5.10.36-rc1 review

This is the start of the stable review cycle for the 5.10.36 release. There are 299 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 12 May 2021 10:19:23 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.36-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.10.36-rc1

Lukasz Luba <[email protected]>
thermal/core/fair share: Lock the thermal zone while looping over instances

brian-sy yang <[email protected]>
thermal/drivers/cpufreq_cooling: Fix slab OOB issue

Rasmus Villemoes <[email protected]>
lib/vsprintf.c: remove leftover 'f' and 'F' cases from bstr_printf()

Benjamin Block <[email protected]>
dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails

Tian Tao <[email protected]>
dm integrity: fix missing goto in bitmap_flush_interval error handling

Joe Thornber <[email protected]>
dm space map common: fix division bug in sm_ll_find_free_block()

Joe Thornber <[email protected]>
dm persistent data: packed struct should have an aligned() attribute too

Steven Rostedt (VMware) <[email protected]>
tracing: Restructure trace_clock_global() to never block

Steven Rostedt (VMware) <[email protected]>
tracing: Map all PIDs to command lines

Calvin Walton <[email protected]>
tools/power turbostat: Fix offset overflow issue in index converting

Marek Vasut <[email protected]>
rsi: Use resume_noirq for SDIO

Pavel Skripkin <[email protected]>
tty: fix memory leak in vc_deallocate

Artur Petrosyan <[email protected]>
usb: dwc2: Fix session request interrupt handler

Yu Chen <[email protected]>
usb: dwc3: core: Do core softreset when switch mode

Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix START_TRANSFER link state check

Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Remove FS bInterval_m1 limitation

Dean Anderson <[email protected]>
usb: gadget/function/f_fs string table fix for multiple languages

Hemant Kumar <[email protected]>
usb: gadget: Fix double free of device descriptor pointers

Anirudh Rayabharam <[email protected]>
usb: gadget: dummy_hcd: fix gpf in gadget_setup

Stanimir Varbanov <[email protected]>
media: venus: hfi_parser: Don't initialize parser on v1

Hans Verkuil <[email protected]>
media: v4l2-ctrls: fix reference to freed memory

Ricardo Ribalda <[email protected]>
media: staging/intel-ipu3: Fix race condition during set_fmt

Ricardo Ribalda <[email protected]>
media: staging/intel-ipu3: Fix set_fmt error handling

Ricardo Ribalda <[email protected]>
media: staging/intel-ipu3: Fix memory leak in imu_fmt

Takashi Iwai <[email protected]>
media: dvb-usb: Fix memory leak at error in dvb_usb_device_init()

Takashi Iwai <[email protected]>
media: dvb-usb: Fix use-after-free access

Peilin Ye <[email protected]>
media: dvbdev: Fix memory leak in dvb_media_device_free()

Jan Kara <[email protected]>
ext4: Fix occasional generic/418 failure

Theodore Ts'o <[email protected]>
ext4: allow the dax flag to be set and cleared on inline directories

Xu Yihang <[email protected]>
ext4: fix error return code in ext4_fc_perform_commit()

Ye Bin <[email protected]>
ext4: fix ext4_error_err save negative errno into superblock

Fengnan Chang <[email protected]>
ext4: fix error code in ext4_commit_super

Zhang Yi <[email protected]>
ext4: do not set SB_ACTIVE in ext4_orphan_cleanup()

Zhang Yi <[email protected]>
ext4: fix check to prevent false positive report of incorrect used inodes

Jan Kara <[email protected]>
ext4: annotate data race in jbd2_journal_dirty_metadata()

Jan Kara <[email protected]>
ext4: annotate data race in start_this_handle()

Masahiro Yamada <[email protected]>
kbuild: update config_data.gz only when the content of .config is changed

Sean Christopherson <[email protected]>
x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported

Thomas Gleixner <[email protected]>
futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI

Thomas Gleixner <[email protected]>
Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op")

Steve French <[email protected]>
smb3: do not attempt multichannel to server which does not support it

Steve French <[email protected]>
smb3: when mounting with multichannel include it in requested capabilities

Yang Yang <[email protected]>
jffs2: check the validity of dstlen in jffs2_zlib_compress()

Linus Torvalds <[email protected]>
Fix misc new gcc warnings

Arnd Bergmann <[email protected]>
security: commoncap: fix -Wstringop-overread warning

Edward Cree <[email protected]>
sfc: farch: fix TX queue lookup in TX event handling

Edward Cree <[email protected]>
sfc: farch: fix TX queue lookup in TX flush done handling

Hyeongseok Kim <[email protected]>
exfat: fix erroneous discard when clear cluster bit

Vivek Goyal <[email protected]>
fuse: fix write deadlock

Heinz Mauelshagen <[email protected]>
dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload sequences

Paul Clements <[email protected]>
md/raid1: properly indicate failure when ending a failed write request

Eric Biggers <[email protected]>
crypto: rng - fix crypto_rng_reset() refcounting when !CRYPTO_STATS

Nathan Chancellor <[email protected]>

    crypto: arm/curve25519 - Move '.fpu' after '.arch'

Stefan Berger <[email protected]>
tpm: vtpm_proxy: Avoid reading host log when using a virtual device

Stefan Berger <[email protected]>
tpm: efi: Use local variable for calculating final log size

Alexander Shishkin <[email protected]>
intel_th: pci: Add Alder Lake-M support

Tony Ambardar <[email protected]>
powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h

Christophe Leroy <[email protected]>
powerpc/32: Fix boot failure with CONFIG_STACKPROTECTOR

Sourabh Jain <[email protected]>
powerpc/kexec_file: Use current CPU info while setting up FDT

Mahesh Salgaonkar <[email protected]>
powerpc/eeh: Fix EEH handling for hugepages in ioremap space.

Nicholas Piggin <[email protected]>
powerpc/powernv: Enable HAIL (HV AIL) for ISA v3.1 processors

Joel Stanley <[email protected]>
jffs2: Hook up splice_write callback

lizhe <[email protected]>
jffs2: Fix kasan slab-out-of-bounds problem

Hansem Ro <[email protected]>

    Input: ili210x - add missing negation for touch indication on ili210x

Trond Myklebust <[email protected]>
NFSv4: Don't discard segments marked for return in _pnfs_return_layout()

Trond Myklebust <[email protected]>
NFS: Don't discard pNFS layout segments that are marked for return

Randy Dunlap <[email protected]>
NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds

Marc Zyngier <[email protected]>
ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure

Davide Caratti <[email protected]>
openvswitch: fix stack OOB read while fragmenting IPv4 packets

Ido Schimmel <[email protected]>
mlxsw: spectrum_mr: Update egress RIF list before route's action

Chao Yu <[email protected]>
f2fs: fix to avoid out-of-bounds memory access

Eric Biggers <[email protected]>
f2fs: fix error handling in f2fs_end_enable_verity()

Guochun Mao <[email protected]>
ubifs: Only check replay with inode type to judge if inode linked

Marco Elver <[email protected]>
kcsan, debugfs: Move debugfs file creation out of early init

Luis Henriques <[email protected]>
virtiofs: fix memory leak in virtio_fs_probe()

Theodore Ts'o <[email protected]>
fs: fix reporting supported extra file attributes for statx()

Nathan Chancellor <[email protected]>
Makefile: Move -Wno-unused-but-set-variable out of GCC only block

Bill Wendling <[email protected]>
arm64/vdso: Discard .note.gnu.property sections in vDSO

Filipe Manana <[email protected]>
btrfs: fix race when picking most recent mod log operation for an old root

Bas Nieuwenhuizen <[email protected]>
tools/power/turbostat: Fix turbostat for AMD Zen CPUs

Eckhart Mohr <[email protected]>
ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx

Sami Loone <[email protected]>
ALSA: hda/realtek: fix static noise on ALC285 Lenovo laptops

Kailang Yang <[email protected]>
ALSA: hda/realtek - Headset Mic issue on HP platform

Phil Calvin <[email protected]>
ALSA: hda/realtek: fix mic boost on Intel NUC 8

Luke D Jones <[email protected]>
ALSA: hda/realtek: GA503 use same quirks as GA401

Jonas Witschel <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G7

Timo Gurr <[email protected]>
ALSA: usb-audio: Add dB range mapping for Sennheiser Communications Headset PC 8

Takashi Iwai <[email protected]>
ALSA: usb-audio: Explicitly set up the clock selector

Lv Yunlong <[email protected]>
ALSA: sb: Fix two use after free in snd_sb_qsound_build

Takashi Iwai <[email protected]>
ALSA: hda/conexant: Re-order CX5066 quirk table entries

Lv Yunlong <[email protected]>
ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer

Guangqing Zhu <[email protected]>
power: supply: cpcap-battery: fix invalid usage of list cursor

Charan Teja Reddy <[email protected]>
sched,psi: Handle potential task count underflow bugs more gracefully

Harald Freudenberger <[email protected]>
s390/archrandom: add parameter check for s390_arch_random_generate

Gioh Kim <[email protected]>
block/rnbd-clt: Fix missing a memory free when unloading the module

Peter Zijlstra <[email protected]>
sched,fair: Alternative sched_slice()

Peter Zijlstra <[email protected]>
perf: Rework perf_event_exit_event()

Bart Van Assche <[email protected]>
scsi: libfc: Fix a format specifier

Dinghao Liu <[email protected]>
mfd: arizona: Fix rumtime PM imbalance on error

Hubert Streidl <[email protected]>
mfd: da9063: Support SMBus and I2C mode

Xu Yilun <[email protected]>
mfd: intel-m10-bmc: Fix the register access range

James Smart <[email protected]>
scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic

James Smart <[email protected]>
scsi: lpfc: Fix error handling for mailboxes completed in MBX_POLL mode

James Smart <[email protected]>
scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response

Guchun Chen <[email protected]>
drm/amdgpu: fix NULL pointer dereference

Werner Sembach <[email protected]>
drm/amd/display: Try YCbCr420 color when YCbCr444 fails

Arnd Bergmann <[email protected]>
amdgpu: avoid incorrect %hu format string

Qu Huang <[email protected]>
drm/amdkfd: Fix cat debugfs hang_hws file causes system crash bug

Anson Jacob <[email protected]>
drm/amd/display: Fix UBSAN: shift-out-of-bounds warning

Fangzhi Zuo <[email protected]>
drm/amd/display: Fix debugfs link_settings entry

Daniel Gomez <[email protected]>
drm/radeon/ttm: Fix memory leak userptr pages

Daniel Gomez <[email protected]>
drm/amdgpu/ttm: Fix memory leak userptr pages

Marijn Suijten <[email protected]>
drm/msm/mdp5: Do not multiply vclk line count by 100

Marijn Suijten <[email protected]>
drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal

Lingutla Chandrasekhar <[email protected]>
sched/fair: Ignore percpu threads for imbalance pulls

Hans Verkuil <[email protected]>
media: gscpa/stv06xx: fix memory leak

Pavel Skripkin <[email protected]>
media: dvb-usb: fix memory leak in dvb_usb_adapter_init

Dinghao Liu <[email protected]>
media: sun8i-di: Fix runtime PM imbalance in deinterlace_start_streaming

Dinghao Liu <[email protected]>
media: platform: sti: Fix runtime PM imbalance in regs_show

Yang Yingliang <[email protected]>
media: i2c: adv7842: fix possible use-after-free in adv7842_remove()

Yang Yingliang <[email protected]>
media: i2c: tda1997: Fix possible use-after-free in tda1997x_remove()

Yang Yingliang <[email protected]>

    media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove()

Yang Yingliang <[email protected]>
media: adv7604: fix possible use-after-free in adv76xx_remove()

Yang Yingliang <[email protected]>

    media: tc358743: fix possible use-after-free in tc358743_remove()

Yang Yingliang <[email protected]>
power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove()

Yang Yingliang <[email protected]>
power: supply: generic-adc-battery: fix possible use-after-free in gab_remove()

Colin Ian King <[email protected]>
clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return

Abhinav Kumar <[email protected]>
drm/msm/dp: Fix incorrect NULL check kbot warnings in DP driver

Hans Verkuil <[email protected]>
media: vivid: update EDID

Muhammad Usama Anjum <[email protected]>
media: em28xx: fix memory leak

Ewan D. Milne <[email protected]>
scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()

Kevin Barnett <[email protected]>
scsi: smartpqi: Add new PCI IDs

Murthy Bhat <[email protected]>
scsi: smartpqi: Correct request leakage during reset operations

Don Brace <[email protected]>
scsi: smartpqi: Use host-wide tag space

Carl Philipp Klemm <[email protected]>
power: supply: cpcap-charger: Add usleep to cpcap charger to avoid usb plug bounce

Fenghua Yu <[email protected]>
selftests/resctrl: Fix checking for < 0 for unsigned values

Fenghua Yu <[email protected]>
selftests/resctrl: Fix incorrect parsing of iMC counters

Fenghua Yu <[email protected]>
selftests/resctrl: Use resctrl/info for feature detection

Fenghua Yu <[email protected]>
selftests/resctrl: Fix missing options "-n" and "-p"

Fenghua Yu <[email protected]>
selftests/resctrl: Clean up resctrl features check

Fenghua Yu <[email protected]>
selftests/resctrl: Fix compilation issues for other global variables

Fenghua Yu <[email protected]>
selftests/resctrl: Fix compilation issues for global variables

Fenghua Yu <[email protected]>
selftests/resctrl: Enable gcc checks to detect buffer overflows

Hou Pu <[email protected]>
nvmet: return proper error code from discovery ctrl

Carsten Haitzler <[email protected]>
drm/komeda: Fix bit check to import to value of proper type

Xingui Yang <[email protected]>
ata: ahci: Disable SXS for Hisilicon Kunpeng920

Al Cooper <[email protected]>
mmc: sdhci-brcmstb: Remove CQE quirk

Adrian Hunter <[email protected]>
mmc: sdhci-pci: Add PCI IDs for Intel LKF

Peng Fan <[email protected]>
mmc: sdhci-esdhc-imx: validate pinctrl before use it

Quinn Tran <[email protected]>
scsi: qla2xxx: Fix use after free in bsg

Dmitry Vyukov <[email protected]>
drm/vkms: fix misuse of WARN_ON

Bart Van Assche <[email protected]>
scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats()

Dmytro Laktyushkin <[email protected]>
drm/amd/display: fix dml prefetch validation

Aric Cyr <[email protected]>
drm/amd/display: DCHUB underflow counter increasing in some scenarios

Anson Jacob <[email protected]>
drm/amd/display: Fix UBSAN warning for not a valid value for type '_Bool'

Kenneth Feng <[email protected]>
drm/amd/pm: fix workload mismatch on vega10

shaoyunl <[email protected]>
drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f

Anson Jacob <[email protected]>
drm/amdkfd: Fix UBSAN shift-out-of-bounds warning

Jonathan Kim <[email protected]>
drm/amdgpu: mask the xgmi number of hops reported from psp to kfd

Kiran Gunda <[email protected]>
backlight: qcom-wled: Fix FSC update issue for WLED5

Obeida Shamoun <[email protected]>
backlight: qcom-wled: Use sink_addr for sync toggle

dongjian <[email protected]>
power: supply: Use IRQF_ONESHOT

Hans Verkuil <[email protected]>
media: gspca/sq905.c: fix uninitialized variable

Daniel Niv <[email protected]>
media: media/saa7164: fix saa7164_encoder_register() memory leak bugs

Hans de Goede <[email protected]>
extcon: arizona: Fix various races on driver unbind

Hans de Goede <[email protected]>
extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged

Matthias Schiffer <[email protected]>
power: supply: bq27xxx: fix power_avg for newer ICs

Mauro Carvalho Chehab <[email protected]>
atomisp: don't let it go past pipes array

Laurent Pinchart <[email protected]>
media: imx: capture: Return -EPIPE from __capture_legacy_try_fmt()

Julian Braha <[email protected]>
media: drivers: media: pci: sta2x11: fix Kconfig dependency on GPIOLIB

Sean Young <[email protected]>
media: ite-cir: check for receive overflow

Chaitanya Kulkarni <[email protected]>
scsi: target: pscsi: Fix warning in pscsi_complete_cmd()

Uladzislau Rezki (Sony) <[email protected]>
kvfree_rcu: Use same set of GFP flags as does single-argument

Vincent Donnefort <[email protected]>
sched/pelt: Fix task util_est update filtering

Emily Deng <[email protected]>
drm/amdgpu: Fix some unload driver issues

James Smart <[email protected]>
scsi: lpfc: Fix pt2pt connection does not recover after LOGO

James Smart <[email protected]>
scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe

Lee Jones <[email protected]>
drm/amd/display/dc/dce/dce_aux: Remove duplicate line causing 'field overwritten' issue

Xiaogang Chen <[email protected]>
drm/amdgpu/display: buffer INTERRUPT_LOW_IRQ_CONTEXT interrupt work

Aric Cyr <[email protected]>
drm/amd/display: Don't optimize bandwidth before disabling planes

Eryk Brol <[email protected]>
drm/amd/display: Check for DSC support instead of ASIC revision

Tong Zhang <[email protected]>
drm/ast: fix memory leak when unload the driver

Martin Leung <[email protected]>
drm/amd/display: changing sr exit latency

Thomas Zimmermann <[email protected]>
drm/ast: Fix invalid usage of AST_MAX_HWC_WIDTH in cursor atomic_check

Gerd Hoffmann <[email protected]>
drm/qxl: release shadow on shutdown

Tong Zhang <[email protected]>
drm/qxl: do not run release if qxl failed to init

Jared Baldridge <[email protected]>
drm: Added orientation quirk for OneGX1 Pro

Josef Bacik <[email protected]>
btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s

Josef Bacik <[email protected]>
btrfs: do proper error handling in btrfs_update_reloc_root

Josef Bacik <[email protected]>
btrfs: do proper error handling in create_reloc_root

David Bauer <[email protected]>
spi: sync up initial chipselect state

David E. Box <[email protected]>
platform/x86: intel_pmc_core: Don't use global pmcdev in quirks

Shixin Liu <[email protected]>
crypto: omap-aes - Fix PM reference leak on omap-aes.c

Shixin Liu <[email protected]>
crypto: sa2ul - Fix PM reference leak in sa_ul_probe()

Shixin Liu <[email protected]>
crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c

Shixin Liu <[email protected]>
crypto: stm32/hash - Fix PM reference leak on stm32-hash.c

Shixin Liu <[email protected]>
crypto: sun8i-ce - Fix PM reference leak in sun8i_ce_probe()

Shixin Liu <[email protected]>
crypto: sun8i-ss - Fix PM reference leak when pm_runtime_get_sync() fails

Yang Yingliang <[email protected]>
phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()

Pavel Machek <[email protected]>
intel_th: Consistency and off-by-one fix

Hillf Danton <[email protected]>
tty: n_gsm: check error while registering tty devices

Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Check for disabled LPM quirk

Bixuan Cui <[email protected]>
usb: core: hub: Fix PM reference leak in usb_port_resume()

Bixuan Cui <[email protected]>
usb: musb: fix PM reference leak in musb_irq_work()

Yang Yingliang <[email protected]>
usb: gadget: tegra-xudc: Fix possible use-after-free in tegra_xudc_remove()

Wang Li <[email protected]>
spi: qup: fix PM reference leak in spi_qup_remove()

Wei Yongjun <[email protected]>
spi: omap-100k: Fix reference leak to master

Wei Yongjun <[email protected]>
spi: dln2: Fix reference leak to master

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Account for increased timeout in some cases

Srinivas Pandruvada <[email protected]>
tools/power/x86/intel-speed-select: Increase string size

Ludovic Desroches <[email protected]>
ARM: dts: at91: change the key code of the gpio key

Bhaumik Bhatt <[email protected]>
bus: mhi: core: Clear context for stopped channels from remove()

Mathias Nyman <[email protected]>
xhci: fix potential array out of bounds with several interrupters

Mathias Nyman <[email protected]>
xhci: check control context is valid before dereferencing it.

