator,password=foo,vers=3.11,seal"
      	# ./dumpkeys /mnt/somefile
      	SessionId      09 00 00 00 00 0C 00 00
      	Cipher         0004
      	SessionKey     93 F5 82 3B 2F B7 2A 50 0B B9 BA 26 FB 8C 8B 03
      	ServerIn Key   6C 6A 89 B2 CB 7B 78 E8 04 93 37 DA 22 53 47 DF B3 2C 5F 02 26 70 43 DB 8D 33 7B DC 66 D3 75 A9
      	ServerOut Key  04 11 AA D7 52 C7 A8 0F ED E3 93 3A 65 FE 03 AD 3F 63 03 01 2B C0 1B D7 D7 E5 52 19 7F CC 46 B4
      Signed-off-by: default avatarAurelien Aptel <aaptel@suse.com>
      Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      1bb56810
    • Shyam Prasad N's avatar
      cifs: fix string declarations and assignments in tracepoints · eb068818
      Shyam Prasad N authored
      
      
      We missed using the variable length string macros in several
      tracepoints. Fixed them in this change.
      
      There's probably more useful macros that we can use to print
      others like flags etc. But I'll submit sepawrate patches for
      those at a future date.
      Signed-off-by: default avatarShyam Prasad N <sprasad@microsoft.com>
      Cc: <stable@vger.kernel.org> # v5.12
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      eb068818
    • Aurelien Aptel's avatar
      cifs: set server->cipher_type to AES-128-CCM for SMB3.0 · 6d2fcfe6
      Aurelien Aptel authored
      
      
      SMB3.0 doesn't have encryption negotiate context but simply uses
      the SMB2_GLOBAL_CAP_ENCRYPTION flag.
      
      When that flag is present in the neg response cifs.ko uses AES-128-CCM
      which is the only cipher available in this context.
      
      cipher_type was set to the server cipher only when parsing encryption
      negotiate context (SMB3.1.1).
      
      For SMB3.0 it was set to 0. This means cipher_type value can be 0 or 1
      for AES-128-CCM.
      
      Fix this by checking for SMB3.0 and encryption capability and setting
      cipher_type appropriately.
      Signed-off-by: default avatarAurelien Aptel <aaptel@suse.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      6d2fcfe6
    • Linus Torvalds's avatar
      Merge tag 'acpi-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 3224374f
      Linus Torvalds authored
      Pull ACPI fix from Rafael Wysocki:
       "Fix a recent ACPI power management regression causing boot issues to
        occur on some systems due to attempts to turn off ACPI power resources
        that are already off (which should work according to the ACPI
        specification)"
      
      * tag 'acpi-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: power: Refine turning off unused power resources
      3224374f
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v5.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 96c132f8
      Linus Torvalds authored
      Pull iommu fixes from Joerg Roedel:
      
       - Important fix for the AMD IOMMU driver in the recently added
         page-specific invalidation code to fix a calculation.
      
       - Fix a NULL-ptr dereference in the AMD IOMMU driver when a device
         switches domain types.
      
       - Fixes for the Intel VT-d driver to check for allocation failure and
         do correct cleanup.
      
       - Another fix for Intel VT-d to not allow supervisor page requests from
         devices when using second level page translation.
      
       - Add a MODULE_DEVICE_TABLE to the VIRTIO IOMMU driver
      
      * tag 'iommu-fixes-v5.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu/vt-d: Fix sysfs leak in alloc_iommu()
        iommu/vt-d: Use user privilege for RID2PASID translation
        iommu/vt-d: Check for allocation failure in aux_detach_device()
        iommu/virtio: Add missing MODULE_DEVICE_TABLE
        iommu/amd: Fix wrong parentheses on page-specific invalidations
        iommu/amd: Clear DMA ops when switching domain
      96c132f8
    • Ian Rogers's avatar
      perf debug: Move debug initialization earlier · c59870e2
      Ian Rogers authored
      This avoids segfaults during option handlers that use pr_err. For
      example, "perf --debug nopager list" segfaults before this change.
      
      Fixes: 8abceacf
      
       (perf debug: Add debug_set_file function)
      Signed-off-by: default avatarIan Rogers <irogers@google.com>
      Tested-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Link: http://lore.kernel.org/lkml/20210519164447.2672030-1-irogers@google.com
      
      Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      c59870e2
    • David Howells's avatar
      afs: Fix the nlink handling of dir-over-dir rename · f610a5a2
      David Howells authored
      Fix rename of one directory over another such that the nlink on the deleted
      directory is cleared to 0 rather than being decremented to 1.
      
      This was causing the generic/035 xfstest to fail.
      
