stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Leon Romanovsky <leonro@nvidia.com>,
	Jason Gunthorpe <jgg@nvidia.com>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 081/199] RDMA/ucma: Do not miss ctx destruction steps in some cases
Date: Mon, 25 Jan 2021 19:38:23 +0100	[thread overview]
Message-ID: <20210125183219.684239876@linuxfoundation.org> (raw)
In-Reply-To: <20210125183216.245315437@linuxfoundation.org>

From: Jason Gunthorpe <jgg@nvidia.com>

[ Upstream commit 8ae291cc95e49011b736b641b0cfad502b7a1526 ]

The destruction flow is very complicated here because the cm_id can be
destroyed from the event handler at any time if the device is
hot-removed. This leaves behind a partial ctx with no cm_id in the
xarray, and will let user space leak memory.

Make everything consistent in this flow in all places:

 - Return the xarray back to XA_ZERO_ENTRY before beginning any
   destruction. The thread that reaches this first is responsible to
   kfree, everyone else does nothing.

 - Test the xarray during the special hot-removal case to block the
   queue_work, this has much simpler locking and doesn't require a
   'destroying'

 - Fix the ref initialization so that it is only positive if cm_id !=
   NULL, then rely on that to guide the destruction process in all cases.

Now the new ucma_destroy_private_ctx() can be called in all places that
want to free the ctx, including all the error unwinds, and none of the
details are missed.

Fixes: a1d33b70dbbc ("RDMA/ucma: Rework how new connections are passed through event delivery")
Link: https://lore.kernel.org/r/20210105111327.230270-1-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/ucma.c | 135 ++++++++++++++++++---------------
 1 file changed, 72 insertions(+), 63 deletions(-)

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ffe2563ad3456..2cc785c1970b4 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -95,8 +95,6 @@ struct ucma_context {
 	u64			uid;
 
 	struct list_head	list;
-	/* sync between removal event and id destroy, protected by file mut */
-	int			destroying;
 	struct work_struct	close_work;
 };
 
@@ -122,7 +120,7 @@ static DEFINE_XARRAY_ALLOC(ctx_table);
 static DEFINE_XARRAY_ALLOC(multicast_table);
 
 static const struct file_operations ucma_fops;
-static int __destroy_id(struct ucma_context *ctx);
+static int ucma_destroy_private_ctx(struct ucma_context *ctx);
 
 static inline struct ucma_context *_ucma_find_context(int id,
 						      struct ucma_file *file)
@@ -179,19 +177,14 @@ static void ucma_close_id(struct work_struct *work)
 
 	/* once all inflight tasks are finished, we close all underlying
 	 * resources. The context is still alive till its explicit destryoing
-	 * by its creator.
+	 * by its creator. This puts back the xarray's reference.
 	 */
 	ucma_put_ctx(ctx);
 	wait_for_completion(&ctx->comp);
 	/* No new events will be generated after destroying the id. */
 	rdma_destroy_id(ctx->cm_id);
 
-	/*
-	 * At this point ctx->ref is zero so the only place the ctx can be is in
-	 * a uevent or in __destroy_id(). Since the former doesn't touch
-	 * ctx->cm_id and the latter sync cancels this, there is no races with
-	 * this store.
-	 */
+	/* Reading the cm_id without holding a positive ref is not allowed */
 	ctx->cm_id = NULL;
 }
 
@@ -204,7 +197,6 @@ static struct ucma_context *ucma_alloc_ctx(struct ucma_file *file)
 		return NULL;
 
 	INIT_WORK(&ctx->close_work, ucma_close_id);
-	refcount_set(&ctx->ref, 1);
 	init_completion(&ctx->comp);
 	/* So list_del() will work if we don't do ucma_finish_ctx() */
 	INIT_LIST_HEAD(&ctx->list);
@@ -218,6 +210,13 @@ static struct ucma_context *ucma_alloc_ctx(struct ucma_file *file)
 	return ctx;
 }
 