Mathias Nyman <[email protected]>
xhci: check port array allocation was successful before dereferencing it

Russ Weight <[email protected]>
fpga: dfl: pci: add DID for D5005 PAC cards

Chunfeng Yun <[email protected]>
usb: xhci-mtk: support quirk to disable usb2 lpm

Eric Biggers <[email protected]>
random: initialize ChaCha20 constants with correct endianness

Robin Murphy <[email protected]>
perf/arm_pmu_platform: Fix error handling

Robin Murphy <[email protected]>
perf/arm_pmu_platform: Use dev_err_probe() for IRQ errors

Pierre-Louis Bossart <[email protected]>
soundwire: cadence: only prepare attached devices on clock stop

Jerome Forissier <[email protected]>
tee: optee: do not check memref size on return from Secure World

Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq-librem5-r3: Mark buck3 as always on

Dmitry Osipenko <[email protected]>
soc/tegra: pmc: Fix completion of power-gate toggling

Nathan Chancellor <[email protected]>

    efi/libstub: Add $(CLANG_FLAGS) to x86 flags

Nathan Chancellor <[email protected]>

    x86/boot: Add $(CLANG_FLAGS) to compressed KBUILD_CFLAGS

John Millikin <[email protected]>

    x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS)

Linus Walleij <[email protected]>
ARM: dts: ux500: Fix up TVK R3 sensors

Rafał Miłecki <[email protected]>
ARM: dts: BCM5301X: fix "reg" formatting in /memory node

Andre Przywara <[email protected]>
kselftest/arm64: mte: Fix MTE feature detection

Rafael J. Wysocki <[email protected]>
PCI: PM: Do not read power state in pci_enable_device_flags()

Dmitry Osipenko <[email protected]>
ARM: tegra: acer-a500: Rename avdd to vdda of touchscreen node

Andre Przywara <[email protected]>
kselftest/arm64: mte: Fix compilation with native compiler

Thinh Nguyen <[email protected]>
usb: xhci: Fix port minor revision

Wesley Cheng <[email protected]>
usb: dwc3: gadget: Ignore EP queue requests during bus reset

Ruslan Bilovol <[email protected]>
usb: gadget: f_uac1: validate input parameters

Ruslan Bilovol <[email protected]>
usb: gadget: f_uac2: validate input parameters

Vitaly Kuznetsov <[email protected]>
genirq/matrix: Prevent allocation counter corruption

Longfang Liu <[email protected]>
crypto: hisilicon/sec - fixes a printing error

Joerg Roedel <[email protected]>
x86/sev: Do not require Hypervisor CPUID bit for SEV guests

Pawel Laszczak <[email protected]>
usb: webcam: Invalid size of Processing Unit Descriptor

Pawel Laszczak <[email protected]>
usb: gadget: uvc: add bInterval checking for HS mode

Hui Tang <[email protected]>
crypto: qat - fix unmap invalid dma address

Ard Biesheuvel <[email protected]>
crypto: api - check for ERR pointers in crypto_destroy_tfm()

Bhaumik Bhatt <[email protected]>
bus: mhi: core: Destroy SBL devices when moving to mission mode

David Bauer <[email protected]>
spi: ath79: remove spi-master setup and cleanup assignment

David Bauer <[email protected]>
spi: ath79: always call chipselect function

karthik alapati <[email protected]>
staging: wimax/i2400m: fix byte-order issue

Tony Lindgren <[email protected]>
bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first

Dmitry Osipenko <[email protected]>
cpuidle: tegra: Fix C7 idling state on Tegra114

Phillip Potter <[email protected]>
fbdev: zero-fill colormap in fbcmap.c

Chen Jun <[email protected]>
posix-timers: Preserve return value in clock_adjtime32()

Filipe Manana <[email protected]>
btrfs: fix race between transaction aborts and fsyncs leading to use-after-free

Alexander Shishkin <[email protected]>
intel_th: pci: Add Rocket Lake CPU support

Filipe Manana <[email protected]>
btrfs: fix metadata extent leak after failure to create subvolume

Maciej W. Rozycki <[email protected]>
x86/build: Disable HIGHMEM64G selection for M486SX

Qu Wenruo <[email protected]>
btrfs: handle remount to no compress during compression

Aurelien Aptel <[email protected]>
smb2: fix use-after-free in smb2_ioctl_query_info()

Shyam Prasad N <[email protected]>
cifs: detect dead connections only when echoes are enabled.

Eugene Korenevsky <[email protected]>
cifs: fix out-of-bound memory access when calling smb3_notify() at mount point

Paul Aurich <[email protected]>
cifs: Return correct error code from smb2_get_enc_key

He Ying <[email protected]>
irqchip/gic-v3: Do not enable irqs when handling spurious interrups

Ulf Hansson <[email protected]>
mmc: core: Fix hanging on I/O during system suspend for removable cards

Seunghui Lee <[email protected]>
mmc: core: Set read only for SD cards with permanent write protect bit

DooHyun Hwang <[email protected]>
mmc: core: Do a power cycle when the CMD11 fails

Avri Altman <[email protected]>
mmc: block: Issue a cache flush only when it's enabled

Avri Altman <[email protected]>
mmc: block: Update ext_csd.cache_ctrl if it was written

Aniruddha Tvs Rao <[email protected]>
mmc: sdhci-tegra: Add required callbacks to set/clear CQE_EN bit

Adrian Hunter <[email protected]>
mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based controllers

Pradeep P V K <[email protected]>
mmc: sdhci: Check for reset prior to DMA address unmap

Christophe JAILLET <[email protected]>
mmc: uniphier-sd: Fix a resource leak in the remove function

Christophe JAILLET <[email protected]>
mmc: uniphier-sd: Fix an error handling path in uniphier_sd_probe()

Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Block PCI config access from userspace during reset

Arun Easi <[email protected]>
scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()

Tudor Ambarus <[email protected]>
spi: spi-ti-qspi: Free DMA resources

Christophe Kerello <[email protected]>
spi: stm32-qspi: fix pm_runtime usage_count counter

Gao Xiang <[email protected]>
erofs: add unsupported inode i_format check

Gustavo A. R. Silva <[email protected]>
mtd: physmap: physmap-bt1-rom: Fix unintentional stack access

Kai Stuhlemmer (ebee Engineering) <[email protected]>
mtd: rawnand: atmel: Update ecc_stats.corrected counter

Alexander Lobakin <[email protected]>
mtd: spinand: core: add missing MODULE_DEVICE_TABLE()

Tudor Ambarus <[email protected]>
Revert "mtd: spi-nor: macronix: Add support for mx25l51245g"

Xiang Chen <[email protected]>
mtd: spi-nor: core: Fix an issue of releasing resources during read/write

Davidlohr Bueso <[email protected]>
fs/epoll: restore waking from ep_done_scan()

Jeffrey Mitchell <[email protected]>
ecryptfs: fix kernel panic with null dev_name

Chunfeng Yun <[email protected]>
arm64: dts: mt8173: fix property typo of 'phys' in dsi node

Marek Behún <[email protected]>
arm64: dts: marvell: armada-37xx: add syscon compatible to NB clk node

Ard Biesheuvel <[email protected]>
ARM: 9056/1: decompressor: fix BSS size calculation for LLVM ld.lld

Steven Rostedt (VMware) <[email protected]>
ftrace: Handle commands when closing set_ftrace_filter file

Mark Langsdorf <[email protected]>
ACPI: custom_method: fix a possible memory leak

Mark Langsdorf <[email protected]>
ACPI: custom_method: fix potential use-after-free issue

Stefan Berger <[email protected]>
tpm: acpi: Check eventlog signature before using it

Jason Wang <[email protected]>
vhost-vdpa: fix vm_flags for virtqueue doorbell mapping

Harald Freudenberger <[email protected]>
s390/zcrypt: fix zcard and zqueue hot-unplug memleak

Vasily Gorbik <[email protected]>
s390/disassembler: increase ebpf disasm buffer size

Shuo Chen <[email protected]>
dyndbg: fix parsing file query without a line-range suffix

Mathias Krause <[email protected]>
nitro_enclaves: Fix stale file descriptors on failed usercopy

Jeffrey Hugo <[email protected]>
bus: mhi: core: Sanity check values from remote device before use

Bhaumik Bhatt <[email protected]>
bus: mhi: core: Clear configuration from channel context during reset

Jeffrey Hugo <[email protected]>
bus: mhi: core: Fix check for syserr at power_up

-------------

Diffstat:

