Merge tag 'v5.2-rc6' into for-5.3/block

Merge 5.2-rc6 into for-5.3/block, so we get the same page merge leak
fix. Otherwise we end up having conflicts with future patches between
for-5.3/block and master that touch this area. In particular, it makes
the bio_full() fix hard to backport to stable.

* tag 'v5.2-rc6': (482 commits)
  Linux 5.2-rc6
  Revert "iommu/vt-d: Fix lock inversion between iommu->lock and device_domain_lock"
  Bluetooth: Fix regression with minimum encryption key size alignment
  tcp: refine memory limit test in tcp_fragment()
  x86/vdso: Prevent segfaults due to hoisted vclock reads
  SUNRPC: Fix a credential refcount leak
  Revert "SUNRPC: Declare RPC timers as TIMER_DEFERRABLE"
  net :sunrpc :clnt :Fix xps refcount imbalance on the error path
  NFS4: Only set creation opendata if O_CREAT
  ARM: 8867/1: vdso: pass --be8 to linker if necessary
  KVM: nVMX: reorganize initial steps of vmx_set_nested_state
  KVM: PPC: Book3S HV: Invalidate ERAT when flushing guest TLB entries
  habanalabs: use u64_to_user_ptr() for reading user pointers
  nfsd: replace Jeff by Chuck as nfsd co-maintainer
  inet: clear num_timeout reqsk_alloc()
  PCI/P2PDMA: Ignore root complex whitelist when an IOMMU is present
  net: mvpp2: debugfs: Add pmap to fs dump
  ipv6: Default fib6_type to RTN_UNICAST when not set
  net: hns3: Fix inconsistent indenting
  net/af_iucv: always register net_device notifier
  ...

1 files changed, 7 insertions, 2 deletions

diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index 15dbc15c5b0c..cd8297b3bdb9 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -178,6 +178,7 @@ static void dev_map_free(struct bpf_map *map)
                 if (!dev)
                         continue;
 
+                free_percpu(dev->bulkq);
                 dev_put(dev->dev);
                 kfree(dev);
         }
@@ -273,6 +274,7 @@ void __dev_map_flush(struct bpf_map *map)
         unsigned long *bitmap = this_cpu_ptr(dtab->flush_needed);
         u32 bit;
 
+        rcu_read_lock();
         for_each_set_bit(bit, bitmap, map->max_entries) {
                 struct bpf_dtab_netdev *dev = READ_ONCE(dtab->netdev_map[bit]);
                 struct xdp_bulk_queue *bq;
@@ -283,11 +285,12 @@ void __dev_map_flush(struct bpf_map *map)
                 if (unlikely(!dev))
                         continue;
 
-                __clear_bit(bit, bitmap);
-
                 bq = this_cpu_ptr(dev->bulkq);
                 bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, true);
+
+                __clear_bit(bit, bitmap);
         }
+        rcu_read_unlock();
 }
 
 /* rcu_read_lock (from syscall and BPF contexts) ensures that if a delete and/or
@@ -380,6 +383,7 @@ static void dev_map_flush_old(struct bpf_dtab_netdev *dev)
 
                 int cpu;
 
+                rcu_read_lock();
                 for_each_online_cpu(cpu) {
                         bitmap = per_cpu_ptr(dev->dtab->flush_needed, cpu);
                         __clear_bit(dev->bit, bitmap);
@@ -387,6 +391,7 @@ static void dev_map_flush_old(struct bpf_dtab_netdev *dev)
                         bq = per_cpu_ptr(dev->bulkq, cpu);
                         bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, false);
                 }
+                rcu_read_unlock();
         }
 }