+static void ucma_set_ctx_cm_id(struct ucma_context *ctx,
+			       struct rdma_cm_id *cm_id)
+{
+	refcount_set(&ctx->ref, 1);
+	ctx->cm_id = cm_id;
+}
+
 static void ucma_finish_ctx(struct ucma_context *ctx)
 {
 	lockdep_assert_held(&ctx->file->mut);
@@ -303,7 +302,7 @@ static int ucma_connect_event_handler(struct rdma_cm_id *cm_id,
 	ctx = ucma_alloc_ctx(listen_ctx->file);
 	if (!ctx)
 		goto err_backlog;
-	ctx->cm_id = cm_id;
+	ucma_set_ctx_cm_id(ctx, cm_id);
 
 	uevent = ucma_create_uevent(listen_ctx, event);
 	if (!uevent)
@@ -321,8 +320,7 @@ static int ucma_connect_event_handler(struct rdma_cm_id *cm_id,
 	return 0;
 
 err_alloc:
-	xa_erase(&ctx_table, ctx->id);
-	kfree(ctx);
+	ucma_destroy_private_ctx(ctx);
 err_backlog:
 	atomic_inc(&listen_ctx->backlog);
 	/* Returning error causes the new ID to be destroyed */
@@ -356,8 +354,12 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
 		wake_up_interruptible(&ctx->file->poll_wait);
 	}
 
-	if (event->event == RDMA_CM_EVENT_DEVICE_REMOVAL && !ctx->destroying)
-		queue_work(system_unbound_wq, &ctx->close_work);
+	if (event->event == RDMA_CM_EVENT_DEVICE_REMOVAL) {
+		xa_lock(&ctx_table);
+		if (xa_load(&ctx_table, ctx->id) == ctx)
+			queue_work(system_unbound_wq, &ctx->close_work);
+		xa_unlock(&ctx_table);
+	}
 	return 0;
 }
 
@@ -461,13 +463,12 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
 		ret = PTR_ERR(cm_id);
 		goto err1;
 	}
-	ctx->cm_id = cm_id;
+	ucma_set_ctx_cm_id(ctx, cm_id);
 
 	resp.id = ctx->id;
 	if (copy_to_user(u64_to_user_ptr(cmd.response),
 			 &resp, sizeof(resp))) {
-		xa_erase(&ctx_table, ctx->id);
-		__destroy_id(ctx);
+		ucma_destroy_private_ctx(ctx);
 		return -EFAULT;
 	}
 
@@ -477,8 +478,7 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
 	return 0;
 
 err1:
-	xa_erase(&ctx_table, ctx->id);
-	kfree(ctx);
+	ucma_destroy_private_ctx(ctx);
 	return ret;
 }
 
@@ -516,68 +516,73 @@ static void ucma_cleanup_mc_events(struct ucma_multicast *mc)
 	rdma_unlock_handler(mc->ctx->cm_id);
 }
 
-/*
- * ucma_free_ctx is called after the underlying rdma CM-ID is destroyed. At
- * this point, no new events will be reported from the hardware. However, we
- * still need to cleanup the UCMA context for this ID. Specifically, there
- * might be events that have not yet been consumed by the user space software.
- * mutex. After that we release them as needed.
- */
-static int ucma_free_ctx(struct ucma_context *ctx)
+static int ucma_cleanup_ctx_events(struct ucma_context *ctx)
 {
 	int events_reported;
 	struct ucma_event *uevent, *tmp;
 	LIST_HEAD(list);
 
-	ucma_cleanup_multicast(ctx);
-
-	/* Cleanup events not yet reported to the user. */
+	/* Cleanup events not yet reported to the user.*/
 	mutex_lock(&ctx->file->mut);
 	list_for_each_entry_safe(uevent, tmp, &ctx->file->event_list, list) {
-		if (uevent->ctx == ctx || uevent->conn_req_ctx == ctx)
+		if (uevent->ctx != ctx)
+			continue;
+
+		if (uevent->resp.event == RDMA_CM_EVENT_CONNECT_REQUEST &&
+		    xa_cmpxchg(&ctx_table, uevent->conn_req_ctx->id,
+			       uevent->conn_req_ctx, XA_ZERO_ENTRY,
+			       GFP_KERNEL) == uevent->conn_req_ctx) {
 			list_move_tail(&uevent->list, &list);
+			continue;
+		}
+		list_del(&uevent->list);
+		kfree(uevent);
 	}
 	list_del(&ctx->list);
 	events_reported = ctx->events_reported;
 	mutex_unlock(&ctx->file->mut);
 