      Fixes: e49c7b2f
      
       ("afs: Build an abstraction around an "operation" concept")
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: default avatarMarc Dionne <marc.dionne@auristor.com>
      cc: linux-afs@lists.infradead.org
      Link: https://lore.kernel.org/r/162194384460.3999479.7605572278074191079.stgit@warthog.procyon.org.uk/
      
       # v1
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f610a5a2
    • Rolf Eike Beer's avatar
      iommu/vt-d: Fix sysfs leak in alloc_iommu() · 0ee74d5a
      Rolf Eike Beer authored
      iommu_device_sysfs_add() is called before, so is has to be cleaned on subsequent
      errors.
      
      Fixes: 39ab9555
      
       ("iommu: Add sysfs bindings for struct iommu_device")
      Cc: stable@vger.kernel.org # 4.11.x
      Signed-off-by: default avatarRolf Eike Beer <eb@emlix.com>
      Acked-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
      Link: https://lore.kernel.org/r/17411490.HIIP88n32C@mobilepool36.emlix.com
      Link: https://lore.kernel.org/r/20210525070802.361755-2-baolu.lu@linux.intel.com
      
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      0ee74d5a
    • Marco Elver's avatar
      io_uring: fix data race to avoid potential NULL-deref · b16ef427
      Marco Elver authored
      Commit ba5ef6dc ("io_uring: fortify tctx/io_wq cleanup") introduced
      setting tctx->io_wq to NULL a bit earlier. This has caused KCSAN to
      detect a data race between accesses to tctx->io_wq:
      
        write to 0xffff88811d8df330 of 8 bytes by task 3709 on cpu 1:
         io_uring_clean_tctx                  fs/io_uring.c:9042 [inline]
         __io_uring_cancel                    fs/io_uring.c:9136
         io_uring_files_cancel                include/linux/io_uring.h:16 [inline]
         do_exit                              kernel/exit.c:781
         do_group_exit                        kernel/exit.c:923
         get_signal                           kernel/signal.c:2835
         arch_do_signal_or_restart            arch/x86/kernel/signal.c:789
         handle_signal_work                   kernel/entry/common.c:147 [inline]
         exit_to_user_mode_loop               kernel/entry/common.c:171 [inline]
         ...
        read to 0xffff88811d8df330 of 8 bytes by task 6412 on cpu 0:
         io_uring_try_cancel_iowq             fs/io_uring.c:8911 [inline]
         io_uring_try_cancel_requests         fs/io_uring.c:8933
         io_ring_exit_work                    fs/io_uring.c:8736
         process_one_work                     kernel/workqueue.c:2276
         ...
      
      With the config used, KCSAN only reports data races with value changes:
      this implies that in the case here we also know that tctx->io_wq was
      non-NULL. Therefore, depending on interleaving, we may end up with:
      
                    [CPU 0]                 |        [CPU 1]
        io_uring_try_cancel_iowq()          | io_uring_clean_tctx()
          if (!tctx->io_wq) // false        |   ...
          ...                               |   tctx->io_wq = NULL
          io_wq_cancel_cb(tctx->io_wq, ...) |   ...
            -> NULL-deref                   |
      
      Note: It is likely that thus far we've gotten lucky and the compiler
      optimizes the double-read into a single read into a register -- but this
      is never guaranteed, and can easily change with a different config!
      
      Fix the data race by restoring the previous behaviour, where both
      setting io_wq to NULL and put of the wq are _serialized_ after
      concurrent io_uring_try_cancel_iowq() via acquisition of the uring_lock
      and removal of the node in io_uring_del_task_file().
      
      Fixes: ba5ef6dc
      
       ("io_uring: fortify tctx/io_wq cleanup")
      Suggested-by: default avatarPavel Begunkov <asml.silence@gmail.com>
      Reported-by: syzbot+bf2b3d0435b9b728946c@syzkaller.appspotmail.com
      Signed-off-by: default avatarMarco Elver <elver@google.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Link: https://lore.kernel.org/r/20210527092547.2656514-1-elver@google.com
      
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      b16ef427
    • Jens Axboe's avatar
      Merge tag 'nvme-5.13-2021-05-27' of git://git.infradead.org/nvme into block-5.13 · a4b58f17
      Jens Axboe authored
      Pull NVMe fixes from Christoph:
      
      "nvme fixes for Linux 5.13
      
       - fix a memory leak in nvme_cdev_add (Guoqing Jiang)
       - fix inline data size comparison in nvmet_tcp_queue_response (Hou Pu)
       - fix false keep-alive timeout when a controller is torn down
         (Sagi Grimberg)
       - fix a nvme-tcp Kconfig dependency (Sagi Grimberg)
       - short-circuit reconnect retries for FC (Hannes Reinecke)
       - decode host pathing error for connect (Hannes Reinecke)"
      