 Makefile                                           |  12 +-
 arch/arm/boot/compressed/Makefile                  |   4 +-
 arch/arm/boot/dts/at91-sam9x60ek.dts               |   3 +-
 arch/arm/boot/dts/at91-sama5d27_som1_ek.dts        |   3 +-
 arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts      |   3 +-
 arch/arm/boot/dts/at91-sama5d2_icp.dts             |   3 +-
 arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts          |   3 +-
 arch/arm/boot/dts/at91-sama5d2_xplained.dts        |   3 +-
 arch/arm/boot/dts/at91-sama5d3_xplained.dts        |   3 +-
 arch/arm/boot/dts/at91sam9260ek.dts                |   3 +-
 arch/arm/boot/dts/at91sam9g20ek_common.dtsi        |   3 +-
 arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts        |   4 +-
 arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts        |   4 +-
 arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts  |   4 +-
 arch/arm/boot/dts/bcm4708-netgear-r6250.dts        |   4 +-
 arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts     |   4 +-
 arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts      |   4 +-
 arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts        |   4 +-
 arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts |   4 +-
 arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts  |   4 +-
 arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts        |   4 +-
 arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts  |   4 +-
 arch/arm/boot/dts/bcm4709-linksys-ea9200.dts       |   4 +-
 arch/arm/boot/dts/bcm4709-netgear-r7000.dts        |   4 +-
 arch/arm/boot/dts/bcm4709-netgear-r8000.dts        |   4 +-
 arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts      |   4 +-
 arch/arm/boot/dts/bcm47094-linksys-panamera.dts    |   4 +-
 arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts      |   4 +-
 arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts      |   4 +-
 arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts      |   4 +-
 arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts      |   4 +-
 arch/arm/boot/dts/bcm47094-luxul-xwr-3150-v1.dts   |   4 +-
 arch/arm/boot/dts/bcm47094-netgear-r8500.dts       |   4 +-
 arch/arm/boot/dts/bcm47094-phicomm-k3.dts          |   4 +-
 arch/arm/boot/dts/ste-href-tvk1281618-r3.dtsi      |  73 ++++++---
 arch/arm/boot/dts/tegra20-acer-a500-picasso.dts    |   2 +-
 arch/arm/crypto/curve25519-core.S                  |   2 +-
 .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts |   4 +
 arch/arm64/boot/dts/marvell/armada-37xx.dtsi       |   3 +-
 arch/arm64/boot/dts/mediatek/mt8173.dtsi           |   2 +-
 arch/arm64/kernel/vdso/vdso.lds.S                  |   8 +-
 arch/powerpc/include/asm/reg.h                     |   1 +
 arch/powerpc/include/uapi/asm/errno.h              |   1 +
 arch/powerpc/kernel/eeh.c                          |  11 +-
 arch/powerpc/kernel/setup_64.c                     |  19 ++-
 arch/powerpc/kexec/file_load_64.c                  |  92 +++++++++++
 arch/powerpc/lib/Makefile                          |   3 +
 arch/s390/crypto/arch_random.c                     |   4 +
 arch/s390/kernel/dis.c                             |   2 +-
 arch/x86/Kconfig                                   |   2 +-
 arch/x86/Makefile                                  |   1 +
 arch/x86/boot/compressed/Makefile                  |   1 +
 arch/x86/boot/compressed/mem_encrypt.S             |   6 -
 arch/x86/kernel/cpu/common.c                       |   2 +-
 arch/x86/kernel/sev-es-shared.c                    |   6 +-
 arch/x86/mm/mem_encrypt_identity.c                 |  35 +++--
 crypto/api.c                                       |   2 +-
 crypto/rng.c                                       |  10 +-
 drivers/acpi/arm64/gtdt.c                          |  10 +-
 drivers/acpi/custom_method.c                       |   4 +-
 drivers/ata/ahci.c                                 |   5 +
 drivers/ata/ahci.h                                 |   1 +
 drivers/ata/libahci.c                              |   5 +
 drivers/block/rnbd/rnbd-clt-sysfs.c                |  10 +-
 drivers/bus/mhi/core/init.c                        |  16 +-
 drivers/bus/mhi/core/main.c                        | 110 +++++++++++--
 drivers/bus/mhi/core/pm.c                          |   5 +-
 drivers/bus/ti-sysc.c                              |  49 ++++++
 drivers/char/random.c                              |   4 +-
 drivers/char/tpm/eventlog/acpi.c                   |  33 +++-
 drivers/char/tpm/eventlog/common.c                 |   3 +
 drivers/char/tpm/eventlog/efi.c                    |  29 +++-
 drivers/clk/socfpga/clk-gate-a10.c                 |   1 +
 drivers/cpuidle/cpuidle-tegra.c                    |  12 +-
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c  |   2 +-
 .../crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c    |   2 +-
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c  |   2 +-
 drivers/crypto/hisilicon/sec2/sec_crypto.c         |   2 +-
 drivers/crypto/omap-aes.c                          |   6 +-
 drivers/crypto/qat/qat_common/qat_algs.c           |  11 +-
 drivers/crypto/sa2ul.c                             |   2 +-
 drivers/crypto/stm32/stm32-cryp.c                  |   4 +-
 drivers/crypto/stm32/stm32-hash.c                  |   8 +-
 drivers/extcon/extcon-arizona.c                    |  57 +++----
 drivers/firmware/efi/libstub/Makefile              |   3 +-
 drivers/fpga/dfl-pci.c                             |  18 ++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c          |   5 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |   8 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c           |   9 +-
 drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c           |   7 +-
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c  |  17 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  17 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h  |  14 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  |  15 +-
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c  | 115 +++++++++-----
 .../amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c   |   4 +-
 drivers/gpu/drm/amd/display/dc/core/dc.c           |   3 +-
 drivers/gpu/drm/amd/display/dc/dce/dce_aux.h       |   1 -
 .../gpu/drm/amd/display/dc/dcn30/dcn30_resource.c  |   2 +-
 .../amd/display/dc/dml/dcn20/display_mode_vba_20.c |   1 +
 .../display/dc/dml/dcn20/display_mode_vba_20v2.c   |   1 +
 .../display/dc/dml/dcn20/display_rq_dlg_calc_20.c  |  28 +++-
 .../dc/dml/dcn20/display_rq_dlg_calc_20v2.c        |  28 +++-
 .../display/dc/dml/dcn21/display_rq_dlg_calc_21.c  |  28 +++-
 .../display/dc/dml/dcn30/display_rq_dlg_calc_30.c  |  28 +++-
 .../amd/display/dc/dml/dml1_display_rq_dlg_calc.c  |  28 +++-
 .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c  |   2 +-
 drivers/gpu/drm/arm/display/include/malidp_utils.h |   3 -
 .../gpu/drm/arm/display/komeda/komeda_pipeline.c   |  16 +-
 .../drm/arm/display/komeda/komeda_pipeline_state.c |  19 ++-
 drivers/gpu/drm/ast/ast_drv.c                      |   2 +
 drivers/gpu/drm/ast/ast_mode.c                     |   2 +-
 drivers/gpu/drm/drm_panel_orientation_quirks.c     |  14 ++
 drivers/gpu/drm/i915/intel_pm.c                    |   2 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c   |  18 ++-
 drivers/gpu/drm/msm/dp/dp_hpd.c                    |   4 +-
 drivers/gpu/drm/qxl/qxl_display.c                  |   4 +
 drivers/gpu/drm/qxl/qxl_drv.c                      |   2 +
 drivers/gpu/drm/radeon/radeon_ttm.c                |   5 +-
 drivers/gpu/drm/vkms/vkms_crtc.c                   |   3 +-
 drivers/hwtracing/intel_th/gth.c                   |   4 +-
 drivers/hwtracing/intel_th/pci.c                   |  10 ++
 drivers/input/touchscreen/ili210x.c                |   2 +-
 drivers/irqchip/irq-gic-v3.c                       |   8 +-
 drivers/md/dm-integrity.c                          |   1 +
 drivers/md/dm-raid.c                               |  34 +++-
 drivers/md/dm-rq.c                                 |   2 +
 drivers/md/persistent-data/dm-btree-internal.h     |   4 +-
 drivers/md/persistent-data/dm-space-map-common.c   |   2 +
 drivers/md/persistent-data/dm-space-map-common.h   |   8 +-
 drivers/md/raid1.c                                 |   2 +
 drivers/media/dvb-core/dvbdev.c                    |   1 +
 drivers/media/i2c/adv7511-v4l2.c                   |   2 +-
 drivers/media/i2c/adv7604.c                        |   2 +-
 drivers/media/i2c/adv7842.c                        |   2 +-
 drivers/media/i2c/tc358743.c                       |   2 +-
 drivers/media/i2c/tda1997x.c                       |   2 +-
 drivers/media/pci/saa7164/saa7164-encoder.c        |  20 +--
 drivers/media/pci/sta2x11/Kconfig                  |   1 +
 drivers/media/platform/qcom/venus/hfi_parser.c     |   6 +-
 drivers/media/platform/sti/bdisp/bdisp-debug.c     |   2 +-
 drivers/media/platform/sunxi/sun8i-di/sun8i-di.c   |   2 +-
 drivers/media/rc/ite-cir.c                         |   8 +-
 drivers/media/test-drivers/vivid/vivid-core.c      |   6 +-
 drivers/media/usb/dvb-usb/dvb-usb-init.c           |  90 +++++++----
 drivers/media/usb/dvb-usb/dvb-usb.h                |   2 +-
 drivers/media/usb/em28xx/em28xx-dvb.c              |   1 +
 drivers/media/usb/gspca/gspca.c                    |   2 +
 drivers/media/usb/gspca/gspca.h                    |   1 +
 drivers/media/usb/gspca/sq905.c                    |   2 +-
 drivers/media/usb/gspca/stv06xx/stv06xx.c          |   9 ++
 drivers/media/v4l2-core/v4l2-ctrls.c               | 137 ++++++++--------
 drivers/mfd/arizona-irq.c                          |   2 +-
 drivers/mfd/da9063-i2c.c                           |  10 ++
 drivers/mmc/core/block.c                           |  16 ++
 drivers/mmc/core/core.c                            |  76 +--------
 drivers/mmc/core/core.h                            |  17 +-
 drivers/mmc/core/host.c                            |  40 ++++-
 drivers/mmc/core/mmc.c                             |   7 +
 drivers/mmc/core/mmc_ops.c                         |   4 +-
 drivers/mmc/core/sd.c                              |   6 +
 drivers/mmc/core/sdio.c                            |  28 +++-
 drivers/mmc/host/sdhci-brcmstb.c                   |   1 -
 drivers/mmc/host/sdhci-esdhc-imx.c                 |   2 +-
 drivers/mmc/host/sdhci-pci-core.c                  |  29 ++++
 drivers/mmc/host/sdhci-pci.h                       |   2 +
 drivers/mmc/host/sdhci-tegra.c                     |  32 ++++
 drivers/mmc/host/sdhci.c                           |  60 +++----
 drivers/mmc/host/uniphier-sd.c                     |   5 +-
 drivers/mtd/maps/physmap-bt1-rom.c                 |   2 +-
 drivers/mtd/nand/raw/atmel/nand-controller.c       |   6 +-
 drivers/mtd/nand/spi/core.c                        |   2 +
 drivers/mtd/spi-nor/core.c                         |  33 ++++
 drivers/mtd/spi-nor/macronix.c                     |   3 -
 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c  |  30 ++--
 drivers/net/ethernet/sfc/farch.c                   |  16 +-
 drivers/net/wimax/i2400m/op-rfkill.c               |   2 +-
 drivers/net/wireless/rsi/rsi_91x_sdio.c            |   2 +-
 drivers/nvme/target/discovery.c                    |   6 +-
 drivers/pci/pci.c                                  |  16 +-
 drivers/perf/arm_pmu_platform.c                    |   9 +-
 drivers/phy/ti/phy-twl4030-usb.c                   |   2 +-
 drivers/platform/x86/intel_pmc_core.c              |  19 ++-
 .../x86/intel_speed_select_if/isst_if_mbox_pci.c   |  33 ++--
 drivers/power/supply/bq27xxx_battery.c             |  51 +++---
 drivers/power/supply/cpcap-battery.c               |   2 +-
 drivers/power/supply/cpcap-charger.c               |   3 +
 drivers/power/supply/generic-adc-battery.c         |   2 +-
 drivers/power/supply/lp8788-charger.c              |   2 +-
 drivers/power/supply/pm2301_charger.c              |   2 +-
 drivers/power/supply/s3c_adc_battery.c             |   2 +-
 drivers/power/supply/tps65090-charger.c            |   2 +-
 drivers/power/supply/tps65217_charger.c            |   2 +-
 drivers/s390/crypto/zcrypt_card.c                  |   1 +
 drivers/s390/crypto/zcrypt_queue.c                 |   1 +
 drivers/scsi/device_handler/scsi_dh_alua.c         |   5 +-
 drivers/scsi/libfc/fc_lport.c                      |   2 +-
 drivers/scsi/lpfc/lpfc_attr.c                      |  75 +++++----
 drivers/scsi/lpfc/lpfc_crtn.h                      |   3 -
 drivers/scsi/lpfc/lpfc_hw4.h                       | 174 +--------------------
 drivers/scsi/lpfc/lpfc_init.c                      | 112 +------------
 drivers/scsi/lpfc/lpfc_mbox.c                      |  36 -----
 drivers/scsi/lpfc/lpfc_nportdisc.c                 |  11 +-
 drivers/scsi/lpfc/lpfc_nvmet.c                     |   1 -
 drivers/scsi/lpfc/lpfc_sli.c                       |  43 ++---
 drivers/scsi/mpt3sas/mpt3sas_base.c                |   4 +
 drivers/scsi/qla2xxx/qla_attr.c                    |   8 +-
 drivers/scsi/qla2xxx/qla_bsg.c                     |   3 +-
 drivers/scsi/qla2xxx/qla_os.c                      |   7 -
 drivers/scsi/smartpqi/smartpqi_init.c              | 161 +++++++++++++++++++
 drivers/soc/tegra/pmc.c                            |  70 ++++++++-
 drivers/soundwire/cadence_master.c                 |  10 +-
 drivers/spi/spi-ath79.c                            |   3 +-
 drivers/spi/spi-dln2.c                             |   2 +-
 drivers/spi/spi-omap-100k.c                        |   6 +-
 drivers/spi/spi-qup.c                              |   2 +-
 drivers/spi/spi-stm32-qspi.c                       |  18 ++-
 drivers/spi/spi-ti-qspi.c                          |  20 ++-
 drivers/spi/spi.c                                  |  16 +-
 drivers/staging/media/atomisp/pci/atomisp_fops.c   |   3 +
 drivers/staging/media/imx/imx-media-capture.c      |   2 +-
 drivers/staging/media/ipu3/ipu3-v4l2.c             |  36 +++--
 drivers/target/target_core_pscsi.c                 |   3 +-
 drivers/tee/optee/core.c                           |  10 --
 drivers/thermal/cpufreq_cooling.c                  |   2 +-
 drivers/thermal/gov_fair_share.c                   |   4 +
 drivers/tty/n_gsm.c                                |  14 +-
 drivers/tty/vt/vt.c                                |   1 +
 drivers/usb/core/hub.c                             |   2 +-
 drivers/usb/dwc2/core_intr.c                       |   8 +
 drivers/usb/dwc3/core.c                            |  29 ++++
 drivers/usb/dwc3/core.h                            |   9 +-
 drivers/usb/dwc3/gadget.c                          |  41 +++--
 drivers/usb/gadget/config.c                        |   4 +
 drivers/usb/gadget/function/f_fs.c                 |   3 +-
 drivers/usb/gadget/function/f_uac1.c               |  43 +++++
 drivers/usb/gadget/function/f_uac2.c               |  39 ++++-
 drivers/usb/gadget/function/f_uvc.c                |   8 +-
 drivers/usb/gadget/legacy/webcam.c                 |   1 +
 drivers/usb/gadget/udc/dummy_hcd.c                 |  23 ++-
 drivers/usb/gadget/udc/tegra-xudc.c                |   2 +-
 drivers/usb/host/xhci-mem.c                        |  12 ++
 drivers/usb/host/xhci-mtk.c                        |   3 +
 drivers/usb/host/xhci-mtk.h                        |   1 +
 drivers/usb/host/xhci.c                            |  14 +-
 drivers/usb/musb/musb_core.c                       |   2 +-
 drivers/vhost/vdpa.c                               |   1 +
 drivers/video/backlight/qcom-wled.c                |  29 +++-
 drivers/video/fbdev/core/fbcmap.c                  |   8 +-
 drivers/virt/nitro_enclaves/ne_misc_dev.c          |  43 ++---
 fs/btrfs/compression.c                             |  11 +-
 fs/btrfs/ctree.c                                   |  20 +++
 fs/btrfs/ioctl.c                                   |  18 ++-
 fs/btrfs/relocation.c                              |  46 ++++--
 fs/btrfs/transaction.c                             |  12 +-
 fs/cifs/connect.c                                  |   1 +
 fs/cifs/sess.c                                     |   6 +
 fs/cifs/smb2ops.c                                  |  18 +--
 fs/cifs/smb2pdu.c                                  |   5 +
 fs/ecryptfs/main.c                                 |   6 +
 fs/erofs/erofs_fs.h                                |   3 +
 fs/erofs/inode.c                                   |   7 +
 fs/eventpoll.c                                     |   6 +
 fs/exfat/balloc.c                                  |  11 +-
 fs/ext4/fast_commit.c                              |   4 +-
 fs/ext4/file.c                                     |  25 ++-
 fs/ext4/ialloc.c                                   |  51 ++++--
 fs/ext4/ioctl.c                                    |   6 +
 fs/ext4/mmp.c                                      |   2 +-
 fs/ext4/super.c                                    |   9 +-
 fs/f2fs/node.c                                     |   3 +
 fs/f2fs/verity.c                                   |  75 ++++++---
 fs/fuse/file.c                                     |  41 +++--
 fs/fuse/fuse_i.h                                   |   1 +
 fs/fuse/virtio_fs.c                                |   1 +
 fs/jbd2/transaction.c                              |  15 +-
 fs/jffs2/compr_rtime.c                             |   3 +
 fs/jffs2/file.c                                    |   1 +
 fs/jffs2/scan.c                                    |   2 +-
 fs/nfs/fs_context.c                                |  12 ++
 fs/nfs/pnfs.c                                      |   7 +-
 fs/stat.c                                          |   8 +
 fs/ubifs/replay.c                                  |   3 +-
 include/crypto/acompress.h                         |   2 +
 include/crypto/aead.h                              |   2 +
 include/crypto/akcipher.h                          |   2 +
 include/crypto/chacha.h                            |   9 +-
 include/crypto/hash.h                              |   4 +
 include/crypto/kpp.h                               |   2 +
 include/crypto/rng.h                               |   2 +
 include/crypto/skcipher.h                          |   2 +
 include/linux/mfd/da9063/registers.h               |   3 +
 include/linux/mfd/intel-m10-bmc.h                  |   2 +-
 include/linux/mmc/host.h                           |   3 -
 include/linux/perf_event.h                         |   1 +
 include/linux/power/bq27xxx_battery.h              |   1 -
 include/media/v4l2-ctrls.h                         |  12 +-
 include/scsi/libfcoe.h                             |   2 +-
 include/uapi/linux/usb/video.h                     |   3 +-
 kernel/.gitignore                                  |   1 +
 kernel/Makefile                                    |   9 +-
 kernel/events/core.c                               | 142 +++++++++--------
 kernel/futex.c                                     |   7 +-
 kernel/irq/matrix.c                                |   4 +-
 kernel/kcsan/core.c                                |   2 -
 kernel/kcsan/debugfs.c                             |   4 +-
 kernel/kcsan/kcsan.h                               |   5 -
 kernel/rcu/tree.c                                  |   2 +-
 kernel/sched/fair.c                                |  31 +++-
 kernel/sched/features.h                            |   3 +
 kernel/sched/psi.c                                 |   5 +-
 kernel/time/posix-timers.c                         |   4 +-
 kernel/trace/ftrace.c                              |   5 +-
 kernel/trace/trace.c                               |  41 ++---
 kernel/trace/trace_clock.c                         |  44 ++++--
 lib/dynamic_debug.c                                |   2 +-
 lib/vsprintf.c                                     |   2 -
 net/bluetooth/ecdh_helper.h                        |   2 +-
 net/openvswitch/actions.c                          |   8 +-
 security/commoncap.c                               |   2 +-
 sound/isa/sb/emu8000.c                             |   4 +-
 sound/isa/sb/sb16_csp.c                            |   8 +-
 sound/pci/hda/patch_conexant.c                     |  14 +-
 sound/pci/hda/patch_realtek.c                      |  52 +++++-
 sound/usb/clock.c                                  |  18 ++-
 sound/usb/mixer_maps.c                             |  12 ++
 tools/power/x86/intel-speed-select/isst-display.c  |  12 +-
 tools/power/x86/turbostat/turbostat.c              |  19 ++-
 tools/testing/selftests/arm64/mte/Makefile         |   2 -
 .../testing/selftests/arm64/mte/mte_common_util.c  |  13 +-
 tools/testing/selftests/resctrl/Makefile           |   2 +-
 tools/testing/selftests/resctrl/cache.c            |   8 +-
 tools/testing/selftests/resctrl/cat_test.c         |  12 +-
 tools/testing/selftests/resctrl/cqm_test.c         |  14 +-
 tools/testing/selftests/resctrl/fill_buf.c         |   4 +-
 tools/testing/selftests/resctrl/mba_test.c         |   2 +-
 tools/testing/selftests/resctrl/mbm_test.c         |   2 +-
 tools/testing/selftests/resctrl/resctrl.h          |  21 ++-
 tools/testing/selftests/resctrl/resctrl_tests.c    |  14 +-
 tools/testing/selftests/resctrl/resctrl_val.c      |  85 ++++++----
 tools/testing/selftests/resctrl/resctrlfs.c        |  79 +++++++---
 344 files changed, 3031 insertions(+), 1640 deletions(-)

From: Jeffrey Hugo <[email protected]>

commit 6403298c58d4858d93648f553abf0bcbd2dfaca2 upstream.

The check to see if we have reset the device after detecting syserr at power_up is inverted. wait_for_event_timeout() returns 0 on failure, and a positive value on success. The check is looking for non-zero as a failure, which is likely to incorrectly cause a device init failure if syserr was detected at power_up. Fix this.

---
 drivers/bus/mhi/core/pm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -992,7 +992,7 @@ int mhi_async_power_up(struct mhi_contro
 							   &val) ||
 					!val,
 				msecs_to_jiffies(mhi_cntrl->timeout_ms));
-		if (ret) {
+		if (!ret) {
 			ret = -EIO;
 			dev_info(dev, "Failed to reset MHI due to syserr state\n");
 			goto error_bhi_offset;

From: Bhaumik Bhatt <[email protected]>

commit 47705c08465931923e2f2b506986ca0bdf80380d upstream.

When clearing up the channel context after client drivers are done using channels, the configuration is currently not being reset entirely. Ensure this is done to appropriately handle issues where clients unaware of the context state end up calling functions which expect a context.

---
 drivers/bus/mhi/core/init.c |   13 +++++++++++++
 1 file changed, 13 insertions(+)

@@ -544,6 +544,7 @@ void mhi_deinit_chan_ctxt(struct mhi_con
 	struct mhi_ring *buf_ring;
 	struct mhi_ring *tre_ring;
 	struct mhi_chan_ctxt *chan_ctxt;
+	u32 tmp;
 
 	buf_ring = &mhi_chan->buf_ring;
 	tre_ring = &mhi_chan->tre_ring;

@@ -554,7 +555,19 @@ void mhi_deinit_chan_ctxt(struct mhi_con
 	vfree(buf_ring->base);
 
 	buf_ring->base = tre_ring->base = NULL;
+	tre_ring->ctxt_wp = NULL;
 	chan_ctxt->rbase = 0;
+	chan_ctxt->rlen = 0;
+	chan_ctxt->rp = 0;
+	chan_ctxt->wp = 0;
+
+	tmp = chan_ctxt->chcfg;
+	tmp &= ~CHAN_CTX_CHSTATE_MASK;
+	tmp |= (MHI_CH_STATE_DISABLED << CHAN_CTX_CHSTATE_SHIFT);
+	chan_ctxt->chcfg = tmp;
+
+	/* Update to all cores */
+	smp_wmb();
 }
 
 int mhi_init_chan_ctxt(struct mhi_controller *mhi_cntrl,

Hi!

...

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Hi Pavel,

Thanks for looking into this.

I agree that the order could be mangled between chcfg read & write and using READ_ONCE & WRITE_ONCE seems to be a good option.

Bhaumik, can you please submit a patch and tag stable?

Thanks,
Mani

Hi Pavel/Mani,

Hemant and I went over this patch and we noticed this particular function is already being called with the channel mutex lock held. This would take care of the atomicity and we also probably don't need the smp_wmb() barrier as the mutex unlock will implicitly take care of it.

To the point of compiler re-ordering, we would need some help to understand the purpose of READ_ONCE()/WRITE_ONCE() for these dependent statements:

okay

Well, I agree that there is a minimal guarantee with modern day CPUs on not breaking the order of dependent memory accesses (like here tmp variable is the one which gets read and written) but we want to make sure that this won't break on future CPUs as well. So IMO using READ_ONCE and WRITE_ONCE adds extra level of safety.

Thanks,
Mani

?

I'm sorry, but this argument is non-sense to me, and so I want to understand more.