 	/*
-	 * If this was a listening ID then any connections spawned from it
-	 * that have not been delivered to userspace are cleaned up too.
-	 * Must be done outside any locks.
+	 * If this was a listening ID then any connections spawned from it that
+	 * have not been delivered to userspace are cleaned up too. Must be done
+	 * outside any locks.
 	 */
 	list_for_each_entry_safe(uevent, tmp, &list, list) {
-		list_del(&uevent->list);
-		if (uevent->resp.event == RDMA_CM_EVENT_CONNECT_REQUEST &&
-		    uevent->conn_req_ctx != ctx)
-			__destroy_id(uevent->conn_req_ctx);
+		ucma_destroy_private_ctx(uevent->conn_req_ctx);
 		kfree(uevent);
 	}
-
-	mutex_destroy(&ctx->mutex);
-	kfree(ctx);
 	return events_reported;
 }
 
-static int __destroy_id(struct ucma_context *ctx)
+/*
+ * When this is called the xarray must have a XA_ZERO_ENTRY in the ctx->id (ie
+ * the ctx is not public to the user). This either because:
+ *  - ucma_finish_ctx() hasn't been called
+ *  - xa_cmpxchg() succeed to remove the entry (only one thread can succeed)
+ */
+static int ucma_destroy_private_ctx(struct ucma_context *ctx)
 {
+	int events_reported;
+
 	/*
-	 * If the refcount is already 0 then ucma_close_id() has already
-	 * destroyed the cm_id, otherwise holding the refcount keeps cm_id
-	 * valid. Prevent queue_work() from being called.
+	 * Destroy the underlying cm_id. New work queuing is prevented now by
+	 * the removal from the xarray. Once the work is cancled ref will either
+	 * be 0 because the work ran to completion and consumed the ref from the
+	 * xarray, or it will be positive because we still have the ref from the
+	 * xarray. This can also be 0 in cases where cm_id was never set
 	 */
-	if (refcount_inc_not_zero(&ctx->ref)) {
-		rdma_lock_handler(ctx->cm_id);
-		ctx->destroying = 1;
-		rdma_unlock_handler(ctx->cm_id);
-		ucma_put_ctx(ctx);
-	}
-
 	cancel_work_sync(&ctx->close_work);
-	/* At this point it's guaranteed that there is no inflight closing task */
-	if (ctx->cm_id)
+	if (refcount_read(&ctx->ref))
 		ucma_close_id(&ctx->close_work);
-	return ucma_free_ctx(ctx);
+
+	events_reported = ucma_cleanup_ctx_events(ctx);
+	ucma_cleanup_multicast(ctx);
+
+	WARN_ON(xa_cmpxchg(&ctx_table, ctx->id, XA_ZERO_ENTRY, NULL,
+			   GFP_KERNEL) != NULL);
+	mutex_destroy(&ctx->mutex);
+	kfree(ctx);
+	return events_reported;
 }
 
 static ssize_t ucma_destroy_id(struct ucma_file *file, const char __user *inbuf,
@@ -596,14 +601,17 @@ static ssize_t ucma_destroy_id(struct ucma_file *file, const char __user *inbuf,
 
 	xa_lock(&ctx_table);
 	ctx = _ucma_find_context(cmd.id, file);
-	if (!IS_ERR(ctx))
-		__xa_erase(&ctx_table, ctx->id);
+	if (!IS_ERR(ctx)) {
+		if (__xa_cmpxchg(&ctx_table, ctx->id, ctx, XA_ZERO_ENTRY,
+				 GFP_KERNEL) != ctx)
+			ctx = ERR_PTR(-ENOENT);
+	}
 	xa_unlock(&ctx_table);
 