      * tag 'nvme-5.13-2021-05-27' of git://git.infradead.org/nvme:
        nvmet: fix false keep-alive timeout when a controller is torn down
        nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
        nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME
        nvme-fabrics: decode host pathing error for connect
        nvme-fc: short-circuit reconnect retries
        nvme: fix potential memory leaks in nvme_cdev_add
      a4b58f17
    • Huilong Deng's avatar
      nfs: Remove trailing semicolon in macros · a799b68a
      Huilong Deng authored
      
      
      Macros should not use a trailing semicolon.
      Signed-off-by: default avatarHuilong Deng <denghuilong@cdjrlc.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
      a799b68a
    • Chuck Lever's avatar
      xprtrdma: Revert 586a0787 · ae605ee9
      Chuck Lever authored
      Commit 9ed5af26 ("SUNRPC: Clean up the handling of page padding
      in rpc_prepare_reply_pages()") [Dec 2020] affects RPC Replies that
      have a data payload (i.e., Write chunks).
      
      rpcrdma_prepare_readch(), as its name suggests, sets up Read chunks
      which are data payloads within RPC Calls. Those payloads are
      constructed by xdr_write_pages(), which continues to stuff the call
      buffer's tail kvec with the payload's XDR roundup. Thus removing
      the tail buffer logic in rpcrdma_prepare_readch() was the wrong
      thing to do.
      
      Fixes: 586a0787
      
       ("xprtrdma: Clean up rpcrdma_prepare_readch()")
      Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
      ae605ee9
    • Zhang Xiaoxu's avatar
      NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config · e67afa7e
      Zhang Xiaoxu authored
      Since commit bdcc2cd1 ("NFSv4.2: handle NFS-specific llseek errors"),
      nfs42_proc_llseek would return -EOPNOTSUPP rather than -ENOTSUPP when
      SEEK_DATA on NFSv4.0/v4.1.
      
      This will lead xfstests generic/285 not run on NFSv4.0/v4.1 when set the
      CONFIG_NFS_V4_2, rather than run failed.
      
      Fixes: bdcc2cd1
      
       ("NFSv4.2: handle NFS-specific llseek errors")
      Cc: <stable.vger.kernel.org> # 4.2
      Signed-off-by: default avatarZhang Xiaoxu <zhangxiaoxu5@huawei.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
      e67afa7e
    • Jeremy Szu's avatar
      ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 17 G8 · 50dbfae9
      Jeremy Szu authored
      
      
      The HP ZBook Studio 17.3 Inch G8 is using ALC285 codec which is
      using 0x04 to control mute LED and 0x01 to control micmute LED.
      In the other hand, there is no output from right channel of speaker.
      Therefore, add a quirk to make it works.
      Signed-off-by: default avatarJeremy Szu <jeremy.szu@canonical.com>
      Cc: <stable@vger.kernel.org>
      Link: https://lore.kernel.org/r/20210519170357.58410-4-jeremy.szu@canonical.com
      
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      50dbfae9
    • Jeremy Szu's avatar
      ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 15 G8 · e650c1a9
      Jeremy Szu authored
      
      
      The HP ZBook Fury 15.6 Inch G8 is using ALC285 codec which is
      using 0x04 to control mute LED and 0x01 to control micmute LED.
      In the other hand, there is no output from right channel of speaker.
      Therefore, add a quirk to make it works.
      Signed-off-by: default avatarJeremy Szu <jeremy.szu@canonical.com>
      Cc: <stable@vger.kernel.org>
      Link: https://lore.kernel.org/r/20210519170357.58410-3-jeremy.szu@canonical.com
      
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      e650c1a9
    • Jeremy Szu's avatar
      ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook G8 · bbe183e0
      Jeremy Szu authored
      
      
      The HP ZBook Studio 15.6 Inch G8 is using ALC285 codec which is
      using 0x04 to control mute LED and 0x01 to control micmute LED.
      In the other hand, there is no output from right channel of speaker.
      Therefore, add a quirk to make it works.
      Signed-off-by: default avatarJeremy Szu <jeremy.szu@canonical.com>
      Cc: <stable@vger.kernel.org>
      Link: https://lore.kernel.org/r/20210519170357.58410-2-jeremy.szu@canonical.com
      
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      bbe183e0
    • Jeremy Szu's avatar
      ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8 · 0e68c4b1
      Jeremy Szu authored
      