I've talked to our CPU designers from time to time, but cannot speak for other vendors. A modern CPU can easily reorder accesses all it wants, so long as it does not change the end result. This is typically identified via "data dependencies", where the CPU identifies that the result of a previous instruction is required to be known before processing the current instruction (or any instructions in flight in the pipeline, the instructions don't need to be adjacent). These data dependencies can be "read" or "write".

The typical reason barriers are needed is because the CPU cannot detect these dependencies when we are talking about different "memory". For example, a write to a register in some hardware block to program some mode, and then a write to another register to activate the hardware block based on that mode. In this example, there is no data dependency that the CPU can detect, although you and I as the software writer knows there is a specific order to these operations. Thus, a barrier is required.

Your argument is that we need to protect against some hypothetical future CPU where these data dependencies are ignored, and so the CPU reorders things. Except that means that the end result is (possibly) changed, meaning the contract between software and hardware is no longer valid. It breaks the entire memory model for the C language.

In the above code snippet, you are saying this is valid for some future CPU to do:

tmp = chan_ctxt->chcfg;
chan_ctxt->chcfg = tmp; //probably optimized out because this now obviously has no effect tmp &= ~CHAN_CTX_CHSTATE_MASK;
tmp |= (MHI_CH_STATE_DISABLED << CHAN_CTX_CHSTATE_SHIFT);

That is clearly wrong (I seriously hope you agree), and while I've seen hardware designers do some boneheaded things to the point where I don't trust them a lot of the time, I have a hard time believing they would think that is acceptable.

That fundamentally breaks all of software to the point where the only recourse is to have a literal barrier between every line of code. That doubles the line count of Linux and kills all performance. Its plainly not tenable.

So, seriously, please explain your view in great detail because it feels like we are talking past each-other and not coming to common ground. As I understand it, adding an explicit barrier in a patch cannot be done "just because" and requires a good documented reason (in a comment next to the barrier) for why the barrier is required. It seems like the same level of scrutiny should be applied for READ_ONCE/WRITE_ONCE, but your reason for adding them, "using READ_ONCE and WRITE_ONCE adds extra level of safety", reads like the reason to use them is "just because" to me.

Jeff, I do understand your point here and I completely agree. I just went with the question raised by Pavel and was trying to be on the safe side (which might not be a valid thing as you said).

Let's hear from Pavel on what exactly his concern is! Maybe I went in the wrong direction.

Thanks for your views.

Thanks,
Mani

Hi!

Umm, if this is protected by locking, already, we really should not add READ_ONCE. Code should be clear, not having "extra safety levels".

I assumed it was running unlocked due to the way it was written.

Best regards,
Pavel

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Thanks for the confirmation Pavel.

Thanks,
Bhaumik
---
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project

From: Jeffrey Hugo <[email protected]>

commit ec32332df7645e0ba463a08d483fe97665167071 upstream.

When parsing the structures in the shared memory, there are values which come from the remote device. For example, a transfer completion event will have a pointer to the tre in the relevant channel's transfer ring. As another example, event ring elements may specify a channel in which the event occurred, however the specified channel value may not be valid as no channel is defined at that index even though the index may be less than the maximum allowed index. Such values should be considered to be untrusted, and validated before use. If we blindly use such values, we may access invalid data or crash if the values are corrupted.

If validation fails, drop the relevant event.

---
 drivers/bus/mhi/core/main.c |   81 ++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 74 insertions(+), 7 deletions(-)

@@ -220,6 +220,11 @@ static void mhi_del_ring_element(struct
 	smp_wmb();
 }
 
+static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr)
+{
+	return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len;
+}
+
 int mhi_destroy_device(struct device *dev, void *data)
 {
 	struct mhi_device *mhi_dev;

@@ -349,7 +354,16 @@ irqreturn_t mhi_irq_handler(int irq_numb
 	struct mhi_event_ctxt *er_ctxt =
 		&mhi_cntrl->mhi_ctxt->er_ctxt[mhi_event->er_index];
 	struct mhi_ring *ev_ring = &mhi_event->ring;
-	void *dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);
+	dma_addr_t ptr = er_ctxt->rp;
+	void *dev_rp;
+
+	if (!is_valid_ring_ptr(ev_ring, ptr)) {
+		dev_err(&mhi_cntrl->mhi_dev->dev,
+			"Event ring rp points outside of the event ring\n");
+		return IRQ_HANDLED;
+	}
+
+	dev_rp = mhi_to_virtual(ev_ring, ptr);
 
 	/* Only proceed if event ring has pending events */
 	if (ev_ring->rp == dev_rp)

@@ -498,6 +512,11 @@ static int parse_xfer_event(struct mhi_c
 		struct mhi_buf_info *buf_info;
 		u16 xfer_len;
 
+		if (!is_valid_ring_ptr(tre_ring, ptr)) {
+			dev_err(&mhi_cntrl->mhi_dev->dev,
+				"Event element points outside of the tre ring\n");
+			break;
+		}
 		/* Get the TRB this event points to */
 		ev_tre = mhi_to_virtual(tre_ring, ptr);
 

@@ -657,6 +676,12 @@ static void mhi_process_cmd_completion(s
 	struct mhi_chan *mhi_chan;
 	u32 chan;
 
+	if (!is_valid_ring_ptr(mhi_ring, ptr)) {
+		dev_err(&mhi_cntrl->mhi_dev->dev,
+			"Event element points outside of the cmd ring\n");
+		return;
+	}
+
 	cmd_pkt = mhi_to_virtual(mhi_ring, ptr);
 
 	chan = MHI_TRE_GET_CMD_CHID(cmd_pkt);

@@ -681,6 +706,7 @@ int mhi_process_ctrl_ev_ring(struct mhi_
 	struct device *dev = &mhi_cntrl->mhi_dev->dev;
 	u32 chan;
 	int count = 0;
+	dma_addr_t ptr = er_ctxt->rp;
 
 	/*
 	 * This is a quick check to avoid unnecessary event processing

@@ -690,7 +716,13 @@ int mhi_process_ctrl_ev_ring(struct mhi_
 	if (unlikely(MHI_EVENT_ACCESS_INVALID(mhi_cntrl->pm_state)))
 		return -EIO;
 
-	dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);
+	if (!is_valid_ring_ptr(ev_ring, ptr)) {
+		dev_err(&mhi_cntrl->mhi_dev->dev,
+			"Event ring rp points outside of the event ring\n");
+		return -EIO;
+	}
+
+	dev_rp = mhi_to_virtual(ev_ring, ptr);
 	local_rp = ev_ring->rp;
 
 	while (dev_rp != local_rp) {

@@ -801,6 +833,8 @@ int mhi_process_ctrl_ev_ring(struct mhi_
 			 */
 			if (chan < mhi_cntrl->max_chan) {
 				mhi_chan = &mhi_cntrl->mhi_chan[chan];
+				if (!mhi_chan->configured)
+					break;
 				parse_xfer_event(mhi_cntrl, local_rp, mhi_chan);
 				event_quota--;
 			}

@@ -812,7 +846,15 @@ int mhi_process_ctrl_ev_ring(struct mhi_
 
 		mhi_recycle_ev_ring_element(mhi_cntrl, ev_ring);
 		local_rp = ev_ring->rp;
-		dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);
+
+		ptr = er_ctxt->rp;
+		if (!is_valid_ring_ptr(ev_ring, ptr)) {
+			dev_err(&mhi_cntrl->mhi_dev->dev,
+				"Event ring rp points outside of the event ring\n");
+			return -EIO;
+		}
+
+		dev_rp = mhi_to_virtual(ev_ring, ptr);
 		count++;
 	}
 

@@ -835,11 +877,18 @@ int mhi_process_data_event_ring(struct m
 	int count = 0;
 	u32 chan;
 	struct mhi_chan *mhi_chan;
+	dma_addr_t ptr = er_ctxt->rp;
 
 	if (unlikely(MHI_EVENT_ACCESS_INVALID(mhi_cntrl->pm_state)))
 		return -EIO;
 
-	dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);
+	if (!is_valid_ring_ptr(ev_ring, ptr)) {
+		dev_err(&mhi_cntrl->mhi_dev->dev,
+			"Event ring rp points outside of the event ring\n");
+		return -EIO;
+	}
+
+	dev_rp = mhi_to_virtual(ev_ring, ptr);
 	local_rp = ev_ring->rp;
 
 	while (dev_rp != local_rp && event_quota > 0) {

@@ -853,7 +902,8 @@ int mhi_process_data_event_ring(struct m
 		 * Only process the event ring elements whose channel
 		 * ID is within the maximum supported range.
 		 */
-		if (chan < mhi_cntrl->max_chan) {
+		if (chan < mhi_cntrl->max_chan &&
+		    mhi_cntrl->mhi_chan[chan].configured) {
 			mhi_chan = &mhi_cntrl->mhi_chan[chan];
 
 			if (likely(type == MHI_PKT_TYPE_TX_EVENT)) {

@@ -867,7 +917,15 @@ int mhi_process_data_event_ring(struct m
 
 		mhi_recycle_ev_ring_element(mhi_cntrl, ev_ring);
 		local_rp = ev_ring->rp;
-		dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);
+
+		ptr = er_ctxt->rp;
+		if (!is_valid_ring_ptr(ev_ring, ptr)) {
+			dev_err(&mhi_cntrl->mhi_dev->dev,
+				"Event ring rp points outside of the event ring\n");
+			return -EIO;
+		}
+
+		dev_rp = mhi_to_virtual(ev_ring, ptr);
 		count++;
 	}
 	read_lock_bh(&mhi_cntrl->pm_lock);

@@ -1394,6 +1452,7 @@ static void mhi_mark_stale_events(struct
 	struct mhi_ring *ev_ring;
 	struct device *dev = &mhi_cntrl->mhi_dev->dev;
 	unsigned long flags;
+	dma_addr_t ptr;
 
 	dev_dbg(dev, "Marking all events for chan: %d as stale\n", chan);
 

@@ -1401,7 +1460,15 @@ static void mhi_mark_stale_events(struct
 
 	/* mark all stale events related to channel as STALE event */
 	spin_lock_irqsave(&mhi_event->lock, flags);
-	dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);
+
+	ptr = er_ctxt->rp;
+	if (!is_valid_ring_ptr(ev_ring, ptr)) {
+		dev_err(&mhi_cntrl->mhi_dev->dev,
+			"Event ring rp points outside of the event ring\n");
+		dev_rp = ev_ring->rp;
+	} else {
+		dev_rp = mhi_to_virtual(ev_ring, ptr);
+	}
 
 	local_rp = ev_ring->rp;
 	while (dev_rp != local_rp) {

From: Mathias Krause <[email protected]>

commit f1ce3986baa62cffc3c5be156994de87524bab99 upstream.

A failing usercopy of the slot uid will lead to a stale entry in the file descriptor table as put_unused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios.

Exchanging put_unused_fd() for close_fd(), ksys_close() or alike won't solve the underlying issue, as the file descriptor might have been replaced in the meantime, e.g. via userland calling close() on it (leading to a NULL pointer dereference in the error handling code as 'fget(enclave_fd)' will return a NULL pointer) or by dup2()'ing a completely different file object to that very file descriptor, leading to the same situation: a dangling file descriptor pointing to a freed object -- just in this case to a file object of user's choosing.

Generally speaking, after the call to fd_install() the file descriptor is live and userland is free to do whatever with it. We cannot rely on it to still refer to our enclave object afterwards. In fact, by abusing userfaultfd() userland can hit the condition without any racing and abuse the error handling in the nitro code as it pleases.

To fix the above issues, defer the call to fd_install() until all possible errors are handled. In this case it's just the usercopy, so do it directly in ne_create_vm_ioctl() itself.

---
 drivers/virt/nitro_enclaves/ne_misc_dev.c |   43 +++++++++++-------------------
 1 file changed, 17 insertions(+), 26 deletions(-)

@@ -1524,7 +1524,8 @@ static const struct file_operations ne_e
  *			  enclave file descriptor to be further used for enclave
  *			  resources handling e.g. memory regions and CPUs.
  * @ne_pci_dev :	Private data associated with the PCI device.
- * @slot_uid:		Generated unique slot id associated with an enclave.
+ * @slot_uid:		User pointer to store the generated unique slot id
+ *			associated with an enclave to.
  *
  * Context: Process context. This function is called with the ne_pci_dev enclave
  *	    mutex held.

@@ -1532,7 +1533,7 @@ static const struct file_operations ne_e
  * * Enclave fd on success.
  * * Negative return value on failure.
  */
-static int ne_create_vm_ioctl(struct ne_pci_dev *ne_pci_dev, u64 *slot_uid)
+static int ne_create_vm_ioctl(struct ne_pci_dev *ne_pci_dev, u64 __user *slot_uid)
 {
 	struct ne_pci_dev_cmd_reply cmd_reply = {};
 	int enclave_fd = -1;

@@ -1634,7 +1635,18 @@ static int ne_create_vm_ioctl(struct ne_
 
 	list_add(&ne_enclave->enclave_list_entry, &ne_pci_dev->enclaves_list);
 
-	*slot_uid = ne_enclave->slot_uid;
+	if (copy_to_user(slot_uid, &ne_enclave->slot_uid, sizeof(ne_enclave->slot_uid))) {
+		/*
+		 * As we're holding the only reference to 'enclave_file', fput()
+		 * will call ne_enclave_release() which will do a proper cleanup
+		 * of all so far allocated resources, leaving only the unused fd
+		 * for us to free.
+		 */
+		fput(enclave_file);
+		put_unused_fd(enclave_fd);
+
+		return -EFAULT;
+	}
 
 	fd_install(enclave_fd, enclave_file);
 

@@ -1671,34 +1683,13 @@ static long ne_ioctl(struct file *file,
 	switch (cmd) {
 	case NE_CREATE_VM: {
 		int enclave_fd = -1;
-		struct file *enclave_file = NULL;
 		struct ne_pci_dev *ne_pci_dev = ne_devs.ne_pci_dev;
-		int rc = -EINVAL;
-		u64 slot_uid = 0;
+		u64 __user *slot_uid = (void __user *)arg;
 
 		mutex_lock(&ne_pci_dev->enclaves_list_mutex);
-
-		enclave_fd = ne_create_vm_ioctl(ne_pci_dev, &slot_uid);
-		if (enclave_fd < 0) {
-			rc = enclave_fd;
-
-			mutex_unlock(&ne_pci_dev->enclaves_list_mutex);
-
-			return rc;
-		}
-
+		enclave_fd = ne_create_vm_ioctl(ne_pci_dev, slot_uid);
 		mutex_unlock(&ne_pci_dev->enclaves_list_mutex);
 
-		if (copy_to_user((void __user *)arg, &slot_uid, sizeof(slot_uid))) {
-			enclave_file = fget(enclave_fd);
-			/* Decrement file refs to have release() called. */
-			fput(enclave_file);
-			fput(enclave_file);
-			put_unused_fd(enclave_fd);
-
-			return -EFAULT;
-		}
-
 		return enclave_fd;
 	}
 

From: Shuo Chen <[email protected]>

commit 7b1ae248279bea33af9e797a93c35f49601cb8a0 upstream.

Query like 'file tcp_input.c line 1234 +p' was broken by
commit aaebe329bff0 ("dyndbg: accept 'file foo.c:func1' and 'file foo.c:10-100'") because a file name without a ':' now makes the loop in ddebug_parse_query() exits early before parsing the 'line 1234' part. As a result, all pr_debug() in tcp_input.c will be enabled, instead of only the one on line 1234. Changing 'break' to 'continue' fixes this.

---
 lib/dynamic_debug.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -396,7 +396,7 @@ static int ddebug_parse_query(char *word
 			/* tail :$info is function or line-range */
 			fline = strchr(query->filename, ':');
 			if (!fline)
-				break;
+				continue;
 			*fline++ = '\0';
 			if (isalpha(*fline) || *fline == '*' || *fline == '?') {
 				/* take as function name */

From: Vasily Gorbik <[email protected]>

commit 6f3353c2d2b3eb4de52e9704cb962712033db181 upstream.

Current ebpf disassembly buffer size of 64 is too small. E.g. this line takes 65 bytes:
01fffff8005822e: ec8100ed8065\tclgrj\t%r8,%r1,8,001fffff80058408\n\0

Double the buffer size like it is done for the kernel disassembly buffer.

Fixes the following KASAN finding:

UG: KASAN: stack-out-of-bounds in print_fn_code+0x34c/0x380

Write of size 1 at addr 001fff800ad5f970 by task test_progs/853

CPU: 53 PID: 853 Comm: test_progs Not tainted
5.12.0-rc7-23786-g23457d86b1f0-dirty #19
Hardware name: IBM 3906 M04 704 (LPAR)
Call Trace:
 [<0000000cd8e0538a>] show_stack+0x17a/0x1668
 [<0000000cd8e2a5d8>] dump_stack+0x140/0x1b8
 [<0000000cd8e16e74>] print_address_description.constprop.0+0x54/0x260
 [<0000000cd75a8698>] kasan_report+0xc8/0x130
 [<0000000cd6e26da4>] print_fn_code+0x34c/0x380
 [<0000000cd6ea0f4e>] bpf_int_jit_compile+0xe3e/0xe58
 [<0000000cd72c4c88>] bpf_prog_select_runtime+0x5b8/0x9c0
 [<0000000cd72d1bf8>] bpf_prog_load+0xa78/0x19c0
 [<0000000cd72d7ad6>] __do_sys_bpf.part.0+0x18e/0x768
 [<0000000cd6e0f392>] do_syscall+0x12a/0x220
 [<0000000cd8e333f8>] __do_syscall+0x98/0xc8
 [<0000000cd8e54834>] system_call+0x6c/0x94
1 lock held by test_progs/853:
 #0: 0000000cd9bf7460 (report_lock){....}-{2:2}, at:
     kasan_report+0x96/0x130

addr 001fff800ad5f970 is located in stack of task test_progs/853 at offset 96 in frame:
print_fn_code+0x0/0x380
this frame has 1 object:
[32, 96) 'buffer'

Memory state around the buggy address:
 001fff800ad5f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 001fff800ad5f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>001fff800ad5f900: 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 f3 f3
                                                             ^
 001fff800ad5f980: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 001fff800ad5fa00: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00

---
 arch/s390/kernel/dis.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -563,7 +563,7 @@ void show_code(struct pt_regs *regs)
 
 void print_fn_code(unsigned char *code, unsigned long len)
 {
-	char buffer[64], *ptr;
+	char buffer[128], *ptr;
 	int opsize, i;
 
 	while (len) {

From: Harald Freudenberger <[email protected]>

commit 70fac8088cfad9f3b379c9082832b4d7532c16c2 upstream.