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
 
-	resp.events_reported = __destroy_id(ctx);
+	resp.events_reported = ucma_destroy_private_ctx(ctx);
 	if (copy_to_user(u64_to_user_ptr(cmd.response),
 			 &resp, sizeof(resp)))
 		ret = -EFAULT;
@@ -1777,15 +1785,16 @@ static int ucma_close(struct inode *inode, struct file *filp)
 	 * prevented by this being a FD release function. The list_add_tail() in
 	 * ucma_connect_event_handler() can run concurrently, however it only
 	 * adds to the list *after* a listening ID. By only reading the first of
-	 * the list, and relying on __destroy_id() to block
+	 * the list, and relying on ucma_destroy_private_ctx() to block
 	 * ucma_connect_event_handler(), no additional locking is needed.
 	 */
 	while (!list_empty(&file->ctx_list)) {
 		struct ucma_context *ctx = list_first_entry(
 			&file->ctx_list, struct ucma_context, list);
 
-		xa_erase(&ctx_table, ctx->id);
-		__destroy_id(ctx);
+		WARN_ON(xa_cmpxchg(&ctx_table, ctx->id, ctx, XA_ZERO_ENTRY,
+				   GFP_KERNEL) != ctx);
+		ucma_destroy_private_ctx(ctx);
 	}
 	kfree(file);
 	return 0;
-- 
2.27.0




  parent reply	other threads:[~2021-01-26 20:54 UTC|newest]

