linux-stable.git, branch v5.17.2

Linux 5.17.2

2022-04-08T11:59:05+00:00

Link: https://lore.kernel.org/r/20220405070407.513532867@linuxfoundation.org
Tested-by: Florian Fainelli 
Tested-by: Fenil Jain 
Tested-by: Fox Chen 
Tested-by: Shuah Khan 
Tested-by: Rudi Heitbaum 
Tested-by: Ronald Warsow 
Tested-by: Guenter Roeck 
Tested-by: Zan Aziz 
Tested-by: Ronald Warsow 
Tested-by: Linux Kernel Functional Testing 
Tested-by: Jon Hunter 
Tested-by: Ron Economos 
Tested-by: Bagas Sanjaya 
Link: https://lore.kernel.org/r/20220406133122.897434068@linuxfoundation.org
Tested-by: Jon Hunter 
Tested-by: Justin M. Forbes 
Tested-by: Fox Chen 
Tested-by: Shuah Khan 
Tested-by: Ronald Warsow 
Tested-by: Florian Fainelli 
Tested-by: Ron Economos 
Tested-by: Jiri Slaby 
Tested-by: Linux Kernel Functional Testing 
Reviewed-by: Guenter Roeck 
Tested-by: Sebastian Dörin 
Tested-by: Rudi Heitbaum 
Tested-by: Bagas Sanjaya 
Signed-off-by: Greg Kroah-Hartman

coredump: Use the vma snapshot in fill_files_note

2022-04-08T11:59:04+00:00

commit 390031c942116d4733310f0684beb8db19885fe6 upstream.

Matthew Wilcox reported that there is a missing mmap_lock in
file_files_note that could possibly lead to a user after free.

Solve this by using the existing vma snapshot for consistency
and to avoid the need to take the mmap_lock anywhere in the
coredump code except for dump_vma_snapshot.

Update the dump_vma_snapshot to capture vm_pgoff and vm_file
that are neeeded by fill_files_note.

Add free_vma_snapshot to free the captured values of vm_file.

Reported-by: Matthew Wilcox 
Link: https://lkml.kernel.org/r/20220131153740.2396974-1-willy@infradead.org
Cc: stable@vger.kernel.org
Fixes: a07279c9a8cd ("binfmt_elf, binfmt_elf_fdpic: use a VMA list snapshot")
Fixes: 2aa362c49c31 ("coredump: extend core dump note section to contain file names of mapped files")
Reviewed-by: Kees Cook 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

coredump/elf: Pass coredump_params into fill_note_info

2022-04-08T11:59:04+00:00

commit 9ec7d3230717b4fe9b6c7afeb4811909c23fa1d7 upstream.

Instead of individually passing cprm->siginfo and cprm->regs
into fill_note_info pass all of struct coredump_params.

This is preparation to allow fill_files_note to use the existing
vma snapshot.

Reviewed-by: Jann Horn 
Reviewed-by: Kees Cook 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

coredump: Remove the WARN_ON in dump_vma_snapshot

2022-04-08T11:59:04+00:00

commit 49c1866348f364478a0c4d3dd13fd08bb82d3a5b upstream.

The condition is impossible and to the best of my knowledge has never
triggered.

We are in deep trouble if that conditions happens and we walk past
the end of our allocated array.

So delete the WARN_ON and the code that makes it look like the kernel
can handle the case of walking past the end of it's vma_meta array.

Reviewed-by: Jann Horn 
Reviewed-by: Kees Cook 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

coredump: Snapshot the vmas in do_coredump

2022-04-08T11:59:04+00:00

commit 95c5436a4883841588dae86fb0b9325f47ba5ad3 upstream.

Move the call of dump_vma_snapshot and kvfree(vma_meta) out of the
individual coredump routines into do_coredump itself.  This makes
the code less error prone and easier to maintain.

Make the vma snapshot available to the coredump routines
in struct coredump_params.  This makes it easier to
change and update what is captures in the vma snapshot
and will be needed for fixing fill_file_notes.