Tests with kvm and a kmemdebug kernel showed, that on hot unplug the zcard and zqueue structs for the unplugged card or queue are not properly freed because of a mismatch with get/put for the embedded kref counter.

This fix now adjusts the handling of the kref counters. With init the kref counter starts with 1. This initial value needs to drop to zero with the unregister of the card or queue to trigger the release and free the object.

---
 drivers/s390/crypto/zcrypt_card.c  |    1 +
 drivers/s390/crypto/zcrypt_queue.c |    1 +
 2 files changed, 2 insertions(+)

@@ -192,5 +192,6 @@ void zcrypt_card_unregister(struct zcryp
 	spin_unlock(&zcrypt_list_lock);
 	sysfs_remove_group(&zc->card->ap_dev.device.kobj,
 			   &zcrypt_card_attr_group);
+	zcrypt_card_put(zc);
 }
 EXPORT_SYMBOL(zcrypt_card_unregister);

@@ -223,5 +223,6 @@ void zcrypt_queue_unregister(struct zcry
 	sysfs_remove_group(&zq->queue->ap_dev.device.kobj,
 			   &zcrypt_queue_attr_group);
 	zcrypt_card_put(zc);
+	zcrypt_queue_put(zq);
 }
 EXPORT_SYMBOL(zcrypt_queue_unregister);

From: Jason Wang <[email protected]>

commit 3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44 upstream.

The virtqueue doorbell is usually implemented via registeres but we don't provide the necessary vma->flags like VM_PFNMAP. This may cause several issues e.g when userspace tries to map the doorbell via vhost IOTLB, kernel may panic due to the page is not backed by page structure. This patch fixes this by setting the necessary vm_flags. With this patch, try to map doorbell via IOTLB will fail with bad address.

---
 drivers/vhost/vdpa.c |    1 +
 1 file changed, 1 insertion(+)

@@ -997,6 +997,7 @@ static int vhost_vdpa_mmap(struct file *
 	if (vma->vm_end - vma->vm_start != notify.size)
 		return -ENOTSUPP;
 
+	vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;
 	vma->vm_ops = &vhost_vdpa_vm_ops;
 	return 0;
 }

From: Stefan Berger <[email protected]>

commit 3dcd15665aca80197333500a4be3900948afccc1 upstream.

Check the eventlog signature before using it. This avoids using an empty log, as may be the case when QEMU created the ACPI tables, rather than probing the EFI log next. This resolves an issue where the EFI log was empty since an empty ACPI log was used.

---
 drivers/char/tpm/eventlog/acpi.c |   33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

@@ -41,6 +41,27 @@ struct acpi_tcpa {
 	};
 };
 
+/* Check that the given log is indeed a TPM2 log. */
+static bool tpm_is_tpm2_log(void *bios_event_log, u64 len)
+{
+	struct tcg_efi_specid_event_head *efispecid;
+	struct tcg_pcr_event *event_header;
+	int n;
+
+	if (len < sizeof(*event_header))
+		return false;
+	len -= sizeof(*event_header);
+	event_header = bios_event_log;
+
+	if (len < sizeof(*efispecid))
+		return false;
+	efispecid = (struct tcg_efi_specid_event_head *)event_header->event;
+
+	n = memcmp(efispecid->signature, TCG_SPECID_SIG,
+		   sizeof(TCG_SPECID_SIG));
+	return n == 0;
+}
+
 /* read binary bios log */
 int tpm_read_log_acpi(struct tpm_chip *chip)
 {

@@ -52,6 +73,7 @@ int tpm_read_log_acpi(struct tpm_chip *c
 	struct acpi_table_tpm2 *tbl;
 	struct acpi_tpm2_phy *tpm2_phy;
 	int format;
+	int ret;
 
 	log = &chip->log;
 

@@ -112,6 +134,7 @@ int tpm_read_log_acpi(struct tpm_chip *c
 
 	log->bios_event_log_end = log->bios_event_log + len;
 
+	ret = -EIO;
 	virt = acpi_os_map_iomem(start, len);
 	if (!virt)
 		goto err;

@@ -119,11 +142,19 @@ int tpm_read_log_acpi(struct tpm_chip *c
 	memcpy_fromio(log->bios_event_log, virt, len);
 
 	acpi_os_unmap_iomem(virt, len);
+
+	if (chip->flags & TPM_CHIP_FLAG_TPM2 &&
+	    !tpm_is_tpm2_log(log->bios_event_log, len)) {
+		/* try EFI log next */
+		ret = -ENODEV;
+		goto err;
+	}
+
 	return format;
 
 err:
 	kfree(log->bios_event_log);
 	log->bios_event_log = NULL;
-	return -EIO;
+	return ret;
 
 }

From: Mark Langsdorf <[email protected]>

commit e483bb9a991bdae29a0caa4b3a6d002c968f94aa upstream.

In cm_write(), buf is always freed when reaching the end of the function. If the requested count is less than table.length, the allocated buffer will be freed but subsequent calls to cm_write() will still try to access it.

Remove the unconditional kfree(buf) at the end of the function and set the buf to NULL in the -EINVAL error path to match the rest of function.

---
 drivers/acpi/custom_method.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -55,6 +55,7 @@ static ssize_t cm_write(struct file *fil
 	    (*ppos + count < count) ||
 	    (count > uncopied_bytes)) {
 		kfree(buf);
+		buf = NULL;
 		return -EINVAL;
 	}
 

@@ -76,7 +77,6 @@ static ssize_t cm_write(struct file *fil
 		add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE);
 	}
 
-	kfree(buf);
 	return count;
 }
 

From: Mark Langsdorf <[email protected]>

commit 1cfd8956437f842836e8a066b40d1ec2fc01f13e upstream.

In cm_write(), if the 'buf' is allocated memory but not fully consumed, it is possible to reallocate the buffer without freeing it by passing '*ppos' as 0 on a subsequent call.

Add an explicit kfree() before kzalloc() to prevent the possible memory leak.

---
 drivers/acpi/custom_method.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -42,6 +42,8 @@ static ssize_t cm_write(struct file *fil
 				   sizeof(struct acpi_table_header)))
 			return -EFAULT;
 		uncopied_bytes = max_size = table.length;
+		/* make sure the buf is not allocated */
+		kfree(buf);
 		buf = kzalloc(max_size, GFP_KERNEL);
 		if (!buf)
 			return -ENOMEM;

From: Steven Rostedt (VMware) <[email protected]>

commit 8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 upstream.

 # echo switch_mm:traceoff > /sys/kernel/tracing/set_ftrace_filter

will cause switch_mm to stop tracing by the traceoff command.

 # echo -n switch_mm:traceoff > /sys/kernel/tracing/set_ftrace_filter

does nothing.

The reason is that the parsing in the write function only processes commands if it finished parsing (there is white space written after the command). That's to handle:

write(fd, "switch_mm:", 10);
write(fd, "traceoff", 8);

cases, where the command is broken over multiple writes.

The problem is if the file descriptor is closed, then the write call is not processed, and the command needs to be processed in the release code. The release code can handle matching of functions, but does not handle commands.

---
 kernel/trace/ftrace.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

@@ -5632,7 +5632,10 @@ int ftrace_regex_release(struct inode *i
 
 	parser = &iter->parser;
 	if (trace_parser_loaded(parser)) {
-		ftrace_match_records(iter->hash, parser->buffer, parser->idx);
+		int enable = !(iter->flags & FTRACE_ITER_NOTRACE);
+
+		ftrace_process_regex(iter, parser->buffer,
+				     parser->idx, enable);
 	}
 
 	trace_parser_put(parser);

From: Ard Biesheuvel <[email protected]>

commit c4e792d1acce31c2eb7b9193ab06ab94de05bf42 upstream.

The LLVM ld.lld linker uses a different symbol type for __bss_start, resulting in the calculation of KBSS_SZ to be thrown off. Up until now, this has gone unnoticed as it only affects the appended DTB case, but pending changes for ARM in the way the decompressed kernel is cleaned from the caches has uncovered this problem.

On a ld.lld build:

  $ nm vmlinux |grep bss_
  c1c22034 D __bss_start
  c1c86e98 B __bss_stop

resulting in

  $ readelf -s arch/arm/boot/compressed/vmlinux | grep bss_size
  433: c1c86e98     0 NOTYPE  GLOBAL DEFAULT  ABS _kernel_bss_size

which is obviously incorrect, and may cause the cache clean to access unmapped memory, or cause the size calculation to wrap, resulting in no cache clean to be performed at all.

Fix this by updating the sed regex to take D type symbols into account.

---
 arch/arm/boot/compressed/Makefile |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -114,8 +114,8 @@ asflags-y := -DZIMAGE
 
 # Supply kernel BSS size to the decompressor via a linker symbol.
 KBSS_SZ = $(shell echo $$(($$($(NM) $(obj)/../../../../vmlinux | \
-		sed -n -e 's/^\([^ ]*\) [AB] __bss_start$$/-0x\1/p' \
-		       -e 's/^\([^ ]*\) [AB] __bss_stop$$/+0x\1/p') )) )
+		sed -n -e 's/^\([^ ]*\) [ABD] __bss_start$$/-0x\1/p' \
+		       -e 's/^\([^ ]*\) [ABD] __bss_stop$$/+0x\1/p') )) )
 LDFLAGS_vmlinux = --defsym _kernel_bss_size=$(KBSS_SZ)
 # Supply ZRELADDR to the decompressor via a linker symbol.
 ifneq ($(CONFIG_AUTO_ZRELADDR),y)

From: Marek Behún <[email protected]>

commit 1d88358a89dbac9c7d4559548b9a44840456e6fb upstream.

Add "syscon" compatible to the North Bridge clocks node to allow the cpufreq driver to access these registers via syscon API.

This is needed for a fix of cpufreq driver.

---
 arch/arm64/boot/dts/marvell/armada-37xx.dtsi |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -156,7 +156,8 @@
 			};
 
 			nb_periph_clk: nb-periph-clk@13000 {
-				compatible = "marvell,armada-3700-periph-clock-nb";
+				compatible = "marvell,armada-3700-periph-clock-nb",
+					     "syscon";
 				reg = <0x13000 0x100>;
 				clocks = <&tbg 0>, <&tbg 1>, <&tbg 2>,
 				<&tbg 3>, <&xtalclk>;

From: Chunfeng Yun <[email protected]>

commit e4e5d030bd779fb8321d3b8bd65406fbe0827037 upstream.

Use 'phys' instead of 'phy'.

---
 arch/arm64/boot/dts/mediatek/mt8173.dtsi |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1169,7 +1169,7 @@
 				 <&mmsys CLK_MM_DSI1_DIGITAL>,
 				 <&mipi_tx1>;
 			clock-names = "engine", "digital", "hs";
-			phy = <&mipi_tx1>;
+			phys = <&mipi_tx1>;
 			phy-names = "dphy";
 			status = "disabled";
 		};

From: Jeffrey Mitchell <[email protected]>

commit 9046625511ad8dfbc8c6c2de16b3532c43d68d48 upstream.

When mounting eCryptfs, a null "dev_name" argument to ecryptfs_mount() causes a kernel panic if the parsed options are valid. The easiest way to reproduce this is to call mount() from userspace with an existing eCryptfs mount's options and a "source" argument of 0.

Error out if "dev_name" is null in ecryptfs_mount()

---
 fs/ecryptfs/main.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -492,6 +492,12 @@ static struct dentry *ecryptfs_mount(str
 		goto out;
 	}
 
+	if (!dev_name) {
+		rc = -EINVAL;
+		err = "Device name cannot be null";
+		goto out;
+	}
+
 	rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid);
 	if (rc) {
 		err = "Error parsing options";

From: Davidlohr Bueso <[email protected]>

commit 7fab29e356309ff93a4b30ecc466129682ec190b upstream.

Commit 339ddb53d373 ("fs/epoll: remove unnecessary wakeups of nested epoll") changed the userspace visible behavior of exclusive waiters blocked on a common epoll descriptor upon a single event becoming ready.

Previously, all tasks doing epoll_wait would awake, and now only one is awoken, potentially causing missed wakeups on applications that rely on this behavior, such as Apache Qpid.

While the aforementioned commit aims at having only a wakeup single path in ep_poll_callback (with the exceptions of epoll_ctl cases), we need to restore the wakeup in what was the old ep_scan_ready_list() such that the next thread can be awoken, in a cascading style, after the waker's corresponding ep_send_events().

---
 fs/eventpoll.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -746,6 +746,12 @@ static __poll_t ep_scan_ready_list(struc
 	 */
 	list_splice(&txlist, &ep->rdllist);
 	__pm_relax(ep->ws);
+
+	if (!list_empty(&ep->rdllist)) {
+		if (waitqueue_active(&ep->wq))
+			wake_up(&ep->wq);
+	}
+
 	write_unlock_irq(&ep->lock);
 
 	if (!ep_locked)

From: Xiang Chen <[email protected]>

commit be94215be1ab19e5d38f50962f611c88d4bfc83a upstream.

If rmmod the driver during read or write, the driver will release the resources which are used during read or write, so it is possible to refer to NULL pointer.

Use the testcase "mtd_debug read /dev/mtd0 0xc00000 0x400000 dest_file & sleep 0.5;rmmod spi_hisi_sfc_v3xx.ko", the issue can be reproduced in hisi_sfc_v3xx driver.

To avoid the issue, fill the interface _get_device and _put_device of mtd_info to grab the reference to the spi controller driver module, so the request of rmmod the driver is rejected before read/write is finished.

---
 drivers/mtd/spi-nor/core.c |   33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

@@ -2981,6 +2981,37 @@ static void spi_nor_resume(struct mtd_in
 		dev_err(dev, "resume() failed\n");
 }
 
+static int spi_nor_get_device(struct mtd_info *mtd)
+{
+	struct mtd_info *master = mtd_get_master(mtd);
+	struct spi_nor *nor = mtd_to_spi_nor(master);
+	struct device *dev;
+
+	if (nor->spimem)
+		dev = nor->spimem->spi->controller->dev.parent;
+	else
+		dev = nor->dev;
+
+	if (!try_module_get(dev->driver->owner))
+		return -ENODEV;
+
+	return 0;
+}
+
+static void spi_nor_put_device(struct mtd_info *mtd)
+{
+	struct mtd_info *master = mtd_get_master(mtd);
+	struct spi_nor *nor = mtd_to_spi_nor(master);
+	struct device *dev;
+
+	if (nor->spimem)
+		dev = nor->spimem->spi->controller->dev.parent;
+	else
+		dev = nor->dev;
+
+	module_put(dev->driver->owner);
+}
+
 void spi_nor_restore(struct spi_nor *nor)
 {
 	/* restore the addressing mode */

@@ -3157,6 +3188,8 @@ int spi_nor_scan(struct spi_nor *nor, co
 	mtd->_erase = spi_nor_erase;
 	mtd->_read = spi_nor_read;
 	mtd->_resume = spi_nor_resume;
+	mtd->_get_device = spi_nor_get_device;
+	mtd->_put_device = spi_nor_put_device;
 
 	if (nor->params->locking_ops) {
 		mtd->_lock = spi_nor_lock;

From: Tudor Ambarus <[email protected]>

commit 46094049a49be777f12a9589798f7c70b90cd03f upstream.

This reverts commit 04b8edad262eec0d153005973dfbdd83423c0dcb.

mx25l51245g and mx66l51235l have the same flash ID. The flash detection returns the first entry in the flash_info array that matches the flash ID that was read, thus for the 0xc2201a ID, mx25l51245g was always hit, introducing a regression for mx66l51235l.

If one wants to differentiate the flash names, a better fix would be to differentiate between the two at run-time, depending on SFDP, and choose the correct name from a list of flash names, depending on the SFDP differentiator.

---
 drivers/mtd/spi-nor/macronix.c |    3 ---
 1 file changed, 3 deletions(-)

@@ -73,9 +73,6 @@ static const struct flash_info macronix_
 			      SECT_4K | SPI_NOR_DUAL_READ |
 			      SPI_NOR_QUAD_READ) },
 	{ "mx25l25655e", INFO(0xc22619, 0, 64 * 1024, 512, 0) },
-	{ "mx25l51245g", INFO(0xc2201a, 0, 64 * 1024, 1024,
-			      SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ |
-			      SPI_NOR_4B_OPCODES) },
 	{ "mx66l51235l", INFO(0xc2201a, 0, 64 * 1024, 1024,
 			      SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ |
 			      SPI_NOR_4B_OPCODES) },

From: Alexander Lobakin <[email protected]>

commit 25fefc88c71f47db0466570335e3f75f10952e7a upstream.

The module misses MODULE_DEVICE_TABLE() for both SPI and OF ID tables and thus never autoloads on ID matches.
Add the missing declarations.
Present since day-0 of spinand framework introduction.

---
 drivers/mtd/nand/spi/core.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -1173,12 +1173,14 @@ static const struct spi_device_id spinan
 	{ .name = "spi-nand" },
 	{ /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(spi, spinand_ids);
 
 #ifdef CONFIG_OF
 static const struct of_device_id spinand_of_ids[] = {
 	{ .compatible = "spi-nand" },
 	{ /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(of, spinand_of_ids);
 #endif
 
 static struct spi_mem_driver spinand_drv = {

From: Kai Stuhlemmer (ebee Engineering) <[email protected]>

commit 33cebf701e98dd12b01d39d1c644387b27c1a627 upstream.

Update MTD ECC statistics with the number of corrected bits.