Thread overview: 208+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-25 18:37 [PATCH 5.10 000/199] 5.10.11-rc1 review Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 001/199] scsi: target: tcmu: Fix use-after-free of se_cmd->priv Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 002/199] mtd: rawnand: gpmi: fix dst bit offset when extracting raw payload Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 003/199] mtd: rawnand: nandsim: Fix the logic when selecting Hamming soft ECC engine Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 004/199] i2c: tegra: Wait for config load atomically while in ISR Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 005/199] i2c: bpmp-tegra: Ignore unknown I2C_M flags Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 006/199] platform/x86: i2c-multi-instantiate: Dont create platform device for INT3515 ACPI nodes Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 007/199] platform/x86: ideapad-laptop: Disable touchpad_switch for ELAN0634 Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 008/199] ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 009/199] ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 010/199] ALSA: hda/via: Add minimum mute flag Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 011/199] crypto: xor - Fix divide error in do_xor_speed() Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 012/199] dm crypt: fix copy and paste bug in crypt_alloc_req_aead Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 013/199] ACPI: scan: Make acpi_bus_get_device() clear return pointer on error Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 014/199] btrfs: dont get an EINTR during drop_snapshot for reloc Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 015/199] btrfs: do not double free backref nodes on error Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 016/199] btrfs: fix lockdep splat in btrfs_recover_relocation Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 017/199] btrfs: dont clear ret in btrfs_start_dirty_block_groups Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 018/199] btrfs: send: fix invalid clone operations when cloning from the same file and root Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 019/199] fs: fix lazytime expiration handling in __writeback_single_inode() Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 020/199] pinctrl: ingenic: Fix JZ4760 support Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 021/199] mmc: core: dont initialize block size from ext_csd if not present Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 022/199] mmc: sdhci-of-dwcmshc: fix rpmb access Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 023/199] mmc: sdhci-xenon: fix 1.8v regulator stabilization Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 024/199] mmc: sdhci-brcmstb: Fix mmc timeout errors on S5 suspend Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 025/199] dm: avoid filesystem lookup in dm_get_dev_t() Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 026/199] dm integrity: fix a crash if "recalculate" used without "internal_hash" Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 027/199] dm integrity: conditionally disable "recalculate" feature Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 028/199] drm/atomic: put state on error path Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 029/199] drm/syncobj: Fix use-after-free Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 030/199] drm/amdgpu: remove gpu info firmware of green sardine Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 031/199] drm/amd/display: DCN2X Find Secondary Pipe properly in MPO + ODM Case Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 032/199] drm/i915/gt: Prevent use of engine->wa_ctx after error Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 033/199] drm/i915: Check for rq->hwsp validity after acquiring RCU lock Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 034/199] ASoC: Intel: haswell: Add missing pm_ops Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 035/199] ASoC: rt711: mutex between calibration and power state changes Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 036/199] SUNRPC: Handle TCP socket sends with kernel_sendpage() again Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 037/199] HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad device Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 038/199] HID: sony: select CONFIG_CRC32 Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 039/199] dm integrity: select CRYPTO_SKCIPHER Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 040/199] x86/hyperv: Fix kexec panic/hang issues Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 041/199] scsi: ufs: Relax the condition of UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 042/199] scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 043/199] scsi: qedi: Correct max length of CHAP secret Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 044/199] scsi: scsi_debug: Fix memleak in scsi_debug_init() Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 045/199] scsi: sd: Suppress spurious errors when WRITE SAME is being disabled Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 046/199] riscv: Fix kernel time_init() Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 047/199] riscv: Fix sifive serial driver Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 048/199] riscv: Enable interrupts during syscalls with M-Mode Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 049/199] HID: logitech-dj: add the G602 receiver Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 050/199] HID: Ignore battery for Elan touchscreen on ASUS UX550 Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 051/199] clk: tegra30: Add hda clock default rates to clock driver Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 052/199] ALSA: hda/tegra: fix tegra-hda on tegra30 soc Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 053/199] riscv: cacheinfo: Fix using smp_processor_id() in preemptible Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 054/199] arm64: make atomic helpers __always_inline Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 055/199] xen: Fix event channel callback via INTX/GSI Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 056/199] x86/xen: Add xen_no_vector_callback option to test PCI INTX delivery Greg Kroah-Hartman