      
      The HP EliteBook 855 G8 Notebook PC is using ALC285 codec which needs
      ALC285_FIXUP_HP_MUTE_LED fixup to make it works. After applying the
      fixup, the mute/micmute LEDs work good.
      Signed-off-by: default avatarJeremy Szu <jeremy.szu@canonical.com>
      Cc: <stable@vger.kernel.org>
      Link: https://lore.kernel.org/r/20210519170357.58410-1-jeremy.szu@canonical.com
      
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      0e68c4b1
    • Linus Torvalds's avatar
      Merge tag 'net-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · d7c5303f
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Networking fixes for 5.13-rc4, including fixes from bpf, netfilter,
        can and wireless trees. Notably including fixes for the recently
        announced "FragAttacks" WiFi vulnerabilities. Rather large batch,
        touching some core parts of the stack, too, but nothing hair-raising.
      
        Current release - regressions:
      
         - tipc: make node link identity publish thread safe
      
         - dsa: felix: re-enable TAS guard band mode
      
         - stmmac: correct clocks enabled in stmmac_vlan_rx_kill_vid()
      
         - stmmac: fix system hang if change mac address after interface
           ifdown
      
        Current release - new code bugs:
      
         - mptcp: avoid OOB access in setsockopt()
      
         - bpf: Fix nested bpf_bprintf_prepare with more per-cpu buffers
      
         - ethtool: stats: fix a copy-paste error - init correct array size
      
        Previous releases - regressions:
      
         - sched: fix packet stuck problem for lockless qdisc
      
         - net: really orphan skbs tied to closing sk
      
         - mlx4: fix EEPROM dump support
      
         - bpf: fix alu32 const subreg bound tracking on bitwise operations
      
         - bpf: fix mask direction swap upon off reg sign change
      
         - bpf, offload: reorder offload callback 'prepare' in verifier
      
         - stmmac: Fix MAC WoL not working if PHY does not support WoL
      
         - packetmmap: fix only tx timestamp on request
      
         - tipc: skb_linearize the head skb when reassembling msgs
      
        Previous releases - always broken:
      
         - mac80211: address recent "FragAttacks" vulnerabilities
      
         - mac80211: do not accept/forward invalid EAPOL frames
      
         - mptcp: avoid potential error message floods
      
         - bpf, ringbuf: deny reserve of buffers larger than ringbuf to
           prevent out of buffer writes
      
         - bpf: forbid trampoline attach for functions with variable arguments
      
         - bpf: add deny list of functions to prevent inf recursion of tracing
           programs
      
         - tls splice: check SPLICE_F_NONBLOCK instead of MSG_DONTWAIT
      
         - can: isotp: prevent race between isotp_bind() and
           isotp_setsockopt()
      
         - netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check,
           fallback to non-AVX2 version
      
        Misc:
      
         - bpf: add kconfig knob for disabling unpriv bpf by default"
      
      * tag 'net-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (172 commits)
        net: phy: Document phydev::dev_flags bits allocation
        mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
        mptcp: avoid error message on infinite mapping
        mptcp: drop unconditional pr_warn on bad opt
        mptcp: avoid OOB access in setsockopt()
        nfp: update maintainer and mailing list addresses
        net: mvpp2: add buffer header handling in RX
        bnx2x: Fix missing error code in bnx2x_iov_init_one()
        net: zero-initialize tc skb extension on allocation
        net: hns: Fix kernel-doc
        sctp: fix the proc_handler for sysctl encap_port
        sctp: add the missing setting for asoc encap_port
        bpf, selftests: Adjust few selftest result_unpriv outcomes
        bpf: No need to simulate speculative domain for immediates
        bpf: Fix mask direction swap upon off reg sign change
        bpf: Wrap aux data inside bpf_sanitize_info container
        bpf: Fix BPF_LSM kconfig symbol dependency
        selftests/bpf: Add test for l3 use of bpf_redirect_peer
        bpftool: Add sock_release help info for cgroup attach/prog load command
        net: dsa: microchip: enable phy errata workaround on 9567
        ...
      d7c5303f
  4. 26 May, 2021 4 commits
    • Florian Fainelli's avatar
      net: phy: Document phydev::dev_flags bits allocation · 62f3415d
      Florian Fainelli authored
      
      
      Document the phydev::dev_flags bit allocation to allow bits 15:0 to
      define PHY driver specific behavior, bits 23:16 to be reserved for now,
      and bits 31:24 to hold generic PHY driver flags.
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
      Link: https://lore.kernel.org/r/20210526184617.3105012-1-f.fainelli@gmail.com
      