---
 drivers/mtd/nand/raw/atmel/nand-controller.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -883,10 +883,12 @@ static int atmel_nand_pmecc_correct_data
 							  NULL, 0,
 							  chip->ecc.strength);
 
-		if (ret >= 0)
+		if (ret >= 0) {
+			mtd->ecc_stats.corrected += ret;
 			max_bitflips = max(ret, max_bitflips);
-		else
+		} else {
 			mtd->ecc_stats.failed++;
+		}
 
 		databuf += chip->ecc.size;
 		eccbuf += chip->ecc.bytes;

From: Gustavo A. R. Silva <[email protected]>

commit 683313993dbe1651c7aa00bb42a041d70e914925 upstream.

Cast &data to (char *) in order to avoid unintentionally accessing the stack.

Notice that data is of type u32, so any increment to &data will be in the order of 4-byte chunks, and this piece of code is actually intended to be a byte offset.

Addresses-Coverity-ID: 1497765 ("Out-of-bounds access")

---
 drivers/mtd/maps/physmap-bt1-rom.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -79,7 +79,7 @@ static void __xipram bt1_rom_map_copy_fr
 	if (shift) {
 		chunk = min_t(ssize_t, 4 - shift, len);
 		data = readl_relaxed(src - shift);
-		memcpy(to, &data + shift, chunk);
+		memcpy(to, (char *)&data + shift, chunk);
 		src += chunk;
 		to += chunk;
 		len -= chunk;

From: Gao Xiang <[email protected]>

commit 24a806d849c0b0c1d0cd6a6b93ba4ae4c0ec9f08 upstream.

If any unknown i_format fields are set (may be of some new incompat inode features), mark such inode as unsupported.

Just in case of any new incompat i_format fields added in the future.

---
 fs/erofs/erofs_fs.h |    3 +++
 fs/erofs/inode.c    |    7 +++++++
 2 files changed, 10 insertions(+)

@@ -75,6 +75,9 @@ static inline bool erofs_inode_is_data_c
 #define EROFS_I_VERSION_BIT             0
 #define EROFS_I_DATALAYOUT_BIT          1
 
+#define EROFS_I_ALL	\
+	((1 << (EROFS_I_DATALAYOUT_BIT + EROFS_I_DATALAYOUT_BITS)) - 1)
+
 /* 32-byte reduced form of an ondisk inode */
 struct erofs_inode_compact {
 	__le16 i_format;	/* inode format hints */

@@ -44,6 +44,13 @@ static struct page *erofs_read_inode(str
 	dic = page_address(page) + *ofs;
 	ifmt = le16_to_cpu(dic->i_format);
 
+	if (ifmt & ~EROFS_I_ALL) {
+		erofs_err(inode->i_sb, "unsupported i_format %u of nid %llu",
+			  ifmt, vi->nid);
+		err = -EOPNOTSUPP;
+		goto err_out;
+	}
+
 	vi->datalayout = erofs_inode_datalayout(ifmt);
 	if (vi->datalayout >= EROFS_INODE_DATALAYOUT_MAX) {
 		erofs_err(inode->i_sb, "unsupported datalayout %u of nid %llu",

From: Christophe Kerello <[email protected]>

commit 102e9d1936569d43f55dd1ea89be355ad207143c upstream.

pm_runtime usage_count counter is not well managed. pm_runtime_put_autosuspend callback drops the usage_counter but this one has never been increased. Add pm_runtime_get_sync callback to bump up the usage counter. It is also needed to use pm_runtime_force_suspend and pm_runtime_force_resume APIs to handle properly the clock.

---
 drivers/spi/spi-stm32-qspi.c |   18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

@@ -727,21 +727,31 @@ static int __maybe_unused stm32_qspi_sus
 {
 	pinctrl_pm_select_sleep_state(dev);
 
-	return 0;
+	return pm_runtime_force_suspend(dev);
 }
 
 static int __maybe_unused stm32_qspi_resume(struct device *dev)
 {
 	struct stm32_qspi *qspi = dev_get_drvdata(dev);
+	int ret;
+
+	ret = pm_runtime_force_resume(dev);
+	if (ret < 0)
+		return ret;
 
 	pinctrl_pm_select_default_state(dev);
-	clk_prepare_enable(qspi->clk);
+
+	ret = pm_runtime_get_sync(dev);
+	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
+		return ret;
+	}
 
 	writel_relaxed(qspi->cr_reg, qspi->io_base + QSPI_CR);
 	writel_relaxed(qspi->dcr_reg, qspi->io_base + QSPI_DCR);
 
-	pm_runtime_mark_last_busy(qspi->dev);
-	pm_runtime_put_autosuspend(qspi->dev);
+	pm_runtime_mark_last_busy(dev);
+	pm_runtime_put_autosuspend(dev);
 
 	return 0;
 }

From: Tudor Ambarus <[email protected]>

commit 1d309cd688a76fb733f0089d36dc630327b32d59 upstream.

Release the RX channel and free the dma coherent memory when devm_spi_register_master() fails.

---
 drivers/spi/spi-ti-qspi.c |   20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

@@ -733,6 +733,17 @@ static int ti_qspi_runtime_resume(struct
 	return 0;
 }
 
+static void ti_qspi_dma_cleanup(struct ti_qspi *qspi)
+{
+	if (qspi->rx_bb_addr)
+		dma_free_coherent(qspi->dev, QSPI_DMA_BUFFER_SIZE,
+				  qspi->rx_bb_addr,
+				  qspi->rx_bb_dma_addr);
+
+	if (qspi->rx_chan)
+		dma_release_channel(qspi->rx_chan);
+}
+
 static const struct of_device_id ti_qspi_match[] = {
 	{.compatible = "ti,dra7xxx-qspi" },
 	{.compatible = "ti,am4372-qspi" },

@@ -886,6 +897,8 @@ no_dma:
 	if (!ret)
 		return 0;
 
+	ti_qspi_dma_cleanup(qspi);
+
 	pm_runtime_disable(&pdev->dev);
 free_master:
 	spi_master_put(master);

@@ -904,12 +917,7 @@ static int ti_qspi_remove(struct platfor
 	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 
-	if (qspi->rx_bb_addr)
-		dma_free_coherent(qspi->dev, QSPI_DMA_BUFFER_SIZE,
-				  qspi->rx_bb_addr,
-				  qspi->rx_bb_dma_addr);
-	if (qspi->rx_chan)
-		dma_release_channel(qspi->rx_chan);
+	ti_qspi_dma_cleanup(qspi);
 
 	return 0;
 }

From: Arun Easi <[email protected]>

commit 6641df81ab799f28a5d564f860233dd26cca0d93 upstream.

    RIP: 0010:kmem_cache_free+0xfa/0x1b0
    Call Trace:
       qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx]
       scsi_queue_rq+0x5e2/0xa40
       __blk_mq_try_issue_directly+0x128/0x1d0
       blk_mq_request_issue_directly+0x4e/0xb0

Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now allocated by upper layers. This fixes smatch warning of srb unintended free.

---
 drivers/scsi/qla2xxx/qla_os.c |    7 -------
 1 file changed, 7 deletions(-)

@@ -1008,8 +1008,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *
 	if (rval != QLA_SUCCESS) {
 		ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x3078,
 		    "Start scsi failed rval=%d for cmd=%p.\n", rval, cmd);
-		if (rval == QLA_INTERFACE_ERROR)
-			goto qc24_free_sp_fail_command;
 		goto qc24_host_busy_free_sp;
 	}
 

@@ -1021,11 +1019,6 @@ qc24_host_busy_free_sp:
 qc24_target_busy:
 	return SCSI_MLQUEUE_TARGET_BUSY;
 
-qc24_free_sp_fail_command:
-	sp->free(sp);
-	CMD_SP(cmd) = NULL;
-	qla2xxx_rel_qpair_sp(sp->qpair, sp);
-
 qc24_fail_command:
 	cmd->scsi_done(cmd);
 

From: Sreekanth Reddy <[email protected]>

commit 3c8604691d2acc7b7d4795d9695070de9eaa5828 upstream.

While diag reset is in progress there is short duration where all access to controller's PCI config space from the host needs to be blocked. This is due to a hardware limitation of the IOC controllers.

Block all access to controller's config space from userland applications by calling pci_cfg_access_lock() while diag reset is in progress and unlocking it again after the controller comes back to ready state.

---
 drivers/scsi/mpt3sas/mpt3sas_base.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -6804,6 +6804,8 @@ _base_diag_reset(struct MPT3SAS_ADAPTER
 
 	ioc_info(ioc, "sending diag reset !!\n");
 
+	pci_cfg_access_lock(ioc->pdev);
+
 	drsprintk(ioc, ioc_info(ioc, "clear interrupts\n"));
 
 	count = 0;

@@ -6894,10 +6896,12 @@ _base_diag_reset(struct MPT3SAS_ADAPTER
 		goto out;
 	}
 
+	pci_cfg_access_unlock(ioc->pdev);
 	ioc_info(ioc, "diag reset: SUCCESS\n");
 	return 0;
 
  out:
+	pci_cfg_access_unlock(ioc->pdev);
 	ioc_err(ioc, "diag reset: FAILED\n");
 	return -EFAULT;
 }

From: Christophe JAILLET <[email protected]>

commit b03aec1c1f337dfdae44cdb0645ecac34208ae0a upstream.

A 'uniphier_sd_clk_enable()' call should be balanced by a corresponding 'uniphier_sd_clk_disable()' call.
This is done in the remove function, but not in the error handling path of the probe.

Add the missing call.

---
 drivers/mmc/host/uniphier-sd.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -636,7 +636,7 @@ static int uniphier_sd_probe(struct plat
 
 	ret = tmio_mmc_host_probe(host);
 	if (ret)
-		goto free_host;
+		goto disable_clk;
 
 	ret = devm_request_irq(dev, irq, tmio_mmc_irq, IRQF_SHARED,
 			       dev_name(dev), host);

@@ -647,6 +647,8 @@ static int uniphier_sd_probe(struct plat
 
 remove_host:
 	tmio_mmc_host_remove(host);
+disable_clk:
+	uniphier_sd_clk_disable(host);
 free_host:
 	tmio_mmc_host_free(host);
 

From: Christophe JAILLET <[email protected]>

commit e29c84857e2d51aa017ce04284b962742fb97d9e upstream.

A 'tmio_mmc_host_free()' call is missing in the remove function, in order to balance a 'tmio_mmc_host_alloc()' call in the probe.
This is done in the error handling path of the probe, but not in the remove function.

Add the missing call.

---
 drivers/mmc/host/uniphier-sd.c |    1 +
 1 file changed, 1 insertion(+)

@@ -661,6 +661,7 @@ static int uniphier_sd_remove(struct pla
 
 	tmio_mmc_host_remove(host);
 	uniphier_sd_clk_disable(host);
+	tmio_mmc_host_free(host);
 
 	return 0;
 }

From: Pradeep P V K <[email protected]>

commit 21e35e898aa9ef7781632959db8613a5380f2eae upstream.

For data read commands, SDHC may initiate data transfers even before it completely process the command response. In case command itself fails, driver un-maps the memory associated with data transfer but this memory can still be accessed by SDHC for the already initiated data transfer. This scenario can lead to un-mapped memory access error.

To avoid this scenario, reset SDHC (when command fails) prior to un-mapping memory. Resetting SDHC ensures that all in-flight data transfers are either aborted or completed. So we don't run into this scenario.

Swap the reset, un-map steps sequence in sdhci_request_done().

---
 drivers/mmc/host/sdhci.c |   60 ++++++++++++++++++++++++-----------------------
 1 file changed, 31 insertions(+), 29 deletions(-)

@@ -2998,6 +2998,37 @@ static bool sdhci_request_done(struct sd
 	}
 
 	/*
+	 * The controller needs a reset of internal state machines
+	 * upon error conditions.
+	 */
+	if (sdhci_needs_reset(host, mrq)) {
+		/*
+		 * Do not finish until command and data lines are available for
+		 * reset. Note there can only be one other mrq, so it cannot
+		 * also be in mrqs_done, otherwise host->cmd and host->data_cmd
+		 * would both be null.
+		 */
+		if (host->cmd || host->data_cmd) {
+			spin_unlock_irqrestore(&host->lock, flags);
+			return true;
+		}
+
+		/* Some controllers need this kick or reset won't work here */
+		if (host->quirks & SDHCI_QUIRK_CLOCK_BEFORE_RESET)
+			/* This is to force an update */
+			host->ops->set_clock(host, host->clock);
+
+		/*
+		 * Spec says we should do both at the same time, but Ricoh
+		 * controllers do not like that.
+		 */
+		sdhci_do_reset(host, SDHCI_RESET_CMD);
+		sdhci_do_reset(host, SDHCI_RESET_DATA);
+
+		host->pending_reset = false;
+	}
+
+	/*
 	 * Always unmap the data buffers if they were mapped by
 	 * sdhci_prepare_data() whenever we finish with a request.
 	 * This avoids leaking DMA mappings on error.

@@ -3060,35 +3091,6 @@ static bool sdhci_request_done(struct sd
 		}
 	}
 
-	/*
-	 * The controller needs a reset of internal state machines
-	 * upon error conditions.
-	 */
-	if (sdhci_needs_reset(host, mrq)) {
-		/*
-		 * Do not finish until command and data lines are available for
-		 * reset. Note there can only be one other mrq, so it cannot
-		 * also be in mrqs_done, otherwise host->cmd and host->data_cmd
-		 * would both be null.
-		 */
-		if (host->cmd || host->data_cmd) {
-			spin_unlock_irqrestore(&host->lock, flags);
-			return true;
-		}
-
-		/* Some controllers need this kick or reset won't work here */
-		if (host->quirks & SDHCI_QUIRK_CLOCK_BEFORE_RESET)
-			/* This is to force an update */
-			host->ops->set_clock(host, host->clock);
-
-		/* Spec says we should do both at the same time, but Ricoh
-		   controllers do not like that. */
-		sdhci_do_reset(host, SDHCI_RESET_CMD);
-		sdhci_do_reset(host, SDHCI_RESET_DATA);
-
-		host->pending_reset = false;
-	}
-
 	host->mrqs_done[i] = NULL;
 
 	spin_unlock_irqrestore(&host->lock, flags);

From: Adrian Hunter <[email protected]>

commit 2970134b927834e9249659a70aac48e62dff804a upstream.

Bus power may control card power, but the full reset done by SDHCI at initialization still may not reset the power, whereas a direct write to SDHCI_POWER_CONTROL can. That might be needed to initialize correctly, if the card was left powered on previously.

---
 drivers/mmc/host/sdhci-pci-core.c |   27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

@@ -516,6 +516,7 @@ struct intel_host {
 	int	drv_strength;
 	bool	d3_retune;
 	bool	rpm_retune_ok;
+	bool	needs_pwr_off;
 	u32	glk_rx_ctrl1;
 	u32	glk_tun_val;
 	u32	active_ltr;

@@ -643,9 +644,25 @@ out:
 static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode,
 				  unsigned short vdd)
 {
+	struct sdhci_pci_slot *slot = sdhci_priv(host);
+	struct intel_host *intel_host = sdhci_pci_priv(slot);
 	int cntr;
 	u8 reg;
 
+	/*
+	 * Bus power may control card power, but a full reset still may not
+	 * reset the power, whereas a direct write to SDHCI_POWER_CONTROL can.
+	 * That might be needed to initialize correctly, if the card was left
+	 * powered on previously.
+	 */
+	if (intel_host->needs_pwr_off) {
+		intel_host->needs_pwr_off = false;
+		if (mode != MMC_POWER_OFF) {
+			sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
+			usleep_range(10000, 12500);
+		}
+	}
+
 	sdhci_set_power(host, mode, vdd);
 
 	if (mode == MMC_POWER_OFF)

@@ -1135,6 +1152,14 @@ static int byt_sdio_probe_slot(struct sd
 	return 0;
 }
 
+static void byt_needs_pwr_off(struct sdhci_pci_slot *slot)
+{
+	struct intel_host *intel_host = sdhci_pci_priv(slot);
+	u8 reg = sdhci_readb(slot->host, SDHCI_POWER_CONTROL);
+
+	intel_host->needs_pwr_off = reg  & SDHCI_POWER_ON;
+}
+
 static int byt_sd_probe_slot(struct sdhci_pci_slot *slot)
 {
 	byt_probe_slot(slot);

@@ -1152,6 +1177,8 @@ static int byt_sd_probe_slot(struct sdhc
 	    slot->chip->pdev->subsystem_device == PCI_SUBDEVICE_ID_NI_78E3)
 		slot->host->mmc->caps2 |= MMC_CAP2_AVOID_3_3V;
 
+	byt_needs_pwr_off(slot);
+
 	return 0;
 }
 

From: Aniruddha Tvs Rao <[email protected]>

commit 5ec6fa5a6dc5e42a4aa782f3a81d5f08b0fac1e6 upstream.

CMD8 is not supported with Command Queue Enabled. Add required callback to clear CQE_EN and CQE_INTR fields in the host controller register before sending CMD8. Add corresponding callback in the CQHCI resume path to re-enable CQE_EN and CQE_INTR fields.