2021-01-25 18:37 ` [PATCH 5.10 057/199] x86/xen: Fix xen_hvm_smp_init() when vector callback not available Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 058/199] dts: phy: fix missing mdio device and probe failure of vsc8541-01 device Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 059/199] dts: phy: add GPIO number and active state used for phy reset Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 060/199] riscv: defconfig: enable gpio support for HiFive Unleashed Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 061/199] drm/amdgpu/psp: fix psp gfx ctrl cmds Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 062/199] drm/amd/display: disable dcn10 pipe split by default Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 063/199] HID: logitech-hidpp: Add product ID for MX Ergo in Bluetooth mode Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 064/199] drm/amd/display: Fix to be able to stop crc calculation Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 065/199] drm/nouveau/bios: fix issue shadowing expansion ROMs Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 066/199] drm/nouveau/privring: ack interrupts the same way as RM Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 067/199] drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 068/199] drm/nouveau/mmu: fix vram heap sizing Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 069/199] drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0 Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 070/199] io_uring: flush timeouts that should already have expired Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 071/199] libperf tests: If a test fails return non-zero Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 072/199] libperf tests: Fail when failing to get a tracepoint id Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 073/199] RISC-V: Set current memblock limit Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 074/199] RISC-V: Fix maximum allowed phsyical memory for RV32 Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 075/199] x86/xen: fix nopvspin build error Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 076/199] nfsd: Fixes for nfsd4_encode_read_plus_data() Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 077/199] nfsd: Dont set eof on a truncated READ_PLUS Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 078/199] gpiolib: cdev: fix frame size warning in gpio_ioctl() Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 079/199] pinctrl: aspeed: g6: Fix PWMG0 pinctrl setting Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 080/199] pinctrl: mediatek: Fix fallback call path Greg Kroah-Hartman
2021-01-25 18:38 ` Greg Kroah-Hartman [this message]
2021-01-25 18:38 ` [PATCH 5.10 082/199] btrfs: print the actual offset in btrfs_root_name Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 083/199] scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 084/199] scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 085/199] scsi: ufs: Fix tm request when non-fatal error happens Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 086/199] crypto: omap-sham - Fix link error without crypto-engine Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 087/199] bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 088/199] powerpc: Use the common INIT_DATA_SECTION macro in vmlinux.lds.S Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 089/199] powerpc: Fix alignment bug within the init sections Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 090/199] arm64: entry: remove redundant IRQ flag tracing Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 091/199] bpf: Reject too big ctx_size_in for raw_tp test run Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 092/199] drm/amdkfd: Fix out-of-bounds read in kdf_create_vcrat_image_cpu() Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 093/199] RDMA/umem: Avoid undefined behavior of rounddown_pow_of_two() Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 094/199] RDMA/cma: Fix error flow in default_roce_mode_store Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 095/199] printk: ringbuffer: fix line counting Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 096/199] printk: fix kmsg_dump_get_buffer length calulations Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 097/199] iov_iter: fix the uaccess area in copy_compat_iovec_from_user Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 098/199] i2c: octeon: check correct size of maximum RECV_LEN packet Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 099/199] drm/vc4: Unify PCM cards driver_name Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 100/199] platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 101/199] platform/x86: hp-wmi: Dont log a warning on HPWMI_RET_UNKNOWN_COMMAND errors Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 102/199] gpio: sifive: select IRQ_DOMAIN_HIERARCHY rather than depend on it Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 103/199] ALSA: hda: Balance runtime/system PM if direct-complete is disabled Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 104/199] xsk: Clear pool even for inactive queues Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 105/199] selftests: net: fib_tests: remove duplicate log test Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 106/199] can: dev: can_restart: fix use after free bug Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 107/199] can: vxcan: vxcan_xmit: " Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 108/199] can: peak_usb: fix use after free bugs Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 109/199] perf evlist: Fix id index for heterogeneous systems Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 110/199] i2c: sprd: depend on COMMON_CLK to fix compile tests Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 111/199] iio: common: st_sensors: fix possible infinite loop in st_sensors_irq_thread Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 112/199] iio: ad5504: Fix setting power-down state Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 113/199] drivers: iio: temperature: Add delay after the addressed reset command in mlx90632.c Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 114/199] iio: adc: ti_am335x_adc: remove omitted iio_kfifo_free() Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 115/199] counter:ti-eqep: remove floor Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 116/199] powerpc/64s: fix scv entry fallback flush vs interrupt Greg Kroah-Hartman
2021-01-25 18:38 ` [PATCH 5.10 117/199] cifs: do not fail __smb_send_rqst if non-fatal signals are pending Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 118/199] irqchip/mips-cpu: Set IPI domain parent chip Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 119/199] x86/mmx: Use KFPU_387 for MMX string operations Greg Kroah-Hartman
2021-01-26  3:24   ` Krzysztof Olędzki
2021-01-26  8:27     ` Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 120/199] x86/setup: dont remove E820_TYPE_RAM for pfn 0 Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 121/199] proc_sysctl: fix oops caused by incorrect command parameters Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 122/199] mm: fix initialization of struct page for holes in memory layout Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 123/199] mm: memcg/slab: optimize objcg stock draining Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 124/199] mm: memcg: fix memcg file_dirty numa stat Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 125/199] mm: fix numa stats for thp migration Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 126/199] io_uring: iopoll requests should also wake task ->in_idle state Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 127/199] io_uring: fix SQPOLL IORING_OP_CLOSE cancelation state Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 128/199] io_uring: fix short read retries for non-reg files Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 129/199] intel_th: pci: Add Alder Lake-P support Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 130/199] stm class: Fix module init return on allocation failure Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 131/199] serial: mvebu-uart: fix tx lost characters at power off Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 132/199] ehci: fix EHCI host controller initialization sequence Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 133/199] USB: ehci: fix an interrupt calltrace error Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 134/199] usb: gadget: aspeed: fix stop dma register setting Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 