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      62f3415d
    • Linus Torvalds's avatar
      Merge tag 'mtd/fixes-for-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux · 7ac3a1c1
      Linus Torvalds authored
      Pull MTD fixes from Miquel Raynal:
       "MTD parsers:
         - Fix ofpart subpartitions parsing
      
        Raw NAND:
         - Fix external use of SW Hamming ECC helper (txx9ndfmc, tmio,
           sharpsl, ndfc, lpc32xx_slc, fsmc, cs553x)"
      
      * tag 'mtd/fixes-for-5.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
        mtd: parsers: ofpart: fix parsing subpartitions
        mtd: rawnand: txx9ndfmc: Fix external use of SW Hamming ECC helper
        mtd: rawnand: tmio: Fix external use of SW Hamming ECC helper
        mtd: rawnand: sharpsl: Fix external use of SW Hamming ECC helper
        mtd: rawnand: ndfc: Fix external use of SW Hamming ECC helper
        mtd: rawnand: lpc32xx_slc: Fix external use of SW Hamming ECC helper
        mtd: rawnand: fsmc: Fix external use of SW Hamming ECC helper
        mtd: rawnand: cs553x: Fix external use of SW Hamming ECC helper
      7ac3a1c1
    • Zqiang's avatar
      io-wq: Fix UAF when wakeup wqe in hash waitqueue · 3743c172
      Zqiang authored
      
      
      BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650
      Read of size 8 at addr ffff8880304250d8 by task iou-wrk-28796/28802
      
      Call Trace:
       __dump_stack [inline]
       dump_stack+0x141/0x1d7
       print_address_description.constprop.0.cold+0x5b/0x2c6
       __kasan_report [inline]
       kasan_report.cold+0x7c/0xd8
       __wake_up_common+0x637/0x650
       __wake_up_common_lock+0xd0/0x130
       io_worker_handle_work+0x9dd/0x1790
       io_wqe_worker+0xb2a/0xd40
       ret_from_fork+0x1f/0x30
      
      Allocated by task 28798:
       kzalloc_node [inline]
       io_wq_create+0x3c4/0xdd0
       io_init_wq_offload [inline]
       io_uring_alloc_task_context+0x1bf/0x6b0
       __io_uring_add_task_file+0x29a/0x3c0
       io_uring_add_task_file [inline]
       io_uring_install_fd [inline]
       io_uring_create [inline]
       io_uring_setup+0x209a/0x2bd0
       do_syscall_64+0x3a/0xb0
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Freed by task 28798:
       kfree+0x106/0x2c0
       io_wq_destroy+0x182/0x380
       io_wq_put [inline]
       io_wq_put_and_exit+0x7a/0xa0
       io_uring_clean_tctx [inline]
       __io_uring_cancel+0x428/0x530
       io_uring_files_cancel
       do_exit+0x299/0x2a60
       do_group_exit+0x125/0x310
       get_signal+0x47f/0x2150
       arch_do_signal_or_restart+0x2a8/0x1eb0
       handle_signal_work[inline]
       exit_to_user_mode_loop [inline]
       exit_to_user_mode_prepare+0x171/0x280
       __syscall_exit_to_user_mode_work [inline]
       syscall_exit_to_user_mode+0x19/0x60
       do_syscall_64+0x47/0xb0
       entry_SYSCALL_64_after_hwframe
      
      There are the following scenarios, hash waitqueue is shared by
      io-wq1 and io-wq2. (note: wqe is worker)
      
      io-wq1:worker2     | locks bit1
      io-wq2:worker1     | waits bit1
      io-wq1:worker3     | waits bit1
      
      io-wq1:worker2     | completes all wqe bit1 work items
      io-wq1:worker2     | drop bit1, exit
      
      io-wq2:worker1     | locks bit1
      io-wq1:worker3     | can not locks bit1, waits bit1 and exit
      io-wq1             | exit and free io-wq1
      io-wq2:worker1     | drops bit1
      io-wq1:worker3     | be waked up, even though wqe is freed
      
      After all iou-wrk belonging to io-wq1 have exited, remove wqe
      form hash waitqueue, it is guaranteed that there will be no more
      wqe belonging to io-wq1 in the hash waitqueue.
      
      Reported-by: syzbot+6cb11ade52aa17095297@syzkaller.appspotmail.com
      Signed-off-by: default avatarZqiang <qiang.zhang@windriver.com>
      Link: https://lore.kernel.org/r/20210526050826.30500-1-qiang.zhang@windriver.com
      
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      3743c172
    • Jens Axboe's avatar
      Merge branch 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-5.13 · 094c271a
      Jens Axboe authored
      Pull MD fix from Song.
      
      * 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md:
        md/raid5: remove an incorrect assert in in_chunk_boundary
      094c271a