---
 drivers/mmc/host/sdhci-tegra.c |   32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

@@ -119,6 +119,10 @@
 /* SDMMC CQE Base Address for Tegra Host Ver 4.1 and Higher */
 #define SDHCI_TEGRA_CQE_BASE_ADDR			0xF000
 
+#define SDHCI_TEGRA_CQE_TRNS_MODE	(SDHCI_TRNS_MULTI | \
+					 SDHCI_TRNS_BLK_CNT_EN | \
+					 SDHCI_TRNS_DMA)
+
 struct sdhci_tegra_soc_data {
 	const struct sdhci_pltfm_data *pdata;
 	u64 dma_mask;

@@ -1156,6 +1160,7 @@ static void tegra_sdhci_voltage_switch(s
 static void tegra_cqhci_writel(struct cqhci_host *cq_host, u32 val, int reg)
 {
 	struct mmc_host *mmc = cq_host->mmc;
+	struct sdhci_host *host = mmc_priv(mmc);
 	u8 ctrl;
 	ktime_t timeout;
 	bool timed_out;

@@ -1170,6 +1175,7 @@ static void tegra_cqhci_writel(struct cq
 	 */
 	if (reg == CQHCI_CTL && !(val & CQHCI_HALT) &&
 	    cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT) {
+		sdhci_writew(host, SDHCI_TEGRA_CQE_TRNS_MODE, SDHCI_TRANSFER_MODE);
 		sdhci_cqe_enable(mmc);
 		writel(val, cq_host->mmio + reg);
 		timeout = ktime_add_us(ktime_get(), 50);

@@ -1205,6 +1211,7 @@ static void sdhci_tegra_update_dcmd_desc
 static void sdhci_tegra_cqe_enable(struct mmc_host *mmc)
 {
 	struct cqhci_host *cq_host = mmc->cqe_private;
+	struct sdhci_host *host = mmc_priv(mmc);
 	u32 val;
 
 	/*

@@ -1218,6 +1225,7 @@ static void sdhci_tegra_cqe_enable(struc
 		if (val & CQHCI_ENABLE)
 			cqhci_writel(cq_host, (val & ~CQHCI_ENABLE),
 				     CQHCI_CFG);
+		sdhci_writew(host, SDHCI_TEGRA_CQE_TRNS_MODE, SDHCI_TRANSFER_MODE);
 		sdhci_cqe_enable(mmc);
 		if (val & CQHCI_ENABLE)
 			cqhci_writel(cq_host, val, CQHCI_CFG);

@@ -1281,12 +1289,36 @@ static void tegra_sdhci_set_timeout(stru
 	__sdhci_set_timeout(host, cmd);
 }
 
+static void sdhci_tegra_cqe_pre_enable(struct mmc_host *mmc)
+{
+	struct cqhci_host *cq_host = mmc->cqe_private;
+	u32 reg;
+
+	reg = cqhci_readl(cq_host, CQHCI_CFG);
+	reg |= CQHCI_ENABLE;
+	cqhci_writel(cq_host, reg, CQHCI_CFG);
+}
+
+static void sdhci_tegra_cqe_post_disable(struct mmc_host *mmc)
+{
+	struct cqhci_host *cq_host = mmc->cqe_private;
+	struct sdhci_host *host = mmc_priv(mmc);
+	u32 reg;
+
+	reg = cqhci_readl(cq_host, CQHCI_CFG);
+	reg &= ~CQHCI_ENABLE;
+	cqhci_writel(cq_host, reg, CQHCI_CFG);
+	sdhci_writew(host, 0x0, SDHCI_TRANSFER_MODE);
+}
+
 static const struct cqhci_host_ops sdhci_tegra_cqhci_ops = {
 	.write_l    = tegra_cqhci_writel,
 	.enable	= sdhci_tegra_cqe_enable,
 	.disable = sdhci_cqe_disable,
 	.dumpregs = sdhci_tegra_dumpregs,
 	.update_dcmd_desc = sdhci_tegra_update_dcmd_desc,
+	.pre_enable = sdhci_tegra_cqe_pre_enable,
+	.post_disable = sdhci_tegra_cqe_post_disable,
 };
 
 static int tegra_sdhci_set_dma_mask(struct sdhci_host *host)

From: Avri Altman <[email protected]>

commit aea0440ad023ab0662299326f941214b0d7480bd upstream.

The cache function can be turned ON and OFF by writing to the CACHE_CTRL byte (EXT_CSD byte [33]). However, card->ext_csd.cache_ctrl is only set on init if cache size > 0.

Fix that by explicitly setting ext_csd.cache_ctrl on ext-csd write.

---
 drivers/mmc/core/block.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

@@ -572,6 +572,18 @@ static int __mmc_blk_ioctl_cmd(struct mm
 	}
 
 	/*
+	 * Make sure to update CACHE_CTRL in case it was changed. The cache
+	 * will get turned back on if the card is re-initialized, e.g.
+	 * suspend/resume or hw reset in recovery.
+	 */
+	if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_CACHE_CTRL) &&
+	    (cmd.opcode == MMC_SWITCH)) {
+		u8 value = MMC_EXTRACT_VALUE_FROM_ARG(cmd.arg) & 1;
+
+		card->ext_csd.cache_ctrl = value;
+	}
+
+	/*
 	 * According to the SD specs, some commands require a delay after
 	 * issuing the command.
 	 */

From: Avri Altman <[email protected]>

commit 97fce126e279690105ee15be652b465fd96f9997 upstream.

In command queueing mode, the cache isn't flushed via the mmc_flush_cache() function, but instead by issuing a CMDQ_TASK_MGMT (CMD48) with a FLUSH_CACHE opcode. In this path, we need to check if cache has been enabled, before deciding to flush the cache, along the lines of what's being done in mmc_flush_cache().

To fix this problem, let's add a new bus ops callback ->cache_enabled() and implement it for the mmc bus type. In this way, the mmc block device driver can call it to know whether cache flushing should be done.

---
 drivers/mmc/core/block.c   |    4 ++++
 drivers/mmc/core/core.h    |    9 +++++++++
 drivers/mmc/core/mmc.c     |    7 +++++++
 drivers/mmc/core/mmc_ops.c |    4 +---
 4 files changed, 21 insertions(+), 3 deletions(-)

@@ -2233,6 +2233,10 @@ enum mmc_issued mmc_blk_mq_issue_rq(stru
 	case MMC_ISSUE_ASYNC:
 		switch (req_op(req)) {
 		case REQ_OP_FLUSH:
+			if (!mmc_cache_enabled(host)) {
+				blk_mq_end_request(req, BLK_STS_OK);
+				return MMC_REQ_FINISHED;
+			}
 			ret = mmc_blk_cqe_issue_flush(mq, req);
 			break;
 		case REQ_OP_READ:

@@ -29,6 +29,7 @@ struct mmc_bus_ops {
 	int (*shutdown)(struct mmc_host *);
 	int (*hw_reset)(struct mmc_host *);
 	int (*sw_reset)(struct mmc_host *);
+	bool (*cache_enabled)(struct mmc_host *);
 };
 
 void mmc_attach_bus(struct mmc_host *host, const struct mmc_bus_ops *ops);

@@ -171,4 +172,12 @@ static inline void mmc_post_req(struct m
 		host->ops->post_req(host, mrq, err);
 }
 
+static inline bool mmc_cache_enabled(struct mmc_host *host)
+{
+	if (host->bus_ops->cache_enabled)
+		return host->bus_ops->cache_enabled(host);
+
+	return false;
+}
+
 #endif

@@ -2033,6 +2033,12 @@ static void mmc_detect(struct mmc_host *
 	}
 }
 
+static bool _mmc_cache_enabled(struct mmc_host *host)
+{
+	return host->card->ext_csd.cache_size > 0 &&
+	       host->card->ext_csd.cache_ctrl & 1;
+}
+
 static int _mmc_suspend(struct mmc_host *host, bool is_suspend)
 {
 	int err = 0;

@@ -2212,6 +2218,7 @@ static const struct mmc_bus_ops mmc_ops
 	.alive = mmc_alive,
 	.shutdown = mmc_shutdown,
 	.hw_reset = _mmc_hw_reset,
+	.cache_enabled = _mmc_cache_enabled,
 };
 
 /*

@@ -988,9 +988,7 @@ int mmc_flush_cache(struct mmc_card *car
 {
 	int err = 0;
 
-	if (mmc_card_mmc(card) &&
-			(card->ext_csd.cache_size > 0) &&
-			(card->ext_csd.cache_ctrl & 1)) {
+	if (mmc_cache_enabled(card->host)) {
 		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
 				 EXT_CSD_FLUSH_CACHE, 1,
 				 MMC_CACHE_FLUSH_TIMEOUT_MS);

From: DooHyun Hwang <[email protected]>

commit 147186f531ae49c18b7a9091a2c40e83b3d95649 upstream.

A CMD11 is sent to the SD/SDIO card to start the voltage switch procedure into 1.8V I/O. According to the SD spec a power cycle is needed of the card, if it turns out that the CMD11 fails. Let's fix this, to allow a retry of the initialization without the voltage switch, to succeed.

Note that, whether it makes sense to also retry with the voltage switch after the power cycle is a bit more difficult to know. At this point, we treat it like the CMD11 isn't supported and therefore we skip it when retrying.

---
 drivers/mmc/core/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1204,7 +1204,7 @@ int mmc_set_uhs_voltage(struct mmc_host
 
 	err = mmc_wait_for_cmd(host, &cmd, 0);
 	if (err)
-		return err;
+		goto power_cycle;
 
 	if (!mmc_host_is_spi(host) && (cmd.resp[0] & R1_ERROR))
 		return -EIO;

From: Seunghui Lee <[email protected]>

commit 917a5336f2c27928be270226ab374ed0cbf3805d upstream.

Some of SD cards sets permanent write protection bit in their CSD register, due to lifespan or internal problem. To avoid unnecessary I/O write operations, let's parse the bits in the CSD during initialization and mark the card as read only for this case.

---
 drivers/mmc/core/sd.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -135,6 +135,9 @@ static int mmc_decode_csd(struct mmc_car
 			csd->erase_size = UNSTUFF_BITS(resp, 39, 7) + 1;
 			csd->erase_size <<= csd->write_blkbits - 9;
 		}
+
+		if (UNSTUFF_BITS(resp, 13, 1))
+			mmc_card_set_readonly(card);
 		break;
 	case 1:
 		/*

@@ -169,6 +172,9 @@ static int mmc_decode_csd(struct mmc_car
 		csd->write_blkbits = 9;
 		csd->write_partial = 0;
 		csd->erase_size = 1;
+
+		if (UNSTUFF_BITS(resp, 13, 1))
+			mmc_card_set_readonly(card);
 		break;
 	default:
 		pr_err("%s: unrecognised CSD structure version %d\n",

From: Ulf Hansson <[email protected]>

commit 17a17bf50612e6048a9975450cf1bd30f93815b5 upstream.

The mmc core uses a PM notifier to temporarily during system suspend, turn off the card detection mechanism for removal/insertion of (e)MMC/SD/SDIO cards. Additionally, the notifier may be used to remove an SDIO card entirely, if a corresponding SDIO functional driver don't have the system suspend/resume callbacks assigned. This behaviour has been around for a very long time.

However, a recent bug report tells us there are problems with this approach. More precisely, when receiving the PM_SUSPEND_PREPARE notification, we may end up hanging on I/O to be completed, thus also preventing the system from getting suspended.

In the end what happens, is that the cancel_delayed_work_sync() in mmc_pm_notify() ends up waiting for mmc_rescan() to complete - and since mmc_rescan() wants to claim the host, it needs to wait for the I/O to be completed first.

Typically, this problem is triggered in Android, if there is ongoing I/O while the user decides to suspend, resume and then suspend the system again. This due to that after the resume, an mmc_rescan() work gets punted to the workqueue, which job is to verify that the card remains inserted after the system has resumed.

To fix this problem, userspace needs to become frozen to suspend the I/O, prior to turning off the card detection mechanism. Therefore, let's drop the PM notifiers for mmc subsystem altogether and rely on the card detection to be turned off/on as a part of the system_freezable_wq, that we are already using.

Moreover, to allow and SDIO card to be removed during system suspend, let's manage this from a ->prepare() callback, assigned at the mmc_host_class level. In this way, we can use the parent device (the mmc_host_class device), to remove the card device that is the child, in the device_prepare() phase.

---
 drivers/mmc/core/core.c  |   74 -----------------------------------------------
 drivers/mmc/core/core.h  |    8 -----
 drivers/mmc/core/host.c  |   40 +++++++++++++++++++++++--
 drivers/mmc/core/sdio.c  |   28 +++++++++++++----
 include/linux/mmc/host.h |    3 -
 5 files changed, 59 insertions(+), 94 deletions(-)

@@ -2355,80 +2355,6 @@ void mmc_stop_host(struct mmc_host *host
 	mmc_release_host(host);
 }
 
-#ifdef CONFIG_PM_SLEEP
-/* Do the card removal on suspend if card is assumed removeable
- * Do that in pm notifier while userspace isn't yet frozen, so we will be able
-   to sync the card.
-*/
-static int mmc_pm_notify(struct notifier_block *notify_block,
-			unsigned long mode, void *unused)
-{
-	struct mmc_host *host = container_of(
-		notify_block, struct mmc_host, pm_notify);
-	unsigned long flags;
-	int err = 0;
-
-	switch (mode) {
-	case PM_HIBERNATION_PREPARE:
-	case PM_SUSPEND_PREPARE:
-	case PM_RESTORE_PREPARE:
-		spin_lock_irqsave(&host->lock, flags);
-		host->rescan_disable = 1;
-		spin_unlock_irqrestore(&host->lock, flags);
-		cancel_delayed_work_sync(&host->detect);
-
-		if (!host->bus_ops)
-			break;
-
-		/* Validate prerequisites for suspend */
-		if (host->bus_ops->pre_suspend)
-			err = host->bus_ops->pre_suspend(host);
-		if (!err)
-			break;
-
-		if (!mmc_card_is_removable(host)) {
-			dev_warn(mmc_dev(host),
-				 "pre_suspend failed for non-removable host: "
-				 "%d\n", err);
-			/* Avoid removing non-removable hosts */
-			break;
-		}
-
-		/* Calling bus_ops->remove() with a claimed host can deadlock */
-		host->bus_ops->remove(host);
-		mmc_claim_host(host);
-		mmc_detach_bus(host);
-		mmc_power_off(host);
-		mmc_release_host(host);
-		host->pm_flags = 0;
-		break;
-
-	case PM_POST_SUSPEND:
-	case PM_POST_HIBERNATION:
-	case PM_POST_RESTORE:
-
-		spin_lock_irqsave(&host->lock, flags);
-		host->rescan_disable = 0;
-		spin_unlock_irqrestore(&host->lock, flags);
-		_mmc_detect_change(host, 0, false);
-
-	}
-
-	return 0;
-}
-
-void mmc_register_pm_notifier(struct mmc_host *host)
-{
-	host->pm_notify.notifier_call = mmc_pm_notify;
-	register_pm_notifier(&host->pm_notify);
-}
-
-void mmc_unregister_pm_notifier(struct mmc_host *host)
-{
-	unregister_pm_notifier(&host->pm_notify);
-}
-#endif
-
 static int __init mmc_init(void)
 {
 	int ret;

@@ -94,14 +94,6 @@ int mmc_execute_tuning(struct mmc_card *
 int mmc_hs200_to_hs400(struct mmc_card *card);
 int mmc_hs400_to_hs200(struct mmc_card *card);
 
-#ifdef CONFIG_PM_SLEEP
-void mmc_register_pm_notifier(struct mmc_host *host);
-void mmc_unregister_pm_notifier(struct mmc_host *host);
-#else
-static inline void mmc_register_pm_notifier(struct mmc_host *host) { }
-static inline void mmc_unregister_pm_notifier(struct mmc_host *host) { }
-#endif
-
 void mmc_wait_for_req_done(struct mmc_host *host, struct mmc_request *mrq);
 bool mmc_is_req_done(struct mmc_host *host, struct mmc_request *mrq);
 

@@ -34,6 +34,42 @@
 
 static DEFINE_IDA(mmc_host_ida);
 
+#ifdef CONFIG_PM_SLEEP
+static int mmc_host_class_prepare(struct device *dev)
+{
+	struct mmc_host *host = cls_dev_to_mmc_host(dev);
+
+	/*
+	 * It's safe to access the bus_ops pointer, as both userspace and the
+	 * workqueue for detecting cards are frozen at this point.
+	 */
+	if (!host->bus_ops)
+		return 0;
+
+	/* Validate conditions for system suspend. */
+	if (host->bus_ops->pre_suspend)
+		return host->bus_ops->pre_suspend(host);
+
+	return 0;
+}
+
+static void mmc_host_class_complete(struct device *dev)
+{
+	struct mmc_host *host = cls_dev_to_mmc_host(dev);
+
+	_mmc_detect_change(host, 0, false);
+}
+
+static const struct dev_pm_ops mmc_host_class_dev_pm_ops = {
+	.prepare = mmc_host_class_prepare,
+	.complete = mmc_host_class_complete,
+};
+
+#define MMC_HOST_CLASS_DEV_PM_OPS (&mmc_host_class_dev_pm_ops)
+#else
+#define MMC_HOST_CLASS_DEV_PM_OPS NULL
+#endif
+
 static void mmc_host_classdev_release(struct device *dev)
 {
 	struct mmc_host *host = cls_dev_to_mmc_host(dev);

@@ -45,6 +81,7 @@ static void mmc_host_classdev_release(st
 static struct class mmc_host_class = {
 	.name		= "mmc_host",
 	.dev_release	= mmc_host_classdev_release,
+	.pm		= MMC_HOST_CLASS_DEV_PM_OPS,
 };
 
 int mmc_register_host_class(void)

@@ -493,8 +530,6 @@ int mmc_add_host(struct mmc_host *host)
 #endif
 
 	mmc_start_host(host);
-	mmc_register_pm_notifier(host);
-
 	return 0;
 }
 

@@ -510,7 +545,6 @@ EXPORT_SYMBOL(mmc_add_host);
  */
 void mmc_remove_host(struct mmc_host *host)
 {
-	mmc_unregister_pm_notifier(host);
 	mmc_stop_host(host);
 
 #ifdef CONFIG_DEBUG_FS

@@ -985,21 +985,37 @@ out:
  */
 static int mmc_sdio_pre_suspend(struct mmc_host *host)
 {
-	int i, err = 0;
+	int i;
 
 	for (i = 0; i < host->card->sdio_funcs; i++) {
 		struct sdio_func *func = host->card->sdio_func[i];
 		if (func && sdio_func_present(func) && func->dev.driver) {
 			const struct dev_pm_ops *pmops = func->dev.driver->pm;
-			if (!pmops || !pmops->suspend || !pmops->resume) {
+			if (!pmops || !pmops->suspend || !pmops->resume)
 				/* force removal of entire card in that case */
-				err = -ENOSYS;
-				break;
-			}
+				goto remove;
 		}
 	}
 
-	return err;
+	return 0;
+
+remove:
+	if (!mmc_card_is_removable(host)) {
+		dev_warn(mmc_dev(host),
+			 "missing suspend/resume ops for non-removable SDIO card\n");
+		/* Don't remove a non-removable card - we can't re-detect it. */
+		return 0;
+	}
+
+	/* Remove the SDIO card and let it be re-detected later on. */
+	mmc_sdio_remove(host);
+	mmc_claim_host(host);
+	mmc_detach_bus(host);
+	mmc_power_off(host);
+	mmc_release_host(host);
+	host->pm_flags = 0;
+
+	return 0;
 }
 
 /*

@@ -285,9 +285,6 @@ struct mmc_host {
 	u32			ocr_avail_sdio;	/* SDIO-specific OCR */
 	u32			ocr_avail_sd;	/* SD-specific OCR */
 	u32			ocr_avail_mmc;	/* MMC-specific OCR */
-#ifdef CONFIG_PM_SLEEP
-	struct notifier_block	pm_notify;
-#endif
 	struct wakeup_source	*ws;		/* Enable consume of uevents */
 	u32			max_current_330;
 	u32			max_current_300;

From: He Ying <[email protected]>

commit a97709f563a078e259bf0861cd259aa60332890a upstream.