135/199] USB: gadget: dummy-hcd: Fix errors in port-reset handling Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 136/199] usb: udc: core: Use lock when write to soft_connect Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 137/199] usb: bdc: Make bdc pci driver depend on BROKEN Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 138/199] usb: cdns3: imx: fix writing read-only memory issue Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 139/199] usb: cdns3: imx: fix cant create core device the second time issue Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 140/199] xhci: make sure TRB is fully written before giving it to the controller Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 141/199] xhci: tegra: Delay for disabling LFPS detector Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 142/199] drivers core: Free dma_range_map when driver probe failed Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 143/199] driver core: Fix device link device name collision Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 144/199] driver core: Extend device_is_dependent() Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 145/199] drm/i915: s/intel_dp_sink_dpms/intel_dp_set_power/ Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 146/199] drm/i915: Only enable DFP 4:4:4->4:2:0 conversion when outputting YCbCr 4:4:4 Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 147/199] x86/entry: Fix noinstr fail Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 148/199] x86/cpu/amd: Set __max_die_per_package on AMD Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 149/199] cls_flower: call nla_ok() before nla_next() Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 150/199] netfilter: rpfilter: mask ecn bits before fib lookup Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 151/199] tools: gpio: fix %llu warning in gpio-event-mon.c Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 152/199] tools: gpio: fix %llu warning in gpio-watch.c Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 153/199] drm/i915/hdcp: Update CP property in update_pipe Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 154/199] sh: dma: fix kconfig dependency for G2_DMA Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 155/199] sh: Remove unused HAVE_COPY_THREAD_TLS macro Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 156/199] locking/lockdep: Cure noinstr fail Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 157/199] ASoC: SOF: Intel: fix page fault at probe if i915 init fails Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 158/199] octeontx2-af: Fix missing check bugs in rvu_cgx.c Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 159/199] net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 160/199] selftests/powerpc: Fix exit status of pkey tests Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 161/199] sh_eth: Fix power down vs. is_opened flag ordering Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 162/199] nvme-pci: refactor nvme_unmap_data Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 163/199] nvme-pci: fix error unwind in nvme_map_data Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 164/199] cachefiles: Drop superfluous readpages aops NULL check Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 165/199] lightnvm: fix memory leak when submit fails Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 166/199] skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 167/199] kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 168/199] kasan: fix incorrect arguments passing in kasan_add_zero_shadow Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 169/199] tcp: fix TCP socket rehash stats mis-accounting Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 170/199] net_sched: gen_estimator: support large ewma log Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 171/199] udp: mask TOS bits in udp_v4_early_demux() Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 172/199] ipv6: create multicast route with RTPROT_KERNEL Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 173/199] net_sched: avoid shift-out-of-bounds in tcindex_set_parms() Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 174/199] net_sched: reject silly cell_log in qdisc_get_rtab() Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 175/199] ipv6: set multicast flag on the multicast route Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 176/199] net: mscc: ocelot: allow offloading of bridge on top of LAG Greg Kroah-Hartman
2021-01-25 18:39 ` [PATCH 5.10 177/199] net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 178/199] net: dsa: b53: fix an off by one in checking "vlan->vid" Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 179/199] tcp: do not mess with cloned skbs in tcp_add_backlog() Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 180/199] tcp: fix TCP_USER_TIMEOUT with zero window Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 181/199] net: mscc: ocelot: Fix multicast to the CPU port Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 182/199] net: core: devlink: use right genl user_ptr when handling port param get/set Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 183/199] pinctrl: qcom: Allow SoCs to specify a GPIO function thats not 0 Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 184/199] pinctrl: qcom: No need to read-modify-write the interrupt status Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 185/199] pinctrl: qcom: Properly clear "intr_ack_high" interrupts when unmasking Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 186/199] pinctrl: qcom: Dont clear pending interrupts when enabling Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 187/199] x86/sev: Fix nonistr violation Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 188/199] tty: implement write_iter Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 189/199] tty: fix up hung_up_tty_write() conversion Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 190/199] net: systemport: free dev before on error path Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 191/199] x86/sev-es: Handle string port IO to kernel memory properly Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 192/199] tcp: Fix potential use-after-free due to double kfree() Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 193/199] ASoC: SOF: Intel: hda: Avoid checking jack on system suspend Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 194/199] drm/i915/hdcp: Get conn while content_type changed Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 195/199] bpf: Local storage helpers should check nullness of owner ptr passed Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 196/199] kernfs: implement ->read_iter Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 197/199] kernfs: implement ->write_iter Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 198/199] kernfs: wire up ->splice_read and ->splice_write Greg Kroah-Hartman
2021-01-25 18:40 ` [PATCH 5.10 199/199] interconnect: imx8mq: Use icc_sync_state Greg Kroah-Hartman
2021-01-25 19:36 ` [PATCH 5.10 000/199] 5.10.11-rc1 review Daniel Díaz
2021-01-25 20:18   ` Guenter Roeck
2021-01-26  8:43     ` Greg Kroah-Hartman
2021-01-25 20:51 ` Pavel Machek
2021-01-26 23:34 ` Shuah Khan
2021-01-26 23:37   ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210125183219.684239876@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=jgg@nvidia.com \
    --cc=leonro@nvidia.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).