Reviewed-by: Jann Horn 
Reviewed-by: Kees Cook 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

mmc: rtsx: Fix build errors/warnings for unused variable

2022-04-08T11:59:04+00:00

commit 3dd9a926ec2308e49445f22abef149fc64e9332e upstream.

The struct device *dev, is no longer needed at various functions, let's
therefore drop it to fix the build errors/warnings.

Fixes: 7570fb41e450 ("mmc: rtsx: Let MMC core handle runtime PM")
Cc: Kai-Heng Feng 
Reported-by: kernel test robot 
Signed-off-by: Ulf Hansson 
Link: https://lore.kernel.org/r/20220301115300.64332-1-ulf.hansson@linaro.org
Signed-off-by: Greg Kroah-Hartman

mmc: rtsx: Let MMC core handle runtime PM

2022-04-08T11:59:04+00:00

commit 7570fb41e450ba37bf9335fe3751fa9f502c30fa upstream.

Since MMC core handles runtime PM reference counting, we can avoid doing
redundant runtime PM work in the driver. That means the only thing
commit 5b4258f6721f ("misc: rtsx: rts5249 support runtime PM") misses is
to always enable runtime PM, to let its parent driver enable ASPM in the
runtime idle routine.

Fixes: 7499b529d97f ("mmc: rtsx: Use pm_runtime_{get,put}() to handle runtime PM")
Reviewed-by: Ulf Hansson 
Signed-off-by: Kai-Heng Feng 
Link: https://lore.kernel.org/r/20220216055435.2335297-1-kai.heng.feng@canonical.com
Signed-off-by: Greg Kroah-Hartman

Revert "nbd: fix possible overflow on 'first_minor' in nbd_dev_add()"

2022-04-08T11:59:04+00:00

commit 7198bfc2017644c6b92d2ecef9b8b8e0363bb5fd upstream.

This reverts commit 6d35d04a9e18990040e87d2bbf72689252669d54.

Both Gabriel and Borislav report that this commit casues a regression
with nbd:

sysfs: cannot create duplicate filename '/dev/block/43:0'

Revert it before 5.18-rc1 and we'll investigage this separately in
due time.

Link: https://lore.kernel.org/all/YkiJTnFOt9bTv6A2@zn.tnic/
Reported-by: Gabriel L. Somlo 
Reported-by: Borislav Petkov 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

n64cart: convert bi_disk to bi_bdev->bd_disk fix build

2022-04-08T11:59:04+00:00

commit b2479de38d8fc7ef13d5c78ff5ded6e5a1a4eac0 upstream.

My kernel robot report below:

  drivers/block/n64cart.c: In function ‘n64cart_submit_bio’:
  drivers/block/n64cart.c:91:26: error: ‘struct bio’ has no member named ‘bi_disk’
     91 |  struct device *dev = bio->bi_disk->private_data;
        |                          ^~
    CC      drivers/slimbus/qcom-ctrl.o
    CC      drivers/auxdisplay/hd44780.o
    CC      drivers/watchdog/watchdog_core.o
    CC      drivers/nvme/host/fault_inject.o
    AR      drivers/accessibility/braille/built-in.a
  make[2]: *** [scripts/Makefile.build:288: drivers/block/n64cart.o] Error 1

Fixes: 309dca309fc3 ("block: store a block_device pointer in struct bio");
Reported-by: k2ci 
Signed-off-by: Jackie Liu 
Reviewed-by: Chaitanya Kulkarni 
Link: https://lore.kernel.org/r/20220321071216.1549596-1-liu.yun@linux.dev
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

torture: Make torture.sh help message match reality

2022-04-08T11:59:04+00:00

commit f233673cd32a048f2eed69e56b61174c33fb740b upstream.

This commit fixes a couple of typos: s/--doall/--do-all/ and
s/--doallmodconfig/--do-allmodconfig/.

[ paulmck: Add Fixes: supplied by Paul Menzel. ]

Fixes: a115a775a8d5 ("torture: Add "make allmodconfig" to torture.sh")
Reported-by: Paul Menzel 
Signed-off-by: Paul E. McKenney 
Signed-off-by: Greg Kroah-Hartman