We triggered the following error while running our 4.19 kernel with the pseudo-NMI patches backported to it:

[   14.816231] ------------[ cut here ]------------
[   14.816231] kernel BUG at irq.c:99!
[   14.816232] Internal error: Oops - BUG: 0 [#1] SMP
[   14.816232] Process swapper/0 (pid: 0, stack limit = 0x(____ptrval____))
[   14.816233] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O      4.19.95.aarch64 #14
[   14.816233] Hardware name: evb (DT)
[   14.816234] pstate: 80400085 (Nzcv daIf +PAN -UAO)
[   14.816234] pc : asm_nmi_enter+0x94/0x98
[   14.816235] lr : asm_nmi_enter+0x18/0x98
[   14.816235] sp : ffff000008003c50
[   14.816235] pmr_save: 00000070
[   14.816237] x29: ffff000008003c50 x28: ffff0000095f56c0
[   14.816238] x27: 0000000000000000 x26: ffff000008004000
[   14.816239] x25: 00000000015e0000 x24: ffff8008fb916000
[   14.816240] x23: 0000000020400005 x22: ffff0000080817cc
[   14.816241] x21: ffff000008003da0 x20: 0000000000000060
[   14.816242] x19: 00000000000003ff x18: ffffffffffffffff
[   14.816243] x17: 0000000000000008 x16: 003d090000000000
[   14.816244] x15: ffff0000095ea6c8 x14: ffff8008fff5ab40
[   14.816244] x13: ffff8008fff58b9d x12: 0000000000000000
[   14.816245] x11: ffff000008c8a200 x10: 000000008e31fca5
[   14.816246] x9 : ffff000008c8a208 x8 : 000000000000000f
[   14.816247] x7 : 0000000000000004 x6 : ffff8008fff58b9e
[   14.816248] x5 : 0000000000000000 x4 : 0000000080000000
[   14.816249] x3 : 0000000000000000 x2 : 0000000080000000
[   14.816250] x1 : 0000000000120000 x0 : ffff0000095f56c0
[   14.816251] Call trace:
[   14.816251]  asm_nmi_enter+0x94/0x98
[   14.816251]  el1_irq+0x8c/0x180                    (IRQ C)
[   14.816252]  gic_handle_irq+0xbc/0x2e4
[   14.816252]  el1_irq+0xcc/0x180                    (IRQ B)
[   14.816253]  arch_timer_handler_virt+0x38/0x58
[   14.816253]  handle_percpu_devid_irq+0x90/0x240
[   14.816253]  generic_handle_irq+0x34/0x50
[   14.816254]  __handle_domain_irq+0x68/0xc0
[   14.816254]  gic_handle_irq+0xf8/0x2e4
[   14.816255]  el1_irq+0xcc/0x180                    (IRQ A)
[   14.816255]  arch_cpu_idle+0x34/0x1c8
[   14.816255]  default_idle_call+0x24/0x44
[   14.816256]  do_idle+0x1d0/0x2c8
[   14.816256]  cpu_startup_entry+0x28/0x30
[   14.816256]  rest_init+0xb8/0xc8
[   14.816257]  start_kernel+0x4c8/0x4f4
[   14.816257] Code: 940587f1 d5384100 b9401001 36a7fd01 (d4210000)
[   14.816258] Modules linked in: start_dp(O) smeth(O)
[   15.103092] ---[ end trace 701753956cb14aa8 ]---
[   15.103093] Kernel panic - not syncing: Fatal exception in interrupt
[   15.103099] SMP: stopping secondary CPUs
[   15.103100] Kernel Offset: disabled
[   15.103100] CPU features: 0x36,a2400218
[   15.103100] Memory Limit: none

which is cause by a 'BUG_ON(in_nmi())' in nmi_enter().

interrupt (A) is preempted by (B), which is further interrupted by (C).

Subsequent investigations show that (B) results in nmi_enter() being called, but that it actually is a spurious interrupt. Furthermore, interrupts are reenabled in the context of (B), and (C) fires with NMI priority. We end-up with a nested NMI situation, something we definitely do not want to (and cannot) handle.

The bug here is that spurious interrupts should never result in any state change, and we should just return to the interrupted context. Moving the handling of spurious interrupts as early as possible in the GICv3 handler fixes this issue.

---
 drivers/irqchip/irq-gic-v3.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -648,6 +648,10 @@ static asmlinkage void __exception_irq_e
 
 	irqnr = gic_read_iar();
 
+	/* Check for special IDs first */
+	if ((irqnr >= 1020 && irqnr <= 1023))
+		return;
+
 	if (gic_supports_nmi() &&
 	    unlikely(gic_read_rpr() == GICD_INT_NMI_PRI)) {
 		gic_handle_nmi(irqnr, regs);

@@ -659,10 +663,6 @@ static asmlinkage void __exception_irq_e
 		gic_arch_enable_irqs();
 	}
 
-	/* Check for special IDs first */
-	if ((irqnr >= 1020 && irqnr <= 1023))
-		return;
-
 	if (static_branch_likely(&supports_deactivate_key))
 		gic_write_eoir(irqnr);
 	else

From: Paul Aurich <[email protected]>

commit 83728cbf366e334301091d5b808add468ab46b27 upstream.

Avoid a warning if the error percolates back up:

[440700.376476] CIFS VFS: \\otters.example.com crypt_message: Could not get encryption key
[440700.386947] ------------[ cut here ]------------
[440700.386948] err = 1
[440700.386977] WARNING: CPU: 11 PID: 2733 at /build/linux-hwe-5.4-p6lk6L/linux-hwe-5.4-5.4.0/lib/errseq.c:74 errseq_set+0x5c/0x70
...
[440700.397304] CPU: 11 PID: 2733 Comm: tar Tainted: G           OE     5.4.0-70-generic #78~18.04.1-Ubuntu
...
[440700.397334] Call Trace:
[440700.397346]  __filemap_set_wb_err+0x1a/0x70
[440700.397419]  cifs_writepages+0x9c7/0xb30 [cifs]
[440700.397426]  do_writepages+0x4b/0xe0
[440700.397444]  __filemap_fdatawrite_range+0xcb/0x100
[440700.397455]  filemap_write_and_wait+0x42/0xa0
[440700.397486]  cifs_setattr+0x68b/0xf30 [cifs]
[440700.397493]  notify_change+0x358/0x4a0
[440700.397500]  utimes_common+0xe9/0x1c0
[440700.397510]  do_utimes+0xc5/0x150
[440700.397520]  __x64_sys_utimensat+0x88/0xd0

---
 fs/cifs/smb2ops.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -4076,7 +4076,7 @@ smb2_get_enc_key(struct TCP_Server_Info
 	}
 	spin_unlock(&cifs_tcp_ses_lock);
 
-	return 1;
+	return -EAGAIN;
 }
 /*
  * Encrypt or decrypt @rqst message. @rqst[0] has the following format:

From: Eugene Korenevsky <[email protected]>

commit a637f4ae037e1e0604ac008564934d63261a8fd1 upstream.

If smb3_notify() is called at mount point of CIFS, build_path_from_dentry() returns the pointer to kmalloc-ed memory with terminating zero (this is empty FileName to be passed to SMB2 CREATE request). This pointer is assigned to the path variable.
Then path + 1 (to skip first backslash symbol) is passed to cifs_convert_path_to_utf16(). This is incorrect for empty path and causes out-of-bound memory access.

Get rid of this "increase by one". cifs_convert_path_to_utf16() already contains the check for leading backslash in the path.

---
 fs/cifs/smb2ops.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2174,7 +2174,7 @@ smb3_notify(const unsigned int xid, stru
 
 	cifs_sb = CIFS_SB(inode->i_sb);
 
-	utf16_path = cifs_convert_path_to_utf16(path + 1, cifs_sb);
+	utf16_path = cifs_convert_path_to_utf16(path, cifs_sb);
 	if (utf16_path == NULL) {
 		rc = -ENOMEM;
 		goto notify_exit;

From: Shyam Prasad N <[email protected]>

commit f4916649f98e2c7bdba38c6597a98c456c17317d upstream.

We can detect server unresponsiveness only if echoes are enabled. Echoes can be disabled under two scenarios:
1. The connection is low on credits, so we've disabled echoes/oplocks.
2. The connection has not seen any request till now (other than negotiate/sess-setup), which is when we enable these two, based on the credits available.

So this fix will check for dead connection, only when echo is enabled.

---
 fs/cifs/connect.c |    1 +
 1 file changed, 1 insertion(+)

@@ -663,6 +663,7 @@ server_unresponsive(struct TCP_Server_In
 	 */
 	if ((server->tcpStatus == CifsGood ||
 	    server->tcpStatus == CifsNeedNegotiate) &&
+	    (!server->ops->can_echo || server->ops->can_echo(server)) &&
 	    time_after(jiffies, server->lstrp + 3 * server->echo_interval)) {
 		cifs_server_dbg(VFS, "has not responded in %lu seconds. Reconnecting...\n",
 			 (3 * server->echo_interval) / HZ);

From: Aurelien Aptel <[email protected]>

commit ccd48ec3d4a6cc595b2d9c5146e63b6c23546701 upstream.

* rqst[1,2,3] is allocated in vars
* each rqst->rq_iov is also allocated in vars or using pooled memory

SMB2_open_free, SMB2_ioctl_free, SMB2_query_info_free are iterating on each rqst after vars has been freed (use-after-free), and they are freeing the kvec a second time (double-free).

How to trigger:

* compile with KASAN
* mount a share

$ smbinfo quota /mnt/foo
Segmentation fault
$ dmesg

==================================================================

 BUG: KASAN: use-after-free in SMB2_open_free+0x1c/0xa0
 Read of size 8 at addr ffff888007b10c00 by task python3/1200

 CPU: 2 PID: 1200 Comm: python3 Not tainted 5.12.0-rc6+ #107
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.org 04/01/2014
 Call Trace:
  dump_stack+0x93/0xc2
  print_address_description.constprop.0+0x18/0x130
  ? SMB2_open_free+0x1c/0xa0
  ? SMB2_open_free+0x1c/0xa0
  kasan_report.cold+0x7f/0x111
  ? smb2_ioctl_query_info+0x240/0x990
  ? SMB2_open_free+0x1c/0xa0
  SMB2_open_free+0x1c/0xa0
  smb2_ioctl_query_info+0x2bf/0x990
  ? smb2_query_reparse_tag+0x600/0x600
  ? cifs_mapchar+0x250/0x250
  ? rcu_read_lock_sched_held+0x3f/0x70
  ? cifs_strndup_to_utf16+0x12c/0x1c0
  ? rwlock_bug.part.0+0x60/0x60
  ? rcu_read_lock_sched_held+0x3f/0x70
  ? cifs_convert_path_to_utf16+0xf8/0x140
  ? smb2_check_message+0x6f0/0x6f0
  cifs_ioctl+0xf18/0x16b0
  ? smb2_query_reparse_tag+0x600/0x600
  ? cifs_readdir+0x1800/0x1800
  ? selinux_bprm_creds_for_exec+0x4d0/0x4d0
  ? do_user_addr_fault+0x30b/0x950
  ? __x64_sys_openat+0xce/0x140
  __x64_sys_ioctl+0xb9/0xf0
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7fdcf1f4ba87
 Code: b3 66 90 48 8b 05 11 14 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 13 2c 00 f7 d8 64 89 01 48
 RSP: 002b:00007ffef1ce7748 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
 RAX: ffffffffffffffda RBX: 00000000c018cf07 RCX: 00007fdcf1f4ba87
 RDX: 0000564c467c5590 RSI: 00000000c018cf07 RDI: 0000000000000003
 RBP: 00007ffef1ce7770 R08: 00007ffef1ce7420 R09: 00007fdcf0e0562b
 R10: 0000000000000100 R11: 0000000000000246 R12: 0000000000004018
 R13: 0000000000000001 R14: 0000000000000003 R15: 0000564c467c5590

 Allocated by task 1200:
  kasan_save_stack+0x1b/0x40
  __kasan_kmalloc+0x7a/0x90
  smb2_ioctl_query_info+0x10e/0x990
  cifs_ioctl+0xf18/0x16b0
  __x64_sys_ioctl+0xb9/0xf0
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae

 Freed by task 1200:
  kasan_save_stack+0x1b/0x40
  kasan_set_track+0x1c/0x30
  kasan_set_free_info+0x20/0x30
  __kasan_slab_free+0xe5/0x110
  slab_free_freelist_hook+0x53/0x130
  kfree+0xcc/0x320
  smb2_ioctl_query_info+0x2ad/0x990
  cifs_ioctl+0xf18/0x16b0
  __x64_sys_ioctl+0xb9/0xf0
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae

 The buggy address belongs to the object at ffff888007b10c00
  which belongs to the cache kmalloc-512 of size 512
 The buggy address is located 0 bytes inside of
  512-byte region [ffff888007b10c00, ffff888007b10e00)
 The buggy address belongs to the page:
 page:0000000044e14b75 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b10
 head:0000000044e14b75 order:2 compound_mapcount:0 compound_pincount:0
 flags: 0x100000000010200(slab|head)
 raw: 0100000000010200 ffffea000015f500 0000000400000004 ffff888001042c80
 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  ffff888007b10b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff888007b10b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 >ffff888007b10c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                    ^
  ffff888007b10c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff888007b10d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ==================================================================

---
 fs/cifs/smb2ops.c |   14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

@@ -1705,18 +1705,14 @@ smb2_ioctl_query_info(const unsigned int
 	}
 
  iqinf_exit:
-	kfree(vars);
-	kfree(buffer);
-	SMB2_open_free(&rqst[0]);
-	if (qi.flags & PASSTHRU_FSCTL)
-		SMB2_ioctl_free(&rqst[1]);
-	else
-		SMB2_query_info_free(&rqst[1]);
-
-	SMB2_close_free(&rqst[2]);
+	cifs_small_buf_release(rqst[0].rq_iov[0].iov_base);
+	cifs_small_buf_release(rqst[1].rq_iov[0].iov_base);
+	cifs_small_buf_release(rqst[2].rq_iov[0].iov_base);
 	free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base);
 	free_rsp_buf(resp_buftype[1], rsp_iov[1].iov_base);
 	free_rsp_buf(resp_buftype[2], rsp_iov[2].iov_base);
+	kfree(vars);
+	kfree(buffer);
 	return rc;
 
 e_fault:

From: Qu Wenruo <[email protected]>

commit 1d8ba9e7e785b6625f4d8e978e8a284b144a7077 upstream.

[BUG]
When running btrfs/071 with inode_need_compress() removed from compress_file_range(), we got the following crash:

  BUG: kernel NULL pointer dereference, address: 0000000000000018
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  Workqueue: btrfs-delalloc btrfs_work_helper [btrfs]
  RIP: 0010:compress_file_range+0x476/0x7b0 [btrfs]
  Call Trace:
   ? submit_compressed_extents+0x450/0x450 [btrfs]
   async_cow_start+0x16/0x40 [btrfs]
   btrfs_work_helper+0xf2/0x3e0 [btrfs]
   process_one_work+0x278/0x5e0
   worker_thread+0x55/0x400
   ? process_one_work+0x5e0/0x5e0
   kthread+0x168/0x190
   ? kthread_create_worker_on_cpu+0x70/0x70
   ret_from_fork+0x22/0x30
  ---[ end trace 65faf4eae941fa7d ]---

This is already after the patch "btrfs: inode: fix NULL pointer dereference if inode doesn't need compression."

[CAUSE]
@pages is firstly created by kcalloc() in compress_file_extent():

                pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);

Then passed to btrfs_compress_pages() to be utilized there:

                ret = btrfs_compress_pages(...
                                           pages,
                                           &nr_pages,
                                           ...);

btrfs_compress_pages() will initialize each page as output, in zlib_compress_pages() we have:

                        pages[nr_pages] = out_page;
                        nr_pages++;

Normally this is completely fine, but there is a special case which is in btrfs_compress_pages() itself:

        switch (type) {
        default:
                return -E2BIG;
        }

In this case, we didn't modify @pages nor @out_pages, leaving them untouched, then when we cleanup pages, the we can hit NULL pointer dereference again:

        if (pages) {
                for (i = 0; i < nr_pages; i++) {
                        WARN_ON(pages[i]->mapping);
                        put_page(pages[i]);
                }
        ...
        }

Since pages[i] are all initialized to zero, and btrfs_compress_pages() doesn't change them at all, accessing pages[i]->mapping would lead to NULL pointer dereference.

This is not possible for current kernel, as we check inode_need_compress() before doing pages allocation. But if we're going to remove that inode_need_compress() in compress_file_extent(), then it's going to be a problem.

[FIX]
When btrfs_compress_pages() hits its default case, modify @out_pages to 0 to prevent such problem from happening.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=212331